<?xml version="1.0" encoding="utf-8"?>
<CheatTable CheatEngineTableVersion="42">
  <CheatEntries>
    <CheatEntry>
      <ID>64</ID>
      <Description>"Compact Mode"</Description>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
--https://forum.cheatengine.org/viewtopic.php?t=570055
LuaCall(function cycleFullCompact(sender,force) local state = not(compactmenuitem.Caption == 'Compact View Mode'); if force~=nil then state = not force end; compactmenuitem.Caption = state and 'Compact View Mode' or 'Full View Mode'; getMainForm().Splitter1.Visible = state; getMainForm().Panel4.Visible    = state; getMainForm().Panel5.Visible    = state; end; function addCompactMenu() if compactmenualreadyexists then return end; local parent = getMainForm().Menu.Items; compactmenuitem = createMenuItem(parent); parent.add(compactmenuitem); compactmenuitem.Caption = 'Compact View Mode'; compactmenuitem.OnClick = cycleFullCompact; compactmenualreadyexists = 'yes'; end; addCompactMenu(); cycleFullCompact(nil,true))

[DISABLE]
LuaCall(cycleFullCompact(nil,false))
</AssemblerScript>
    </CheatEntry>
    <CheatEntry>
      <ID>29</ID>
      <Description>"Scripts only available in shop only, or game may crash"</Description>
      <Color>8000FF</Color>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
    <CheatEntry>
      <ID>2</ID>
      <Description>"Get coin (Spend $ in shop)"</Description>
      <Options moHideChildren="1" moDeactivateChildrenAsWell="1"/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : Brotato.exe
  Version: 
  Date   : 2022-10-02
  Author : bbfox@https://opencheattables.com
}

[ENABLE]

aobscanmodule(INJECT_GET_COIN,Brotato.exe,48 8B 53 08 48 2B 56 08) // should be unique
alloc(newmem,$1000,INJECT_GET_COIN)

label(code)
label(return)
label(i_base_coin_addr)

newmem:
  db EB 3B 54 68 69 73 20 74 61 62 6C 65 20 63 6F 6D 65 73 20 66 72 6F 6D 20 68 74 74 70 73 3A 2F 2F 6F 70 65 6E 63 68 65 61 74 74 61 62 6C 65 73 2E 63 6F 6D 20 2F 20 43 45 20 37 2E 34 2B
  push rax

  test r12, r12
  jne endp
  test r13, r13
  jne endp
  cmp r9,r14
  jne endp

  //mov rax, [rbx+08]

  mov eax, [rbx+18]
  cmp eax, 2
  jne endp
  mov eax, [rbx+00]
  cmp eax, 2
  jne endp
  mov eax, [rbx+0C]
  test eax, eax
  jne endp
  mov eax, [rbx+20]
  test eax, eax
  je endp

{$try}
  mov rax, [rbx+E8]
  jmp _test1
{$except}
  xor rax,rax

_test1:
  test rax, rax
  je endp

  mov [i_base_coin_addr], rbx

endp:
  pop rax

code:
  mov rdx,[rbx+08]
  sub rdx,[rsi+08]
  jmp return
align 10 cc
  i_base_coin_addr:
  dq 0

INJECT_GET_COIN:
  jmp newmem
  nop 3
return:
registersymbol(INJECT_GET_COIN)
registersymbol(i_base_coin_addr)

[DISABLE]

INJECT_GET_COIN:
  db 48 8B 53 08 48 2B 56 08

unregistersymbol(*)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: Brotato.exe+1AB03BB

