Вызов функции другого процесса (неверные регистры)

using System;
using System.IO;
using System.Reflection;
using System.Runtime.InteropServices;
using System.Threading;
using System.Windows.Forms;
 
namespace DomainManager
{
    public interface IAssemblyLoader
    {
        void LoadAndRun(string file);
    }
 
    public class EntryPoint
    {
        [DllImport("User32.dll")]
        private static extern short GetAsyncKeyState(Keys vKey);
 
        [STAThread]
        public static int Main(string args)
        {
            bool firstLoaded = false;
            while (true)
            {
                if (!firstLoaded)
                {
                    firstLoaded = true;
                    new CleanDomain(args);
                }
 
                if ((GetAsyncKeyState(Keys.F11) & 1) == 1)
                {
                    new CleanDomain(args);
                }
 
                Thread.Sleep(10);
            }
            return 0;
        }
    }
 
    public static class DomainManager
    {
        public static AppDomain CurrentDomain { get; set; }
        public static CleanAssemblyLoader CurrentAssemblyLoader { get; set; }
    }
 
    public class CleanAssemblyLoader : MarshalByRefObject, IAssemblyLoader
    {
        public CleanAssemblyLoader()
        {
            AppDomain.CurrentDomain.AssemblyResolve += CurrentDomain_AssemblyResolve;
        }
 
        #region IAssemblyLoader Members
 
        public void LoadAndRun(string file)
        {
            Assembly asm = Assembly.Load(file);
            MethodInfo entry = asm.EntryPoint;
            //object o = asm.CreateInstance(entry.Name);
            entry.Invoke(null, new object[] {null});
        }
 
        #endregion
 
        private Assembly CurrentDomain_AssemblyResolve(object sender, ResolveEventArgs args)
        {
            if (args.Name == Assembly.GetExecutingAssembly().FullName)
                return Assembly.GetExecutingAssembly();
 
            string appDir = Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location);
            string shortAsmName = Path.GetFileName(args.Name);
            string fileName = Path.Combine(appDir, shortAsmName);
 
            if (File.Exists(fileName))
            {
                return Assembly.LoadFrom(fileName);
            }
            return Assembly.GetExecutingAssembly().FullName == args.Name ? Assembly.GetExecutingAssembly() : null;
        }
    }
 
    /// <summary> 
    /// The actual domain object we'll be using to load and run the Onyx binaries.
    /// </summary>
    public class CleanDomain
    {
        private readonly Random _rand = new Random();
        public CleanDomain(string assemblyName)
        {
            try
            {
                string appBase = Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location);
                var ads = new AppDomainSetup { ApplicationBase = appBase, PrivateBinPath = appBase };
                DomainManager.CurrentDomain = AppDomain.CreateDomain("CleanDomain_Internal_" + _rand.Next(0, 100000),
                                                                     null, ads);
                AppDomain.CurrentDomain.AssemblyResolve += CurrentDomain_AssemblyResolve;
                DomainManager.CurrentAssemblyLoader =
                    (CleanAssemblyLoader)
                    DomainManager.CurrentDomain.CreateInstanceAndUnwrap(Assembly.GetExecutingAssembly().FullName,
                                                               typeof(CleanAssemblyLoader).FullName);
                //System.Windows.Forms.MessageBox.Show(Path.Combine(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location), assemblyName));
                
                DomainManager.CurrentAssemblyLoader.LoadAndRun(
                    Path.Combine(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location), assemblyName));
            }
            catch (Exception e)
            {
                MessageBox.Show(e.ToString());
            }
            finally
            {
                DomainManager.CurrentAssemblyLoader = null;
                AppDomain.Unload(DomainManager.CurrentDomain);
            }
        }
 
        Assembly CurrentDomain_AssemblyResolve(object sender, ResolveEventArgs args)
        {
            try
            {
                Assembly assembly = System.Reflection.Assembly.Load(args.Name);
                if (assembly != null)
                    return assembly;
            }
            catch
            {
                // ignore load error 
            }
 
            // *** Try to load by filename - split out the filename of the full assembly name
            // *** and append the base path of the original assembly (ie. look in the same dir)
            // *** NOTE: this doesn't account for special search paths but then that never
            //           worked before either.
            string[] Parts = args.Name.Split(',');
            string File = Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location) + "" + Parts[0].Trim() + ".dll";
 
            return System.Reflection.Assembly.LoadFrom(File);
        }
    }
}

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
 
namespace TestExecude
{
    static class Program
    {
        [STAThread]
        static void Main(string[] args)
        {
            Int64 CastSpellOffset = 0x45C9F0; //0x45DE0B;
            Int64 address = Process.GetProcessesByName("Wow-64")[0].MainModule.BaseAddress.ToInt64() + CastSpellOffset;
            CastSpellByID Cast = (CastSpellByID)Marshal.GetDelegateForFunctionPointer(new IntPtr(address), typeof(CastSpellByID));
            Cast(19434, 0, new byte[16], 0, 0, 0, 0);
        }
 
        [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
        delegate Int64 CastSpellByID(UInt64 spellId, Int64 itemId, byte[] guid, Int64 isTrade, Int64 a6, Int64 a7, Int64 a8);
    }
}

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
 
namespace TestExecude
{
    static class Program
    {
        [STAThread]
        static void Main(string[] args)
        {
            Int64 CastSpellOffset = 0x45E3A0; //0x45C9F0; //0x45DE0B;
            ProcessMemory mem_wow = new ProcessMemory();
            Int64 address = mem_wow.GetBaseAddress() + CastSpellOffset;
            CastSpellByID Cast = (CastSpellByID)Marshal.GetDelegateForFunctionPointer(new IntPtr(address), typeof(CastSpellByID));
            // ["Wow-64.exe"+01861C48] + 0x128 = RBP = R9
            Int64 rbp = mem_wow.ReadAddress(mem_wow.GetBaseAddress() + 0x01861C48) + 0x128;
            Cast(19434, rbp - 0x1A0, 0, rbp);
        }
 
        //char __fastcall sub_14045E3A0(unsigned int a1, __int64 a2, __int64 a3, __int64 a4)
        [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
        delegate Int64 CastSpellByID(UInt64 a1, Int64 a2, Int64 a3, Int64 a4);
 
        [DllImport("kernel32.dll")]
        static extern bool ReadProcessMemory(IntPtr hProcess, Int64 lpBaseAddress, byte[] buffer, Int64 nSize, out Int64 lpNumberOfBytesRead);
 
        class ProcessMemory
        {
            Process pWow;
 
            public ProcessMemory()
            {
                pWow = Process.GetProcessesByName("Wow-64")[0];
            }
 
            public Int64 GetBaseAddress()
            {
                return pWow.MainModule.BaseAddress.ToInt64();
            }
 
            public Int64 ReadAddress(Int64 address)
            {
                Int64 numRead = 0;
                byte[] buffer = new byte[sizeof(Int64)];
                ReadProcessMemory(pWow.Handle, address, buffer, sizeof(Int64), out numRead);
                return BitConverter.ToInt64(buffer, 0);
            }
        }
    }
}