Descobri uma função interna na CShell.dll que retorna o ponteiro para o WeaponSet, então fiz essa função!

Code:
void GetWeaponSetByNeo()
{
	char PATT_WEAPONSET[] = "\x6A\xFF\x68\x00\x00\x00\x00\x64\xA1\x00\x00\x00\x00\x50\xA1\x00\x00\x00\x00\x33\xC4\x50\x8D\x44\x24\x04\x64\xA3\x00\x00\x00\x00\xB8\x00\x00\x00\x00\x84\x05\x50\x21\xA4\x37";
	char MASK_WEAPONSET[] = "xxx????xx????xx????xxxxxxxxx????x????xxxxxx";

	while (ADDR_WEAPONSET == 0)
		ADDR_WEAPONSET = FindPattern( 0x37100000 , 0xedc000, (BYTE*)PATT_WEAPONSET, MASK_WEAPONSET);

	__asm CALL ADDR_WEAPONSET;
	__asm MOV ADDR_WEAPONSET, EAX;
}
Créditos: Eu, Google e OllyDbg (SigMaker)