Brotato.exe+1AB0392: 48 63 03                    - movsxd  rax,dword ptr [rbx]
Brotato.exe+1AB0395: 83 F8 1A                    - cmp eax,1A
Brotato.exe+1AB0398: 0F 87 F3 02 00 00           - ja Brotato.exe+1AB0691
Brotato.exe+1AB039E: 41 0F B6 84 00 44 28 AB 01  - movzx eax,byte ptr [r8+rax+01AB2844]
Brotato.exe+1AB03A7: 41 8B 8C 80 28 28 AB 01     - mov ecx,[r8+rax*4+01AB2828]
Brotato.exe+1AB03AF: 49 03 C8                    - add rcx,r8
Brotato.exe+1AB03B2: FF E1                       - jmp rcx
Brotato.exe+1AB03B4: 8B 06                       - mov eax,[rsi]
Brotato.exe+1AB03B6: 83 F8 02                    - cmp eax,02
Brotato.exe+1AB03B9: 75 3E                       - jne Brotato.exe+1AB03F9
// ---------- INJECTING HERE ----------
Brotato.exe+1AB03BB: 48 8B 53 08                 - mov rdx,[rbx+08]
// ---------- DONE INJECTING  ----------
Brotato.exe+1AB03BF: 48 2B 56 08                 - sub rdx,[rsi+08]
Brotato.exe+1AB03C3: 48 8D 8D 78 1B 00 00        - lea rcx,[rbp+00001B78]
Brotato.exe+1AB03CA: E8 C1 ED FD FF              - call Brotato.exe+1A8F190
Brotato.exe+1AB03CF: 90                          - nop 
Brotato.exe+1AB03D0: 48 8D 95 78 1B 00 00        - lea rdx,[rbp+00001B78]
Brotato.exe+1AB03D7: 49 8B CE                    - mov rcx,r14
Brotato.exe+1AB03DA: E8 B1 76 FE FF              - call Brotato.exe+1A97A90
Brotato.exe+1AB03DF: 90                          - nop 
Brotato.exe+1AB03E0: 83 BD 78 1B 00 00 00        - cmp dword ptr [rbp+00001B78],00
Brotato.exe+1AB03E7: 0F 84 DF 20 00 00           - je Brotato.exe+1AB24CC
}
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>8</ID>
          <Description>"Available in shop only"</Description>
          <Color>8000FF</Color>
          <GroupHeader>1</GroupHeader>
        </CheatEntry>
        <CheatEntry>
          <ID>31</ID>
          <Description>"Base addr."</Description>
          <ShowAsHex>1</ShowAsHex>
          <ShowAsSigned>0</ShowAsSigned>
          <Color>808080</Color>
          <VariableType>8 Bytes</VariableType>
          <Address>i_base_coin_addr</Address>
        </CheatEntry>
        <CheatEntry>
          <ID>3</ID>
          <Description>"Coin"</Description>
          <ShowAsSigned>0</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_coin_addr</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>6</ID>
      <Description>"Get base max HP, luck....etc (Buy any HP modification item in shop screen)"</Description>
      <Options moHideChildren="1" moDeactivateChildrenAsWell="1"/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript Async="1">{ Game   : Brotato.exe
  Version:
  Date   : 2022-10-02
  Author : bbfox@https://opencheattables.com
}

[ENABLE]

aobscanmodule(INJECT_GET_HP,Brotato.exe,48 8B 47 08 48 89 43 08 E9) // should be unique
alloc(newmem,$2000,INJECT_GET_HP)

label(code)
label(return)
label(i_temp_addr)
label(i_base_hp_addr1)
label(i_base_hp_addr2)
label(i_base_hp_addr3)
label(i_base_hp_addr4)
label(i_base_hp_addr5)
label(i_base_hp_addr6)
label(i_base_hp_addr7)
label(i_base_hp_addr8)
label(i_base_hp_addr9)
label(i_base_hp_addr10)
label(i_base_elemental_damage)
label(i_base_crit_chance)
label(i_base_engineering1)
label(i_base_engineering2)
label(i_base_engineering3)
label(i_base_luck)
label(i_base_armor)
label(i_base_damage)

