2010-3-26 22:00
godtype
全策略效果代码分析
有一段时间没有发技术帖了，百忙中抽点时间开挖大坑，对曹操传的全策略效果代码进行分析，想修改策略效果的就请持续关注了。
[b][size=3]第一部分 使用策略的时候所需要的内存位置介绍（必备知识）：[/size][/b]
497AF8 是策略编号
497AF8+1 是使用策略的武将的战场序号
497AF8+4 是使用策略的武将的DATA内存地址（DWORD）
497AF8+8 是使用策略的武将的战场内存地址（DWORD）
497AF8+C 是目前被策略攻击或被策略恢复、提升武将的战场序号
497AF8+D 开始是全体被策略攻击或被策略恢复、提升武将的战场序号
497AF8+84 开始是全体被策略攻击武将按被攻击顺序存放伤害值（DWORD）
497AF8+254 是策略效果标识
497AF8+255 开始是全体被策略攻击武将按被攻击顺序存放实际策略效果标识（这个在一般情况下是统一跟+254的标识值一样，但是特殊的多组合效果策略就会用到不同的效果标识，例如八阵和玄武）
497AF8+2C9和+2CA 分别是使用的策略的攻击范围和穿透范围
497AF8+2D0 是使用策略的武将所得到的个人经验（DWORD）
497AF8+2D4 是使用策略的武将所得到的武器经验（DWORD）
497AF8+2D8 开始是全体被策略攻击武将所得到的防具经验（DWORD）
497AF8+4A8 （暂未详细分析，只有0和1两个值，对应的是使用策略的武将是否可以控制）
497AF8+4AC 最终输出用，表示是否成功使用策略，0不成功并返回选择策略界面，1成功并结束武将行动
497AF8+4B0 策略动画相关
[color=Silver][[i] 本帖最后由 godtype 于 2010-4-30 20:32 编辑 [/i]][/color]
2010-3-26 22:02
godtype
[font=宋体][b][size=3]第二部分 策略效果的第一道函数，我称之为识别函数。[/size][/b]
以玩家为例，战场中点击“策略”按钮再选择需要使用的策略后，经过一些其他函数（这些函数就没必要分析了）后就来到这条函数，这条函数会根据使用的策略对应效果再决定程序向对应的效果函数走过去。
00425627 /$ 55 PUSH EBP
00425628 |. 8BEC MOV EBP,ESP
0042562A |. 83EC 08 SUB ESP,8
0042562D |. 894D FC MOV DWORD PTR SS:[EBP-4],ECX
这里输入进来的ECX就是497AF8
00425630 |. 8A45 0C MOV AL,BYTE PTR SS:[EBP+C]
00425633 |. 50 PUSH EAX
00425634 |. 8A4D 08 MOV CL,BYTE PTR SS:[EBP+8]
00425637 |. 51 PUSH ECX
00425638 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042563B |. E8 A1FBFFFF CALL 004251E1
按照第一部分中的所需要的内存位置，将部分必要的数据保存进去，包括将08栈的策略编号存入497AF8中；0C栈的使用策略的武将的战场序号存入+1中；+C和从+D开始是74H字节进行赋值0FF（表示目前没有武将被使用）；计算出战场内存地址并存入+8中；计算出武将DATA内存地址并存入+4中；根据是否可控对+4A8进行赋值；根据策略的DATA数据将攻击范围和穿透范围存入分别+2C9和+2CA；对以下内存进行清零：+2D0、+2D4、74H*4+2D8、74H*4+84、74H*1+255、+4AC
00425640 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00425643 |. 8B4A 08 MOV ECX,DWORD PTR DS:[EDX+8]
00425646 |. E8 85040000 CALL 00425AD0
0042564B |. 25 FF000000 AND EAX,0FF
00425650 |. 33C9 XOR ECX,ECX
00425652 |. 83F8 07 CMP EAX,7
00425655 |. 0F94C1 SETE CL
使用策略的武将是否可控，是则CL=1
00425658 |. 51 PUSH ECX
00425659 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
0042565C |. 8A42 01 MOV AL,BYTE PTR DS:[EDX+1]
0042565F |. 50 PUSH EAX
00425660 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425663 |. 8A11 MOV DL,BYTE PTR DS:[ECX]
00425665 |. 52 PUSH EDX
00425666 |. E8 5EA8FFFF CALL 0041FEC9
0042566B |. 83C4 0C ADD ESP,0C
0042566E |. 85C0 TEST EAX,EAX
00425670 |. 75 0E JNZ SHORT 00425680
41FEC9是全策略是否有天气或装备或HP的使用限制（四神装备限制就是在里面，以后有需要再写出分析），EAX=0则不可使用，返回，其中如果是可控武将会弹出旁白提示不可使用的原因。
00425672 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00425675 |. 8B80 AC040000 MOV EAX,DWORD PTR DS:[EAX+4AC]
0042567B |. E9 3D030000 JMP 004259BD
以上代码就是策略不可使用（EAX=0），所以输出+4AC的值，此时为0，然后跳到最后面结束函数。
00425680 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425683 |. 33D2 XOR EDX,EDX
00425685 |. 8A11 MOV DL,BYTE PTR DS:[ECX]
00425687 |. 33C0 XOR EAX,EAX
00425689 |. 8A82 C0664800 MOV AL,BYTE PTR DS:[EDX+4866C0]
0042568F |. 83F8 63 CMP EAX,63
00425692 |. 7E 37 JLE SHORT 004256CB
00425694 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425697 |. 33D2 XOR EDX,EDX
00425699 |. 8A11 MOV DL,BYTE PTR DS:[ECX]
0042569B |. 33C0 XOR EAX,EAX
0042569D |. 8A82 C0664800 MOV AL,BYTE PTR DS:[EDX+4866C0]
004256A3 |. 3D FF000000 CMP EAX,0FF
004256A8 |. 74 21 JE SHORT 004256CB
004256AA |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004256AD |. 33D2 XOR EDX,EDX
004256AF |. 8A11 MOV DL,BYTE PTR DS:[ECX]
004256B1 |. 8A82 C0664800 MOV AL,BYTE PTR DS:[EDX+4866C0]
004256B7 |. 50 PUSH EAX
004256B8 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004256BB |. E8 3FC1FFFF CALL 004217FF
004256C0 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004256C3 |. 8981 B0040000 MOV DWORD PTR DS:[ECX+4B0],EAX
004256C9 |. EB 0D JMP SHORT 004256D8
004256CB |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
004256CE |. C782 B0040000 >MOV DWORD PTR DS:[EDX+4B0],0
以上部分为策略动画的相关代码，不作详细分析了，其中4866C0是全策略的动画编号，大于63的都是MCALL动画，需要另外调用函数4217FF。最后将动画编号存入+4B0中。
004256D8 |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004256DB |. 33C9 XOR ECX,ECX
004256DD |. 8A08 MOV CL,BYTE PTR DS:[EAX]
004256DF |. 894D F8 MOV DWORD PTR SS:[EBP-8],ECX
004256E2 |. 837D F8 43 CMP DWORD PTR SS:[EBP-8],43
004256E6 |. 0F87 A0020000 JA 0042598C
004256EC |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
004256EF |. 33D2 XOR EDX,EDX
004256F1 |. 8A90 3F5A4200 MOV DL,BYTE PTR DS:[EAX+425A3F]
004256F7 |. FF2495 C359420>JMP DWORD PTR DS:[EDX*4+4259C3]
这里开始就重要的，全策略按顺序对照着4259C3的索引表，再根据对应425A3F的分支表进行跳转到对应的效果函数中。
004256FE |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425701 |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],40
00425708 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042570B |. E8 2EDAFFFF CALL 0042313E
00425710 |. E9 81020000 JMP 00425996
以上为索引表00、02、1B的，对应效果都是直接伤害，效果标识值为40，先存入+254中，其他效果函数都是同样处理，下面就不重复了。
00425715 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00425718 |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],50
0042571F |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425722 |. E8 17DAFFFF CALL 0042313E
00425727 |. E9 6A020000 JMP 00425996
索引表03，对应效果都是吸取MP，效果标识值为50。
0042572C |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0042572F |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],40
00425736 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425739 |. E8 FCEAFFFF CALL 0042423A
0042573E |. E9 53020000 JMP 00425996
索引表01，对应效果为全屏伤害，即砂暴，效果标识值为40。
00425743 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425746 |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],62
0042574D |. 6A 00 PUSH 0
0042574F |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425752 |. E8 04DCFFFF CALL 0042335B
00425757 |. E9 3A020000 JMP 00425996
索引表04，对应效果为爆发下降，效果标识值为62
0042575C |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
0042575F |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],64
00425766 |. 6A 00 PUSH 0
00425768 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042576B |. E8 EBDBFFFF CALL 0042335B
00425770 |. E9 21020000 JMP 00425996
索引表05，对应效果为士气下降，效果标识值为64
00425775 |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00425778 |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],60
0042577F |. 6A 00 PUSH 0
00425781 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425784 |. E8 D2DBFFFF CALL 0042335B
00425789 |. E9 08020000 JMP 00425996
索引表06，对应效果为能力下降，效果标识值为60
0042578E |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425791 |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],61
00425798 |. 6A 00 PUSH 0
0042579A |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042579D |. E8 B9DBFFFF CALL 0042335B
004257A2 |. E9 EF010000 JMP 00425996
索引表07，对应效果为防御下降，效果标识值为61
004257A7 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
004257AA |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],70
004257B1 |. 6A 00 PUSH 0
004257B3 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004257B6 |. E8 8EDDFFFF CALL 00423549
004257BB |. E9 D6010000 JMP 00425996
索引表09，对应效果为中毒攻击，效果标识值为70
004257C0 |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004257C3 |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],71
004257CA |. 6A 00 PUSH 0
004257CC |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004257CF |. E8 75DDFFFF CALL 00423549
004257D4 |. E9 BD010000 JMP 00425996
索引表08，对应效果为混乱攻击，效果标识值为71
004257D9 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004257DC |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],72
004257E3 |. 6A 00 PUSH 0
004257E5 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004257E8 |. E8 5CDDFFFF CALL 00423549
004257ED |. E9 A4010000 JMP 00425996
索引表0A，对应效果为麻痹攻击，效果标识值为72
004257F2 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
004257F5 |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],74
004257FC |. 6A 00 PUSH 0
004257FE |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425801 |. E8 43DDFFFF CALL 00423549
00425806 |. E9 8B010000 JMP 00425996
索引表0B，对应效果为封咒攻击，效果标识值为74
0042580B |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0042580E |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],80
00425815 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425818 |. E8 70DFFFFF CALL 0042378D
0042581D |. E9 74010000 JMP 00425996
索引表0D，对应效果为恢复HP，效果标识值为80
00425822 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425825 |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],90
0042582C |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042582F |. E8 59DFFFFF CALL 0042378D
00425834 |. E9 5D010000 JMP 00425996
索引表0E，对应效果为恢复MP，效果标识值为90
00425839 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
0042583C |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],0A8
00425843 |. 6A 01 PUSH 1
00425845 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425848 |. E8 0EDBFFFF CALL 0042335B
0042584D |. E9 44010000 JMP 00425996
索引表10，对应效果为移动上升，效果标识值为A8
00425852 |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00425855 |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],0A2
0042585C |. 6A 01 PUSH 1
0042585E |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425861 |. E8 F5DAFFFF CALL 0042335B
00425866 |. E9 2B010000 JMP 00425996
索引表11，对应效果为爆发上升，效果标识值为A2
0042586B |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042586E |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],0A4
00425875 |. 6A 01 PUSH 1
00425877 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042587A |. E8 DCDAFFFF CALL 0042335B
0042587F |. E9 12010000 JMP 00425996
索引表12，对应效果为士气上升，效果标识值为A4
00425884 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00425887 |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],0A0
0042588E |. 6A 01 PUSH 1
00425890 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425893 |. E8 C3DAFFFF CALL 0042335B
00425898 |. E9 F9000000 JMP 00425996
索引表13，对应效果为能力上升，效果标识值为A0
0042589D |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004258A0 |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],0A1
004258A7 |. 6A 01 PUSH 1
004258A9 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004258AC |. E8 AADAFFFF CALL 0042335B
004258B1 |. E9 E0000000 JMP 00425996
索引表14，对应效果为防御上升，效果标识值为A1
004258B6 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004258B9 |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],0BF
004258C0 |. 6A 01 PUSH 1
004258C2 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004258C5 |. E8 7FDCFFFF CALL 00423549
004258CA |. E9 C7000000 JMP 00425996
索引表0F，对应效果为恢复状态，效果标识值为BF
004258CF |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
004258D2 |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],0B8
004258D9 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004258DC |. E8 7FE0FFFF CALL 00423960
004258E1 |. E9 B0000000 JMP 00425996
索引表15，对应效果为再行动，效果标识值为B8
004258E6 |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004258E9 |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],0FF
004258F0 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004258F3 |. E8 E4E5FFFF CALL 00423EDC
004258F8 |. E9 99000000 JMP 00425996
索引表0C，对应效果为八阵图，效果标识值为FF，因为是复合策略，所以真正的标识在效果函数中设置，这里只用0FF来存入+254中
004258FD |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425900 |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],0C0
00425907 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042590A |. E8 20E2FFFF CALL 00423B2F
0042590F |. E9 82000000 JMP 00425996
索引表16，对应效果为天气变化，效果标识值为C0
00425914 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00425917 |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],0A0
0042591E |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425921 |. E8 9AE3FFFF CALL 00423CC0
00425926 |. EB 6E JMP SHORT 00425996
索引表17，对应效果为自身能力上升，效果标识值为A0
00425928 |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0042592B |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],0AF
00425932 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425935 |. E8 86E3FFFF CALL 00423CC0
0042593A |. EB 5A JMP SHORT 00425996
索引表19，对应效果为自身全能力上升，效果标识值为AF
0042593C |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042593F |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],90
00425946 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425949 |. E8 1EE4FFFF CALL 00423D6C
0042594E |. EB 46 JMP SHORT 00425996
索引表18，对应效果为冥想，效果标识值为90
00425950 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00425953 |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],40
0042595A |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042595D |. E8 3CF5FFFF CALL 00424E9E
00425962 |. EB 32 JMP SHORT 00425996
索引表1A，对应效果为青龙，效果标识值为40
00425964 |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00425967 |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],0FF
0042596E |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425971 |. E8 9AEEFFFF CALL 00424810
00425976 |. EB 1E JMP SHORT 00425996
索引表1C，对应效果为玄武，效果标识值为FF
00425978 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042597B |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],0BF
00425982 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425985 |. E8 89EBFFFF CALL 00424513
0042598A |. EB 0A JMP SHORT 00425996
索引表1D，对应效果为白虎，效果标识值为BF
0042598C |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4] ——索引1E，无效果
0042598F |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],0
00425996 |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ——全部正常策略效果的代码运行完毕后跳到这里
00425999 |. 83B8 B0040000 >CMP DWORD PTR DS:[EAX+4B0],0
004259A0 |. 74 0A JE SHORT 004259AC
004259A2 |. B9 88274900 MOV ECX,00492788
004259A7 |. E8 EFCCFDFF CALL 0040269B
应该是与动画部分的有关，不分析了。
004259AC |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004259AF |. E8 59D5FFFF CALL 00422F0D
后续处理，HP和MP的增减（节约MP就在里面），经验的增加，升级处理等。
004259B4 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004259B7 |. 8B81 AC040000 MOV EAX,DWORD PTR DS:[ECX+4AC]
输出+4AC的值，决定是否结束当前武将的行动。
004259BD |> 8BE5 MOV ESP,EBP
004259BF |. 5D POP EBP
004259C0 \. C2 0800 RETN 8
分支表
004259C3 . FE564200 DD 004256FE ——索引表00，对应效果为直接伤害，效果标识值为40
004259C7 . 2C574200 DD 0042572C ——索引表01，对应效果为全屏伤害，效果标识值为40
004259CB . FE564200 DD 004256FE ——索引表02，与00相同
004259CF . 15574200 DD 00425715 ——索引表03，对应效果为吸取MP，效果标识值为50
004259D3 . 43574200 DD 00425743 ——索引表04，对应效果为爆发下降，效果标识值为62
004259D7 . 5C574200 DD 0042575C ——索引表05，对应效果为士气下降，效果标识值为64
004259DB . 75574200 DD 00425775 ——索引表06，对应效果为能力下降（文精武攻），效果标识值为60
004259DF . 8E574200 DD 0042578E ——索引表07，对应效果为防御下降，效果标识值为61
004259E3 . C0574200 DD 004257C0 ——索引表08，对应效果为混乱攻击，效果标识值为71
004259E7 . A7574200 DD 004257A7 ——索引表09，对应效果为中毒攻击，效果标识值为70
004259EB . D9574200 DD 004257D9 ——索引表0A，对应效果为麻痹攻击，效果标识值为72
004259EF . F2574200 DD 004257F2 ——索引表0B，对应效果为封咒攻击，效果标识值为74
004259F3 . E6584200 DD 004258E6 ——索引表0C，对应效果为八阵图，效果标识值为FF
004259F7 . 0B584200 DD 0042580B ——索引表0D，对应效果为恢复HP，效果标识值为80
004259FB . 22584200 DD 00425822 ——索引表0E，对应效果为恢复MP，效果标识值为90
004259FF . B6584200 DD 004258B6 ——索引表0F，对应效果为恢复状态，效果标识值为BF
00425A03 . 39584200 DD 00425839 ——索引表10，对应效果为移动上升，效果标识值为A8
00425A07 . 52584200 DD 00425852 ——索引表11，对应效果为爆发上升，效果标识值为A2
00425A0B . 6B584200 DD 0042586B ——索引表12，对应效果为士气上升，效果标识值为A4
00425A0F . 84584200 DD 00425884 ——索引表13，对应效果为能力上升，效果标识值为A0
00425A13 . 9D584200 DD 0042589D ——索引表14，对应效果为防御上升，效果标识值为A1
00425A17 . CF584200 DD 004258CF ——索引表15，对应效果为再行动，效果标识值为B8
00425A1B . FD584200 DD 004258FD ——索引表16，对应效果为天气变化，效果标识值为C0
00425A1F . 14594200 DD 00425914 ——索引表17，对应效果为自身能力上升，效果标识值为A0
00425A23 . 3C594200 DD 0042593C ——索引表18，对应效果为冥想，效果标识值为90
00425A27 . 28594200 DD 00425928 ——索引表19，对应效果为自身全能力上升，效果标识值为AF
00425A2B . 50594200 DD 00425950 ——索引表1A，对应效果为青龙，效果标识值为40
00425A2F . FE564200 DD 004256FE ——索引表1B，与00相同
00425A33 . 64594200 DD 00425964 ——索引表1C，对应效果为玄武，效果标识值为FF
00425A37 . 78594200 DD 00425978 ——索引表1D，对应效果为白虎，效果标识值为BF
00425A3B . 8C594200 DD 0042598C ——索引表1E，无效果
索引表
五火
00425A3F . 00 DB 00
00425A40 . 00 DB 00
00425A41 . 00 DB 00
00425A42 . 00 DB 00
00425A43 . 00 DB 00
五水
00425A44 . 00 DB 00
00425A45 . 00 DB 00
00425A46 . 00 DB 00
00425A47 . 00 DB 00
00425A48 . 00 DB 00
四风
00425A49 . 00 DB 00
00425A4A . 00 DB 00
00425A4B . 00 DB 00
00425A4C . 00 DB 00
砂暴
00425A4D . 01 DB 01
五地、诱惑、晕眩
00425A4E . 02 DB 02
00425A4F . 02 DB 02
00425A50 . 02 DB 02
00425A51 . 02 DB 02
