<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>45</ID>
      <Description>"SelectAnyChar"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : Expendabros.exe
  Version:
  Date   : 2020-02-29
  Author : omega

  This script does blah blah blah
}

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat



aobscanmodule(SelectAnyChar,Expendabros.exe,84 C0 75 2D 48 8B 0D 75 9B A1 00) // should be unique
alloc(newmem,$1000,SelectAnyChar)

label(code)
label(return)

newmem:
  mov al,0
  jmp code

code:
  test al,al
  jne Expendabros.exe+4F83F1
  mov rcx,[Expendabros.exe+F11F40]
  jmp return

SelectAnyChar:
  jmp newmem
  nop 6
return:
registersymbol(SelectAnyChar)

[DISABLE]
//code from here till the end of the code will be used to disable the cheat
SelectAnyChar:
  db 84 C0 75 2D 48 8B 0D 75 9B A1 00

unregistersymbol(SelectAnyChar)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "Expendabros.exe"+4F83C0

"Expendabros.exe"+4F8399: 48 83 C0 04           -  add rax,04
"Expendabros.exe"+4F839D: 48 3B D1              -  cmp rdx,rcx
"Expendabros.exe"+4F83A0: 7F F0                 -  jg Expendabros.exe+4F8392
"Expendabros.exe"+4F83A2: FF C7                 -  inc edi
"Expendabros.exe"+4F83A4: 44 3B F7              -  cmp r14d,edi
"Expendabros.exe"+4F83A7: 7F A7                 -  jg Expendabros.exe+4F8350
"Expendabros.exe"+4F83A9: 48 8B 0D 90 9B A1 00  -  mov rcx,[Expendabros.exe+F11F40]
"Expendabros.exe"+4F83B0: 48 8B 44 24 60        -  mov rax,[rsp+60]
"Expendabros.exe"+4F83B5: 8B 90 58 02 00 00     -  mov edx,[rax+00000258]
"Expendabros.exe"+4F83BB: E8 A0 A9 FF FF        -  call Expendabros.exe+4F2D60
// ---------- INJECTING HERE ----------
"Expendabros.exe"+4F83C0: 84 C0                 -  test al,al
"Expendabros.exe"+4F83C2: 75 2D                 -  jne Expendabros.exe+4F83F1
"Expendabros.exe"+4F83C4: 48 8B 0D 75 9B A1 00  -  mov rcx,[Expendabros.exe+F11F40]
// ---------- DONE INJECTING  ----------
"Expendabros.exe"+4F83CB: 8B D6                 -  mov edx,esi
"Expendabros.exe"+4F83CD: E8 0E 9A FF FF        -  call Expendabros.exe+4F1DE0
"Expendabros.exe"+4F83D2: 48 8B 0D 67 9B A1 00  -  mov rcx,[Expendabros.exe+F11F40]
"Expendabros.exe"+4F83D9: 44 8B C0              -  mov r8d,eax
"Expendabros.exe"+4F83DC: 40 38 A9 A8 00 00 00  -  cmp [rcx+000000A8],bpl
"Expendabros.exe"+4F83E3: 74 10                 -  je Expendabros.exe+4F83F5
"Expendabros.exe"+4F83E5: 8B D0                 -  mov edx,eax
"Expendabros.exe"+4F83E7: 41 8B CF              -  mov ecx,r15d
"Expendabros.exe"+4F83EA: E8 A1 9D E1 FF        -  call Expendabros.exe+312190
"Expendabros.exe"+4F83EF: EB 2D                 -  jmp Expendabros.exe+4F841E
}
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>46</ID>
      <Description>"SelectAnyChar2"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : Expendabros.exe
  Version:
  Date   : 2020-02-29
  Author : omega

  This script does blah blah blah
}

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat



aobscanmodule(SelectAnyChar2,Expendabros.exe,44 0F B6 E0 B8 3C 00 00 00) // should be unique
alloc(newmem,$1000,SelectAnyChar2)

label(code)
label(return)

newmem:
  mov al,0
  jmp code

code:
  movzx r12d,al
  mov eax,0000003C
  jmp return

SelectAnyChar2:
  jmp newmem
  nop 4
return:
registersymbol(SelectAnyChar2)

[DISABLE]
//code from here till the end of the code will be used to disable the cheat
SelectAnyChar2:
  db 44 0F B6 E0 B8 3C 00 00 00

unregistersymbol(SelectAnyChar2)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "Expendabros.exe"+4ECD3B

"Expendabros.exe"+4ECD0D: 74 1D                    -  je Expendabros.exe+4ECD2C
"Expendabros.exe"+4ECD0F: 41 BF 01 00 00 00        -  mov r15d,00000001
"Expendabros.exe"+4ECD15: EB 15                    -  jmp Expendabros.exe+4ECD2C
"Expendabros.exe"+4ECD17: 41 B8 01 00 00 00        -  mov r8d,00000001
"Expendabros.exe"+4ECD1D: 8B 15 21 95 A2 00        -  mov edx,[Expendabros.exe+F16244]
"Expendabros.exe"+4ECD23: 48 8B 4E 18              -  mov rcx,[rsi+18]
"Expendabros.exe"+4ECD27: E8 A4 A1 23 00           -  call Expendabros.exe+726ED0
"Expendabros.exe"+4ECD2C: 48 8B 0D 0D 52 A2 00     -  mov rcx,[Expendabros.exe+F11F40]
"Expendabros.exe"+4ECD33: 41 8B D6                 -  mov edx,r14d
"Expendabros.exe"+4ECD36: E8 25 60 00 00           -  call Expendabros.exe+4F2D60
// ---------- INJECTING HERE ----------
"Expendabros.exe"+4ECD3B: 44 0F B6 E0              -  movzx r12d,al
"Expendabros.exe"+4ECD3F: B8 3C 00 00 00           -  mov eax,0000003C
// ---------- DONE INJECTING  ----------
"Expendabros.exe"+4ECD44: 8B 0C 03                 -  mov ecx,[rbx+rax]
"Expendabros.exe"+4ECD47: 39 0D 03 95 A2 00        -  cmp [Expendabros.exe+F16250],ecx
"Expendabros.exe"+4ECD4D: 7E 13                    -  jle Expendabros.exe+4ECD62
"Expendabros.exe"+4ECD4F: E9 70 10 00 00           -  jmp Expendabros.exe+4EDDC4
"Expendabros.exe"+4ECD54: 48 FF C2                 -  inc rdx
"Expendabros.exe"+4ECD57: 44 38 2C 11              -  cmp [rcx+rdx],r13l
"Expendabros.exe"+4ECD5B: 75 F7                    -  jne Expendabros.exe+4ECD54
"Expendabros.exe"+4ECD5D: E9 8A 10 00 00           -  jmp Expendabros.exe+4EDDEC
"Expendabros.exe"+4ECD62: 45 84 E4                 -  test r12l,r12l
"Expendabros.exe"+4ECD65: 0F 84 7B 02 00 00        -  je Expendabros.exe+4ECFE6
}
</AssemblerScript>
    </CheatEntry>
  </CheatEntries>
</CheatTable>