; This source is in the public domain. Loosely based on code originally written
; by Maxxuss, rufus, and semthex. (last modified: 7/26/07 2:04:10)
;
; To generate code for additional slots (unlimited, though this source expects
; three), simply copy-and-paste both the patching routines and code templates
; and replace all instances of cs1 to csN (also adjusting slotN accordingly).

bits 32
org 0xffff4000

start1:
    push eax
restart:
    lock inc dword [cs1_counter]
    cs jnz start2
    mov eax, [esp+0x4]
    mov [cs1+0x38], eax ; store opcode
    pop eax
    mov dword [esp], slot1
    iret
; ------------------------------------------------------------------------------
start2:
    lock inc dword [cs2_counter]
    cs jnz start3
    mov eax, [esp+0x4]
    mov [cs2+0x38], eax ; store opcode
    pop eax
    mov dword [esp], slot2
    iret
; ------------------------------------------------------------------------------
start3:
    lock inc dword [cs3_counter]
    cs jnz reset
    mov eax, [esp+0x4]
    mov [cs3+0x38], eax ; store opcode
    pop eax
    mov dword [esp], slot3
    iret
; ------------------------------------------------------------------------------
reset:
    mov eax, counta
    inc dword [eax]
    mov eax, [eax]
    and eax, 0xffff
    jnz near restart
    inc dword [countb]
    xor eax, eax
    dec eax
    mov [cs1_counter], eax
    mov [cs2_counter], eax
    mov [cs3_counter], eax
    jmp restart

; ********************************************************************
; ****************************** SLOT 1 ******************************
; ********************************************************************