00425A52 . 02 DB 02
00425A53 . 02 DB 02
00425A54 . 02 DB 02
谍报
00425A55 . 03 DB 03
降爆
00425A56 . 04 DB 04
00425A57 . 04 DB 04
降士
00425A58 . 05 DB 05
00425A59 . 05 DB 05
降力
00425A5A . 06 DB 06
00425A5B . 06 DB 06
降防
00425A5C . 07 DB 07
00425A5D . 07 DB 07
混乱
00425A5E . 08 DB 08
00425A5F . 08 DB 08
中毒
00425A60 . 09 DB 09
00425A61 . 09 DB 09
麻痹
00425A62 . 0A DB 0A
00425A63 . 0A DB 0A
封咒
00425A64 . 0B DB 0B
八阵图
00425A65 . 0C DB 0C
恢复HP
00425A66 . 0D DB 0D
00425A67 . 0D DB 0D
00425A68 . 0D DB 0D
00425A69 . 0D DB 0D
00425A6A . 0D DB 0D
恢复MP
00425A6B . 0E DB 0E
00425A6C . 0E DB 0E
恢复状态
00425A6D . 0F DB 0F
00425A6E . 0F DB 0F
加移
00425A6F . 10 DB 10
加爆
00425A70 . 11 DB 11
00425A71 . 11 DB 11
加士
00425A72 . 12 DB 12
00425A73 . 12 DB 12
加力
00425A74 . 13 DB 13
00425A75 . 13 DB 13
加防
00425A76 . 14 DB 14
00425A77 . 14 DB 14
回归
00425A78 . 15 DB 15
天气
00425A79 . 16 DB 16
00425A7A . 16 DB 16
00425A7B . 16 DB 16
气合
00425A7C . 17 DB 17
冥想
00425A7D . 18 DB 18
霸气
00425A7E . 19 DB 19
青龙
00425A7F . 1A DB 1A
朱雀
00425A80 . 1B DB 1B
玄武
00425A81 . 1C DB 1C
白虎
00425A82 . 1D DB 1D
一般情况下，想要修改策略的效果，就按照策略的编号顺序来修改索引表的值就可以了；如果想高级修改，就要进入到对应的效果函数中进行修改；如果是新增策略效果，这条函数是必须首先进行修改，然后才是编写新的效果函数。[/font]
[color=Silver][[i] 本帖最后由 godtype 于 2010-4-12 10:50 编辑 [/i]][/color]
2010-3-26 22:04
godtype
[font=宋体][b][size=3]第三部分 效果函数[/size][/b]
[b][size=2]一、直接伤害和吸收MP[/size][/b]
004256FE |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425701 |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],40
00425708 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042570B |. E8 2EDAFFFF CALL 0042313E
00425710 |. E9 81020000 JMP 00425996
直接伤害（非砂暴的四类策略、诱惑、晕眩、朱雀）是从这里过来的
00425715 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00425718 |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],50
0042571F |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425722 |. E8 17DAFFFF CALL 0042313E
00425727 |. E9 6A020000 JMP 00425996
吸收MP（谍报）是从这里过来的
0042313E /$ 55 PUSH EBP
0042313F |. 8BEC MOV EBP,ESP
00423141 |. 83EC 10 SUB ESP,10
00423144 |. 894D F8 MOV DWORD PTR SS:[EBP-8],ECX
这里输入进来的ECX就是497AF8
00423147 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
0042314A |. 8A08 MOV CL,BYTE PTR DS:[EAX]
0042314C |. 51 PUSH ECX ; /Arg4
0042314D |. 6A 02 PUSH 2 ; |Arg3 = 00000002
0042314F |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] ; |
00423152 |. 8A82 C9020000 MOV AL,BYTE PTR DS:[EDX+2C9] ; |
00423158 |. 50 PUSH EAX ; |Arg2
00423159 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
0042315C |. 8A51 01 MOV DL,BYTE PTR DS:[ECX+1] ; |
0042315F |. 52 PUSH EDX ; |Arg1
00423160 |. B9 50424B00 MOV ECX,004B4250 ; |
00423165 |. E8 D3210300 CALL 0045533D ; \0045533D
45533D（一共四个参数 + 一个ECX=4B4250的数据输入）确定被策略攻击的目标武将，穿透型策略就是第一个被攻击的武将。
0042316A |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
0042316D |. 8841 0C MOV BYTE PTR DS:[ECX+C],AL
45533D输出的AL值存入497AF8+0CH中
00423170 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
00423173 |. 33C0 XOR EAX,EAX
00423175 |. 8A42 0C MOV AL,BYTE PTR DS:[EDX+C]
00423178 |. 3D FF000000 CMP EAX,0FF
0042317D |. 75 05 JNZ SHORT 00423184
0042317F |. E9 D3010000 JMP 00423357
检查一下497AF8+CH是否为0FF，即有没有攻击目标，0FF就是没有，跳到最后返回。
00423184 |> 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
00423187 |. 8B91 A8040000 MOV EDX,DWORD PTR DS:[ECX+4A8]
0042318D |. 52 PUSH EDX ; /Arg4
0042318E |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; |
00423191 |. 8A48 0C MOV CL,BYTE PTR DS:[EAX+C] ; |
00423194 |. 51 PUSH ECX ; |Arg3
00423195 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] ; |
00423198 |. 8A42 01 MOV AL,BYTE PTR DS:[EDX+1] ; |
0042319B |. 50 PUSH EAX ; |Arg2
0042319C |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
0042319F |. 8A11 MOV DL,BYTE PTR DS:[ECX] ; |
004231A1 |. 52 PUSH EDX ; |Arg1
004231A2 |. E8 7BD2FFFF CALL 00420422 ; \00420422
004231A7 |. 83C4 10 ADD ESP,10
004231AA |. 85C0 TEST EAX,EAX
004231AC |. 75 05 JNZ SHORT 004231B3
004231AE |. E9 A4010000 JMP 00423357
420422（一共四个参数输入）是第二个策略限制，包括地形、使用的对象（例如回归不能指向使用策略的武将）。输出的EAX为零表示不可使用，跳到最后返回。
004231B3 |> 6A 00 PUSH 0 ; /Arg1 = 00000000
004231B5 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
004231B8 |. E8 8C210000 CALL 00425349 ; \00425349
425349是根据穿透范围将全部被攻击武将的战场编号按顺序存入497AF8+DH开始的74H*1个内存中。
004231BD |. C645 FC 00 MOV BYTE PTR SS:[EBP-4],0
004231C1 |. EB 08 JMP SHORT 004231CB
[EBP-4]是循环计数器，这里先将BYTE位清零。（如果是我就将整个DWORD清零，下面会省好多字节）
004231C3 |> 8A45 FC /MOV AL,BYTE PTR SS:[EBP-4]
004231C6 |. 04 01 |ADD AL,1
004231C8 |. 8845 FC |MOV BYTE PTR SS:[EBP-4],AL
004231CB |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004231CE |. 81E1 FF000000 |AND ECX,0FF
004231D4 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
004231D7 |. 33C0 |XOR EAX,EAX
004231D9 |. 8A440A 0D |MOV AL,BYTE PTR DS:[EDX+ECX+D]
004231DD |. 3D FF000000 |CMP EAX,0FF
004231E2 |. 0F84 52010000 |JE 0042333A
按顺序从497AF8+DH开始的74H*1个内存地址中读出战场编号，等于0FF即已经没有被攻击武将了，跳出这个循环。
004231E8 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
004231EB |. 81E1 FF000000 |AND ECX,0FF
004231F1 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
004231F4 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
004231F7 |. 8A4C08 0D |MOV CL,BYTE PTR DS:[EAX+ECX+D]
004231FB |. 884A 0C |MOV BYTE PTR DS:[EDX+C],CL
计数器数值+497AF8+DH输出来，存入497AF8+CH中，作为计算伤害的时候使用。
004231FE |. 6A 00 |PUSH 0
00423200 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423203 |. 8A02 |MOV AL,BYTE PTR DS:[EDX]
00423205 |. 50 |PUSH EAX
00423206 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423209 |. 33D2 |XOR EDX,EDX
0042320B |. 8A51 0C |MOV DL,BYTE PTR DS:[ECX+C]
0042320E |. 8BCA |MOV ECX,EDX
00423210 |. 6BC9 24 |IMUL ECX,ECX,24
00423213 |. 81C1 502C4B00 |ADD ECX,004B2C50
00423219 |. E8 52C40300 |CALL 0045F670
0042321E |. 6BC0 48 |IMUL EAX,EAX,48 ; |
00423221 |. 05 681B4A00 |ADD EAX,004A1B68 ; |
00423226 |. 50 |PUSH EAX ; |Arg2
00423227 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8] ; |
0042322A |. 33C9 |XOR ECX,ECX ; |
0042322C |. 8A48 0C |MOV CL,BYTE PTR DS:[EAX+C] ; |
0042322F |. 6BC9 24 |IMUL ECX,ECX,24 ; |
00423232 |. 81C1 502C4B00 |ADD ECX,004B2C50 ; |
00423238 |. 51 |PUSH ECX ; |Arg1
00423239 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8] ; |
0042323C |. 8B4A 08 |MOV ECX,DWORD PTR DS:[EDX+8] ; |
0042323F |. E8 668D0100 |CALL 0043BFAA ; \0043BFAA
43BFAA是策略伤害计算，重要，一共四个参数 + ECX=497AF8+8H的值 输入。其中14栈为0时才是实际计算伤害，为1时是平时鼠标移过去显示伤害用的；10栈是策略编号；0C栈是当前被攻击武将的DATA内存；08栈是当前被攻击武将的战场内存。输出的EAX为策略伤害，最低为1，为0的时候表示没有命中。
00423244 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
00423247 |. 81E1 FF000000 |AND ECX,0FF
0042324D |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423250 |. 89848A 8400000>|MOV DWORD PTR DS:[EDX+ECX*4+84],EAX
将伤害存入497AF8+计数器*4+84H的内存中。
00423257 |. 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4]
0042325A |. 25 FF000000 |AND EAX,0FF
0042325F |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423262 |. 83BC81 8400000>|CMP DWORD PTR DS:[ECX+EAX*4+84],0
0042326A |. 75 16 |JNZ SHORT 00423282
0042326C |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
0042326F |. 81E2 FF000000 |AND EDX,0FF
00423275 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423278 |. C68410 5502000>|MOV BYTE PTR DS:[EAX+EDX+255],0
00423280 |. EB 1C |JMP SHORT 0042329E
判断伤害值是否为0，为0就要将497AF8+计数器+255H的效果标识置为0，表示最后没有效果出现，即MISS。
00423282 |> 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
00423285 |. 81E1 FF000000 |AND ECX,0FF
0042328B |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
0042328E |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423291 |. 8A80 54020000 |MOV AL,BYTE PTR DS:[EAX+254]
00423297 |. 88840A 5502000>|MOV BYTE PTR DS:[EDX+ECX+255],AL
有伤害值，就要将497AF8+254H的策略效果标识存入到497AF8+计数器+255H里，让每一个被攻击武将都出现策略效果以及动画。谍报是50，其他是40。
0042329E |> 8A4D FC |MOV CL,BYTE PTR SS:[EBP-4]
004232A1 |. 51 |PUSH ECX ; /Arg1
004232A2 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
004232A5 |. E8 51DCFFFF |CALL 00420EFB ; \00420EFB
004232AA |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
004232AD |. 3B82 D0020000 |CMP EAX,DWORD PTR DS:[EDX+2D0]
004232B3 |. 76 11 |JBE SHORT 004232C6
004232B5 |. 8A45 FC |MOV AL,BYTE PTR SS:[EBP-4]
004232B8 |. 50 |PUSH EAX ; /Arg1
004232B9 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
004232BC |. E8 3ADCFFFF |CALL 00420EFB ; \00420EFB
004232C1 |. 8945 F4 |MOV DWORD PTR SS:[EBP-C],EAX
004232C4 |. EB 0C |JMP SHORT 004232D2
004232C6 |> 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004232C9 |. 8B91 D0020000 |MOV EDX,DWORD PTR DS:[ECX+2D0]
004232CF |. 8955 F4 |MOV DWORD PTR SS:[EBP-C],EDX
004232D2 |> 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
004232D5 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
004232D8 |. 8988 D0020000 |MOV DWORD PTR DS:[EAX+2D0],ECX
420EFB是武将使用策略所获得的个人经验，计数器作为参数和ECX=497AF8H输入，第一次出来的数值与497AF8+2D0H的内存中的数值进行比较，大于则存入497AF8+2D0H中，小于等于则将497AF8+2D0H的数值读出再重新存入（其实就是跳过）。
004232DE |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004232E1 |. E8 A5DFFFFF |CALL 0042128B
004232E6 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
004232E9 |. 3B82 D4020000 |CMP EAX,DWORD PTR DS:[EDX+2D4]
004232EF |. 76 0D |JBE SHORT 004232FE
004232F1 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004232F4 |. E8 92DFFFFF |CALL 0042128B
004232F9 |. 8945 F0 |MOV DWORD PTR SS:[EBP-10],EAX
004232FC |. EB 0C |JMP SHORT 0042330A
004232FE |> 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423301 |. 8B88 D4020000 |MOV ECX,DWORD PTR DS:[EAX+2D4]
00423307 |. 894D F0 |MOV DWORD PTR SS:[EBP-10],ECX
0042330A |> 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
0042330D |. 8B45 F0 |MOV EAX,DWORD PTR SS:[EBP-10]
00423310 |. 8982 D4020000 |MOV DWORD PTR DS:[EDX+2D4],EAX
42128B是使用策略所获得的武器经验，只要ECX=497AF8H输入即可，输出来的数值跟前面的个人经验相同的处理方式，存入到497AF8+2D4H中。
00423316 |. 8A4D FC |MOV CL,BYTE PTR SS:[EBP-4]
00423319 |. 51 |PUSH ECX ; /Arg1
0042331A |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
0042331D |. E8 81E0FFFF |CALL 004213A3 ; \004213A3
00423322 |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
00423325 |. 81E2 FF000000 |AND EDX,0FF
0042332B |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
0042332E |. 898491 D802000>|MOV DWORD PTR DS:[ECX+EDX*4+2D8],EAX
4213A3是被策略攻击的武将所获得的防具经验，计数器作为参数和ECX=497AF8输入，输出来的数值跟前面的个人经验相同的处理方式，存入到497AF8+计数器*4+2D8H中。
00423335 |.^E9 89FEFFFF \JMP 004231C3
跳回前面，将计数器+1再继续循环一次。
0042333A |> 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
0042333D |. E8 7DE1FFFF CALL 004214BF
动画处理，不分析了。
00423342 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
00423345 |. E8 5EF1FFFF CALL 004224A8
这条才是真真正正的策略效果，最后再分析。
0042334A |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
0042334D |. C782 AC040000 >MOV DWORD PTR DS:[EDX+4AC],1
将 497AF8+4ACH 赋值为1，结束武将行动。
00423357 |> 8BE5 MOV ESP,EBP
00423359 |. 5D POP EBP
0042335A \. C3 RETN
直接伤害是相当简单，也可以算是一个基础，其他的效果函数基本与这条相同。
[b][size=2]二、砂暴式全屏伤害[/size][/b]
0042572C |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0042572F |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],40
00425736 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425739 |. E8 FCEAFFFF CALL 0042423A
0042573E |. E9 53020000 JMP 00425996
砂暴式全屏伤害是从这里过来的
0042423A /$ 55 PUSH EBP
0042423B |. 8BEC MOV EBP,ESP
0042423D |. 83EC 18 SUB ESP,18
00424240 |. 56 PUSH ESI
00424241 |. 894D F4 MOV DWORD PTR SS:[EBP-C],ECX
00424244 |. C645 F8 00 MOV BYTE PTR SS:[EBP-8],0
00424248 |. C645 FC 00 MOV BYTE PTR SS:[EBP-4],0
0042424C |. EB 08 JMP SHORT 00424256
[EBP-4]是循环计数器，[EBP-8]是用来统计有多少敌人被攻击，这里一起先将BYTE位清零。
0042424E |> 8A45 FC /MOV AL,BYTE PTR SS:[EBP-4]
00424251 |. 04 01 |ADD AL,1
00424253 |. 8845 FC |MOV BYTE PTR SS:[EBP-4],AL
00424256 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424259 |. 81E1 FF000000 |AND ECX,0FF
0042425F |. 83F9 73 |CMP ECX,73
00424262 |. 0F8D 80000000 |JGE 004242E8
00424268 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
0042426B |. 81E1 FF000000 |AND ECX,0FF
00424271 |. 6BC9 24 |IMUL ECX,ECX,24
00424274 |. 81C1 502C4B00 |ADD ECX,004B2C50
0042427A |. E8 114AFFFF |CALL 00418C90
0042427F |. 25 FF000000 |AND EAX,0FF
00424284 |. 83F8 02 |CMP EAX,2
00424287 |. 75 5A |JNZ SHORT 004242E3
418C90是判断计数器当前的数值对应的战场编号的出场武将是否可见（未撤退，未隐藏），输出的EAX=2就是可见。
00424289 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
0042428C |. 81E1 FF000000 |AND ECX,0FF
00424292 |. 6BC9 24 |IMUL ECX,ECX,24
00424295 |. 81C1 502C4B00 |ADD ECX,004B2C50
0042429B |. E8 7024FEFF |CALL 00406710
004242A0 |. 8BF0 |MOV ESI,EAX
004242A2 |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C]
004242A5 |. 8B4A 08 |MOV ECX,DWORD PTR DS:[EDX+8]
004242A8 |. E8 6324FEFF |CALL 00406710
004242AD |. 3BF0 |CMP ESI,EAX
004242AF |. 74 32 |JE SHORT 004242E3
406710是武将在战场中属于哪一方，上面这部分代码是先读出计数器当前的数值对应的战场编号的出场武将属于哪一方，然后再读出使用策略的武将属于哪一方的数值，两者进行比较，相同表示为同属一阵营，跳到最后面再返回前面计数器+1再循环，不相同才继续执行代码。
004242B1 |. 8A45 FC |MOV AL,BYTE PTR SS:[EBP-4]
004242B4 |. 50 |PUSH EAX ; /Arg2
004242B5 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C] ; |
004242B8 |. 8A11 |MOV DL,BYTE PTR DS:[ECX] ; |
004242BA |. 52 |PUSH EDX ; |Arg1
004242BB |. E8 BAC6FFFF |CALL 0042097A ; \0042097A
004242C0 |. 83C4 08 |ADD ESP,8
004242C3 |. 85C0 |TEST EAX,EAX
004242C5 |. 75 02 |JNZ SHORT 004242C9
004242C7 |.^EB 85 |JMP SHORT 0042424E
42097A是前二十个策略（即四类策略）才用的，根据被攻击者所在地形是否当前策略是否可以在此地形中使用，输出的EAX为0则不可用，跳回计数器+1再继续循环。
004242C9 |> 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
004242CC |. 25 FF000000 |AND EAX,0FF
004242D1 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
004242D4 |. 8A55 FC |MOV DL,BYTE PTR SS:[EBP-4]
004242D7 |. 885401 0D |MOV BYTE PTR DS:[ECX+EAX+D],DL
将计数器当前数值存入到497AF8+当前可以攻击的敌人数量+0DH的内存中。
004242DB |. 8A45 F8 |MOV AL,BYTE PTR SS:[EBP-8]
004242DE |. 04 01 |ADD AL,1
004242E0 |. 8845 F8 |MOV BYTE PTR SS:[EBP-8],AL
004242E3 |>^E9 66FFFFFF \JMP 0042424E
当前可以攻击的敌人数量+1后，跳回计数器+1再继续循环。
当循环计数器>=73H的时候就跳到下面这里，因为一场战役中最多有74H个出场人物，从0到73H，上面一大段循环计算是要判断全部出场人物中有多少是可以攻击的相对敌人（所谓相对敌人就是指当我友军攻击的时候，敌军和援军就是敌人，当敌军和援军攻击的时候，我军和友军就是敌人）。
004242E8 |> 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
004242EB |. 81E1 FF000000 AND ECX,0FF
004242F1 |. 85C9 TEST ECX,ECX
004242F3 |. 0F85 81000000 JNZ 0042437A
可以攻击的敌人数量是否为0，不为0跳到后面。
004242F9 |. 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
004242FC |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
004242FF |. 8A48 01 MOV CL,BYTE PTR DS:[EAX+1]
00424302 |. 884A 0D MOV BYTE PTR DS:[EDX+D],CL
00424305 |. 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
00424308 |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
0042430B |. 8A48 0D MOV CL,BYTE PTR DS:[EAX+D]
0042430E |. 884A 0C MOV BYTE PTR DS:[EDX+C],CL
00424311 |. 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
00424314 |. C782 84000000 >MOV DWORD PTR DS:[EDX+84],0
0042431E |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00424321 |. 25 FF000000 AND EAX,0FF
00424326 |. 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
00424329 |. C68401 5502000>MOV BYTE PTR DS:[ECX+EAX+255],0
00424331 |. 6A 00 PUSH 0 ; /Arg1 = 00000000
00424333 |. 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C] ; |
00424336 |. E8 C0CBFFFF CALL 00420EFB ; \00420EFB
0042433B |. 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
0042433E |. 3B82 D0020000 CMP EAX,DWORD PTR DS:[EDX+2D0]
00424344 |. 76 0F JBE SHORT 00424355
00424346 |. 6A 00 PUSH 0 ; /Arg1 = 00000000
00424348 |. 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C] ; |
0042434B |. E8 ABCBFFFF CALL 00420EFB ; \00420EFB
00424350 |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
00424353 |. EB 0C JMP SHORT 00424361
00424355 |> 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
00424358 |. 8B88 D0020000 MOV ECX,DWORD PTR DS:[EAX+2D0]
0042435E |. 894D F0 MOV DWORD PTR SS:[EBP-10],ECX
00424361 |> 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
00424364 |. 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
00424367 |. 8982 D0020000 MOV DWORD PTR DS:[EDX+2D0],EAX
0042436D |. 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
00424370 |. E8 61D5FFFF CALL 004218D6
00424375 |. E9 7F010000 JMP 004244F9
上面这一大段是指没有可以被攻击的敌人，因此将使用策略武将的战场编号分别存入497AF8+0CH和497AF8+0DH中，然后497AF8+84H和+255H的伤害值和效果标识都置0，相当于没有命中策略，接着计算个人经验的获得，最后再一个动画处理，跳到最后面结束，返回后结束武将行动（因为砂暴一点击使用就马上执行，所以就算没有敌人被攻击，一样会结束武将行动）。