newmem:
  db EB 3B 54 68 69 73 20 74 61 62 6C 65 20 63 6F 6D 65 73 20 66 72 6F 6D 20 68 74 74 70 73 3A 2F
  db 2F 6F 70 65 6E 63 68 65 61 74 74 61 62 6C 65 73 2E 63 6F 6D 20 2F 20 43 45 20 37 2E 34 2B

  pushf
  push rax
  push rcx
  push rdi


  test r12, r12
  jne endp
  cmp r8d, B
  jne endp

  mov eax, [rbx+0C]
  test eax, eax
  jne endp

  mov eax, [rbx]
  cmp eax, 2
  jne endp

{$try}
  mov rax, [rbx+18]
  test rax, rax
  je endp

  mov rax, [rbx+28]
  test rax, rax
  je endp

  mov rax, [rax+00]
  test rax, rax
  je endp

  mov rax, [rax+00]
  test rax, rax
  je endp

  mov rax, [rax+08]
  jmp _test3
{$except}
  xor rax,rax

_test3:
  test rax, rax
  je endp


  mov ecx, [rax]
  cmp ecx, 00740073
  jne endp

  mov ecx, [rax+04]
  cmp ecx, 00740061
  jne endp

  mov ecx, [rax+08]
  cmp ecx, 006D005F
  jne endp

  mov ecx, [rax+0C]
  cmp ecx, 00780061
  jne endp

  mov ecx, [rax+10]
  cmp ecx, 0068005F
  jne endp




  cmp qword ptr [i_base_hp_addr1], rbx
  je endp
  cmp qword ptr [i_base_hp_addr1], 0
  jne set_next2
  mov [i_base_hp_addr1], rbx
  jmp endp_final

set_next2:
  cmp qword ptr [i_base_hp_addr2], rbx
  je endp
  cmp qword ptr [i_base_hp_addr2], 0
  jne set_next3
  mov [i_base_hp_addr2], rbx
  jmp endp_final

set_next3:
  cmp qword ptr [i_base_hp_addr3], rbx
  je endp
  cmp qword ptr [i_base_hp_addr3], 0
  jne set_next4
  mov [i_base_hp_addr3], rbx
  jmp endp_final

set_next4:
  cmp qword ptr [i_base_hp_addr4], rbx
  je endp
  cmp qword ptr [i_base_hp_addr4], 0
  jne set_next5
  mov [i_base_hp_addr4], rbx
  jmp endp_final

set_next5:
  cmp qword ptr [i_base_hp_addr5], rbx
  je endp
  cmp qword ptr [i_base_hp_addr5], 0
  jne set_next6
  mov [i_base_hp_addr5], rbx
  jmp endp_final

set_next6:

endp:


check_ele_dmg:
  test r12, r12
  jne endp1
  cmp r8d, 15
  jne endp1
  cmp r13d, 11
  jne endp1


  mov eax, [rbx+0C]
  test eax, eax
  jne endp1

{$try}
  mov rax, [rbx+18]
  jmp _test4
{$except}
  xor rax,rax

_test4:
  test rax, rax
  je endp1

  //mov rax,[rdi+08]
  //mov [rbx+08],rax

  mov [i_base_elemental_damage], rbx
  jmp endp_final

endp1:
//jmp endp_final

chk_crit:
  test r12, r12
  jne endp2
  cmp r8d, 10
  jne endp2
  cmp r13d, 11
  jne endp2