    align 4, nop
slot1:
    pushf
    push    esi
    push    edi
    push    eax
    push    ecx
    push    edx
    push    ebx
    mov     edx, [cs1+0x38]
    mov     ecx, [edx]
    mov     eax, ecx
    cmp     cl, 0xdf ; m16int
    jz      cs1_do_fisttp
    cmp     cl, 0xdb ; m32int
    jz      cs1_do_fisttp
    cmp     cl, 0xdd ; m64int
    jz      cs1_do_fisttp
    jmp     cs1_not_fisttp
; ----------------------------------------------------------------------------
cs1_do_fisttp: ; beware: http://osdir.com/ml/lang.nasm.devel/2005-09/msg00054.html
    mov     edx, eax
    shr     edx, 8
    and     edx, 0x38
    shr     edx, 3
    cmp     edx, 1
    jnz     near cs1_not_fisttp
; ----------------------------------------------------------------------------
    mov     word [cs1_fisttp+32], 0x909c
    mov     dword [cs1_fisttp+34], 0x90909090
    mov     edx, eax ; fisttp begins
    shr     eax, 8
    and     eax, 0xff
    mov     esi, [cs1+0x38]
    mov     ebx, modrm_table
    xlatb
    add     dword [cs1+0x38], eax
    add     eax, 2
    mov     ecx, eax
    mov     edi, cs1_fisttp+31
    rep movsb
    cmp     dl, 0xdd ; m64int
    jnz     cs1_do_fisttp_not_m64int
    mov     byte [cs1_fisttp+31], 0xdf
    or      byte [cs1_fisttp+32], 0x38
    jmp     cs1_do_fisttp_done
cs1_do_fisttp_not_m64int:
    or      byte [cs1_fisttp+32], 0x18
cs1_do_fisttp_done:
    pop     ebx
    pop     edx
    pop     ecx
    pop     eax
    pop     edi
    pop     esi
    popf
    jmp     cs1_fisttp
; ----------------------------------------------------------------------------
cs1_do_lddqu:
    mov     word [cs1_lddqu+3], 0x9084
    mov     dword [cs1_lddqu+5], 0x90909090
    shr     eax, 0x18 ; lddqu begins
    mov     esi, [cs1+0x38]
    add     esi, 3
    mov     ebx, modrm_table
    xlatb
    add     eax, 1
    mov     ecx, eax
    add     eax, 3
    add     dword [cs1+0x38], eax
    mov     edx, ecx
    mov     edi, cs1_lddqu+0x3
    rep movsb
    pop     ebx
    pop     edx
    pop     ecx
    pop     eax
    pop     edi
    pop     esi
    popf
    jmp     cs1_lddqu
; ----------------------------------------------------------------------------
cs1_not_fisttp:
    and     ecx, 0xffffff
    cmp     ecx, 0xf00ff2 ; check for lddqu
    jz      cs1_do_lddqu
    cmp     ecx, 0x120ff2 ; check if movddup
    jz      cs1_do_movddup
    cmp     ecx, 0x7c0f66 ; check for haddpd
    jz      cs1_do_haddpd
    jmp     cs1_check9
; ----------------------------------------------------------------------------
cs1_do_movddup:
    mov     word [cs1_movddup+3], 0x9084
    mov     dword [cs1_movddup+5], 0x90909090
    shr     eax, 0x18 ; movddup begins
    mov     edx, eax
    and     eax, 0xc7
    mov     [cs1_movddup+0x3], al
    mov     esi, [cs1+0x38]
    add     esi, 4
    mov     ebx, modrm_table
    xlatb
    add     dword [cs1+0x38], eax
    mov     ecx, eax
    mov     edi, cs1_movddup+0x4
    rep movsb
    and     edx, 0x38
    or      edx, 5
    mov     [cs1_movddup+0x1c], dl
    mov     [cs1_movddup+0x24], dl
    pop     ebx
    pop     edx
    pop     ecx
    pop     eax
    pop     edi
    pop     esi
    popf
    movupd  [cs1_temp_xmm0], xmm0
    jmp     cs1_movddup
; ----------------------------------------------------------------------------
cs1_do_haddpd:
    mov     word [cs1_haddpd+11], 0x9084
    mov     dword [cs1_haddpd+13], 0x90909090
    shr     eax, 0x18 ; haddpd begins
    mov     edx, eax
    and     eax, 0xc7
    mov     [cs1_haddpd+0xb], al
    mov     esi, [cs1+0x38]
    add     esi, 4
    mov     ebx, modrm_table
    xlatb
    add     dword [cs1+0x38], eax
    mov     ecx, eax
    mov     edi, cs1_haddpd+0xc
    rep movsb
    and     edx, 0x38
    or      edx, 5
    mov     [cs1_haddpd+0x3], dl
    mov     [cs1_haddpd+0x5c], dl
    pop     ebx
    pop     edx
    pop     ecx
    pop     eax
    pop     edi
    pop     esi
    popf
    movupd  [cs1_temp_xmm0], xmm0
    movupd  [cs1_temp_xmm1], xmm1
    jmp     cs1_haddpd
; ----------------------------------------------------------------------------
cs1_check9:
    cmp     ecx, 0x7d0f66 ; check for hsubpd
    jz      cs1_do_hsubpd
    cmp     ecx, 0xd00f66 ; check for addsubpd
    jz      cs1_do_addsubpd
    jmp     cs1_check10
cs1_do_hsubpd:
    mov     word [cs1_hsubpd+11], 0x9084
    mov     dword [cs1_hsubpd+13], 0x90909090
    shr     eax, 0x18 ; hsubpd begins
    mov     edx, eax
    and     eax, 0xc7
    mov     [cs1_hsubpd+0xb], al
    mov     esi, [cs1+0x38]
    add     esi, 4
    mov     ebx, modrm_table
    xlatb
    add     dword [cs1+0x38], eax
    mov     ecx, eax
    mov     edi, cs1_hsubpd+0xc
    rep movsb
    and     edx, 0x38
    or      edx, 5
    mov     [cs1_hsubpd+0x3], dl
    mov     [cs1_hsubpd+0x60], dl
    pop     ebx
    pop     edx
    pop     ecx
    pop     eax
    pop     edi
    pop     esi
    popf
    movupd  [cs1_temp_xmm0], xmm0
    movupd  [cs1_temp_xmm1], xmm1
    jmp     cs1_hsubpd
; ----------------------------------------------------------------------------
cs1_do_addsubpd:
    mov     word [cs1_addsubpd+11], 0x9084
