It is not a simple byte replacement you can just generalize so readily, though it's not super complicated. Find where the CPS-B registers are being committed, and jump to your own routine that reorders bits according to the scrambled masks and does the write to the (possibly moved) corresponding locations. Also remove checks for CPS-B ID at startup if they are not already removed.