  mov eax, [rbx+0C]
  test eax, eax
  jne endp2

  mov eax, [rbx]
  cmp eax, 2
  jne endp2

{$try}
  mov rax, [rbx+18]
  test rax, rax
  je endp2

  mov rax, [rbx+28]
  jmp _test6
{$except}
  xor rax,rax

_test6:
  test rax, rax
  je endp2

  //mov rax,[rdi+08]
  //mov [rbx+08],rax

  cmp qword ptr [i_base_crit_chance], rbx
  je endp_final
  cmp qword ptr [i_base_crit_chance], 0
  je chk_crit_0
  jmp chk_crit_1
chk_crit_0:
  mov [i_base_crit_chance], rbx
  jmp endp_final
chk_crit_1:
  cmp qword ptr [i_base_engineering1], rbx
  je endp_final
  cmp qword ptr [i_base_engineering1], 0
  je @F
  jmp chk_crit_2
@@:
  mov [i_base_engineering1], rbx
  jmp endp_final
chk_crit_2:
  cmp qword ptr [i_base_engineering2], rbx
  je endp_final
  cmp qword ptr [i_base_engineering2], 0
  je @F
  jmp chk_crit_3
@@:
  mov [i_base_engineering2], rbx
  jmp endp_final
chk_crit_3:
  cmp qword ptr [i_base_engineering3], rbx
  je endp_final
  cmp qword ptr [i_base_engineering3], 0
  je @F
  jmp chk_crit_4
@@:
  mov [i_base_engineering3], rbx
  jmp endp_final
chk_crit_4:

endp2:

chk_luck:
  test r12, r12
  jne endp3
  cmp r8d, 9
  jne endp3
  cmp r13d, 11
  jne endp3


  mov eax, [rbx+0C]
  test eax, eax
  jne endp3

  mov eax, [rbx]
  cmp eax, 2
  jne endp3

{$try}
  mov rax, [rbx+18]
  test rax, rax
  je endp3

  mov rax, [rbx+28]
  jmp _test8
{$except}
  xor rax,rax

_test8:
  test rax, rax
  je endp3

  cmp qword ptr [i_base_luck], rbx
  je endp_final
  cmp qword ptr [i_base_luck], 0
  je chk_luck_0
  jmp chk_luck_1
chk_luck_0:
  mov [i_base_luck], rbx
  jmp endp_final
chk_luck_1:
  cmp qword ptr [i_base_luck+8], rbx
  je endp_final
  cmp qword ptr [i_base_luck+8], 0
  je @F
  jmp chk_luck_2
@@:
  mov [i_base_luck+8], rbx
  jmp endp_final
chk_luck_2:
  cmp qword ptr [i_base_luck+10], rbx
  je endp_final
  cmp qword ptr [i_base_luck+10], 0
  je @F
  jmp chk_luck_3
@@:
  mov [i_base_luck+10], rbx
  jmp endp_final
chk_luck_3:
  cmp qword ptr [i_base_luck+18], rbx
  je endp_final
  cmp qword ptr [i_base_luck+18], 0
  je @F
  jmp chk_luck_4
@@:
  mov [i_base_luck+18], rbx
  jmp endp_final
chk_luck_4:
  cmp qword ptr [i_base_luck+20], rbx
  je endp_final
  cmp qword ptr [i_base_luck+20], 0
  je @F
  jmp chk_luck_5
@@:
  mov [i_base_luck+20], rbx
  jmp endp_final
chk_luck_5:


endp3:


check_armor:
  test r12, r12
  jne endp4
  cmp r8d, 0A
  jne endp4
  cmp r13d, 11
  jne endp4


  mov eax, [rbx+0C]
  test eax, eax
  jne endp4

{$try}
  mov rax, [rbx+28]
  test rax, rax
  je endp4

  mov rax, [rbx+18]
  jmp _test9
{$except}
  xor rax,rax

_test9:
  test rax, rax
  je endp4

  //mov rax,[rdi+08]
  //mov [rbx+08],rax

  //mov eax, [rbx+10]
  //cmp eax, 005F0065
  //jne endp4

  //mov eax, [rbx+14]
  //cmp eax, 00680063
  //jne endp4

{
  // crash
  xor rcx, rcx
  mov ecx, 5
loop_armor:
  lea rax, [i_base_armor+ecx*8-8]
  mov rdi, [rax]
  mov [i_temp_addr], rdi
  cmp [i_temp_addr], rbx
  je endp_final
  cmp [i_temp_addr], 0
  jne @F
  mov [rax], rbx
  jmp endp_final