    mov     dword [cs1_addsubpd+13], 0x90909090
    shr     eax, 0x18 ; addsubpd begins
    mov     edx, eax
    and     eax, 0xc7
    mov     [cs1_addsubpd+0xb], al
    mov     esi, [cs1+0x38]
    add     esi, 4
    mov     ebx, modrm_table
    xlatb
    add     dword [cs1+0x38], eax
    mov     ecx, eax
    mov     edi, cs1_addsubpd+0xc
    rep movsb
    and     edx, 0x38
    or      edx, 5
    mov     [cs1_addsubpd+0x3], dl
    mov     [cs1_addsubpd+0x5c], dl
    pop     ebx
    pop     edx
    pop     ecx
    pop     eax
    pop     edi
    pop     esi
    popf
    movupd  [cs1_temp_xmm0], xmm0
    movupd  [cs1_temp_xmm1], xmm1
    jmp     cs1_addsubpd
; ----------------------------------------------------------------------------
cs1_check10:
    cmp     ecx, 0x160ff3 ; check for movshdup
    jz      cs1_do_movshdup
    cmp     ecx, 0x120ff3 ; check for movsldup
    jz      cs1_do_movsldup
    jmp     cs1_check11
cs1_do_movshdup:
    mov     word [cs1_movshdup+2], 0x9084
    mov     dword [cs1_movshdup+4], 0x90909090
    shr     eax, 0x18 ; movshdup begins
    mov     edx, eax
    and     eax, 0xc7
    mov     [cs1_movshdup+0x2], al
    mov     esi, [cs1+0x38]
    add     esi, 4
    mov     ebx, modrm_table
    xlatb
    add     dword [cs1+0x38], eax
    mov     ecx, eax
    mov     edi, cs1_movshdup+0x3
    rep movsb
    and     edx, 0x38
    or      edx, 5
    mov     [cs1_movshdup+0x2c], dl
    pop     ebx
    pop     edx
    pop     ecx
    pop     eax
    pop     edi
    pop     esi
    popf
    push    eax
    movups  [cs1_temp_xmm0], xmm0
    jmp     cs1_movshdup
; ----------------------------------------------------------------------------
cs1_do_movsldup:
    mov     word [cs1_movsldup+2], 0x9084
    mov     dword [cs1_movsldup+4], 0x90909090
    shr     eax, 0x18 ; movsldup begins
    mov     edx, eax
    and     eax, 0xc7
    mov     [cs1_movsldup+0x2], al
    mov     esi, [cs1+0x38]
    add     esi, 4
    mov     ebx, modrm_table
    xlatb
    add     dword [cs1+0x38], eax
    mov     ecx, eax
    mov     edi, cs1_movsldup+0x3 
    rep movsb
    and     edx, 0x38
    or      edx, 5
    mov     [cs1_movsldup+0x2c], dl
    pop     ebx
    pop     edx
    pop     ecx
    pop     eax
    pop     edi
    pop     esi
    popf
    push    eax
    movups  [cs1_temp_xmm0], xmm0
    jmp     cs1_movsldup
; ----------------------------------------------------------------------------
cs1_check11:
    cmp     ecx, 0x7c0ff2 ; check for haddps
    jz      cs1_do_haddps
    cmp     ecx, 0x7d0ff2 ; check for hsubps
    jz      cs1_do_hsubps
    jmp     cs1_check12
cs1_do_haddps:
    mov     word [cs1_haddps+9], 0x9084
    mov     dword [cs1_haddps+11], 0x90909090
    shr     eax, 0x18 ; haddps begins
    mov     edx, eax
    and     eax, 0xc7
    mov     [cs1_haddps+0x9], al
    mov     esi, [cs1+0x38]
    add     esi, 4
    mov     ebx, modrm_table
    xlatb
    add     dword [cs1+0x38], eax
    mov     ecx, eax
    mov     edi, cs1_haddps+0xa
    rep movsb
    and     edx, 0x38
    or      edx, 5
    mov     [cs1_haddps+2], dl
    mov     [cs1_haddps+143], dl
    pop     ebx
    pop     edx
    pop     ecx
    pop     eax
    pop     edi
    pop     esi
    popf
    push    eax
    movups  [cs1_temp_xmm0], xmm0
    movups  [cs1_temp_xmm1], xmm1
    jmp     cs1_haddps
; ----------------------------------------------------------------------------
cs1_do_hsubps:
    mov     word [cs1_hsubps+9], 0x9084
    mov     dword [cs1_hsubps+11], 0x90909090
    shr     eax, 0x18 ; hsubps begins
    mov     edx, eax
    and     eax, 0xc7
    mov     [cs1_hsubps+0x9], al
    mov     esi, [cs1+0x38]
    add     esi, 4
    mov     ebx, modrm_table
    xlatb
    add     dword [cs1+0x38], eax
    mov     ecx, eax
    mov     edi, cs1_hsubps+0xa
    rep movsb
    and     edx, 0x38
    or      edx, 5
    mov     [cs1_hsubps+2], dl
    mov     [cs1_hsubps+143], dl
    pop     ebx
    pop     edx
    pop     ecx
    pop     eax
    pop     edi
    pop     esi
    popf
    push    eax
    movups  [cs1_temp_xmm0], xmm0
    movups  [cs1_temp_xmm1], xmm1
    jmp     cs1_hsubps
; ----------------------------------------------------------------------------
cs1_check12:
    cmp     ecx, 0xd00ff2 ; check for addsubps
    jz      cs1_do_addsubps
    jmp     unknown
cs1_do_addsubps:
    mov     word [cs1_addsubps+9], 0x9084
    mov     dword [cs1_addsubps+11], 0x90909090
    shr     eax, 0x18 ; addsubps begins
    mov     edx, eax
    and     eax, 0xc7
    mov     [cs1_addsubps+0x9], al
    mov     esi, [cs1+0x38]
    add     esi, 4
    mov     ebx, modrm_table
    xlatb
    add     dword [cs1+0x38], eax
    mov     ecx, eax
    mov     edi, cs1_addsubps+0xa
    rep movsb
    and     edx, 0x38
    or      edx, 5
    mov     [cs1_addsubps+2], dl
    mov     [cs1_addsubps+106], dl
    pop     ebx
    pop     edx
    pop     ecx
    pop     eax
    pop     edi
    pop     esi
    popf
    push    eax
    movups  [cs1_temp_xmm0], xmm0
    movups  [cs1_temp_xmm1], xmm1
    jmp     cs1_addsubps
; ----------------------------------------------------------------------------