0042437A |> C645 FC 00 MOV BYTE PTR SS:[EBP-4],0
0042437E |. EB 09 JMP SHORT 00424389
再次清空[EBP-4]的BYTE位，用作另外一个计数器使用。
00424380 |> 8A4D FC /MOV CL,BYTE PTR SS:[EBP-4]
00424383 |. 80C1 01 |ADD CL,1
00424386 |. 884D FC |MOV BYTE PTR SS:[EBP-4],CL
00424389 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
0042438C |. 81E2 FF000000 |AND EDX,0FF
00424392 |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
00424395 |. 33C9 |XOR ECX,ECX
00424397 |. 8A4C10 0D |MOV CL,BYTE PTR DS:[EAX+EDX+D]
0042439B |. 81F9 FF000000 |CMP ECX,0FF
004243A1 |. 0F84 4A010000 |JE 004244F1
004243A7 |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
004243AA |. 81E2 FF000000 |AND EDX,0FF
004243B0 |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
004243B3 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
004243B6 |. 8A5411 0D |MOV DL,BYTE PTR DS:[ECX+EDX+D]
004243BA |. 8850 0C |MOV BYTE PTR DS:[EAX+C],DL
004243BD |. 6A 00 |PUSH 0
004243BF |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
004243C2 |. 8A08 |MOV CL,BYTE PTR DS:[EAX]
004243C4 |. 51 |PUSH ECX
004243C5 |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C]
004243C8 |. 33C0 |XOR EAX,EAX
004243CA |. 8A42 0C |MOV AL,BYTE PTR DS:[EDX+C]
004243CD |. 8BC8 |MOV ECX,EAX
004243CF |. 6BC9 24 |IMUL ECX,ECX,24
004243D2 |. 81C1 502C4B00 |ADD ECX,004B2C50
004243D8 |. E8 93B20300 |CALL 0045F670
004243DD |. 6BC0 48 |IMUL EAX,EAX,48 ; |
004243E0 |. 05 681B4A00 |ADD EAX,004A1B68 ; |
004243E5 |. 50 |PUSH EAX ; |Arg2
004243E6 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C] ; |
004243E9 |. 33D2 |XOR EDX,EDX ; |
004243EB |. 8A51 0C |MOV DL,BYTE PTR DS:[ECX+C] ; |
004243EE |. 6BD2 24 |IMUL EDX,EDX,24 ; |
004243F1 |. 81C2 502C4B00 |ADD EDX,004B2C50 ; |
004243F7 |. 52 |PUSH EDX ; |Arg1
004243F8 |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C] ; |
004243FB |. 8B48 08 |MOV ECX,DWORD PTR DS:[EAX+8] ; |
004243FE |. E8 A77B0100 |CALL 0043BFAA ; \0043BFAA
00424403 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
00424406 |. 81E1 FF000000 |AND ECX,0FF
0042440C |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C]
0042440F |. 89848A 8400000>|MOV DWORD PTR DS:[EDX+ECX*4+84],EAX
00424416 |. 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4]
00424419 |. 25 FF000000 |AND EAX,0FF
0042441E |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
00424421 |. 83BC81 8400000>|CMP DWORD PTR DS:[ECX+EAX*4+84],0
00424429 |. 75 16 |JNZ SHORT 00424441
0042442B |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
0042442E |. 81E2 FF000000 |AND EDX,0FF
00424434 |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
00424437 |. C68410 5502000>|MOV BYTE PTR DS:[EAX+EDX+255],0
0042443F |. EB 14 |JMP SHORT 00424455
00424441 |> 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
00424444 |. 81E1 FF000000 |AND ECX,0FF
0042444A |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C]
0042444D |. C6840A 5502000>|MOV BYTE PTR DS:[EDX+ECX+255],40
00424455 |> 8A45 FC |MOV AL,BYTE PTR SS:[EBP-4]
00424458 |. 50 |PUSH EAX ; /Arg1
00424459 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C] ; |
0042445C |. E8 9ACAFFFF |CALL 00420EFB ; \00420EFB
00424461 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
00424464 |. 3B81 D0020000 |CMP EAX,DWORD PTR DS:[ECX+2D0]
0042446A |. 76 11 |JBE SHORT 0042447D
0042446C |. 8A55 FC |MOV DL,BYTE PTR SS:[EBP-4]
0042446F |. 52 |PUSH EDX ; /Arg1
00424470 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C] ; |
00424473 |. E8 83CAFFFF |CALL 00420EFB ; \00420EFB
00424478 |. 8945 EC |MOV DWORD PTR SS:[EBP-14],EAX
0042447B |. EB 0C |JMP SHORT 00424489
0042447D |> 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
00424480 |. 8B88 D0020000 |MOV ECX,DWORD PTR DS:[EAX+2D0]
00424486 |. 894D EC |MOV DWORD PTR SS:[EBP-14],ECX
00424489 |> 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C]
0042448C |. 8B45 EC |MOV EAX,DWORD PTR SS:[EBP-14]
0042448F |. 8982 D0020000 |MOV DWORD PTR DS:[EDX+2D0],EAX
00424495 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
00424498 |. E8 EECDFFFF |CALL 0042128B
0042449D |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
004244A0 |. 3B81 D4020000 |CMP EAX,DWORD PTR DS:[ECX+2D4]
004244A6 |. 76 0D |JBE SHORT 004244B5
004244A8 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
004244AB |. E8 DBCDFFFF |CALL 0042128B
004244B0 |. 8945 E8 |MOV DWORD PTR SS:[EBP-18],EAX
004244B3 |. EB 0C |JMP SHORT 004244C1
004244B5 |> 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C]
004244B8 |. 8B82 D4020000 |MOV EAX,DWORD PTR DS:[EDX+2D4]
004244BE |. 8945 E8 |MOV DWORD PTR SS:[EBP-18],EAX
004244C1 |> 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
004244C4 |. 8B55 E8 |MOV EDX,DWORD PTR SS:[EBP-18]
004244C7 |. 8991 D4020000 |MOV DWORD PTR DS:[ECX+2D4],EDX
004244CD |. 8A45 FC |MOV AL,BYTE PTR SS:[EBP-4]
004244D0 |. 50 |PUSH EAX ; /Arg1
004244D1 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C] ; |
004244D4 |. E8 CACEFFFF |CALL 004213A3 ; \004213A3
004244D9 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
004244DC |. 81E1 FF000000 |AND ECX,0FF
004244E2 |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C]
004244E5 |. 89848A D802000>|MOV DWORD PTR DS:[EDX+ECX*4+2D8],EAX
004244EC |.^E9 8FFEFFFF \JMP 00424380
004244F1 |> 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
004244F4 |. E8 C6CFFFFF CALL 004214BF
004244F9 |> 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
004244FC |. E8 A7DFFFFF CALL 004224A8
00424501 |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
00424504 |. C780 AC040000 >MOV DWORD PTR DS:[EAX+4AC],1
0042450E |. 5E POP ESI
0042450F |. 8BE5 MOV ESP,EBP
00424511 |. 5D POP EBP
00424512 \. C3 RETN
后面这一段跟直接伤害42313E的是一样的，所以就不作注解了。
[b][size=2]三、异常状态类，包括产生异常状态和取消异常状态[/size][/b]
004257A7 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
004257AA |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],70
004257B1 |. 6A 00 PUSH 0
004257B3 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004257B6 |. E8 8EDDFFFF CALL 00423549
004257BB |. E9 D6010000 JMP 00425996
004257C0 |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004257C3 |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],71
004257CA |. 6A 00 PUSH 0
004257CC |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004257CF |. E8 75DDFFFF CALL 00423549
004257D4 |. E9 BD010000 JMP 00425996
004257D9 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004257DC |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],72
004257E3 |. 6A 00 PUSH 0
004257E5 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004257E8 |. E8 5CDDFFFF CALL 00423549
004257ED |. E9 A4010000 JMP 00425996
004257F2 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
004257F5 |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],74
004257FC |. 6A 00 PUSH 0
004257FE |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425801 |. E8 43DDFFFF CALL 00423549
00425806 |. E9 8B010000 JMP 00425996
004258B6 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004258B9 |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],0BF
004258C0 |. 6A 01 PUSH 1
004258C2 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004258C5 |. E8 7FDCFFFF CALL 00423549
004258CA |. E9 C7000000 JMP 00425996
异常状态类从上面五个位置过来，由于有产生（对敌方）和取消（对己方）效果，所以要加上一个参数作为区分，08栈中0为产生（对敌方），1为取消（对己方）。
00423549 /$ 55 PUSH EBP
0042354A |. 8BEC MOV EBP,ESP
0042354C |. 83EC 10 SUB ESP,10
0042354F |. 894D F8 MOV DWORD PTR SS:[EBP-8],ECX
00423552 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
00423555 |. 8A08 MOV CL,BYTE PTR DS:[EAX]
00423557 |. 51 PUSH ECX ; /Arg4
00423558 |. 33D2 XOR EDX,EDX ; |
0042355A |. 837D 08 00 CMP DWORD PTR SS:[EBP+8],0 ; |
0042355E |. 0F95C2 SETNE DL ; |
00423561 |. 83C2 02 ADD EDX,2 ; |
00423564 |. 52 PUSH EDX ; |Arg3
00423565 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; |
00423568 |. 8A88 C9020000 MOV CL,BYTE PTR DS:[EAX+2C9] ; |
0042356E |. 51 PUSH ECX ; |Arg2
0042356F |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] ; |
00423572 |. 8A42 01 MOV AL,BYTE PTR DS:[EDX+1] ; |
00423575 |. 50 PUSH EAX ; |Arg1
00423576 |. B9 50424B00 MOV ECX,004B4250 ; |
0042357B |. E8 BD1D0300 CALL 0045533D ; \0045533D
跟直接伤害类一样，45533D确定被策略攻击的目标武将，其中根据08栈的数值决定目标对象是否敌方或己方。
00423580 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
00423583 |. 8841 0C MOV BYTE PTR DS:[ECX+C],AL
45533D输出的AL值存入497AF8+0CH中
00423586 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
00423589 |. 33C0 XOR EAX,EAX
0042358B |. 8A42 0C MOV AL,BYTE PTR DS:[EDX+C]
0042358E |. 3D FF000000 CMP EAX,0FF
00423593 |. 75 05 JNZ SHORT 0042359A
00423595 |. E9 ED010000 JMP 00423787
检查一下497AF8+CH是否为0FF，即有没有攻击目标，0FF就是没有，跳到最后返回。
0042359A |> 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
0042359D |. 8B91 A8040000 MOV EDX,DWORD PTR DS:[ECX+4A8]
004235A3 |. 52 PUSH EDX ; /Arg4
004235A4 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; |
004235A7 |. 8A48 0C MOV CL,BYTE PTR DS:[EAX+C] ; |
004235AA |. 51 PUSH ECX ; |Arg3
004235AB |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] ; |
004235AE |. 8A42 01 MOV AL,BYTE PTR DS:[EDX+1] ; |
004235B1 |. 50 PUSH EAX ; |Arg2
004235B2 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
004235B5 |. 8A11 MOV DL,BYTE PTR DS:[ECX] ; |
004235B7 |. 52 PUSH EDX ; |Arg1
004235B8 |. E8 65CEFFFF CALL 00420422 ; \00420422
004235BD |. 83C4 10 ADD ESP,10
004235C0 |. 85C0 TEST EAX,EAX
004235C2 |. 75 05 JNZ SHORT 004235C9
004235C4 |. E9 BE010000 JMP 00423787
420422（一共四个参数输入）是第二个策略限制，包括地形、使用的对象（例如回归不能指向使用策略的武将）。输出的EAX为零表示不可使用，跳到最后返回。
004235C9 |> 33C0 XOR EAX,EAX
004235CB |. 837D 08 00 CMP DWORD PTR SS:[EBP+8],0
004235CF |. 0F95C0 SETNE AL
004235D2 |. 50 PUSH EAX ; /Arg1
004235D3 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
004235D6 |. E8 6E1D0000 CALL 00425349 ; \00425349
425349是根据穿透范围将全部被攻击武将的战场编号按顺序存入497AF8+DH开始的74H*1个内存中，同样根据08栈的数值决定目标对象是否敌方或己方。
004235DB |. C645 FC 00 MOV BYTE PTR SS:[EBP-4],0
004235DF |. EB 09 JMP SHORT 004235EA
[EBP-4]是循环计数器，这里先将BYTE位清零。（如果是我就将整个DWORD清零，下面会省好多字节）
004235E1 |> 8A4D FC /MOV CL,BYTE PTR SS:[EBP-4]
004235E4 |. 80C1 01 |ADD CL,1
004235E7 |. 884D FC |MOV BYTE PTR SS:[EBP-4],CL
004235EA |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
004235ED |. 81E2 FF000000 |AND EDX,0FF
004235F3 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
004235F6 |. 33C9 |XOR ECX,ECX
004235F8 |. 8A4C10 0D |MOV CL,BYTE PTR DS:[EAX+EDX+D]
004235FC |. 81F9 FF000000 |CMP ECX,0FF
00423602 |. 0F84 62010000 |JE 0042376A
按顺序从497AF8+DH开始的74H*1个内存地址中读出战场编号，等于0FF即已经没有被攻击武将了，跳出这个循环。
00423608 |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
0042360B |. 81E2 FF000000 |AND EDX,0FF
00423611 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423614 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423617 |. 8A5411 0D |MOV DL,BYTE PTR DS:[ECX+EDX+D]
0042361B |. 8850 0C |MOV BYTE PTR DS:[EAX+C],DL
计数器数值+497AF8+DH输出来，存入497AF8+CH中，作为是否产生或取消异常状态以及计算伤害的时候使用。
0042361E |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423621 |. 8A08 |MOV CL,BYTE PTR DS:[EAX]
00423623 |. 51 |PUSH ECX ; /Arg3
00423624 |. 6A 02 |PUSH 2 ; |Arg2 = 00000002
00423626 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8] ; |
00423629 |. 33C0 |XOR EAX,EAX ; |
0042362B |. 8A42 0C |MOV AL,BYTE PTR DS:[EDX+C] ; |
0042362E |. 6BC0 24 |IMUL EAX,EAX,24 ; |
00423631 |. 05 502C4B00 |ADD EAX,004B2C50 ; |
00423636 |. 50 |PUSH EAX ; |Arg1
00423637 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
0042363A |. 8B49 08 |MOV ECX,DWORD PTR DS:[ECX+8] ; |
0042363D |. E8 6E7E0100 |CALL 0043B4B0 ; \0043B4B0
00423642 |. 85C0 |TEST EAX,EAX
00423644 |. 74 1E |JE SHORT 00423664
43B4B0是先计算出策略命中率，再判断是否有发生此概率，输出EAX=0则没有发生。
00423646 |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
00423649 |. 81E2 FF000000 |AND EDX,0FF
0042364F |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423652 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423655 |. 8A89 54020000 |MOV CL,BYTE PTR DS:[ECX+254]
0042365B |. 888C10 5502000>|MOV BYTE PTR DS:[EAX+EDX+255],CL
00423662 |. EB 14 |JMP SHORT 00423678
策略命中了，根据对应的策略效果将497AF8+254H的效果标识存入到497AF8+计数器+255H里，让每一个被攻击武将都出现策略效果以及动画。
00423664 |> 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
00423667 |. 81E2 FF000000 |AND EDX,0FF
0042366D |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423670 |. C68410 5502000>|MOV BYTE PTR DS:[EAX+EDX+255],0
策略没有命中，所以效果标识置0。
以上只是是否产生和取消异常状态，但有中毒和麻痹会附加产生伤害，所以下面接下来还要继续计算策略伤害。
00423678 |> 6A 00 |PUSH 0
0042367A |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
0042367D |. 8A11 |MOV DL,BYTE PTR DS:[ECX]
0042367F |. 52 |PUSH EDX
00423680 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423683 |. 33C9 |XOR ECX,ECX
00423685 |. 8A48 0C |MOV CL,BYTE PTR DS:[EAX+C]
00423688 |. 6BC9 24 |IMUL ECX,ECX,24
0042368B |. 81C1 502C4B00 |ADD ECX,004B2C50
00423691 |. E8 DABF0300 |CALL 0045F670
00423696 |. 6BC0 48 |IMUL EAX,EAX,48 ; |
00423699 |. 05 681B4A00 |ADD EAX,004A1B68 ; |
0042369E |. 50 |PUSH EAX ; |Arg2
0042369F |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8] ; |
004236A2 |. 33C0 |XOR EAX,EAX ; |
004236A4 |. 8A42 0C |MOV AL,BYTE PTR DS:[EDX+C] ; |
004236A7 |. 6BC0 24 |IMUL EAX,EAX,24 ; |
004236AA |. 05 502C4B00 |ADD EAX,004B2C50 ; |
004236AF |. 50 |PUSH EAX ; |Arg1
004236B0 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
004236B3 |. 8B49 08 |MOV ECX,DWORD PTR DS:[ECX+8] ; |
004236B6 |. E8 EF880100 |CALL 0043BFAA ; \0043BFAA
计算策略伤害
004236BB |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
004236BE |. 81E2 FF000000 |AND EDX,0FF
004236C4 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004236C7 |. 898491 8400000>|MOV DWORD PTR DS:[ECX+EDX*4+84],EAX
伤害值存入+84H中，不用再判断是否命中了。
004236CE |. 8A55 FC |MOV DL,BYTE PTR SS:[EBP-4]
004236D1 |. 52 |PUSH EDX ; /Arg1
004236D2 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
004236D5 |. E8 21D8FFFF |CALL 00420EFB ; \00420EFB
004236DA |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004236DD |. 3B81 D0020000 |CMP EAX,DWORD PTR DS:[ECX+2D0]
004236E3 |. 76 11 |JBE SHORT 004236F6
004236E5 |. 8A55 FC |MOV DL,BYTE PTR SS:[EBP-4]
004236E8 |. 52 |PUSH EDX ; /Arg1
004236E9 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
004236EC |. E8 0AD8FFFF |CALL 00420EFB ; \00420EFB
004236F1 |. 8945 F4 |MOV DWORD PTR SS:[EBP-C],EAX
004236F4 |. EB 0C |JMP SHORT 00423702
004236F6 |> 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
004236F9 |. 8B88 D0020000 |MOV ECX,DWORD PTR DS:[EAX+2D0]
004236FF |. 894D F4 |MOV DWORD PTR SS:[EBP-C],ECX
00423702 |> 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423705 |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
00423708 |. 8982 D0020000 |MOV DWORD PTR DS:[EDX+2D0],EAX
0042370E |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423711 |. E8 75DBFFFF |CALL 0042128B
00423716 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423719 |. 3B81 D4020000 |CMP EAX,DWORD PTR DS:[ECX+2D4]
0042371F |. 76 0D |JBE SHORT 0042372E
00423721 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423724 |. E8 62DBFFFF |CALL 0042128B
00423729 |. 8945 F0 |MOV DWORD PTR SS:[EBP-10],EAX
0042372C |. EB 0C |JMP SHORT 0042373A
0042372E |> 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423731 |. 8B82 D4020000 |MOV EAX,DWORD PTR DS:[EDX+2D4]
00423737 |. 8945 F0 |MOV DWORD PTR SS:[EBP-10],EAX
0042373A |> 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
0042373D |. 8B55 F0 |MOV EDX,DWORD PTR SS:[EBP-10]
00423740 |. 8991 D4020000 |MOV DWORD PTR DS:[ECX+2D4],EDX
00423746 |. 8A45 FC |MOV AL,BYTE PTR SS:[EBP-4]
00423749 |. 50 |PUSH EAX ; /Arg1
0042374A |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
0042374D |. E8 51DCFFFF |CALL 004213A3 ; \004213A3
00423752 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
00423755 |. 81E1 FF000000 |AND ECX,0FF
0042375B |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
0042375E |. 89848A D802000>|MOV DWORD PTR DS:[EDX+ECX*4+2D8],EAX
00423765 |.^E9 77FEFFFF \JMP 004235E1
0042376A |> 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
0042376D |. E8 4DDDFFFF CALL 004214BF
00423772 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
