from pathlib import Path


def u16(data, off):
    return data[off] | (data[off + 1] << 8)


def set_bytes(buf, off, blob):
    buf[off:off+len(blob)] = blob


def set_u16(buf, off, value):
    buf[off] = value & 0xFF
    buf[off+1] = (value >> 8) & 0xFF


data = bytearray(Path(r'd:\Ghidra\Crusader\REGRET.EXE').read_bytes())
code = bytes.fromhex('55 8b ec 56 57 53 06 a1 2c 71 8b 16 2e 71 0b c2 74 4e c4 5e 06 83 eb 36 26 8b 47 02 d1 e0 d1 e0 c4 1e 30 44 01 c3 26 8b 37 26 8b 7f 02 8b c6 0b c7 74 2d c4 5e 06 26 ff b7 e3 00 26 ff b7 e1 00 26 ff b7 dc 00 26 ff b7 da 00 26 ff b7 d8 00 26 ff b7 d6 00 57 56 52 50 9a f5 02 e0 13 83 c4 14 ff 76 0c ff 76 0a ff 76 08 ff 76 06 9a 8b 03 f0 13 83 c4 08 07 5b 5f 5e 5d cb')
set_bytes(data, 0xD2840, code)
patches = {
    0xD2C94: bytes.fromhex('03 00 fb 10 80 00 40 20'),
    0xD2E0C: bytes.fromhex('03 00 99 20 7d 00 f5 02'),
}
for off, blob in patches.items():
    set_bytes(data, off, blob)
for rec_off in [0xD2C94,0xD2E0C,0xD2E14,0xD2E1C]:
    rec = data[rec_off:rec_off+8]
    src = u16(rec, 2)
    segidx = rec[4]
    target_off = u16(rec, 6)
    selector = 0x1000 + ((segidx - 1) << 3)
    op_off = 0xD0800 + src
    set_u16(data, op_off, target_off)
    set_u16(data, op_off+2, selector)
print(data[0xD2840:0xD28DD].hex(' '))