; [slots 2/3 omitted]

unknown:
    int     0xfd ; this won't return

align 16, db 0

modrm_table:
    times 8 db 0, 0, 0, 0, 5, 4, 0, 0
    times 8 db 1, 1, 1, 1, 2, 1, 1, 1
    times 8 db 4, 4, 4, 4, 5, 4, 4, 4
    times 64 db 0

align 16, db 0

cs1: times 56 db 0
cs1_opcode: dd 0x00000000
cs1_counter: dd 0xffffffff

cs2: times 56 db 0
cs2_opcode: dd 0x00000000
cs2_counter: dd 0xffffffff

cs3: times 56 db 0
cs3_opcode: dd 0x00000000
cs3_counter: dd 0xffffffff

cs1_temp_xmm0: times 16 db 0
cs1_temp_xmm1: times 16 db 0
cs1_temp_dst: times 16 db 0

cs2_temp_xmm0: times 16 db 0
cs2_temp_xmm1: times 16 db 0
cs2_temp_dst: times 16 db 0

cs3_temp_xmm0: times 16 db 0
cs3_temp_xmm1: times 16 db 0
cs3_temp_dst: times 16 db 0

counta: dd 0x00000000
countb: dd 0x00000000

; ********************************************************************
; ****************************** SLOT 1 ******************************
; ********************************************************************