00423775 |. E8 2EEDFFFF CALL 004224A8
0042377A |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
0042377D |. C780 AC040000 >MOV DWORD PTR DS:[EAX+4AC],1
00423787 |> 8BE5 MOV ESP,EBP
00423789 |. 5D POP EBP
0042378A \. C2 0400 RETN 4
后面的计算经验，动画处理，真正效果就不用说了。
[b][size=2]四、上升下降类（非气合霸气）[/size][/b]
00425743 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425746 |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],62
0042574D |. 6A 00 PUSH 0
0042574F |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425752 |. E8 04DCFFFF CALL 0042335B
00425757 |. E9 3A020000 JMP 00425996
0042575C |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
0042575F |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],64
00425766 |. 6A 00 PUSH 0
00425768 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042576B |. E8 EBDBFFFF CALL 0042335B
00425770 |. E9 21020000 JMP 00425996
00425775 |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00425778 |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],60
0042577F |. 6A 00 PUSH 0
00425781 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425784 |. E8 D2DBFFFF CALL 0042335B
00425789 |. E9 08020000 JMP 00425996
0042578E |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425791 |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],61
00425798 |. 6A 00 PUSH 0
0042579A |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042579D |. E8 B9DBFFFF CALL 0042335B
004257A2 |. E9 EF010000 JMP 00425996
00425839 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
0042583C |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],0A8
00425843 |. 6A 01 PUSH 1
00425845 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425848 |. E8 0EDBFFFF CALL 0042335B
0042584D |. E9 44010000 JMP 00425996
00425852 |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00425855 |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],0A2
0042585C |. 6A 01 PUSH 1
0042585E |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425861 |. E8 F5DAFFFF CALL 0042335B
00425866 |. E9 2B010000 JMP 00425996
0042586B |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042586E |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],0A4
00425875 |. 6A 01 PUSH 1
00425877 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042587A |. E8 DCDAFFFF CALL 0042335B
0042587F |. E9 12010000 JMP 00425996
00425884 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00425887 |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],0A0
0042588E |. 6A 01 PUSH 1
00425890 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425893 |. E8 C3DAFFFF CALL 0042335B
00425898 |. E9 F9000000 JMP 00425996
0042589D |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004258A0 |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],0A1
004258A7 |. 6A 01 PUSH 1
004258A9 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004258AC |. E8 AADAFFFF CALL 0042335B
004258B1 |. E9 E0000000 JMP 00425996
非气合霸气的上升下降类从上面九个位置过来，由于有下降（对敌方）和上升（对己方）效果，所以要加上一个参数作为区分，08栈中0为下降（对敌方），1为上升（对己方）。
0042335B /$ 55 PUSH EBP
0042335C |. 8BEC MOV EBP,ESP
0042335E |. 83EC 10 SUB ESP,10
00423361 |. 894D F8 MOV DWORD PTR SS:[EBP-8],ECX
00423364 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
00423367 |. 8A08 MOV CL,BYTE PTR DS:[EAX]
00423369 |. 51 PUSH ECX ; /Arg4
0042336A |. 33D2 XOR EDX,EDX ; |
0042336C |. 837D 08 00 CMP DWORD PTR SS:[EBP+8],0 ; |
00423370 |. 0F95C2 SETNE DL ; |
00423373 |. 83C2 02 ADD EDX,2 ; |
00423376 |. 52 PUSH EDX ; |Arg3
00423377 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; |
0042337A |. 8A88 C9020000 MOV CL,BYTE PTR DS:[EAX+2C9] ; |
00423380 |. 51 PUSH ECX ; |Arg2
00423381 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] ; |
00423384 |. 8A42 01 MOV AL,BYTE PTR DS:[EDX+1] ; |
00423387 |. 50 PUSH EAX ; |Arg1
00423388 |. B9 50424B00 MOV ECX,004B4250 ; |
0042338D |. E8 AB1F0300 CALL 0045533D ; \0045533D
00423392 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
00423395 |. 8841 0C MOV BYTE PTR DS:[ECX+C],AL
00423398 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
0042339B |. 33C0 XOR EAX,EAX
0042339D |. 8A42 0C MOV AL,BYTE PTR DS:[EDX+C]
004233A0 |. 3D FF000000 CMP EAX,0FF
004233A5 |. 75 05 JNZ SHORT 004233AC
004233A7 |. E9 97010000 JMP 00423543
004233AC |> 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
004233AF |. 8B91 A8040000 MOV EDX,DWORD PTR DS:[ECX+4A8]
004233B5 |. 52 PUSH EDX ; /Arg4
004233B6 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; |
004233B9 |. 8A48 0C MOV CL,BYTE PTR DS:[EAX+C] ; |
004233BC |. 51 PUSH ECX ; |Arg3
004233BD |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] ; |
004233C0 |. 8A42 01 MOV AL,BYTE PTR DS:[EDX+1] ; |
004233C3 |. 50 PUSH EAX ; |Arg2
004233C4 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
004233C7 |. 8A11 MOV DL,BYTE PTR DS:[ECX] ; |
004233C9 |. 52 PUSH EDX ; |Arg1
004233CA |. E8 53D0FFFF CALL 00420422 ; \00420422
004233CF |. 83C4 10 ADD ESP,10
004233D2 |. 85C0 TEST EAX,EAX
004233D4 |. 75 05 JNZ SHORT 004233DB
004233D6 |. E9 68010000 JMP 00423543
004233DB |> 33C0 XOR EAX,EAX
004233DD |. 837D 08 00 CMP DWORD PTR SS:[EBP+8],0
004233E1 |. 0F95C0 SETNE AL
004233E4 |. 50 PUSH EAX ; /Arg1
004233E5 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
004233E8 |. E8 5C1F0000 CALL 00425349 ; \00425349
004233ED |. C645 FC 00 MOV BYTE PTR SS:[EBP-4],0
004233F1 |. EB 09 JMP SHORT 004233FC
004233F3 |> 8A4D FC /MOV CL,BYTE PTR SS:[EBP-4]
004233F6 |. 80C1 01 |ADD CL,1
004233F9 |. 884D FC |MOV BYTE PTR SS:[EBP-4],CL
004233FC |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
004233FF |. 81E2 FF000000 |AND EDX,0FF
00423405 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423408 |. 33C9 |XOR ECX,ECX
0042340A |. 8A4C10 0D |MOV CL,BYTE PTR DS:[EAX+EDX+D]
0042340E |. 81F9 FF000000 |CMP ECX,0FF
00423414 |. 0F84 0C010000 |JE 00423526
0042341A |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
0042341D |. 81E2 FF000000 |AND EDX,0FF
00423423 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423426 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423429 |. 8A5411 0D |MOV DL,BYTE PTR DS:[ECX+EDX+D]
0042342D |. 8850 0C |MOV BYTE PTR DS:[EAX+C],DL
00423430 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423433 |. 8A08 |MOV CL,BYTE PTR DS:[EAX]
00423435 |. 51 |PUSH ECX ; /Arg3
00423436 |. 6A 02 |PUSH 2 ; |Arg2 = 00000002
00423438 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8] ; |
0042343B |. 33C0 |XOR EAX,EAX ; |
0042343D |. 8A42 0C |MOV AL,BYTE PTR DS:[EDX+C] ; |
00423440 |. 6BC0 24 |IMUL EAX,EAX,24 ; |
00423443 |. 05 502C4B00 |ADD EAX,004B2C50 ; |
00423448 |. 50 |PUSH EAX ; |Arg1
00423449 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
0042344C |. 8B49 08 |MOV ECX,DWORD PTR DS:[ECX+8] ; |
0042344F |. E8 5C800100 |CALL 0043B4B0 ; \0043B4B0
00423454 |. 85C0 |TEST EAX,EAX
00423456 |. 74 1E |JE SHORT 00423476
00423458 |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
0042345B |. 81E2 FF000000 |AND EDX,0FF
00423461 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423464 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423467 |. 8A89 54020000 |MOV CL,BYTE PTR DS:[ECX+254]
0042346D |. 888C10 5502000>|MOV BYTE PTR DS:[EAX+EDX+255],CL
00423474 |. EB 14 |JMP SHORT 0042348A
00423476 |> 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
00423479 |. 81E2 FF000000 |AND EDX,0FF
0042347F |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423482 |. C68410 5502000>|MOV BYTE PTR DS:[EAX+EDX+255],0
0042348A |> 8A4D FC |MOV CL,BYTE PTR SS:[EBP-4]
0042348D |. 51 |PUSH ECX ; /Arg1
0042348E |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
00423491 |. E8 65DAFFFF |CALL 00420EFB ; \00420EFB
00423496 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423499 |. 3B82 D0020000 |CMP EAX,DWORD PTR DS:[EDX+2D0]
0042349F |. 76 11 |JBE SHORT 004234B2
004234A1 |. 8A45 FC |MOV AL,BYTE PTR SS:[EBP-4]
004234A4 |. 50 |PUSH EAX ; /Arg1
004234A5 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
004234A8 |. E8 4EDAFFFF |CALL 00420EFB ; \00420EFB
004234AD |. 8945 F4 |MOV DWORD PTR SS:[EBP-C],EAX
004234B0 |. EB 0C |JMP SHORT 004234BE
004234B2 |> 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004234B5 |. 8B91 D0020000 |MOV EDX,DWORD PTR DS:[ECX+2D0]
004234BB |. 8955 F4 |MOV DWORD PTR SS:[EBP-C],EDX
004234BE |> 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
004234C1 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
004234C4 |. 8988 D0020000 |MOV DWORD PTR DS:[EAX+2D0],ECX
004234CA |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004234CD |. E8 B9DDFFFF |CALL 0042128B
004234D2 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
004234D5 |. 3B82 D4020000 |CMP EAX,DWORD PTR DS:[EDX+2D4]
004234DB |. 76 0D |JBE SHORT 004234EA
004234DD |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004234E0 |. E8 A6DDFFFF |CALL 0042128B
004234E5 |. 8945 F0 |MOV DWORD PTR SS:[EBP-10],EAX
004234E8 |. EB 0C |JMP SHORT 004234F6
004234EA |> 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
004234ED |. 8B88 D4020000 |MOV ECX,DWORD PTR DS:[EAX+2D4]
004234F3 |. 894D F0 |MOV DWORD PTR SS:[EBP-10],ECX
004234F6 |> 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
004234F9 |. 8B45 F0 |MOV EAX,DWORD PTR SS:[EBP-10]
004234FC |. 8982 D4020000 |MOV DWORD PTR DS:[EDX+2D4],EAX
00423502 |. 8A4D FC |MOV CL,BYTE PTR SS:[EBP-4]
00423505 |. 51 |PUSH ECX ; /Arg1
00423506 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
00423509 |. E8 95DEFFFF |CALL 004213A3 ; \004213A3
0042350E |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
00423511 |. 81E2 FF000000 |AND EDX,0FF
00423517 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
0042351A |. 898491 D802000>|MOV DWORD PTR DS:[ECX+EDX*4+2D8],EAX
00423521 |.^E9 CDFEFFFF \JMP 004233F3
00423526 |> 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
00423529 |. E8 91DFFFFF CALL 004214BF
0042352E |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
00423531 |. E8 72EFFFFF CALL 004224A8
00423536 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
00423539 |. C782 AC040000 >MOV DWORD PTR DS:[EDX+4AC],1
00423543 |> 8BE5 MOV ESP,EBP
00423545 |. 5D POP EBP
00423546 \. C2 0400 RETN 4
非气合霸气的上升下降类跟异常状态类的代码是基本一样的，只是少了计算伤害部分，也就是说下降类策略是永远不会对敌人产生伤害。[/font]
[color=Silver][[i] 本帖最后由 godtype 于 2010-4-12 10:50 编辑 [/i]][/color]
2010-3-26 22:06
godtype
[font=宋体][b][size=2]五、恢复HP和MP类[/size][/b]
0042580B |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0042580E |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],80
00425815 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425818 |. E8 70DFFFFF CALL 0042378D
0042581D |. E9 74010000 JMP 00425996
恢复HP从这里过来
00425822 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425825 |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],90
0042582C |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042582F |. E8 59DFFFFF CALL 0042378D
00425834 |. E9 5D010000 JMP 00425996
恢复MP从这里过来
0042378D /$ 55 PUSH EBP
0042378E |. 8BEC MOV EBP,ESP
00423790 |. 83EC 10 SUB ESP,10
00423793 |. 894D F8 MOV DWORD PTR SS:[EBP-8],ECX
00423796 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
00423799 |. 8A08 MOV CL,BYTE PTR DS:[EAX]
0042379B |. 51 PUSH ECX ; /Arg4
0042379C |. 6A 03 PUSH 3 ; |Arg3 = 00000003
0042379E |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] ; |
004237A1 |. 8A82 C9020000 MOV AL,BYTE PTR DS:[EDX+2C9] ; |
004237A7 |. 50 PUSH EAX ; |Arg2
004237A8 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
004237AB |. 8A51 01 MOV DL,BYTE PTR DS:[ECX+1] ; |
004237AE |. 52 PUSH EDX ; |Arg1
004237AF |. B9 50424B00 MOV ECX,004B4250 ; |
004237B4 |. E8 841B0300 CALL 0045533D ; \0045533D
45533D的第三个参数是03，表示对己方有效。
004237B9 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
004237BC |. 8841 0C MOV BYTE PTR DS:[ECX+C],AL
004237BF |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
004237C2 |. 33C0 XOR EAX,EAX
004237C4 |. 8A42 0C MOV AL,BYTE PTR DS:[EDX+C]
004237C7 |. 3D FF000000 CMP EAX,0FF
004237CC |. 75 05 JNZ SHORT 004237D3
004237CE |. E9 89010000 JMP 0042395C
004237D3 |> 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
004237D6 |. 8B91 A8040000 MOV EDX,DWORD PTR DS:[ECX+4A8]
004237DC |. 52 PUSH EDX ; /Arg4
004237DD |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; |
004237E0 |. 8A48 0C MOV CL,BYTE PTR DS:[EAX+C] ; |
004237E3 |. 51 PUSH ECX ; |Arg3
004237E4 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] ; |
004237E7 |. 8A42 01 MOV AL,BYTE PTR DS:[EDX+1] ; |
004237EA |. 50 PUSH EAX ; |Arg2
004237EB |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
004237EE |. 8A11 MOV DL,BYTE PTR DS:[ECX] ; |
004237F0 |. 52 PUSH EDX ; |Arg1
004237F1 |. E8 2CCCFFFF CALL 00420422 ; \00420422
004237F6 |. 83C4 10 ADD ESP,10
004237F9 |. 85C0 TEST EAX,EAX
004237FB |. 75 05 JNZ SHORT 00423802
004237FD |. E9 5A010000 JMP 0042395C
00423802 |> 6A 01 PUSH 1 ; /Arg1 = 00000001
00423804 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
00423807 |. E8 3D1B0000 CALL 00425349 ; \00425349
0042380C |. C645 FC 00 MOV BYTE PTR SS:[EBP-4],0
00423810 |. EB 08 JMP SHORT 0042381A
00423812 |> 8A45 FC /MOV AL,BYTE PTR SS:[EBP-4]
00423815 |. 04 01 |ADD AL,1
00423817 |. 8845 FC |MOV BYTE PTR SS:[EBP-4],AL
0042381A |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042381D |. 81E1 FF000000 |AND ECX,0FF
00423823 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423826 |. 33C0 |XOR EAX,EAX
00423828 |. 8A440A 0D |MOV AL,BYTE PTR DS:[EDX+ECX+D]
0042382C |. 3D FF000000 |CMP EAX,0FF
00423831 |. 0F84 08010000 |JE 0042393F
00423837 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
0042383A |. 81E1 FF000000 |AND ECX,0FF
00423840 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423843 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423846 |. 8A4C08 0D |MOV CL,BYTE PTR DS:[EAX+ECX+D]
0042384A |. 884A 0C |MOV BYTE PTR DS:[EDX+C],CL
0042384D |. 6A 00 |PUSH 0 ; /Arg3 = 00000000
0042384F |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8] ; |
00423852 |. 8A42 01 |MOV AL,BYTE PTR DS:[EDX+1] ; |
00423855 |. 50 |PUSH EAX ; |Arg2
00423856 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
00423859 |. 8A11 |MOV DL,BYTE PTR DS:[ECX] ; |
0042385B |. 52 |PUSH EDX ; |Arg1
0042385C |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8] ; |
0042385F |. 33C9 |XOR ECX,ECX ; |
00423861 |. 8A48 0C |MOV CL,BYTE PTR DS:[EAX+C] ; |
00423864 |. 6BC9 24 |IMUL ECX,ECX,24 ; |
00423867 |. 81C1 502C4B00 |ADD ECX,004B2C50 ; |
0042386D |. E8 D68C0100 |CALL 0043C548 ; \0043C548
00423872 |. F7D8 |NEG EAX
43C548是计算HP和MP的恢复量，输出的EAX必须用NEG来求相反数。
00423874 |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
00423877 |. 81E2 FF000000 |AND EDX,0FF
0042387D |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423880 |. 898491 8400000>|MOV DWORD PTR DS:[ECX+EDX*4+84],EAX
00423887 |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
0042388A |. 81E2 FF000000 |AND EDX,0FF
00423890 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423893 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423896 |. 8A89 54020000 |MOV CL,BYTE PTR DS:[ECX+254]
0042389C |. 888C10 5502000>|MOV BYTE PTR DS:[EAX+EDX+255],CL
004238A3 |. 8A55 FC |MOV DL,BYTE PTR SS:[EBP-4]
004238A6 |. 52 |PUSH EDX ; /Arg1
004238A7 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
004238AA |. E8 4CD6FFFF |CALL 00420EFB ; \00420EFB
004238AF |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004238B2 |. 3B81 D0020000 |CMP EAX,DWORD PTR DS:[ECX+2D0]
004238B8 |. 76 11 |JBE SHORT 004238CB
004238BA |. 8A55 FC |MOV DL,BYTE PTR SS:[EBP-4]
004238BD |. 52 |PUSH EDX ; /Arg1
004238BE |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
004238C1 |. E8 35D6FFFF |CALL 00420EFB ; \00420EFB
004238C6 |. 8945 F4 |MOV DWORD PTR SS:[EBP-C],EAX
004238C9 |. EB 0C |JMP SHORT 004238D7
004238CB |> 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
004238CE |. 8B88 D0020000 |MOV ECX,DWORD PTR DS:[EAX+2D0]
004238D4 |. 894D F4 |MOV DWORD PTR SS:[EBP-C],ECX
004238D7 |> 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
004238DA |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
004238DD |. 8982 D0020000 |MOV DWORD PTR DS:[EDX+2D0],EAX
