Les dejo el ASM de un parche que porte recientemente, los offsets comentados son del W995 R1HA035
Código:
include "x.inc"
include "W595_R3EF001.lib.asm"


;W595 SW-R3EF001
;Añadir el número de tareas en el título
;Añadir icono en el título
;Cambiar el estilo del GUI
;(c) anarkes & thomassafca
;(p) DaRkMaN 


;=========HOOKS=========
org 0x10E7DE70 ;0x1559C32C
_1559C32C:

        MOV    R1, 9 ;estilo del GUI


org 0x10E7DE66 ;0x1559C322
_1559C322:

        NOP
        NOP
        NOP
        NOP
        NOP


org 0x10E7DE96 ;0x1559C348
_1559C348:

        LDR    R3, off_1559C350
        BLX    R3
        B    0x10E7DEA2 ;0x1559C354

off_1559C350    dw loc_15E6B5F0+1    
        NOP



;=========NEWCODE=========

org 0x1279E390 ;0x15E6B5F0
loc_15E6B5F0:                
                    
        PUSH    {LR}
        ADD    R1, R1,    1
        LSL    R1, R1,    0x10
        LSR    R7, R1,    0x10
        ADD    R1, R7,    0
        BL    sub_15E6B640
        BL    sub_15E6B618
        ADD    R1, R0,    0
        LDR    R0, [R4,0x18]
        BL    sub_15E6B648
        LDR    R1, dword_15E6B660
        LDR    R0, [R4,0x18]
        BL    sub_15E6B63C
        LDR    R0, [R4,0x18]
        LDR    R5, dword_15E6B668
        POP    {PC}


sub_15E6B618:                

var_10        = -0x10
var_C        = -0xC
var_8        = -8

        PUSH    {R1-R3,LR}
        STR    R5, [SP,0x10+var_10]
        SUB    R0, R7,    1
        BL    sub_15E6B644
        STR    R0, [SP,0x10+var_8]
        MOV    R2, 2
        MOV    R1, 6
        adr    R0, asc_15E6B66C 
        BL    sub_15E6B64C
        STR    R0, [SP,0x10+var_C]
        MOV    R2, 3
        MOV    R1, 5
        MOV    R0, SP
        BL    sub_15E6B64C
        POP    {R1-R3,PC}


sub_15E6B63C:                
        LDR    R3, off_15E6B664
        BX    R3


sub_15E6B640:                
        LDR    R3, off_15E6B650
        BX    R3


sub_15E6B644:                

var_28        = -0x28

        LDR    R3, off_15E6B654
        BX    R3


sub_15E6B648:                
        LDR    R3, off_15E6B658
        BX    R3


sub_15E6B64C:                
        LDR    R3, off_15E6B65C
        BX    R3


off_15E6B650    dw ListMenu_SetItemCount
off_15E6B654    dw 0x10F61C68+1 ;0x143D6484+1     ;int2strID
off_15E6B658    dw GUIObject_SetTitleText
off_15E6B65C    dw 0x10F61E3C+1 ;0x142D8380+1     ;Str2ID
dword_15E6B660    dw 0xF826        
off_15E6B664    dw GUIObject_SetTitleIcon
dword_15E6B668    dw 0xFAD        
asc_15E6B66C    db ": ",0
Saludos ...