    align 4, nop
cs1_fisttp:
    fnstcw  [cs1+8]
    push    eax
    movzx   eax, word [cs1+8]
    or      eax, 0xc00
    mov     dword [cs1+4], eax
    pop     eax
    fldcw   [cs1+4]
    fistp   dword [eax+edx*4+0x90909090]
    fldcw   [cs1+8]
    add     dword [cs1+0x38], 0x2
    push    dword [cs1+0x38]
    mov     dword [cs1_counter], 0xffffffff
    ret
; ----------------------------------------------------------------------------
    align 4, nop
cs1_lddqu:
    movdqu  xmm0, [eax+edx*4+0x90909090]
    push    dword [cs1+0x38]
    mov     dword [cs1_counter], 0xffffffff
    ret
; ----------------------------------------------------------------------------
    align 4, nop
cs1_movddup:
    movupd  xmm0, [eax+edx*4+0x90909090]
    movlpd  [cs1], xmm0
    movupd  xmm0, [cs1_temp_xmm0]
    movlpd  xmm1, [cs1]
    movhpd  xmm1, [cs1]
    add     dword [cs1+0x38], 0x4
    push    dword [cs1+0x38]
    mov     dword [cs1_counter], 0xffffffff
    ret
; ----------------------------------------------------------------------------
    align 4, nop
cs1_haddpd:
    movupd  [cs1_temp_dst], xmm7
    movupd  xmm0, [eax+edx*4+0x90909090]
    movupd  xmm1, [cs1_temp_dst]
    movupd  [cs1], xmm0
    movlpd  [cs1+0x10], xmm0
    movhpd  [cs1], xmm1
    movhpd  xmm1, [cs1+0x10]
    addpd   xmm1, [cs1]
    movupd  xmm0, [cs1_temp_xmm0]
    movupd  [cs1_temp_dst], xmm1
    movupd  xmm1, [cs1_temp_xmm1]
    movupd  xmm7, [cs1_temp_dst]
    add     dword [cs1+0x38], 0x4
    push    dword [cs1+0x38]
    mov     dword [cs1_counter], 0xffffffff
    ret
; ----------------------------------------------------------------------------
    align 4, nop
cs1_hsubpd:
    movupd  [cs1_temp_dst], xmm7
    movupd  xmm0, [eax+edx*4+0x90909090]
    movupd  xmm1, [cs1_temp_dst]
    movlpd  [cs1], xmm0
    movhpd  [cs1+0x8], xmm1
    movhpd  xmm1, [cs1]
    movlpd  xmm0, [cs1+0x8]
    subpd   xmm1, xmm0
    movlpd  xmm0, [cs1]
    movupd  xmm0, [cs1_temp_xmm0]
    movupd  [cs1_temp_dst], xmm1
    movupd  xmm1, [cs1_temp_xmm1]
    movupd  xmm7, [cs1_temp_dst]
    add     dword [cs1+0x38], 0x4
    push    dword [cs1+0x38]
    mov     dword [cs1_counter], 0xffffffff
    ret
; ----------------------------------------------------------------------------
    align 4, nop
cs1_addsubpd:
    movupd  [cs1_temp_dst], xmm7
    movupd  xmm0, [eax+edx*4+0x90909090]
    movupd  xmm1, [cs1_temp_dst]
    movlpd  [cs1], xmm1
    addpd   xmm1, xmm0
    movhpd  [cs1+0x8], xmm1
    movlpd  xmm1, [cs1]
    subpd   xmm1, xmm0
    movhpd  xmm1, [cs1+0x8]
    movupd  xmm0, [cs1_temp_xmm0]
    movupd  [cs1_temp_dst], xmm1
    movupd  xmm1, [cs1_temp_xmm1]
    movupd  xmm7, [cs1_temp_dst]
    add     dword [cs1+0x38], 0x4
    push    dword [cs1+0x38]
    mov     dword [cs1_counter], 0xffffffff
    ret
; ----------------------------------------------------------------------------
    align 4, nop
cs1_movshdup:
    movups  xmm0, [eax+edx*4+0x90909090]
    movups  [cs1], xmm0
    mov     eax, [cs1+0xc]
    mov     [cs1+0x8], eax
    mov     eax, [cs1+0x4]
    mov     [cs1], eax
    movups  xmm0, [cs1_temp_xmm0]
    movups  xmm1, [cs1]
    pop     eax
    add     dword [cs1+0x38], 0x4
    push    dword [cs1+0x38]
    mov     dword [cs1_counter], 0xffffffff
    ret