004238E3 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004238E6 |. E8 A0D9FFFF |CALL 0042128B
004238EB |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004238EE |. 3B81 D4020000 |CMP EAX,DWORD PTR DS:[ECX+2D4]
004238F4 |. 76 0D |JBE SHORT 00423903
004238F6 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004238F9 |. E8 8DD9FFFF |CALL 0042128B
004238FE |. 8945 F0 |MOV DWORD PTR SS:[EBP-10],EAX
00423901 |. EB 0C |JMP SHORT 0042390F
00423903 |> 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423906 |. 8B82 D4020000 |MOV EAX,DWORD PTR DS:[EDX+2D4]
0042390C |. 8945 F0 |MOV DWORD PTR SS:[EBP-10],EAX
0042390F |> 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423912 |. 8B55 F0 |MOV EDX,DWORD PTR SS:[EBP-10]
00423915 |. 8991 D4020000 |MOV DWORD PTR DS:[ECX+2D4],EDX
0042391B |. 8A45 FC |MOV AL,BYTE PTR SS:[EBP-4]
0042391E |. 50 |PUSH EAX ; /Arg1
0042391F |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
00423922 |. E8 7CDAFFFF |CALL 004213A3 ; \004213A3
00423927 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
0042392A |. 81E1 FF000000 |AND ECX,0FF
00423930 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423933 |. 89848A D802000>|MOV DWORD PTR DS:[EDX+ECX*4+2D8],EAX
0042393A |.^E9 D3FEFFFF \JMP 00423812
0042393F |> 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
00423942 |. E8 78DBFFFF CALL 004214BF
00423947 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
0042394A |. E8 59EBFFFF CALL 004224A8
0042394F |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
00423952 |. C780 AC040000 >MOV DWORD PTR DS:[EAX+4AC],1
0042395C |> 8BE5 MOV ESP,EBP
0042395E |. 5D POP EBP
0042395F \. C3 RETN
恢复HP和MP类，基本都跟其他效果函数相同，要注意的地方就是43C548来代替命中率或伤害计算（43C548我以前有发过帖讲解，所以不说了）。
[b][size=2]六、自身提升类（气合、霸气）[/size][/b]
00425914 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00425917 |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],0A0
0042591E |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425921 |. E8 9AE3FFFF CALL 00423CC0
00425926 |. EB 6E JMP SHORT 00425996
自身能力上升（气合）从这里过来
00425928 |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0042592B |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],0AF
00425932 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425935 |. E8 86E3FFFF CALL 00423CC0
0042593A |. EB 5A JMP SHORT 00425996
自身全能力上升（霸气）从这里过来
00423CC0 /$ 55 PUSH EBP
00423CC1 |. 8BEC MOV EBP,ESP
00423CC3 |. 51 PUSH ECX
00423CC4 |. 894D FC MOV DWORD PTR SS:[EBP-4],ECX
00423CC7 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00423CCA |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423CCD |. 8A51 01 MOV DL,BYTE PTR DS:[ECX+1]
00423CD0 |. 8850 0D MOV BYTE PTR DS:[EAX+D],DL
00423CD3 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00423CD6 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423CD9 |. 8A51 0D MOV DL,BYTE PTR DS:[ECX+D]
00423CDC |. 8850 0C MOV BYTE PTR DS:[EAX+C],DL
00423CDF |. B9 50424B00 MOV ECX,004B4250
00423CE4 |. E8 33090300 CALL 0045461C
00423CE9 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00423CEC |. 8B88 A8040000 MOV ECX,DWORD PTR DS:[EAX+4A8]
00423CF2 |. 51 PUSH ECX ; /Arg4
00423CF3 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4] ; |
00423CF6 |. 8A42 0C MOV AL,BYTE PTR DS:[EDX+C] ; |
00423CF9 |. 50 PUSH EAX ; |Arg3
00423CFA |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4] ; |
00423CFD |. 8A51 01 MOV DL,BYTE PTR DS:[ECX+1] ; |
00423D00 |. 52 PUSH EDX ; |Arg2
00423D01 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; |
00423D04 |. 8A08 MOV CL,BYTE PTR DS:[EAX] ; |
00423D06 |. 51 PUSH ECX ; |Arg1
00423D07 |. E8 16C7FFFF CALL 00420422 ; \00420422
00423D0C |. 83C4 10 ADD ESP,10
00423D0F |. 85C0 TEST EAX,EAX
00423D11 |. 75 02 JNZ SHORT 00423D15
00423D13 |. EB 53 JMP SHORT 00423D68
00423D15 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00423D18 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00423D1B |. 8A88 54020000 MOV CL,BYTE PTR DS:[EAX+254]
00423D21 |. 888A 55020000 MOV BYTE PTR DS:[EDX+255],CL
00423D27 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423D2A |. E8 90D7FFFF CALL 004214BF
00423D2F |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423D32 |. E8 71E7FFFF CALL 004224A8
00423D37 |. 6A 00 PUSH 0 ; /Arg1 = 00000000
00423D39 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4] ; |
00423D3C |. E8 BAD1FFFF CALL 00420EFB ; \00420EFB
00423D41 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00423D44 |. 8982 D0020000 MOV DWORD PTR DS:[EDX+2D0],EAX
00423D4A |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423D4D |. E8 39D5FFFF CALL 0042128B
00423D52 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423D55 |. 8981 D4020000 MOV DWORD PTR DS:[ECX+2D4],EAX
00423D5B |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00423D5E |. C782 AC040000 >MOV DWORD PTR DS:[EDX+4AC],1
00423D68 |> 8BE5 MOV ESP,EBP
00423D6A |. 5D POP EBP
00423D6B \. C3 RETN
自身上升实在是没有什么好解释的，前面的效果函数已经都写过了，一看就明白了。
[b][size=2]七、回归[/size][/b]
004258CF |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
004258D2 |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],0B8
004258D9 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004258DC |. E8 7FE0FFFF CALL 00423960
004258E1 |. E9 B0000000 JMP 00425996
00423960 /$ 55 PUSH EBP
00423961 |. 8BEC MOV EBP,ESP
00423963 |. 83EC 10 SUB ESP,10
00423966 |. 894D F8 MOV DWORD PTR SS:[EBP-8],ECX
00423969 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
0042396C |. 8A08 MOV CL,BYTE PTR DS:[EAX]
0042396E |. 51 PUSH ECX ; /Arg4
0042396F |. 6A 03 PUSH 3 ; |Arg3 = 00000003
00423971 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] ; |
00423974 |. 8A82 C9020000 MOV AL,BYTE PTR DS:[EDX+2C9] ; |
0042397A |. 50 PUSH EAX ; |Arg2
0042397B |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
0042397E |. 8A51 01 MOV DL,BYTE PTR DS:[ECX+1] ; |
00423981 |. 52 PUSH EDX ; |Arg1
00423982 |. B9 50424B00 MOV ECX,004B4250 ; |
00423987 |. E8 B1190300 CALL 0045533D ; \0045533D
0042398C |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
0042398F |. 8841 0C MOV BYTE PTR DS:[ECX+C],AL
00423992 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
00423995 |. 33C0 XOR EAX,EAX
00423997 |. 8A42 0C MOV AL,BYTE PTR DS:[EDX+C]
0042399A |. 3D FF000000 CMP EAX,0FF
0042399F |. 75 05 JNZ SHORT 004239A6
004239A1 |. E9 85010000 JMP 00423B2B
004239A6 |> 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
004239A9 |. 8B91 A8040000 MOV EDX,DWORD PTR DS:[ECX+4A8]
004239AF |. 52 PUSH EDX ; /Arg4
004239B0 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; |
004239B3 |. 8A48 0C MOV CL,BYTE PTR DS:[EAX+C] ; |
004239B6 |. 51 PUSH ECX ; |Arg3
004239B7 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] ; |
004239BA |. 8A42 01 MOV AL,BYTE PTR DS:[EDX+1] ; |
004239BD |. 50 PUSH EAX ; |Arg2
004239BE |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
004239C1 |. 8A11 MOV DL,BYTE PTR DS:[ECX] ; |
004239C3 |. 52 PUSH EDX ; |Arg1
004239C4 |. E8 59CAFFFF CALL 00420422 ; \00420422
004239C9 |. 83C4 10 ADD ESP,10
004239CC |. 85C0 TEST EAX,EAX
004239CE |. 75 05 JNZ SHORT 004239D5
004239D0 |. E9 56010000 JMP 00423B2B
004239D5 |> 6A 01 PUSH 1 ; /Arg1 = 00000001
004239D7 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
004239DA |. E8 6A190000 CALL 00425349 ; \00425349
004239DF |. C645 FC 00 MOV BYTE PTR SS:[EBP-4],0
004239E3 |. EB 08 JMP SHORT 004239ED
004239E5 |> 8A45 FC /MOV AL,BYTE PTR SS:[EBP-4]
004239E8 |. 04 01 |ADD AL,1
004239EA |. 8845 FC |MOV BYTE PTR SS:[EBP-4],AL
004239ED |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004239F0 |. 81E1 FF000000 |AND ECX,0FF
004239F6 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
004239F9 |. 33C0 |XOR EAX,EAX
004239FB |. 8A440A 0D |MOV AL,BYTE PTR DS:[EDX+ECX+D]
004239FF |. 3D FF000000 |CMP EAX,0FF
00423A04 |. 0F84 04010000 |JE 00423B0E
00423A0A |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
00423A0D |. 81E1 FF000000 |AND ECX,0FF
00423A13 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423A16 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423A19 |. 8A4C08 0D |MOV CL,BYTE PTR DS:[EAX+ECX+D]
00423A1D |. 884A 0C |MOV BYTE PTR DS:[EDX+C],CL
00423A20 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423A23 |. 8A02 |MOV AL,BYTE PTR DS:[EDX]
00423A25 |. 50 |PUSH EAX ; /Arg3
00423A26 |. 6A 02 |PUSH 2 ; |Arg2 = 00000002
00423A28 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
00423A2B |. 33D2 |XOR EDX,EDX ; |
00423A2D |. 8A51 0C |MOV DL,BYTE PTR DS:[ECX+C] ; |
00423A30 |. 6BD2 24 |IMUL EDX,EDX,24 ; |
00423A33 |. 81C2 502C4B00 |ADD EDX,004B2C50 ; |
00423A39 |. 52 |PUSH EDX ; |Arg1
00423A3A |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8] ; |
00423A3D |. 8B48 08 |MOV ECX,DWORD PTR DS:[EAX+8] ; |
00423A40 |. E8 6B7A0100 |CALL 0043B4B0 ; \0043B4B0
00423A45 |. 85C0 |TEST EAX,EAX
00423A47 |. 74 16 |JE SHORT 00423A5F
00423A49 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
00423A4C |. 81E1 FF000000 |AND ECX,0FF
00423A52 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423A55 |. C6840A 5502000>|MOV BYTE PTR DS:[EDX+ECX+255],0B8
00423A5D |. EB 13 |JMP SHORT 00423A72
00423A5F |> 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4]
00423A62 |. 25 FF000000 |AND EAX,0FF
00423A67 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423A6A |. C68401 5502000>|MOV BYTE PTR DS:[ECX+EAX+255],0
00423A72 |> 8A55 FC |MOV DL,BYTE PTR SS:[EBP-4]
00423A75 |. 52 |PUSH EDX ; /Arg1
00423A76 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
00423A79 |. E8 7DD4FFFF |CALL 00420EFB ; \00420EFB
00423A7E |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423A81 |. 3B81 D0020000 |CMP EAX,DWORD PTR DS:[ECX+2D0]
00423A87 |. 76 11 |JBE SHORT 00423A9A
00423A89 |. 8A55 FC |MOV DL,BYTE PTR SS:[EBP-4]
00423A8C |. 52 |PUSH EDX ; /Arg1
00423A8D |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
00423A90 |. E8 66D4FFFF |CALL 00420EFB ; \00420EFB
00423A95 |. 8945 F4 |MOV DWORD PTR SS:[EBP-C],EAX
00423A98 |. EB 0C |JMP SHORT 00423AA6
00423A9A |> 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423A9D |. 8B88 D0020000 |MOV ECX,DWORD PTR DS:[EAX+2D0]
00423AA3 |. 894D F4 |MOV DWORD PTR SS:[EBP-C],ECX
00423AA6 |> 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423AA9 |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
00423AAC |. 8982 D0020000 |MOV DWORD PTR DS:[EDX+2D0],EAX
00423AB2 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423AB5 |. E8 D1D7FFFF |CALL 0042128B
00423ABA |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423ABD |. 3B81 D4020000 |CMP EAX,DWORD PTR DS:[ECX+2D4]
00423AC3 |. 76 0D |JBE SHORT 00423AD2
00423AC5 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423AC8 |. E8 BED7FFFF |CALL 0042128B
00423ACD |. 8945 F0 |MOV DWORD PTR SS:[EBP-10],EAX
00423AD0 |. EB 0C |JMP SHORT 00423ADE
00423AD2 |> 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423AD5 |. 8B82 D4020000 |MOV EAX,DWORD PTR DS:[EDX+2D4]
00423ADB |. 8945 F0 |MOV DWORD PTR SS:[EBP-10],EAX
00423ADE |> 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00423AE1 |. 8B55 F0 |MOV EDX,DWORD PTR SS:[EBP-10]
00423AE4 |. 8991 D4020000 |MOV DWORD PTR DS:[ECX+2D4],EDX
00423AEA |. 8A45 FC |MOV AL,BYTE PTR SS:[EBP-4]
00423AED |. 50 |PUSH EAX ; /Arg1
00423AEE |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
00423AF1 |. E8 ADD8FFFF |CALL 004213A3 ; \004213A3
00423AF6 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
00423AF9 |. 81E1 FF000000 |AND ECX,0FF
00423AFF |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423B02 |. 89848A D802000>|MOV DWORD PTR DS:[EDX+ECX*4+2D8],EAX
00423B09 |.^E9 D7FEFFFF \JMP 004239E5
00423B0E |> 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
00423B11 |. E8 A9D9FFFF CALL 004214BF
00423B16 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
00423B19 |. E8 8AE9FFFF CALL 004224A8
00423B1E |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
00423B21 |. C780 AC040000 >MOV DWORD PTR DS:[EAX+4AC],1
00423B2B |> 8BE5 MOV ESP,EBP
00423B2D |. 5D POP EBP
00423B2E \. C3 RETN
回归也不解释了，全部跟前面的一样，注意有目标对象的限制，在420422里面。
[b][size=2]八、天气变化[/size][/b]
004258FD |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425900 |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],0C0
00425907 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042590A |. E8 20E2FFFF CALL 00423B2F
0042590F |. E9 82000000 JMP 00425996
00423B2F /$ 55 PUSH EBP
00423B30 |. 8BEC MOV EBP,ESP
00423B32 |. 83EC 08 SUB ESP,8
00423B35 |. 894D FC MOV DWORD PTR SS:[EBP-4],ECX
00423B38 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00423B3B |. C680 55020000 >MOV BYTE PTR DS:[EAX+255],0
00423B42 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423B45 |. 8A11 MOV DL,BYTE PTR DS:[ECX]
00423B47 |. 8855 F8 MOV BYTE PTR SS:[EBP-8],DL
00423B4A |. 807D F8 3A CMP BYTE PTR SS:[EBP-8],3A
00423B4E |. 74 0E JE SHORT 00423B5E
00423B50 |. 807D F8 3B CMP BYTE PTR SS:[EBP-8],3B
00423B54 |. 74 2E JE SHORT 00423B84
00423B56 |. 807D F8 3C CMP BYTE PTR SS:[EBP-8],3C
00423B5A |. 74 4E JE SHORT 00423BAA
00423B5C |. EB 70 JMP SHORT 00423BCE
天气类是有策略编号的限制，就是上面的3A、3B和3C
00423B5E |> 6A 02 PUSH 2 ; /Arg1 = 00000002
00423B60 |. B9 083D4B00 MOV ECX,004B3D08 ; |
00423B65 |. E8 8F660200 CALL 0044A1F9 ; \0044A1F9
00423B6A |. 25 FF000000 AND EAX,0FF
00423B6F |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423B72 |. 8981 84000000 MOV DWORD PTR DS:[ECX+84],EAX
00423B78 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00423B7B |. C682 55020000 >MOV BYTE PTR DS:[EDX+255],0C0
00423B82 |. EB 4A JMP SHORT 00423BCE
变雨天
00423B84 |> 6A 00 PUSH 0 ; /Arg1 = 00000000
00423B86 |. B9 083D4B00 MOV ECX,004B3D08 ; |
00423B8B |. E8 69660200 CALL 0044A1F9 ; \0044A1F9
00423B90 |. 25 FF000000 AND EAX,0FF
00423B95 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423B98 |. 8981 84000000 MOV DWORD PTR DS:[ECX+84],EAX
00423B9E |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00423BA1 |. C682 55020000 >MOV BYTE PTR DS:[EDX+255],0C1
00423BA8 |. EB 24 JMP SHORT 00423BCE
变晴天
00423BAA |> 6A 01 PUSH 1 ; /Arg1 = 00000001
00423BAC |. B9 083D4B00 MOV ECX,004B3D08 ; |
00423BB1 |. E8 43660200 CALL 0044A1F9 ; \0044A1F9
00423BB6 |. 25 FF000000 AND EAX,0FF
00423BBB |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423BBE |. 8981 84000000 MOV DWORD PTR DS:[ECX+84],EAX
00423BC4 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00423BC7 |. C682 55020000 >MOV BYTE PTR DS:[EDX+255],0C2
变云天（阴天）
上面三种变化，通过44A1F9将新的天气编号存入497AF8+84H里面，497AF8+255H中存入对应的效果标识
00423BCE |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423BD1 |. E8 E9D8FFFF CALL 004214BF
00423BD6 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00423BD9 |. 33C9 XOR ECX,ECX
00423BDB |. 8A88 55020000 MOV CL,BYTE PTR DS:[EAX+255]
00423BE1 |. 85C9 TEST ECX,ECX
00423BE3 |. 74 52 JE SHORT 00423C37
00423BE5 |. B9 083D4B00 MOV ECX,004B3D08
00423BEA |. E8 C186FFFF CALL 0041C2B0
00423BEF |. 25 FF000000 AND EAX,0FF
00423BF4 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00423BF7 |. 3982 84000000 CMP DWORD PTR DS:[EDX+84],EAX
00423BFD |. 74 38 JE SHORT 00423C37
41C2B0输出当前天气编号，并对497AF8+84H的值进行比较，相同跳过。
00423BFF |. 6A 01 PUSH 1 ; /Arg2 = 00000001
00423C01 |. 68 86000000 PUSH 86 ; |Arg1 = 00000086
00423C06 |. B9 B0694B00 MOV ECX,004B69B0 ; |
00423C0B |. E8 6A0A0500 CALL 0047467A ; \0047467A
00423C10 |. 6A 1E PUSH 1E ; /Arg1 = 0000001E
00423C12 |. B9 181B4B00 MOV ECX,004B1B18 ; |
00423C17 |. E8 24F7FDFF CALL 00403340 ; \00403340
00423C1C |. E8 BF880000 CALL 0042C4E0
00423C21 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00423C24 |. 8A88 84000000 MOV CL,BYTE PTR DS:[EAX+84]
00423C2A |. 51 PUSH ECX ; /Arg1
00423C2B |. B9 083D4B00 MOV ECX,004B3D08 ; |
00423C30 |. E8 5C630200 CALL 00449F91 ; \00449F91
00423C35 |. EB 54 JMP SHORT 00423C8B
天气变化的动画处理，前面的1E是延时。
00423C37 |> 68 004C0400 PUSH 44C00 ; /Arg4 = 00044C00
00423C3C |. 6A 04 PUSH 4 ; |/Arg3 = 00000004
00423C3E |. 6A 00 PUSH 0 ; ||Arg2 = 00000000
00423C40 |. 6A 00 PUSH 0 ; ||Arg1 = 00000000
00423C42 |. B9 C8E44A00 MOV ECX,004AE4C8 ; ||
00423C47 |. E8 F4BD0500 CALL 0047FA40 ; |\0047FA40
00423C4C |. 50 PUSH EAX ; |Arg3
00423C4D |. 6A 2D PUSH 2D ; |Arg2 = 0000002D