@@:
  loop loop_armor
  jmp endp_final
}


  cmp qword ptr [i_base_armor], rbx
  je endp_final
  cmp qword ptr [i_base_armor], 0
  je @F
  jmp chk_armor_1
@@:
  mov [i_base_armor], rbx
  jmp endp_final

chk_armor_1:
  cmp qword ptr [i_base_armor+8], rbx
  je endp_final
  cmp qword ptr [i_base_armor+8], 0
  je @F
  jmp chk_armor_2
@@:
  mov [i_base_armor+8], rbx
  jmp endp_final

chk_armor_2:
  cmp qword ptr [i_base_armor+10], rbx
  je endp_final
  cmp qword ptr [i_base_armor+10], 0
  je @F
  jmp chk_armor_3
@@:
  mov [i_base_armor+10], rbx
  jmp endp_final

chk_armor_3:
  cmp qword ptr [i_base_armor+18], rbx
  je endp_final
  cmp qword ptr [i_base_armor+18], 0
  je @F
  jmp chk_armor_4
@@:
  mov [i_base_armor+18], rbx
  jmp endp_final
chk_armor_4:
  cmp qword ptr [i_base_armor+20], rbx
  je endp_final
  cmp qword ptr [i_base_armor+20], 0
  je @F
  jmp chk_armor_5
@@:
  mov [i_base_armor+20], rbx
  jmp endp_final
chk_armor_5:

  jmp endp_final

endp4:


check_damage:
  test r12, r12
  jne endp5
  cmp r8d, 13
  jne endp5
  cmp r13d, 11
  jne endp5


  mov eax, [rbx+0C]
  test eax, eax
  jne endp5

{$try}
  mov rax, [rbx+28]
  test rax, rax
  je endp5

  mov rax, [rbx+18]
  jmp _testa
{$except}
  xor rax,rax

_testa:
  test rax, rax
  je endp5


  cmp qword ptr [i_base_damage], rbx
  je endp_final
  cmp qword ptr [i_base_damage], 0
  je @F
  jmp chk_damage_1
@@:
  mov [i_base_damage], rbx
  jmp endp_final

chk_damage_1:
  cmp qword ptr [i_base_damage+8], rbx
  je endp_final
  cmp qword ptr [i_base_damage+8], 0
  je @F
  jmp chk_damage_2
@@:
  mov [i_base_damage+8], rbx
  jmp endp_final

chk_damage_2:
  cmp qword ptr [i_base_damage+10], rbx
  je endp_final
  cmp qword ptr [i_base_damage+10], 0
  je @F
  jmp chk_damage_3
@@:
  mov [i_base_damage+10], rbx
  jmp endp_final

chk_damage_3:
  cmp qword ptr [i_base_damage+18], rbx
  je endp_final
  cmp qword ptr [i_base_damage+18], 0
  je @F
  jmp chk_damage_4
@@:
  mov [i_base_damage+18], rbx
  jmp endp_final
chk_damage_4:
  cmp qword ptr [i_base_damage+20], rbx
  je endp_final
  cmp qword ptr [i_base_damage+20], 0
  je @F
  jmp chk_damage_5
@@:
  mov [i_base_damage+20], rbx
  jmp endp_final
chk_damage_5:

  jmp endp_final

endp5:



endp_final:

  pop rdi
  pop rcx
  pop rax
  popf


code:
  mov rax,[rdi+08]
  mov [rbx+08],rax
  jmp return
align 10 cc
  i_temp_addr:
  dq 0
  i_base_hp_addr1:
  dq 0
  i_base_hp_addr2:
  dq 0
  i_base_hp_addr3:
  dq 0
  i_base_hp_addr4:
  dq 0
  i_base_hp_addr5:
  dq 0
  i_base_hp_addr6:
  dq 0
  i_base_hp_addr7:
  dq 0
  i_base_hp_addr8:
  dq 0
  i_base_hp_addr9:
  dq 0
  i_base_hp_addr10:
  dq 0
  i_base_elemental_damage:
  dq 0
  i_base_crit_chance:
  dq 0
  i_base_engineering1:
  dq 0
  i_base_engineering2:
  dq 0
  i_base_engineering3:
  dq 0
  align 10 cc
  i_base_luck:
  dq 0
  align 10 0
  db 0
  align 10 0
  db 0
  align 10 0
  db 0
  i_base_armor:
  dq 0
  align 10 0
  db 0
  align 10 0
  db 0
  align 10 0
  db 0
  i_base_damage:
  dq 0
  align 10 0
  db 0
  align 10 0
  db 0
  align 10 0
  db 0

INJECT_GET_HP:
  jmp newmem
  nop 3
return:
registersymbol(INJECT_GET_HP)
registersymbol(i_base_hp_addr1)
registersymbol(i_base_hp_addr2)
registersymbol(i_base_hp_addr3)
registersymbol(i_base_hp_addr4)
registersymbol(i_base_hp_addr5)
registersymbol(i_base_hp_addr6)
registersymbol(i_base_hp_addr7)
registersymbol(i_base_hp_addr8)
registersymbol(i_base_hp_addr9)
registersymbol(i_base_hp_addr10)
registersymbol(i_base_elemental_damage)
registersymbol(i_base_crit_chance)
registersymbol(i_base_engineering1)
registersymbol(i_base_engineering2)
registersymbol(i_base_engineering3)
registersymbol(i_base_luck)
registersymbol(i_base_armor)
registersymbol(i_base_damage)

[DISABLE]

INJECT_GET_HP:
  db 48 8B 47 08 48 89 43 08

unregistersymbol(*)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: Brotato.exe+1A97AF4

