hotfix x64 calling convention and more prototypes

this fix a problem with BeaEngine and use the arg.mne as a workaround to detect register modifications. An email was sent to the original author of BeaEngine. Many undocumented function prototypes were added to the library list.

README.md

@@ -1,20 +1,25 @@
 x64dbg-StaticAnalysis
 =====================
-
 This is a plugin for the project x64_dbg. It detect win32api calls and add useful comments at found parameters for easier analysis. It supports **x86 and x64**.
-
+The plugin delivers a comprehensive list (3304 descriptions of functions) of function prototypes. *These were crafted by hand and RegEx, so please respect the credits and license.
 
 ### x86 and x64
+It fully supports the x64 calling convention:
 ![default x86 calling](https://raw.githubusercontent.com/x64dbg/x64dbg-StaticAnalysis/master/x64.PNG)
+
+It even detects different argument order. Notice that the prototype is
+
+   int GetModuleFileNameW(DWORD nBufferSize,LPTSTR lpBuffer,HMODULE hModule)
+
+but the plugin recognize the order of the arguments
 ![default x86 calling](https://raw.githubusercontent.com/x64dbg/x64dbg-StaticAnalysis/master/x64_2.PNG)
+Hence it knows, that in this case the argument order changed.
 
 
 ### advanced parameter detection (MinGW)
 
 ![default x86 calling](https://raw.githubusercontent.com/x64dbg/x64dbg-StaticAnalysis/master/analysis2.PNG)
-
-due some stack emulation it is possible to analyse MingGW parameter passing to the stack
-
+Due some stack emulation it is possible to analyse MingGW parameter passing to the stack
 ![MingGW parameters](https://raw.githubusercontent.com/x64dbg/x64dbg-StaticAnalysis/master/analysis.PNG)
 
 ## Download

src/RegisterEmulator.cpp

@@ -1,6 +1,6 @@
 #include "RegisterEmulator.h"
 
-
+#define _SAME(a,b)  ((strcmp(a ,b) == 0) )
 
 RegisterEmulator::RegisterEmulator()
 {
@@ -13,22 +13,40 @@ RegisterEmulator::~RegisterEmulator()
 
 void RegisterEmulator::emulate(const DISASM* BeaStruct)
 {
-
-
 	if ((BeaStruct->Argument1.AccessMode == WRITE) && ((BeaStruct->Argument1.ArgType & GENERAL_REG))){
-		 
-		if (BeaStruct->Argument1.ArgType & REG1){
+		// Unfortunately there is a bug in BeaEngine, so we cannot use 
+		// "if (BeaStruct->Argument1.ArgType & REG?)"
+		if (_SAME(BeaStruct->Argument1.ArgMnemonic, "cl") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "ch") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "cx") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "ecx") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "rcx")
+			){
 			mRCX = BeaStruct->VirtualAddr;
 		}
-		else if (BeaStruct->Argument1.ArgType & REG2){
+		else if (_SAME(BeaStruct->Argument1.ArgMnemonic, "dl") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "dh") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "dx") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "edx") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "rdx")
+			){
 			mRDX = BeaStruct->VirtualAddr;
 		}
-		else if (BeaStruct->Argument1.ArgType & REG8){
+		else if (_SAME(BeaStruct->Argument1.ArgMnemonic, "r8") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "r8d") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "r8w") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "r8b")
+			){
 			mR8 = BeaStruct->VirtualAddr;
 		}
-		else if (BeaStruct->Argument1.ArgType & REG9){
+		else if (_SAME(BeaStruct->Argument1.ArgMnemonic, "r9") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "r9d") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "r9w") ||
+			_SAME(BeaStruct->Argument1.ArgMnemonic, "r9b")
+			){
 			mR9 = BeaStruct->VirtualAddr;
 		}
+
 	}
 }