00423C4F |. 68 F8BB4800 PUSH 0048BBF8 ; |Arg1 = 0048BBF8 ASCII "MEFF.E5"
00423C54 |. B9 B0174900 MOV ECX,004917B0 ; |
00423C59 |. E8 9AD8FDFF CALL 004014F8 ; \004014F8
2D是MISS动画。
00423C5E |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00423C61 |. 8A42 01 MOV AL,BYTE PTR DS:[EDX+1]
00423C64 |. 50 PUSH EAX ; /Arg1
00423C65 |. B9 B0174900 MOV ECX,004917B0 ; |
00423C6A |. E8 CDE1FDFF CALL 00401E3C ; \00401E3C
00423C6F |. 85C0 TEST EAX,EAX
00423C71 |. 74 0E JE SHORT 00423C81
00423C73 |. 6A 01 PUSH 1
00423C75 |. 6A 00 PUSH 0
00423C77 |. B9 B0174900 MOV ECX,004917B0
00423C7C |. E8 DBE1FDFF CALL 00401E5C
00423C81 |> B9 B0174900 MOV ECX,004917B0
00423C86 |. E8 20DAFDFF CALL 004016AB
这一大段不研究了，估计没什么大意义。
00423C8B |> 6A 00 PUSH 0 ; /Arg1 = 00000000
00423C8D |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4] ; |
00423C90 |. E8 66D2FFFF CALL 00420EFB ; \00420EFB
00423C95 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423C98 |. 8981 D0020000 MOV DWORD PTR DS:[ECX+2D0],EAX
00423C9E |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423CA1 |. E8 E5D5FFFF CALL 0042128B
00423CA6 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00423CA9 |. 8982 D4020000 MOV DWORD PTR DS:[EDX+2D4],EAX
00423CAF |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00423CB2 |. C780 AC040000 >MOV DWORD PTR DS:[EAX+4AC],1
00423CBC |. 8BE5 MOV ESP,EBP
00423CBE |. 5D POP EBP
00423CBF \. C3 RETN
注意天气类是有策略编号的限制，如果要调整策略的位置，在这条函数中还要对应修改。
[b][size=2]九、冥想[/size][/b]
0042593C |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042593F |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],90
00425946 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425949 |. E8 1EE4FFFF CALL 00423D6C
0042594E |. EB 46 JMP SHORT 00425996
00423D6C /$ 55 PUSH EBP
00423D6D |. 8BEC MOV EBP,ESP
00423D6F |. 51 PUSH ECX
00423D70 |. 56 PUSH ESI
00423D71 |. 894D FC MOV DWORD PTR SS:[EBP-4],ECX
00423D74 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00423D77 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423D7A |. 8A51 01 MOV DL,BYTE PTR DS:[ECX+1]
00423D7D |. 8850 0D MOV BYTE PTR DS:[EAX+D],DL
00423D80 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00423D83 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423D86 |. 8A51 0D MOV DL,BYTE PTR DS:[ECX+D]
00423D89 |. 8850 0C MOV BYTE PTR DS:[EAX+C],DL
00423D8C |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00423D8F |. 8B88 A8040000 MOV ECX,DWORD PTR DS:[EAX+4A8]
00423D95 |. 51 PUSH ECX ; /Arg4
00423D96 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4] ; |
00423D99 |. 8A42 0C MOV AL,BYTE PTR DS:[EDX+C] ; |
00423D9C |. 50 PUSH EAX ; |Arg3
00423D9D |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4] ; |
00423DA0 |. 8A51 01 MOV DL,BYTE PTR DS:[ECX+1] ; |
00423DA3 |. 52 PUSH EDX ; |Arg2
00423DA4 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; |
00423DA7 |. 8A08 MOV CL,BYTE PTR DS:[EAX] ; |
00423DA9 |. 51 PUSH ECX ; |Arg1
00423DAA |. E8 73C6FFFF CALL 00420422 ; \00420422
00423DAF |. 83C4 10 ADD ESP,10
00423DB2 |. 85C0 TEST EAX,EAX
00423DB4 |. 75 05 JNZ SHORT 00423DBB
00423DB6 |. E9 1C010000 JMP 00423ED7
00423DBB |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00423DBE |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00423DC1 |. 8A88 54020000 MOV CL,BYTE PTR DS:[EAX+254]
00423DC7 |. 888A 55020000 MOV BYTE PTR DS:[EDX+255],CL
00423DCD |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00423DD0 |. 8B4A 08 MOV ECX,DWORD PTR DS:[EDX+8]
00423DD3 |. E8 B8EE0400 CALL 00472C90
00423DD8 |. 83F8 32 CMP EAX,32
00423DDB |. 76 1C JBE SHORT 00423DF9
使用策略的武将当前HP是否小于等于50，小于等于跳到后面，大于则接下面。
00423DDD |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00423DE0 |. C780 88000000 >MOV DWORD PTR DS:[EAX+88],32
00423DEA |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423DED |. C781 84000000 >MOV DWORD PTR DS:[ECX+84],-19
00423DF7 |. EB 30 JMP SHORT 00423E29
将需要减少的HP值（50）存入497AF8+88H中，将需要增加的MP值（-25，注意要负数）存入497AF8+84H中。
00423DF9 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00423DFC |. 8B4A 08 MOV ECX,DWORD PTR DS:[EDX+8]
00423DFF |. E8 8CEE0400 CALL 00472C90
00423E04 |. 83E8 01 SUB EAX,1
00423E07 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423E0A |. 8981 88000000 MOV DWORD PTR DS:[ECX+88],EAX
00423E10 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00423E13 |. 8B82 88000000 MOV EAX,DWORD PTR DS:[EDX+88]
00423E19 |. 99 CDQ
00423E1A |. 2BC2 SUB EAX,EDX
00423E1C |. D1F8 SAR EAX,1
00423E1E |. F7D8 NEG EAX
00423E20 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423E23 |. 8981 84000000 MOV DWORD PTR DS:[ECX+84],EAX
这是使用策略的武将当前HP小于等于50的情况。将当前HP减1（即必须剩下1点HP）后存入497AF8+88H中，然后将当前HP减1后的值除以2后存入497AF8+84H中。
00423E29 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00423E2C |. 8B4A 08 MOV ECX,DWORD PTR DS:[EDX+8]
00423E2F |. E8 3CB80300 CALL 0045F670
00423E34 |. 8BC8 MOV ECX,EAX
00423E36 |. 6BC9 48 IMUL ECX,ECX,48
00423E39 |. 81C1 681B4A00 ADD ECX,004A1B68
00423E3F |. E8 0634FEFF CALL 0040724A
00423E44 |. 8BF0 MOV ESI,EAX
00423E46 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00423E49 |. 8B48 08 MOV ECX,DWORD PTR DS:[EAX+8]
00423E4C |. E8 EFE90400 CALL 00472840
00423E51 |. 2BF0 SUB ESI,EAX
00423E53 |. F7DE NEG ESI
00423E55 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423E58 |. 39B1 84000000 CMP DWORD PTR DS:[ECX+84],ESI
00423E5E |. 7D 36 JGE SHORT 00423E96
00423E60 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00423E63 |. 8B4A 08 MOV ECX,DWORD PTR DS:[EDX+8]
00423E66 |. E8 05B80300 CALL 0045F670
00423E6B |. 8BC8 MOV ECX,EAX
00423E6D |. 6BC9 48 IMUL ECX,ECX,48
00423E70 |. 81C1 681B4A00 ADD ECX,004A1B68
00423E76 |. E8 CF33FEFF CALL 0040724A
00423E7B |. 8BF0 MOV ESI,EAX
00423E7D |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00423E80 |. 8B48 08 MOV ECX,DWORD PTR DS:[EAX+8]
00423E83 |. E8 B8E90400 CALL 00472840
00423E88 |. 2BF0 SUB ESI,EAX
00423E8A |. 6BF6 FF IMUL ESI,ESI,-1
00423E8D |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423E90 |. 89B1 84000000 MOV DWORD PTR DS:[ECX+84],ESI
上面一大段是根据当前的MP和最大MP计算出实际需要增加的MP值。
00423E96 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423E99 |. E8 21D6FFFF CALL 004214BF
00423E9E |. 6A 00 PUSH 0 ; /Arg1 = 00000000
00423EA0 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4] ; |
00423EA3 |. E8 53D0FFFF CALL 00420EFB ; \00420EFB
00423EA8 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00423EAB |. 8982 D0020000 MOV DWORD PTR DS:[EDX+2D0],EAX
00423EB1 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423EB4 |. E8 D2D3FFFF CALL 0042128B
00423EB9 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423EBC |. 8981 D4020000 MOV DWORD PTR DS:[ECX+2D4],EAX
00423EC2 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423EC5 |. E8 DEE5FFFF CALL 004224A8
00423ECA |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00423ECD |. C782 AC040000 >MOV DWORD PTR DS:[EDX+4AC],1
00423ED7 |> 5E POP ESI
00423ED8 |. 8BE5 MOV ESP,EBP
00423EDA |. 5D POP EBP
00423EDB \. C3 RETN
冥想需要注意的是增加的MP值必须是负数，减少的HP值是正数。[/font]
[color=Silver][[i] 本帖最后由 godtype 于 2010-4-12 10:49 编辑 [/i]][/color]
2010-3-26 22:07
godtype
[font=宋体][b][size=2]十、八阵图[/size][/b]
004258E6 |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004258E9 |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],0FF
004258F0 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004258F3 |. E8 E4E5FFFF CALL 00423EDC
004258F8 |. E9 99000000 JMP 00425996
00423EDC /$ 55 PUSH EBP
00423EDD |. 8BEC MOV EBP,ESP
00423EDF |. 83EC 14 SUB ESP,14
00423EE2 |. 894D F8 MOV DWORD PTR SS:[EBP-8],ECX
00423EE5 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
00423EE8 |. 8A08 MOV CL,BYTE PTR DS:[EAX]
00423EEA |. 51 PUSH ECX ; /Arg4
00423EEB |. 6A 02 PUSH 2 ; |Arg3 = 00000002
00423EED |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] ; |
00423EF0 |. 8A82 C9020000 MOV AL,BYTE PTR DS:[EDX+2C9] ; |
00423EF6 |. 50 PUSH EAX ; |Arg2
00423EF7 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
00423EFA |. 8A51 01 MOV DL,BYTE PTR DS:[ECX+1] ; |
00423EFD |. 52 PUSH EDX ; |Arg1
00423EFE |. B9 50424B00 MOV ECX,004B4250 ; |
00423F03 |. E8 35140300 CALL 0045533D ; \0045533D
00423F08 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
00423F0B |. 8841 0C MOV BYTE PTR DS:[ECX+C],AL
00423F0E |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
00423F11 |. 33C0 XOR EAX,EAX
00423F13 |. 8A42 0C MOV AL,BYTE PTR DS:[EDX+C]
00423F16 |. 3D FF000000 CMP EAX,0FF
00423F1B |. 75 05 JNZ SHORT 00423F22
00423F1D |. E9 F4020000 JMP 00424216
00423F22 |> 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
00423F25 |. 8B91 A8040000 MOV EDX,DWORD PTR DS:[ECX+4A8]
00423F2B |. 52 PUSH EDX ; /Arg4
00423F2C |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8] ; |
00423F2F |. 8A48 0C MOV CL,BYTE PTR DS:[EAX+C] ; |
00423F32 |. 51 PUSH ECX ; |Arg3
00423F33 |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8] ; |
00423F36 |. 8A42 01 MOV AL,BYTE PTR DS:[EDX+1] ; |
00423F39 |. 50 PUSH EAX ; |Arg2
00423F3A |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
00423F3D |. 8A11 MOV DL,BYTE PTR DS:[ECX] ; |
00423F3F |. 52 PUSH EDX ; |Arg1
00423F40 |. E8 DDC4FFFF CALL 00420422 ; \00420422
00423F45 |. 83C4 10 ADD ESP,10
00423F48 |. 85C0 TEST EAX,EAX
00423F4A |. 75 05 JNZ SHORT 00423F51
00423F4C |. E9 C5020000 JMP 00424216
00423F51 |> 6A 00 PUSH 0 ; /Arg1 = 00000000
00423F53 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
00423F56 |. E8 EE130000 CALL 00425349 ; \00425349
前面部分跟其他效果函数一样，不解释了。
00423F5B |. C645 FC 00 MOV BYTE PTR SS:[EBP-4],0
00423F5F |. EB 08 JMP SHORT 00423F69
00423F61 |> 8A45 FC /MOV AL,BYTE PTR SS:[EBP-4]
00423F64 |. 04 01 |ADD AL,1
00423F66 |. 8845 FC |MOV BYTE PTR SS:[EBP-4],AL
00423F69 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00423F6C |. 81E1 FF000000 |AND ECX,0FF
00423F72 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423F75 |. 33C0 |XOR EAX,EAX
00423F77 |. 8A440A 0D |MOV AL,BYTE PTR DS:[EDX+ECX+D]
00423F7B |. 3D FF000000 |CMP EAX,0FF
00423F80 |. 0F84 73020000 |JE 004241F9
00423F86 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
00423F89 |. 81E1 FF000000 |AND ECX,0FF
00423F8F |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423F92 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423F95 |. 8A4C08 0D |MOV CL,BYTE PTR DS:[EAX+ECX+D]
00423F99 |. 884A 0C |MOV BYTE PTR DS:[EDX+C],CL
00423F9C |. 6A 08 |PUSH 8 ; /Arg1 = 00000008
00423F9E |. E8 70BB0500 |CALL 0047FB13 ; \0047FB13
00423FA3 |. 83C4 04 |ADD ESP,4
00423FA6 |. 8945 F4 |MOV DWORD PTR SS:[EBP-C],EAX
这里是从0-7这8个数中随机取出一个，保存到[EBP-C]中
00423FA9 |. 837D F4 07 |CMP DWORD PTR SS:[EBP-C],7
00423FAD |. 0F87 AA010000 |JA 0042415D
随机数大于7跳出，虽然有点多余，但是是专业的表现。
00423FB3 |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C]
00423FB6 |. FF2495 1A42420>|JMP DWORD PTR DS:[EDX*4+42421A]
按照随机数，根据42421A开始的分支表进行跳转
0042421A . BD3F4200 DD 00423FBD ; Switch table used at 00423FB6
0042421E . 2E404200 DD 0042402E
00424222 . 47404200 DD 00424047
00424226 . 60404200 DD 00424060
0042422A . 78404200 DD 00424078
0042422E . E2404200 DD 004240E2
00424232 . F8404200 DD 004240F8
00424236 . 0E414200 DD 0042410E
00423FBD |> 6A 00 |PUSH 0
00423FBF |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00423FC2 |. 8A08 |MOV CL,BYTE PTR DS:[EAX]
00423FC4 |. 51 |PUSH ECX
00423FC5 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00423FC8 |. 33C0 |XOR EAX,EAX
00423FCA |. 8A42 0C |MOV AL,BYTE PTR DS:[EDX+C]
00423FCD |. 8BC8 |MOV ECX,EAX
00423FCF |. 6BC9 24 |IMUL ECX,ECX,24
00423FD2 |. 81C1 502C4B00 |ADD ECX,004B2C50
00423FD8 |. E8 93B60300 |CALL 0045F670
00423FDD |. 6BC0 48 |IMUL EAX,EAX,48 ; |
00423FE0 |. 05 681B4A00 |ADD EAX,004A1B68 ; |
00423FE5 |. 50 |PUSH EAX ; |Arg2
00423FE6 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
00423FE9 |. 33D2 |XOR EDX,EDX ; |
00423FEB |. 8A51 0C |MOV DL,BYTE PTR DS:[ECX+C] ; |
00423FEE |. 6BD2 24 |IMUL EDX,EDX,24 ; |
00423FF1 |. 81C2 502C4B00 |ADD EDX,004B2C50 ; |
00423FF7 |. 52 |PUSH EDX ; |Arg1
00423FF8 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8] ; |
00423FFB |. 8B48 08 |MOV ECX,DWORD PTR DS:[EAX+8] ; |
00423FFE |. E8 A77F0100 |CALL 0043BFAA ; \0043BFAA
00424003 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
00424006 |. 81E1 FF000000 |AND ECX,0FF
0042400C |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
0042400F |. 89848A 8400000>|MOV DWORD PTR DS:[EDX+ECX*4+84],EAX
00424016 |. 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4]
00424019 |. 25 FF000000 |AND EAX,0FF
0042401E |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00424021 |. C68401 5502000>|MOV BYTE PTR DS:[ECX+EAX+255],40
00424029 |. E9 2F010000 |JMP 0042415D
分支表00，直接伤害，即出现巨岩动画的情况。
0042402E |> 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
00424031 |. 81E2 FF000000 |AND EDX,0FF
00424037 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
0042403A |. C68410 5502000>|MOV BYTE PTR DS:[EAX+EDX+255],71
00424042 |. E9 16010000 |JMP 0042415D
分支表01，混乱效果。
00424047 |> 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
0042404A |. 81E1 FF000000 |AND ECX,0FF
00424050 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00424053 |. C6840A 5502000>|MOV BYTE PTR DS:[EDX+ECX+255],72
0042405B |. E9 FD000000 |JMP 0042415D
分支表02，麻痹效果。
00424060 |> 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4]
00424063 |. 25 FF000000 |AND EAX,0FF
00424068 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
0042406B |. C68401 5502000>|MOV BYTE PTR DS:[ECX+EAX+255],74
00424073 |. E9 E5000000 |JMP 0042415D
分支表03，封咒效果。
00424078 |> 6A 00 |PUSH 0
0042407A |. 6A 21 |PUSH 21
0042407C |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
0042407F |. 33C0 |XOR EAX,EAX
00424081 |. 8A42 0C |MOV AL,BYTE PTR DS:[EDX+C]
00424084 |. 8BC8 |MOV ECX,EAX
00424086 |. 6BC9 24 |IMUL ECX,ECX,24
00424089 |. 81C1 502C4B00 |ADD ECX,004B2C50
0042408F |. E8 DCB50300 |CALL 0045F670
00424094 |. 6BC0 48 |IMUL EAX,EAX,48 ; |
00424097 |. 05 681B4A00 |ADD EAX,004A1B68 ; |
0042409C |. 50 |PUSH EAX ; |Arg2
0042409D |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
004240A0 |. 33D2 |XOR EDX,EDX ; |
004240A2 |. 8A51 0C |MOV DL,BYTE PTR DS:[ECX+C] ; |
004240A5 |. 6BD2 24 |IMUL EDX,EDX,24 ; |
004240A8 |. 81C2 502C4B00 |ADD EDX,004B2C50 ; |
004240AE |. 52 |PUSH EDX ; |Arg1
004240AF |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8] ; |
004240B2 |. 8B48 08 |MOV ECX,DWORD PTR DS:[EAX+8] ; |
004240B5 |. E8 F07E0100 |CALL 0043BFAA ; \0043BFAA
004240BA |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
004240BD |. 81E1 FF000000 |AND ECX,0FF
004240C3 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
004240C6 |. 89848A 8400000>|MOV DWORD PTR DS:[EDX+ECX*4+84],EAX
004240CD |. 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4]
004240D0 |. 25 FF000000 |AND EAX,0FF
004240D5 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004240D8 |. C68401 5502000>|MOV BYTE PTR DS:[ECX+EAX+255],70
004240E0 |. EB 7B |JMP SHORT 0042415D
分支表04，中毒效果。注意这里也带有伤害效果，而且43BFAA的第三个参数输入固定为21，即毒烟策略的编号，计算伤害和命中就按照毒烟来计算。
004240E2 |> 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
004240E5 |. 81E2 FF000000 |AND EDX,0FF
004240EB |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
004240EE |. C68410 5502000>|MOV BYTE PTR DS:[EAX+EDX+255],6F
004240F6 |. EB 65 |JMP SHORT 0042415D
分支表05，反霸气效果。
004240F8 |> 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
004240FB |. 81E1 FF000000 |AND ECX,0FF
00424101 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00424104 |. C6840A 5502000>|MOV BYTE PTR DS:[EDX+ECX+255],0AF
0042410C |. EB 4F |JMP SHORT 0042415D
分支表06，霸气效果。
0042410E |> 6A 00 |PUSH 0 ; /Arg3 = 00000000
00424110 |. 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8] ; |
00424113 |. 8A48 01 |MOV CL,BYTE PTR DS:[EAX+1] ; |
00424116 |. 51 |PUSH ECX ; |Arg2
00424117 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8] ; |
0042411A |. 8A02 |MOV AL,BYTE PTR DS:[EDX] ; |
0042411C |. 50 |PUSH EAX ; |Arg1
0042411D |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
00424120 |. 33D2 |XOR EDX,EDX ; |
00424122 |. 8A51 0C |MOV DL,BYTE PTR DS:[ECX+C] ; |
00424125 |. 8BCA |MOV ECX,EDX ; |
00424127 |. 6BC9 24 |IMUL ECX,ECX,24 ; |
0042412A |. 81C1 502C4B00 |ADD ECX,004B2C50 ; |
