As per this conversation, it seems the skill multiplier may be applied incorrectly. Possibly delaying when the multiplier is applied to until after the offset is retrieved could resolve this, though that may not be in the same section of the code.

I'm not a huge fan of modifying the fLegendaryResetSkillLevel variable at runtime in some unknown part of the legendary process to change the level. I think a much better way to do this would be to find where it loads that variable and change the value there. A good place to start would be to print the offset of the variable when the mod loads it, since that seems to be static.

There is a bug where hovering over a skill which is over the configured threshold and then hovering over a skill which is over level 100 (regardless of the configured threshold) still shows the legendary button. I've searched for quite a few places to find where the game is determining if the button should be removed or not. Things I have tried:

• Doesn't seem to be connected to any place where the constant "100.0" is loaded into an xmm register.
• Doesn't seem to be connected to any place where the skill menu calls PlayerAVOGetBase(). The menu only seems to call this function when determining the color of the skill level text and when determining which perks are available for purchase.
  • Observation: This is quite strange. As this also means I found no location where the game gets the base value and stores it. So it can't be that the game is storing the value (cast to u32) and then comparing it to $0x64. Is there a bug in base skyrim where the button is displayed over skills which are buffed above level 100 by magic effects? e.g., is the game calling PlayerAVOGetCurrent() instead?
• Doesn't seem to be related to any future scaleform-api calls. I snooped the calls to those and didn't find any string function names which made sense for such a call. Dumping the binary of strings shows the only scaleform function name with "legendary" in it is "ShowLegendaryButtonHint", which is what displays the button.

According to the x64 calling convention spec:

Consider volatile registers destroyed on function calls unless otherwise safety-provable by analysis such as whole program optimization.

That last line is the rub. It seems skyrim does have some amount of this in it. At the very least, the level exp patch comes after a call and assumes rcx is preserved across that call.

In order to be super safe, it seems I will need to inject saveall/restoreall in every wrapper, not just the ones which aren't replacing a call.