Brotato.exe+1A97ACA: 83 F8 19              - cmp eax,19
Brotato.exe+1A97ACD: 0F 87 2A 03 00 00     - ja Brotato.exe+1A97DFD
Brotato.exe+1A97AD3: 48 98                 - cdqe
Brotato.exe+1A97AD5: 48 8D 15 24 85 56 FE  - lea rdx,[Brotato.exe]
Brotato.exe+1A97ADC: 8B 8C 82 20 7E A9 01  - mov ecx,[rdx+rax*4+01A97E20]
Brotato.exe+1A97AE3: 48 03 CA              - add rcx,rdx
Brotato.exe+1A97AE6: FF E1                 - jmp rcx
Brotato.exe+1A97AE8: 0F B6 47 08           - movzx eax,byte ptr [rdi+08]
Brotato.exe+1A97AEC: 88 43 08              - mov [rbx+08],al
Brotato.exe+1A97AEF: E9 09 03 00 00        - jmp Brotato.exe+1A97DFD
// ---------- INJECTING HERE ----------
Brotato.exe+1A97AF4: 48 8B 47 08           - mov rax,[rdi+08]
// ---------- DONE INJECTING  ----------
Brotato.exe+1A97AF8: 48 89 43 08           - mov [rbx+08],rax
Brotato.exe+1A97AFC: E9 FC 02 00 00        - jmp Brotato.exe+1A97DFD
Brotato.exe+1A97B01: 48 8D 57 08           - lea rdx,[rdi+08]
Brotato.exe+1A97B05: 48 8D 4B 08           - lea rcx,[rbx+08]
Brotato.exe+1A97B09: E8 A2 77 58 FE        - call Brotato.exe+1F2B0
Brotato.exe+1A97B0E: 4C 89 7C 24 70        - mov [rsp+70],r15
Brotato.exe+1A97B13: 48 8D 53 08           - lea rdx,[rbx+08]
Brotato.exe+1A97B17: 48 8D 4C 24 70        - lea rcx,[rsp+70]
Brotato.exe+1A97B1C: E8 8F 77 58 FE        - call Brotato.exe+1F2B0
Brotato.exe+1A97B21: 90                    - nop
}
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>21</ID>
          <Description>"Available in shop only / positive trend values"</Description>
          <Color>8000FF</Color>
          <GroupHeader>1</GroupHeader>
        </CheatEntry>
        <CheatEntry>
          <ID>7</ID>
          <Description>"Possible base max HP #1"</Description>
          <ShowAsSigned>0</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_hp_addr1</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>12</ID>
          <Description>"Possible base max HP #2"</Description>
          <ShowAsSigned>0</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_hp_addr2</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>24</ID>
          <Description>"Possible base max HP #3"</Description>
          <ShowAsSigned>0</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_hp_addr3</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>25</ID>
          <Description>"Possible base max HP #4"</Description>
          <ShowAsSigned>0</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_hp_addr4</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>26</ID>
          <Description>"Possible base max HP #5"</Description>
          <ShowAsSigned>0</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_hp_addr5</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>28</ID>
          <Description>"Possible elemental damage"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_elemental_damage</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>32</ID>
          <Description>"Possible critical % / Engineering"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_crit_chance</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>36</ID>
          <Description>"Possible critical % / Engineering"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_engineering1</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>39</ID>
          <Description>"Possible critical % / Engineering"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_engineering2</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>40</ID>
          <Description>"Possible critical % / Engineering"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_engineering3</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>42</ID>
          <Description>"Possible luck"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_luck</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>43</ID>
          <Description>"Possible luck"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_luck+8</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>44</ID>
          <Description>"Possible luck"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_luck+10</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>45</ID>
          <Description>"Possible luck"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_luck+18</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>46</ID>
          <Description>"Possible luck"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_luck+20</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>48</ID>
          <Description>"Possible armor"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_armor</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>49</ID>
          <Description>"Possible armor"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_armor+8</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>50</ID>
          <Description>"Possible armor"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_armor+10</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>51</ID>
          <Description>"Possible armor"</Description>
          <ShowAsSigned>1</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_armor+18</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>59</ID>
          <Description>"Possible damage"</Description>
          <ShowAsSigned>0</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_damage</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>60</ID>
          <Description>"Possible damage"</Description>
          <ShowAsSigned>0</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_damage+8</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
        <CheatEntry>
          <ID>61</ID>
          <Description>"Possible damage"</Description>
          <ShowAsSigned>0</ShowAsSigned>
          <VariableType>4 Bytes</VariableType>
          <Address>i_base_damage+10</Address>
          <Offsets>
            <Offset>8</Offset>
          </Offsets>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>56</ID>
      <Description>"Get wave timer"</Description>
      <Options moHideChildren="1"/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : Brotato.exe
  Version: 
  Date   : 2022-10-04
  Author : bbfox@https://opencheattablesc.com
}

[ENABLE]

aobscanmodule(INJECT_WAVE_TIMER,Brotato.exe,F2 0F 5C C8 F2 0F 11 89 E0 01 00 00 0F 57 C0 66 0F 2F C1 0F 86 51) // should be unique
alloc(newmem,$1000,INJECT_WAVE_TIMER)

label(code)
label(return)
label(i_base_timer_addr)
label(vf_timer_threshold)

newmem:
  vmovss xmm15, [rcx+000001D8]
  vmovss xmm14, [vf_timer_threshold]
  vucomiss xmm15, xmm14
  jb code
  // should be wave timer
  push rax
  mov ax, [rcx+000001DC]
  cmp ax, 1
  jne endp
  mov ax, [rcx+000001DE]
  cmp ax, 1
  jne endp
  mov eax, [rcx+000001E8]
  cmp eax, 1
  jne endp

  mov [i_base_timer_addr], rcx

endp:
  pop rax

code:
  subsd xmm1,xmm0
  movsd [rcx+000001E0],xmm1
  jmp return
align 10 cc
  vf_timer_threshold:
  dd (float)20
  i_base_timer_addr:
  dq 0