; ----------------------------------------------------------------------------
    align 4, nop
cs1_movsldup:
    movups  xmm0, [eax+edx*4+0x90909090]
    movups  [cs1], xmm0
    mov     eax, [cs1+0x8]
    mov     [cs1+0xc], eax
    mov     eax, [cs1]
    mov     [cs1+0x4], eax
    movups  xmm0, [cs1_temp_xmm0]
    movups  xmm1, [cs1]
    pop     eax
    add     dword [cs1+0x38], 0x4
    push    dword [cs1+0x38]
    mov     dword [cs1_counter], 0xffffffff
    ret
; ----------------------------------------------------------------------------
    align 4, nop
cs1_haddps:
    movups  [cs1_temp_dst], xmm7
    movups  xmm0, [eax+edx*4+0x90909090]
    movups  xmm1, [cs1_temp_dst]
    movups  [cs1], xmm0
    movups  [cs1+0x20], xmm0
    movups  [cs1+0x10], xmm1
    mov     eax, [cs1+0x14]
    mov     [cs1], eax
    mov     eax, [cs1+0x1c]
    mov     [cs1+0x4], eax
    mov     eax, [cs1+0x24]
    mov     [cs1+0x8], eax
    mov     eax, [cs1+0x18]
    mov     [cs1+0x14], eax
    mov     eax, [cs1+0x28]
    mov     [cs1+0x1c], eax
    mov     eax, [cs1+0x20]
    mov     [cs1+0x18], eax
    movups  xmm0, [cs1]
    movups  xmm1, [cs1+0x10]
    addps   xmm1, xmm0
    movups  xmm0, [cs1_temp_xmm0]
    movups  [cs1_temp_dst], xmm1
    movups  xmm1, [cs1_temp_xmm1]
    movups  xmm7, [cs1_temp_dst]
    pop     eax
    add     dword [cs1+0x38], 0x4
    push    dword [cs1+0x38]
    mov     dword [cs1_counter], 0xffffffff
    ret
; ----------------------------------------------------------------------------
    align 4, nop
cs1_hsubps:
    movups  [cs1_temp_dst], xmm7
    movups  xmm0, [eax+edx*4+0x90909090]
    movups  xmm1, [cs1_temp_dst]
    movups  [cs1], xmm0
    movups  [cs1+0x20], xmm0
    movups  [cs1+0x10], xmm1
    mov     eax, [cs1+0x14]
    mov     [cs1], eax
    mov     eax, [cs1+0x1c]
    mov     [cs1+0x4], eax
    mov     eax, [cs1+0x24]
    mov     [cs1+0x8], eax
    mov     eax, [cs1+0x18]
    mov     [cs1+0x14], eax
    mov     eax, [cs1+0x28]
    mov     [cs1+0x1c], eax
    mov     eax, [cs1+0x20]
    mov     [cs1+0x18], eax
    movups  xmm0, [cs1]
    movups  xmm1, [cs1+0x10]
    subps   xmm1, xmm0
    movups  xmm0, [cs1_temp_xmm0]
    movups  [cs1_temp_dst], xmm1
    movups  xmm1, [cs1_temp_xmm1]
    movups  xmm7, [cs1_temp_dst]
    pop     eax
    add     dword [cs1+0x38], 0x4
    push    dword [cs1+0x38]
    mov     dword [cs1_counter], 0xffffffff
    ret
; ----------------------------------------------------------------------------
    align 4, nop
cs1_addsubps:
    movups  [cs1_temp_dst], xmm7
    movups  xmm0, [eax+edx*4+0x90909090]
    movups  xmm1, [cs1_temp_dst]
    movups  [cs1], xmm1
    addps   xmm1, xmm0
    movups  [cs1+0x10], xmm1
    movups  xmm1, [cs1]
    subps   xmm1, xmm0
    movups  [cs1+0x20], xmm1
    mov     eax, [cs1+0x14]
    mov     [cs1+0x24], eax
    mov     eax, [cs1+0x1c]
    mov     [cs1+0x2C], eax
    movups  xmm1, [cs1+0x20]
    movups  xmm0, [cs1_temp_xmm0]
    movups  [cs1_temp_dst], xmm1
    movups  xmm1, [cs1_temp_xmm1]
    movups  xmm7, [cs1_temp_dst]
    pop     eax
    add     dword [cs1+0x38], 0x4
    push    dword [cs1+0x38]
    mov     dword [cs1_counter], 0xffffffff
    ret
; ----------------------------------------------------------------------------

; [slots 2/3 omitted]

times 0x2000-($-$$) db 0