00424130 |. E8 13840100 |CALL 0043C548 ; \0043C548
00424135 |. F7D8 |NEG EAX
00424137 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
0042413A |. 81E1 FF000000 |AND ECX,0FF
00424140 |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00424143 |. 89848A 8400000>|MOV DWORD PTR DS:[EDX+ECX*4+84],EAX
0042414A |. 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4]
0042414D |. 25 FF000000 |AND EAX,0FF
00424152 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
00424155 |. C68401 5502000>|MOV BYTE PTR DS:[ECX+EAX+255],80
分支表07，恢复HP。
0042415D |> 8A55 FC |MOV DL,BYTE PTR SS:[EBP-4]
00424160 |. 52 |PUSH EDX ; /Arg1
00424161 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
00424164 |. E8 92CDFFFF |CALL 00420EFB ; \00420EFB
00424169 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
0042416C |. 3B81 D0020000 |CMP EAX,DWORD PTR DS:[ECX+2D0]
00424172 |. 76 11 |JBE SHORT 00424185
00424174 |. 8A55 FC |MOV DL,BYTE PTR SS:[EBP-4]
00424177 |. 52 |PUSH EDX ; /Arg1
00424178 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
0042417B |. E8 7BCDFFFF |CALL 00420EFB ; \00420EFB
00424180 |. 8945 F0 |MOV DWORD PTR SS:[EBP-10],EAX
00424183 |. EB 0C |JMP SHORT 00424191
00424185 |> 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00424188 |. 8B88 D0020000 |MOV ECX,DWORD PTR DS:[EAX+2D0]
0042418E |. 894D F0 |MOV DWORD PTR SS:[EBP-10],ECX
00424191 |> 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
00424194 |. 8B45 F0 |MOV EAX,DWORD PTR SS:[EBP-10]
00424197 |. 8982 D0020000 |MOV DWORD PTR DS:[EDX+2D0],EAX
0042419D |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004241A0 |. E8 E6D0FFFF |CALL 0042128B
004241A5 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004241A8 |. 3B81 D4020000 |CMP EAX,DWORD PTR DS:[ECX+2D4]
004241AE |. 76 0D |JBE SHORT 004241BD
004241B0 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004241B3 |. E8 D3D0FFFF |CALL 0042128B
004241B8 |. 8945 EC |MOV DWORD PTR SS:[EBP-14],EAX
004241BB |. EB 0C |JMP SHORT 004241C9
004241BD |> 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
004241C0 |. 8B82 D4020000 |MOV EAX,DWORD PTR DS:[EDX+2D4]
004241C6 |. 8945 EC |MOV DWORD PTR SS:[EBP-14],EAX
004241C9 |> 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004241CC |. 8B55 EC |MOV EDX,DWORD PTR SS:[EBP-14]
004241CF |. 8991 D4020000 |MOV DWORD PTR DS:[ECX+2D4],EDX
004241D5 |. 8A45 FC |MOV AL,BYTE PTR SS:[EBP-4]
004241D8 |. 50 |PUSH EAX ; /Arg1
004241D9 |. 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8] ; |
004241DC |. E8 C2D1FFFF |CALL 004213A3 ; \004213A3
004241E1 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
004241E4 |. 81E1 FF000000 |AND ECX,0FF
004241EA |. 8B55 F8 |MOV EDX,DWORD PTR SS:[EBP-8]
004241ED |. 89848A D802000>|MOV DWORD PTR DS:[EDX+ECX*4+2D8],EAX
004241F4 |.^E9 68FDFFFF \JMP 00423F61
004241F9 |> 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
004241FC |. E8 BED2FFFF CALL 004214BF
00424201 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8]
00424204 |. E8 9FE2FFFF CALL 004224A8
00424209 |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
0042420C |. C780 AC040000 >MOV DWORD PTR DS:[EAX+4AC],1
00424216 |> 8BE5 MOV ESP,EBP
00424218 |. 5D POP EBP
00424219 \. C3 RETN
0042421A . BD3F4200 DD 00423FBD ; Switch table used at 00423FB6
0042421E . 2E404200 DD 0042402E
00424222 . 47404200 DD 00424047
00424226 . 60404200 DD 00424060
0042422A . 78404200 DD 00424078
0042422E . E2404200 DD 004240E2
00424232 . F8404200 DD 004240F8
00424236 . 0E414200 DD 0042410E
[b][size=2]十一、四神之青龙[/size][/b]
00425950 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
00425953 |. C682 54020000 >MOV BYTE PTR DS:[EDX+254],40
0042595A |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042595D |. E8 3CF5FFFF CALL 00424E9E
00425962 |. EB 32 JMP SHORT 00425996
00424E9E /$ 55 PUSH EBP
00424E9F |. 8BEC MOV EBP,ESP
00424EA1 |. 83EC 44 SUB ESP,44
00424EA4 |. 894D C4 MOV DWORD PTR SS:[EBP-3C],ECX
00424EA7 |. C645 D0 00 MOV BYTE PTR SS:[EBP-30],0
00424EAB |. 8B45 C4 MOV EAX,DWORD PTR SS:[EBP-3C]
00424EAE |. 8A08 MOV CL,BYTE PTR DS:[EAX]
00424EB0 |. 51 PUSH ECX ; /Arg4
00424EB1 |. 6A 02 PUSH 2 ; |Arg3 = 00000002
00424EB3 |. 8B55 C4 MOV EDX,DWORD PTR SS:[EBP-3C] ; |
00424EB6 |. 8A82 C9020000 MOV AL,BYTE PTR DS:[EDX+2C9] ; |
00424EBC |. 50 PUSH EAX ; |Arg2
00424EBD |. 8B4D C4 MOV ECX,DWORD PTR SS:[EBP-3C] ; |
00424EC0 |. 8A51 01 MOV DL,BYTE PTR DS:[ECX+1] ; |
00424EC3 |. 52 PUSH EDX ; |Arg1
00424EC4 |. B9 50424B00 MOV ECX,004B4250 ; |
00424EC9 |. E8 6F040300 CALL 0045533D ; \0045533D
00424ECE |. 8845 E4 MOV BYTE PTR SS:[EBP-1C],AL
00424ED1 |. 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]
00424ED4 |. 25 FF000000 AND EAX,0FF
00424ED9 |. 3D FF000000 CMP EAX,0FF
00424EDE |. 75 05 JNZ SHORT 00424EE5
00424EE0 |. E9 F8020000 JMP 004251DD
00424EE5 |> 8B4D C4 MOV ECX,DWORD PTR SS:[EBP-3C]
00424EE8 |. 8B55 C4 MOV EDX,DWORD PTR SS:[EBP-3C]
00424EEB |. 8A42 01 MOV AL,BYTE PTR DS:[EDX+1]
00424EEE |. 8841 0C MOV BYTE PTR DS:[ECX+C],AL
00424EF1 |. 6A 00 PUSH 0 ; /Arg1 = 00000000
00424EF3 |. 8B4D C4 MOV ECX,DWORD PTR SS:[EBP-3C] ; |
00424EF6 |. E8 4E040000 CALL 00425349 ; \00425349
00424EFB |. 8B4D C4 MOV ECX,DWORD PTR SS:[EBP-3C]
00424EFE |. 8A55 E4 MOV DL,BYTE PTR SS:[EBP-1C]
00424F01 |. 8851 0D MOV BYTE PTR DS:[ECX+D],DL
前面部分跟其他效果函数相似，但是45533D出来的AL值，即目标敌人的战场编号是先存入到[EBP-1C]里面，然后从497AF8+1H里面取出使用策略者的战场编号并存入497AF8+CH里面，以这个为基准确定所有被攻击到的敌人的战场编号按顺序存入到497AF8+DH开始的内存中。最后再将目标敌人的战场编号从[EBP-1C]里面取出存入到497F8+DH里面（因为此时的+DH位置里面是使用策略者的战场编号）。
00424F04 |. C645 D0 00 MOV BYTE PTR SS:[EBP-30],0
00424F08 |. EB 08 JMP SHORT 00424F12
00424F0A |> 8A45 D0 /MOV AL,BYTE PTR SS:[EBP-30]
00424F0D |. 04 01 |ADD AL,1
00424F0F |. 8845 D0 |MOV BYTE PTR SS:[EBP-30],AL
00424F12 |> 8B4D D0 MOV ECX,DWORD PTR SS:[EBP-30]
00424F15 |. 81E1 FF000000 |AND ECX,0FF
00424F1B |. 8B55 C4 |MOV EDX,DWORD PTR SS:[EBP-3C]
00424F1E |. 33C0 |XOR EAX,EAX
00424F20 |. 8A440A 0E |MOV AL,BYTE PTR DS:[EDX+ECX+E]
00424F24 |. 3D FF000000 |CMP EAX,0FF
00424F29 |. 74 02 |JE SHORT 00424F2D
00424F2B |.^EB DD \JMP SHORT 00424F0A
[EBP-30]被清空，同时从497F8+EH开始检查，直到内存值为0FF为止。实际意义就是确定总共有多少个敌人在影响范围内，[EBP-30]保存的就是这个数量值。
00424F2D |> 8B4D C4 MOV ECX,DWORD PTR SS:[EBP-3C]
00424F30 |. 8B55 C4 MOV EDX,DWORD PTR SS:[EBP-3C]
00424F33 |. 8A42 01 MOV AL,BYTE PTR DS:[EDX+1]
00424F36 |. 8841 0D MOV BYTE PTR DS:[ECX+D],AL
00424F39 |. 8B4D C4 MOV ECX,DWORD PTR SS:[EBP-3C]
00424F3C |. E8 95C9FFFF CALL 004218D6
这里是弹出策略名称。
00424F41 |. C645 DC 00 MOV BYTE PTR SS:[EBP-24],0
00424F45 |. EB 09 JMP SHORT 00424F50
00424F47 |> 8A4D DC /MOV CL,BYTE PTR SS:[EBP-24]
00424F4A |. 80C1 01 |ADD CL,1
00424F4D |. 884D DC |MOV BYTE PTR SS:[EBP-24],CL
00424F50 |> 8B55 DC MOV EDX,DWORD PTR SS:[EBP-24]
00424F53 |. 81E2 FF000000 |AND EDX,0FF
00424F59 |. 8B45 D0 |MOV EAX,DWORD PTR SS:[EBP-30]
00424F5C |. 25 FF000000 |AND EAX,0FF
00424F61 |. 3BD0 |CMP EDX,EAX
00424F63 |. 7D 1F |JGE SHORT 00424F84
00424F65 |. 8B4D DC |MOV ECX,DWORD PTR SS:[EBP-24]
00424F68 |. 81E1 FF000000 |AND ECX,0FF
00424F6E |. 8B55 DC |MOV EDX,DWORD PTR SS:[EBP-24]
00424F71 |. 81E2 FF000000 |AND EDX,0FF
00424F77 |. 8B45 C4 |MOV EAX,DWORD PTR SS:[EBP-3C]
00424F7A |. 8A4C08 0E |MOV CL,BYTE PTR DS:[EAX+ECX+E]
00424F7E |. 884C15 E4 |MOV BYTE PTR SS:[EBP+EDX-1C],CL
00424F82 |.^EB C3 \JMP SHORT 00424F47
清空[EBP-24]作为循环计数器，当[EBP-24]的值大于等于[EBP-30]的值的时候跳出循环。用途是将所有可能被攻击到的敌人的战场编号按顺序存入到[EBP-1C]--[EBP-5]里面，由于青龙穿透范围最多有24个敌人存在，刚刚好，所以不能随意更换穿透范围，尤其是敌人数量超过24的。
00424F84 |> 8B55 D0 MOV EDX,DWORD PTR SS:[EBP-30]
00424F87 |. 81E2 FF000000 AND EDX,0FF
00424F8D |. C64415 E4 FF MOV BYTE PTR SS:[EBP+EDX-1C],0FF
在最后一个位置赋值0FF，作为结束的标识。
00424F92 |. C645 DC 00 MOV BYTE PTR SS:[EBP-24],0
00424F96 |. EB 08 JMP SHORT 00424FA0
00424F98 |> 8A45 DC /MOV AL,BYTE PTR SS:[EBP-24]
00424F9B |. 04 01 |ADD AL,1
00424F9D |. 8845 DC |MOV BYTE PTR SS:[EBP-24],AL
00424FA0 |> 8B4D DC MOV ECX,DWORD PTR SS:[EBP-24]
00424FA3 |. 81E1 FF000000 |AND ECX,0FF
00424FA9 |. 83F9 05 |CMP ECX,5
00424FAC |. 7D 13 |JGE SHORT 00424FC1
00424FAE |. 8B55 DC |MOV EDX,DWORD PTR SS:[EBP-24]
00424FB1 |. 81E2 FF000000 |AND EDX,0FF
00424FB7 |. 8B45 C4 |MOV EAX,DWORD PTR SS:[EBP-3C]
00424FBA |. C64410 0D FF |MOV BYTE PTR DS:[EAX+EDX+D],0FF
00424FBF |.^EB D7 \JMP SHORT 00424F98
再次清空[EBP-24]作为循环计数器，[EBP-24]大于等于5的时候跳出循环，同时将497AF8+DH开始的五个字节赋值0FF。如果要修改攻击次数，这里是第一个要修改的地方。
00424FC1 |> 8B4D C4 MOV ECX,DWORD PTR SS:[EBP-3C]
00424FC4 |. 33D2 XOR EDX,EDX
00424FC6 |. 8A51 01 MOV DL,BYTE PTR DS:[ECX+1]
00424FC9 |. 8BCA MOV ECX,EDX
00424FCB |. 6BC9 24 IMUL ECX,ECX,24
00424FCE |. 81C1 502C4B00 ADD ECX,004B2C50
00424FD4 |. E8 87E3FDFF CALL 00403360
00424FD9 |. 66:8B00 MOV AX,WORD PTR DS:[EAX]
00424FDC |. 50 PUSH EAX ; /Arg1
00424FDD |. E8 9CAA0200 CALL 0044FA7E ; \0044FA7E
00424FE2 |. 83C4 04 ADD ESP,4
00424FE5 |. 8945 C8 MOV DWORD PTR SS:[EBP-38],EAX
00424FE8 |. 8955 CC MOV DWORD PTR SS:[EBP-34],EDX
00424FEB |. 8B4D C8 MOV ECX,DWORD PTR SS:[EBP-38]
00424FEE |. 894D D4 MOV DWORD PTR SS:[EBP-2C],ECX
00424FF1 |. 8B55 CC MOV EDX,DWORD PTR SS:[EBP-34]
00424FF4 |. 8955 D8 MOV DWORD PTR SS:[EBP-28],EDX
00424FF7 |. 8B45 D8 MOV EAX,DWORD PTR SS:[EBP-28]
00424FFA |. 83C0 18 ADD EAX,18
00424FFD |. 50 PUSH EAX ; /Arg2
00424FFE |. 8B4D D4 MOV ECX,DWORD PTR SS:[EBP-2C] ; |
00425001 |. 83C1 18 ADD ECX,18 ; |
00425004 |. 51 PUSH ECX ; |Arg1
00425005 |. 8B4D C4 MOV ECX,DWORD PTR SS:[EBP-3C] ; |
00425008 |. E8 6CC8FFFF CALL 00421879 ; \00421879
青龙的MCALL动画出现。
0042500D |. 8B55 C4 MOV EDX,DWORD PTR SS:[EBP-3C]
00425010 |. C782 B0040000 >MOV DWORD PTR DS:[EDX+4B0],0
0042501A |. C645 DC 00 MOV BYTE PTR SS:[EBP-24],0
再次清空[EBP-24]作为循环计数器。
0042501E |> 8B45 DC /MOV EAX,DWORD PTR SS:[EBP-24]
00425021 |. 25 FF000000 |AND EAX,0FF
00425026 |. 83F8 05 |CMP EAX,5
00425029 |. 0F8D A1010000 |JGE 004251D0
[EBP-24]大于等于5跳出循环，要修改攻击次数的第二个地方，注意要不大于第一个地方的数值。
0042502F |. 8B4D D0 |MOV ECX,DWORD PTR SS:[EBP-30]
00425032 |. 81E1 FF000000 |AND ECX,0FF
00425038 |. 51 |PUSH ECX ; /Arg1
00425039 |. E8 D5AA0500 |CALL 0047FB13 ; \0047FB13
0042503E |. 83C4 04 |ADD ESP,4
00425041 |. 8945 E0 |MOV DWORD PTR SS:[EBP-20],EAX
根据[EBP-30]的数值取出随机数，并存入[EBP-20]中。为什么有的敌人会被攻击多次，原因就是这里。
00425044 |. 8B55 C4 |MOV EDX,DWORD PTR SS:[EBP-3C]
00425047 |. 8B45 E0 |MOV EAX,DWORD PTR SS:[EBP-20]
0042504A |. 8A4C05 E4 |MOV CL,BYTE PTR SS:[EBP+EAX-1C]
0042504E |. 884A 0D |MOV BYTE PTR DS:[EDX+D],CL
00425051 |. 8B55 C4 |MOV EDX,DWORD PTR SS:[EBP-3C]
00425054 |. 8B45 C4 |MOV EAX,DWORD PTR SS:[EBP-3C]
00425057 |. 8A48 0D |MOV CL,BYTE PTR DS:[EAX+D]
0042505A |. 884A 0C |MOV BYTE PTR DS:[EDX+C],CL
根据随机数，调出497AF8+随机数+DH位置的敌人作为当前被攻击敌人来计算伤害、动画处理等。
0042505D |. 8B55 C4 |MOV EDX,DWORD PTR SS:[EBP-3C]
00425060 |. 33C0 |XOR EAX,EAX
00425062 |. 8A42 0C |MOV AL,BYTE PTR DS:[EDX+C]
00425065 |. 8BC8 |MOV ECX,EAX
00425067 |. 6BC9 24 |IMUL ECX,ECX,24
0042506A |. 81C1 502C4B00 |ADD ECX,004B2C50
00425070 |. E8 1BDC0400 |CALL 00472C90
00425075 |. 85C0 |TEST EAX,EAX
00425077 |. 75 41 |JNZ SHORT 004250BA
00425079 |. 8A4D D0 |MOV CL,BYTE PTR SS:[EBP-30]
0042507C |. 80E9 01 |SUB CL,1
0042507F |. 884D D0 |MOV BYTE PTR SS:[EBP-30],CL
00425082 |. 8B55 D0 |MOV EDX,DWORD PTR SS:[EBP-30]
00425085 |. 81E2 FF000000 |AND EDX,0FF
0042508B |. 8B45 E0 |MOV EAX,DWORD PTR SS:[EBP-20]
0042508E |. 8A4C15 E4 |MOV CL,BYTE PTR SS:[EBP+EDX-1C]
00425092 |. 884C05 E4 |MOV BYTE PTR SS:[EBP+EAX-1C],CL
00425096 |. 8B55 D0 |MOV EDX,DWORD PTR SS:[EBP-30]
00425099 |. 81E2 FF000000 |AND EDX,0FF
0042509F |. C64415 E4 FF |MOV BYTE PTR SS:[EBP+EDX-1C],0FF
004250A4 |. 8B45 D0 |MOV EAX,DWORD PTR SS:[EBP-30]
004250A7 |. 25 FF000000 |AND EAX,0FF
004250AC |. 85C0 |TEST EAX,EAX
004250AE |. 75 05 |JNZ SHORT 004250B5
004250B0 |. E9 1B010000 |JMP 004251D0
004250B5 |>^E9 64FFFFFF |JMP 0042501E
前面一段的作用是根据当前被攻击敌人是否已经HP为0，是就要将这个敌人从被攻击的总名单中删除。
004250BA |> 8A4D DC |MOV CL,BYTE PTR SS:[EBP-24]
004250BD |. 80C1 01 |ADD CL,1
004250C0 |. 884D DC |MOV BYTE PTR SS:[EBP-24],CL
004250C3 |. 6A 00 |PUSH 0
004250C5 |. 8B55 C4 |MOV EDX,DWORD PTR SS:[EBP-3C]
004250C8 |. 8A02 |MOV AL,BYTE PTR DS:[EDX]
004250CA |. 50 |PUSH EAX
004250CB |. 8B4D C4 |MOV ECX,DWORD PTR SS:[EBP-3C]
004250CE |. 33D2 |XOR EDX,EDX
004250D0 |. 8A51 0C |MOV DL,BYTE PTR DS:[ECX+C]
004250D3 |. 8BCA |MOV ECX,EDX
004250D5 |. 6BC9 24 |IMUL ECX,ECX,24
004250D8 |. 81C1 502C4B00 |ADD ECX,004B2C50
004250DE |. E8 8DA50300 |CALL 0045F670
004250E3 |. 6BC0 48 |IMUL EAX,EAX,48 ; |
004250E6 |. 05 681B4A00 |ADD EAX,004A1B68 ; |
004250EB |. 50 |PUSH EAX ; |Arg2
004250EC |. 8B45 C4 |MOV EAX,DWORD PTR SS:[EBP-3C] ; |
004250EF |. 33C9 |XOR ECX,ECX ; |
004250F1 |. 8A48 0C |MOV CL,BYTE PTR DS:[EAX+C] ; |
004250F4 |. 6BC9 24 |IMUL ECX,ECX,24 ; |
004250F7 |. 81C1 502C4B00 |ADD ECX,004B2C50 ; |
004250FD |. 51 |PUSH ECX ; |Arg1
004250FE |. 8B55 C4 |MOV EDX,DWORD PTR SS:[EBP-3C] ; |
00425101 |. 8B4A 08 |MOV ECX,DWORD PTR DS:[EDX+8] ; |
00425104 |. E8 A16E0100 |CALL 0043BFAA ; \0043BFAA
00425109 |. 8B4D C4 |MOV ECX,DWORD PTR SS:[EBP-3C]
0042510C |. 8981 84000000 |MOV DWORD PTR DS:[ECX+84],EAX
00425112 |. 8B55 C4 |MOV EDX,DWORD PTR SS:[EBP-3C]
00425115 |. 83BA 84000000 >|CMP DWORD PTR DS:[EDX+84],0
0042511C |. 75 0C |JNZ SHORT 0042512A
0042511E |. 8B45 C4 |MOV EAX,DWORD PTR SS:[EBP-3C]
00425121 |. C680 55020000 >|MOV BYTE PTR DS:[EAX+255],0
00425128 |. EB 0A |JMP SHORT 00425134
0042512A |> 8B4D C4 |MOV ECX,DWORD PTR SS:[EBP-3C]
0042512D |. C681 55020000 >|MOV BYTE PTR DS:[ECX+255],40
00425134 |> 6A 00 |PUSH 0 ; /Arg1 = 00000000
00425136 |. 8B4D C4 |MOV ECX,DWORD PTR SS:[EBP-3C] ; |
00425139 |. E8 BDBDFFFF |CALL 00420EFB ; \00420EFB
0042513E |. 8B55 C4 |MOV EDX,DWORD PTR SS:[EBP-3C]
00425141 |. 3B82 D0020000 |CMP EAX,DWORD PTR DS:[EDX+2D0]
00425147 |. 76 0F |JBE SHORT 00425158
00425149 |. 6A 00 |PUSH 0 ; /Arg1 = 00000000
0042514B |. 8B4D C4 |MOV ECX,DWORD PTR SS:[EBP-3C] ; |
0042514E |. E8 A8BDFFFF |CALL 00420EFB ; \00420EFB
00425153 |. 8945 C0 |MOV DWORD PTR SS:[EBP-40],EAX
00425156 |. EB 0C |JMP SHORT 00425164
00425158 |> 8B45 C4 |MOV EAX,DWORD PTR SS:[EBP-3C]
0042515B |. 8B88 D0020000 |MOV ECX,DWORD PTR DS:[EAX+2D0]
00425161 |. 894D C0 |MOV DWORD PTR SS:[EBP-40],ECX
00425164 |> 8B55 C4 |MOV EDX,DWORD PTR SS:[EBP-3C]
00425167 |. 8B45 C0 |MOV EAX,DWORD PTR SS:[EBP-40]
0042516A |. 8982 D0020000 |MOV DWORD PTR DS:[EDX+2D0],EAX
00425170 |. 8B4D C4 |MOV ECX,DWORD PTR SS:[EBP-3C]
00425173 |. E8 13C1FFFF |CALL 0042128B
00425178 |. 8B4D C4 |MOV ECX,DWORD PTR SS:[EBP-3C]
0042517B |. 3B81 D4020000 |CMP EAX,DWORD PTR DS:[ECX+2D4]
00425181 |. 76 0D |JBE SHORT 00425190
00425183 |. 8B4D C4 |MOV ECX,DWORD PTR SS:[EBP-3C]
00425186 |. E8 00C1FFFF |CALL 0042128B
0042518B |. 8945 BC |MOV DWORD PTR SS:[EBP-44],EAX
0042518E |. EB 0C |JMP SHORT 0042519C
00425190 |> 8B55 C4 |MOV EDX,DWORD PTR SS:[EBP-3C]
00425193 |. 8B82 D4020000 |MOV EAX,DWORD PTR DS:[EDX+2D4]
00425199 |. 8945 BC |MOV DWORD PTR SS:[EBP-44],EAX
0042519C |> 8B4D C4 |MOV ECX,DWORD PTR SS:[EBP-3C]
0042519F |. 8B55 BC |MOV EDX,DWORD PTR SS:[EBP-44]
004251A2 |. 8991 D4020000 |MOV DWORD PTR DS:[ECX+2D4],EDX
004251A8 |. 6A 00 |PUSH 0 ; /Arg1 = 00000000
004251AA |. 8B4D C4 |MOV ECX,DWORD PTR SS:[EBP-3C] ; |
004251AD |. E8 F1C1FFFF |CALL 004213A3 ; \004213A3
004251B2 |. 8B4D C4 |MOV ECX,DWORD PTR SS:[EBP-3C]
004251B5 |. 8981 D8020000 |MOV DWORD PTR DS:[ECX+2D8],EAX
004251BB |. 8B4D C4 |MOV ECX,DWORD PTR SS:[EBP-3C]
004251BE |. E8 FCC2FFFF |CALL 004214BF
004251C3 |. 8B4D C4 |MOV ECX,DWORD PTR SS:[EBP-3C]
004251C6 |. E8 DDD2FFFF |CALL 004224A8
004251CB |.^E9 4EFEFFFF \JMP 0042501E
之后的伤害计算，经验处理，动画处理和真正效果处理就不解释了，注意动画处理和真正效果处理是每一次循环都要用一次，与之前的那些效果函数不同。
004251D0 |> 8B55 C4 MOV EDX,DWORD PTR SS:[EBP-3C]
004251D3 |. C782 AC040000 >MOV DWORD PTR DS:[EDX+4AC],1
004251DD |> 8BE5 MOV ESP,EBP
004251DF |. 5D POP EBP
004251E0 \. C3 RETN[/font]
[color=Silver][[i] 本帖最后由 godtype 于 2010-4-12 10:48 编辑 [/i]][/color]
2010-3-26 22:09
godtype
[font=宋体][b][size=2]十二、四神之玄武[/size][/b]
00425964 |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00425967 |. C680 54020000 >MOV BYTE PTR DS:[EAX+254],0FF
0042596E |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425971 |. E8 9AEEFFFF CALL 00424810
00425976 |. EB 1E JMP SHORT 00425996
00424810 /$ 55 PUSH EBP
00424811 |. 8BEC MOV EBP,ESP
00424813 |. 83EC 2C SUB ESP,2C