INJECT_WAVE_TIMER:
  jmp newmem
  nop 7
return:
registersymbol(INJECT_WAVE_TIMER)
registersymbol(i_base_timer_addr)
registersymbol(vf_timer_threshold)

[DISABLE]

INJECT_WAVE_TIMER:
  db F2 0F 5C C8 F2 0F 11 89 E0 01 00 00

unregistersymbol(*)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: Brotato.exe+119D0A3

Brotato.exe+119D072: F6 81 B8 01 00 00 08     - test byte ptr [rcx+000001B8],08
Brotato.exe+119D079: 0F 84 8E 01 00 00        - je Brotato.exe+119D20D
Brotato.exe+119D07F: 48 8B 81 38 01 00 00     - mov rax,[rcx+00000138]
Brotato.exe+119D086: 48 85 C0                 - test rax,rax
Brotato.exe+119D089: 74 0A                    - je Brotato.exe+119D095
Brotato.exe+119D08B: F3 0F 10 80 5C 01 00 00  - movss xmm0,[rax+0000015C]
Brotato.exe+119D093: EB 03                    - jmp Brotato.exe+119D098
Brotato.exe+119D095: 0F 57 C0                 - xorps xmm0,xmm0
Brotato.exe+119D098: 0F 5A C0                 - cvtps2pd xmm0,xmm0
Brotato.exe+119D09B: F2 0F 10 89 E0 01 00 00  - movsd xmm1,[rcx+000001E0]
// ---------- INJECTING HERE ----------
Brotato.exe+119D0A3: F2 0F 5C C8              - subsd xmm1,xmm0
// ---------- DONE INJECTING  ----------
Brotato.exe+119D0A7: F2 0F 11 89 E0 01 00 00  - movsd [rcx+000001E0],xmm1
Brotato.exe+119D0AF: 0F 57 C0                 - xorps xmm0,xmm0
Brotato.exe+119D0B2: 66 0F 2F C1              - comisd xmm0,xmm1
Brotato.exe+119D0B6: 0F 86 51 01 00 00        - jbe Brotato.exe+119D20D
Brotato.exe+119D0BC: 80 B9 DC 01 00 00 00     - cmp byte ptr [rcx+000001DC],00
Brotato.exe+119D0C3: 75 19                    - jne Brotato.exe+119D0DE
Brotato.exe+119D0C5: F3 0F 10 81 D8 01 00 00  - movss xmm0,[rcx+000001D8]
Brotato.exe+119D0CD: 0F 5A C0                 - cvtps2pd xmm0,xmm0
Brotato.exe+119D0D0: F2 0F 58 C1              - addsd xmm0,xmm1
Brotato.exe+119D0D4: F2 0F 11 81 E0 01 00 00  - movsd [rcx+000001E0],xmm0
}
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>57</ID>
          <Description>"Timer identifies threshold"</Description>
          <ShowAsSigned>0</ShowAsSigned>
          <VariableType>Float</VariableType>
          <Address>vf_timer_threshold</Address>
        </CheatEntry>
        <CheatEntry>
          <ID>54</ID>
          <Description>"Timer"</Description>
          <ShowAsSigned>0</ShowAsSigned>
          <VariableType>Double</VariableType>
          <Address>i_base_timer_addr</Address>
          <Offsets>
            <Offset>1E0</Offset>
          </Offsets>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
    <CheatEntry>
      <ID>30</ID>
      <Description>"Brotato EA 0.5.10 /  https://opencheattables.com  /  CE 7.4+"</Description>
      <Color>400080</Color>
      <GroupHeader>1</GroupHeader>
    </CheatEntry>
  </CheatEntries>
  <UserdefinedSymbols/>
</CheatTable>