00424816 |. 894D E4 MOV DWORD PTR SS:[EBP-1C],ECX
00424819 |. C645 F8 00 MOV BYTE PTR SS:[EBP-8],0
0042481D |. C645 FC 00 MOV BYTE PTR SS:[EBP-4],0
00424821 |. EB 08 JMP SHORT 0042482B
00424823 |> 8A45 FC /MOV AL,BYTE PTR SS:[EBP-4]
00424826 |. 04 01 |ADD AL,1
00424828 |. 8845 FC |MOV BYTE PTR SS:[EBP-4],AL
0042482B |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042482E |. 81E1 FF000000 |AND ECX,0FF
00424834 |. 83F9 73 |CMP ECX,73
00424837 |. 7D 58 |JGE SHORT 00424891
00424839 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
0042483C |. 81E1 FF000000 |AND ECX,0FF
00424842 |. 6BC9 24 |IMUL ECX,ECX,24
00424845 |. 81C1 502C4B00 |ADD ECX,004B2C50
0042484B |. E8 4044FFFF |CALL 00418C90
00424850 |. 25 FF000000 |AND EAX,0FF
00424855 |. 83F8 02 |CMP EAX,2
00424858 |. 75 35 |JNZ SHORT 0042488F
0042485A |. 8B55 E4 |MOV EDX,DWORD PTR SS:[EBP-1C]
0042485D |. 8A42 0C |MOV AL,BYTE PTR DS:[EDX+C]
00424860 |. 50 |PUSH EAX ; /Arg2
00424861 |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C] ; |
00424864 |. 8A11 |MOV DL,BYTE PTR DS:[ECX] ; |
00424866 |. 52 |PUSH EDX ; |Arg1
00424867 |. E8 0EC1FFFF |CALL 0042097A ; \0042097A
0042486C |. 83C4 08 |ADD ESP,8
0042486F |. 85C0 |TEST EAX,EAX
00424871 |. 75 02 |JNZ SHORT 00424875
00424873 |.^EB AE |JMP SHORT 00424823
00424875 |> 8B45 F8 |MOV EAX,DWORD PTR SS:[EBP-8]
00424878 |. 25 FF000000 |AND EAX,0FF
0042487D |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C]
00424880 |. 8A55 FC |MOV DL,BYTE PTR SS:[EBP-4]
00424883 |. 885401 0D |MOV BYTE PTR DS:[ECX+EAX+D],DL
00424887 |. 8A45 F8 |MOV AL,BYTE PTR SS:[EBP-8]
0042488A |. 04 01 |ADD AL,1
0042488C |. 8845 F8 |MOV BYTE PTR SS:[EBP-8],AL
0042488F |>^EB 92 \JMP SHORT 00424823
前面部分与砂暴类似，确定在战场上哪些人受到玄武的影响，不分敌我。
00424891 |> C645 FC 00 MOV BYTE PTR SS:[EBP-4],0
00424895 |. EB 09 JMP SHORT 004248A0
00424897 |> 8A4D FC /MOV CL,BYTE PTR SS:[EBP-4]
0042489A |. 80C1 01 |ADD CL,1
0042489D |. 884D FC |MOV BYTE PTR SS:[EBP-4],CL
004248A0 |> 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
004248A3 |. 81E2 FF000000 |AND EDX,0FF
004248A9 |. 8B45 E4 |MOV EAX,DWORD PTR SS:[EBP-1C]
004248AC |. 33C9 |XOR ECX,ECX
004248AE |. 8A4C10 0D |MOV CL,BYTE PTR DS:[EAX+EDX+D]
004248B2 |. 81F9 FF000000 |CMP ECX,0FF
004248B8 |. 0F84 AD010000 |JE 00424A6B
004248BE |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
004248C1 |. 81E2 FF000000 |AND EDX,0FF
004248C7 |. 8B45 E4 |MOV EAX,DWORD PTR SS:[EBP-1C]
004248CA |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C]
004248CD |. 8A5411 0D |MOV DL,BYTE PTR DS:[ECX+EDX+D]
004248D1 |. 8850 0C |MOV BYTE PTR DS:[EAX+C],DL
004248D4 |. 6A 07 |PUSH 7 ; /Arg1 = 00000007
004248D6 |. E8 38B20500 |CALL 0047FB13 ; \0047FB13
004248DB |. 83C4 04 |ADD ESP,4
004248DE |. 8945 E0 |MOV DWORD PTR SS:[EBP-20],EAX
004248E1 |. 837D E0 06 |CMP DWORD PTR SS:[EBP-20],6
004248E5 |. 0F87 E4000000 |JA 004249CF
004248EB |. 8B45 E0 |MOV EAX,DWORD PTR SS:[EBP-20]
004248EE |. FF2485 214E420>|JMP DWORD PTR DS:[EAX*4+424E21]
在0--6这7个数中随机取出一个保存进[EBP-20]里面，也就是7种不同的策略效果。然后按照随机数，根据424E21开始的分支表进行跳转：
00424E21 . F5484200 DD 004248F5 ; Switch table used at 004248EE
00424E25 . 0E494200 DD 0042490E
00424E29 . 26494200 DD 00424926
00424E2D . 3F494200 DD 0042493F
00424E31 . 55494200 DD 00424955
00424E35 . 6A494200 DD 0042496A
00424E39 . 80494200 DD 00424980
004248F5 |> 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
004248F8 |. 81E1 FF000000 |AND ECX,0FF
004248FE |. 8B55 E4 |MOV EDX,DWORD PTR SS:[EBP-1C]
00424901 |. C6840A 5502000>|MOV BYTE PTR DS:[EDX+ECX+255],71
00424909 |. E9 C1000000 |JMP 004249CF
混乱效果
0042490E |> 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4]
00424911 |. 25 FF000000 |AND EAX,0FF
00424916 |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C]
00424919 |. C68401 5502000>|MOV BYTE PTR DS:[ECX+EAX+255],72
00424921 |. E9 A9000000 |JMP 004249CF
麻痹效果
00424926 |> 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
00424929 |. 81E2 FF000000 |AND EDX,0FF
0042492F |. 8B45 E4 |MOV EAX,DWORD PTR SS:[EBP-1C]
00424932 |. C68410 5502000>|MOV BYTE PTR DS:[EAX+EDX+255],74
0042493A |. E9 90000000 |JMP 004249CF
封咒效果
0042493F |> 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
00424942 |. 81E1 FF000000 |AND ECX,0FF
00424948 |. 8B55 E4 |MOV EDX,DWORD PTR SS:[EBP-1C]
0042494B |. C6840A 5502000>|MOV BYTE PTR DS:[EDX+ECX+255],70
00424953 |. EB 7A |JMP SHORT 004249CF
中毒效果
00424955 |> 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4]
00424958 |. 25 FF000000 |AND EAX,0FF
0042495D |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C]
00424960 |. C68401 5502000>|MOV BYTE PTR DS:[ECX+EAX+255],6F
00424968 |. EB 65 |JMP SHORT 004249CF
反霸气效果
0042496A |> 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
0042496D |. 81E2 FF000000 |AND EDX,0FF
00424973 |. 8B45 E4 |MOV EAX,DWORD PTR SS:[EBP-1C]
00424976 |. C68410 5502000>|MOV BYTE PTR DS:[EAX+EDX+255],0AF
0042497E |. EB 4F |JMP SHORT 004249CF
霸气效果
00424980 |> 6A 00 |PUSH 0 ; /Arg3 = 00000000
00424982 |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C] ; |
00424985 |. 8A51 01 |MOV DL,BYTE PTR DS:[ECX+1] ; |
00424988 |. 52 |PUSH EDX ; |Arg2
00424989 |. 8B45 E4 |MOV EAX,DWORD PTR SS:[EBP-1C] ; |
0042498C |. 8A08 |MOV CL,BYTE PTR DS:[EAX] ; |
0042498E |. 51 |PUSH ECX ; |Arg1
0042498F |. 8B55 E4 |MOV EDX,DWORD PTR SS:[EBP-1C] ; |
00424992 |. 33C0 |XOR EAX,EAX ; |
00424994 |. 8A42 0C |MOV AL,BYTE PTR DS:[EDX+C] ; |
00424997 |. 8BC8 |MOV ECX,EAX ; |
00424999 |. 6BC9 24 |IMUL ECX,ECX,24 ; |
0042499C |. 81C1 502C4B00 |ADD ECX,004B2C50 ; |
004249A2 |. E8 A17B0100 |CALL 0043C548 ; \0043C548
004249A7 |. F7D8 |NEG EAX
004249A9 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
004249AC |. 81E1 FF000000 |AND ECX,0FF
004249B2 |. 8B55 E4 |MOV EDX,DWORD PTR SS:[EBP-1C]
004249B5 |. 89848A 8400000>|MOV DWORD PTR DS:[EDX+ECX*4+84],EAX
004249BC |. 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4]
004249BF |. 25 FF000000 |AND EAX,0FF
004249C4 |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C]
004249C7 |. C68401 5502000>|MOV BYTE PTR DS:[ECX+EAX+255],80
HP恢复
004249CF |> 8A55 FC |MOV DL,BYTE PTR SS:[EBP-4]
004249D2 |. 52 |PUSH EDX ; /Arg1
004249D3 |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C] ; |
004249D6 |. E8 20C5FFFF |CALL 00420EFB ; \00420EFB
004249DB |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C]
004249DE |. 3B81 D0020000 |CMP EAX,DWORD PTR DS:[ECX+2D0]
004249E4 |. 76 11 |JBE SHORT 004249F7
004249E6 |. 8A55 FC |MOV DL,BYTE PTR SS:[EBP-4]
004249E9 |. 52 |PUSH EDX ; /Arg1
004249EA |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C] ; |
004249ED |. E8 09C5FFFF |CALL 00420EFB ; \00420EFB
004249F2 |. 8945 DC |MOV DWORD PTR SS:[EBP-24],EAX
004249F5 |. EB 0C |JMP SHORT 00424A03
004249F7 |> 8B45 E4 |MOV EAX,DWORD PTR SS:[EBP-1C]
004249FA |. 8B88 D0020000 |MOV ECX,DWORD PTR DS:[EAX+2D0]
00424A00 |. 894D DC |MOV DWORD PTR SS:[EBP-24],ECX
00424A03 |> 8B55 E4 |MOV EDX,DWORD PTR SS:[EBP-1C]
00424A06 |. 8B45 DC |MOV EAX,DWORD PTR SS:[EBP-24]
00424A09 |. 8982 D0020000 |MOV DWORD PTR DS:[EDX+2D0],EAX
00424A0F |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C]
00424A12 |. E8 74C8FFFF |CALL 0042128B
00424A17 |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C]
00424A1A |. 3B81 D4020000 |CMP EAX,DWORD PTR DS:[ECX+2D4]
00424A20 |. 76 0D |JBE SHORT 00424A2F
00424A22 |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C]
00424A25 |. E8 61C8FFFF |CALL 0042128B
00424A2A |. 8945 D8 |MOV DWORD PTR SS:[EBP-28],EAX
00424A2D |. EB 0C |JMP SHORT 00424A3B
00424A2F |> 8B55 E4 |MOV EDX,DWORD PTR SS:[EBP-1C]
00424A32 |. 8B82 D4020000 |MOV EAX,DWORD PTR DS:[EDX+2D4]
00424A38 |. 8945 D8 |MOV DWORD PTR SS:[EBP-28],EAX
00424A3B |> 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C]
00424A3E |. 8B55 D8 |MOV EDX,DWORD PTR SS:[EBP-28]
00424A41 |. 8991 D4020000 |MOV DWORD PTR DS:[ECX+2D4],EDX
00424A47 |. 8A45 FC |MOV AL,BYTE PTR SS:[EBP-4]
00424A4A |. 50 |PUSH EAX ; /Arg1
00424A4B |. 8B4D E4 |MOV ECX,DWORD PTR SS:[EBP-1C] ; |
00424A4E |. E8 50C9FFFF |CALL 004213A3 ; \004213A3
00424A53 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
00424A56 |. 81E1 FF000000 |AND ECX,0FF
00424A5C |. 8B55 E4 |MOV EDX,DWORD PTR SS:[EBP-1C]
00424A5F |. 89848A D802000>|MOV DWORD PTR DS:[EDX+ECX*4+2D8],EAX
00424A66 |.^E9 2CFEFFFF \JMP 00424897
经过获得各种经验的处理后，跳回到前面继续循环。
00424A6B |> 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C]
00424A6E |. E8 4CCAFFFF CALL 004214BF
动画处理
下面接着的是真正的附加效果。
00424A73 |. 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C]
00424A76 |. E8 D7090000 CALL 00425452
00424A7B |. B9 083D4B00 MOV ECX,004B3D08
00424A80 |. E8 4B78FFFF CALL 0041C2D0
00424A85 |. 25 FF000000 AND EAX,0FF
00424A8A |. 99 CDQ
00424A8B |. 33C2 XOR EAX,EDX
00424A8D |. 2BC2 SUB EAX,EDX
00424A8F |. 83E0 03 AND EAX,3
00424A92 |. 33C2 XOR EAX,EDX
00424A94 |. 2BC2 SUB EAX,EDX
00424A96 |. 83F8 02 CMP EAX,2
00424A99 |. 7D 14 JGE SHORT 00424AAF
00424A9B |. B9 083D4B00 MOV ECX,004B3D08
00424AA0 |. E8 8B1CFEFF CALL 00406730
00424AA5 |. B9 083D4B00 MOV ECX,004B3D08
00424AAA |. E8 811CFEFF CALL 00406730
00424AAF |> B9 50424B00 MOV ECX,004B4250
00424AB4 |. E8 5AF00200 CALL 00453B13
00424AB9 |. C645 FC 00 MOV BYTE PTR SS:[EBP-4],0
00424ABD |. EB 08 JMP SHORT 00424AC7
00424ABF |> 8A45 FC MOV AL,BYTE PTR SS:[EBP-4]
00424AC2 |. 04 01 ADD AL,1
00424AC4 |. 8845 FC MOV BYTE PTR SS:[EBP-4],AL
00424AC7 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424ACA |. 81E1 FF000000 AND ECX,0FF
00424AD0 |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424AD3 |. 33C0 XOR EAX,EAX
00424AD5 |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424AD9 |. 3D FF000000 CMP EAX,0FF
00424ADE |. 0F84 2C030000 JE 00424E10
00424AE4 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424AE7 |. 81E1 FF000000 AND ECX,0FF
00424AED |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424AF0 |. 33C0 XOR EAX,EAX
00424AF2 |. 8A840A 5502000>MOV AL,BYTE PTR DS:[EDX+ECX+255]
00424AF9 |. 8945 D4 MOV DWORD PTR SS:[EBP-2C],EAX
00424AFC |. 8B4D D4 MOV ECX,DWORD PTR SS:[EBP-2C]
00424AFF |. 83E9 6F SUB ECX,6F
00424B02 |. 894D D4 MOV DWORD PTR SS:[EBP-2C],ECX
00424B05 |. 837D D4 40 CMP DWORD PTR SS:[EBP-2C],40
00424B09 |. 0F87 E3010000 JA 00424CF2
00424B0F |. 8B45 D4 MOV EAX,DWORD PTR SS:[EBP-2C]
00424B12 |. 33D2 XOR EDX,EDX
00424B14 |. 8A90 5D4E4200 MOV DL,BYTE PTR DS:[EAX+424E5D]
00424B1A |. FF2495 3D4E420>JMP DWORD PTR DS:[EDX*4+424E3D]
从497AF8+计数器+255H中取出效果标识，减去前面的6F（因为在玄武中真正起作用的效果对应的标识是从6F开始），保存入[EBP-2C]里面，然后按照随机数，根据424E3D开始的分支表进行跳转：
00424E3D . 214B4200 DD 00424B21 ; Switch table used at 00424B1A
00424E41 . B24B4200 DD 00424BB2
00424E45 . 924B4200 DD 00424B92
00424E49 . D24B4200 DD 00424BD2
00424E4D . F24B4200 DD 00424BF2
00424E51 . 9B4C4200 DD 00424C9B
00424E55 . 124C4200 DD 00424C12
00424E59 . F24C4200 DD 00424CF2
效果标识6F反霸气从这里开始
00424B21 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424B24 |. 81E1 FF000000 AND ECX,0FF
00424B2A |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424B2D |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424B31 |. 50 PUSH EAX ; /Arg2
00424B32 |. 6A 17 PUSH 17 ; |Arg1 = 00000017
00424B34 |. E8 79C1FFFF CALL 00420CB2 ; \00420CB2
00424B39 |. 83C4 08 ADD ESP,8
420CB2是真正的五围上升下降函数，其中08栈的17表示降爆发
00424B3C |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424B3F |. 81E1 FF000000 AND ECX,0FF
00424B45 |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424B48 |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424B4C |. 50 PUSH EAX ; /Arg2
00424B4D |. 6A 19 PUSH 19 ; |Arg1 = 00000019
00424B4F |. E8 5EC1FFFF CALL 00420CB2 ; \00420CB2
00424B54 |. 83C4 08 ADD ESP,8
420CB2的08栈的19表示降士气
00424B57 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424B5A |. 81E1 FF000000 AND ECX,0FF
00424B60 |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424B63 |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424B67 |. 50 PUSH EAX ; /Arg2
00424B68 |. 6A 1B PUSH 1B ; |Arg1 = 0000001B
00424B6A |. E8 43C1FFFF CALL 00420CB2 ; \00420CB2
00424B6F |. 83C4 08 ADD ESP,8
420CB2的08栈的1B表示降能力（武攻文精）
00424B72 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424B75 |. 81E1 FF000000 AND ECX,0FF
00424B7B |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424B7E |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424B82 |. 50 PUSH EAX ; /Arg2
00424B83 |. 6A 1D PUSH 1D ; |Arg1 = 0000001D
00424B85 |. E8 28C1FFFF CALL 00420CB2 ; \00420CB2
00424B8A |. 83C4 08 ADD ESP,8
00424B8D |. E9 60010000 JMP 00424CF2
四种下降效果都执行一次后，反霸气就正式完成了，然后跳到后面。
效果标识70中毒效果从这里开始
00424B92 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424B95 |. 81E1 FF000000 AND ECX,0FF
00424B9B |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424B9E |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424BA2 |. 50 PUSH EAX ; /Arg2
00424BA3 |. 6A 1F PUSH 1F ; |Arg1 = 0000001F
00424BA5 |. E8 7BC2FFFF CALL 00420E25 ; \00420E25
00424BAA |. 83C4 08 ADD ESP,8
00424BAD |. E9 40010000 JMP 00424CF2
420E25是真正的异常状态产生和取消函数，其中08栈的1F表示增加中毒状态。
效果标识71混乱效果从这里开始
00424BB2 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424BB5 |. 81E1 FF000000 AND ECX,0FF
00424BBB |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424BBE |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424BC2 |. 50 PUSH EAX ; /Arg2
00424BC3 |. 6A 21 PUSH 21 ; |Arg1 = 00000021
00424BC5 |. E8 5BC2FFFF CALL 00420E25 ; \00420E25
00424BCA |. 83C4 08 ADD ESP,8
00424BCD |. E9 20010000 JMP 00424CF2
420E25的08栈的21表示增加混乱状态。
效果标识72麻痹效果从这里开始
00424BD2 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424BD5 |. 81E1 FF000000 AND ECX,0FF
00424BDB |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424BDE |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424BE2 |. 50 PUSH EAX ; /Arg2
00424BE3 |. 6A 23 PUSH 23 ; |Arg1 = 00000023
00424BE5 |. E8 3BC2FFFF CALL 00420E25 ; \00420E25
00424BEA |. 83C4 08 ADD ESP,8
00424BED |. E9 00010000 JMP 00424CF2
420E25的08栈的23表示增加麻痹状态。
效果标识74封咒效果从这里开始
00424BF2 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424BF5 |. 81E1 FF000000 AND ECX,0FF
00424BFB |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424BFE |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424C02 |. 50 PUSH EAX ; /Arg2
00424C03 |. 6A 25 PUSH 25 ; |Arg1 = 00000025
00424C05 |. E8 1BC2FFFF CALL 00420E25 ; \00420E25
00424C0A |. 83C4 08 ADD ESP,8
00424C0D |. E9 E0000000 JMP 00424CF2
420E25的08栈的25表示增加封咒状态。
效果标识AF霸气效果从这里开始
00424C12 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424C15 |. 81E1 FF000000 AND ECX,0FF
00424C1B |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424C1E |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424C22 |. 50 PUSH EAX ; /Arg2
00424C23 |. 6A 31 PUSH 31 ; |Arg1 = 00000031
00424C25 |. E8 88C0FFFF CALL 00420CB2 ; \00420CB2
00424C2A |. 83C4 08 ADD ESP,8
00424C2D |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424C30 |. 81E1 FF000000 AND ECX,0FF
00424C36 |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424C39 |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424C3D |. 50 PUSH EAX ; /Arg2
00424C3E |. 6A 33 PUSH 33 ; |Arg1 = 00000033
00424C40 |. E8 6DC0FFFF CALL 00420CB2 ; \00420CB2
00424C45 |. 83C4 08 ADD ESP,8
00424C48 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424C4B |. 81E1 FF000000 AND ECX,0FF
00424C51 |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424C54 |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424C58 |. 50 PUSH EAX ; /Arg2
00424C59 |. 6A 35 PUSH 35 ; |Arg1 = 00000035
00424C5B |. E8 52C0FFFF CALL 00420CB2 ; \00420CB2
00424C60 |. 83C4 08 ADD ESP,8
00424C63 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424C66 |. 81E1 FF000000 AND ECX,0FF
00424C6C |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424C6F |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424C73 |. 50 PUSH EAX ; /Arg2
00424C74 |. 6A 37 PUSH 37 ; |Arg1 = 00000037
00424C76 |. E8 37C0FFFF CALL 00420CB2 ; \00420CB2
00424C7B |. 83C4 08 ADD ESP,8
00424C7E |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424C81 |. 81E1 FF000000 AND ECX,0FF
00424C87 |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424C8A |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424C8E |. 50 PUSH EAX ; /Arg2
00424C8F |. 6A 30 PUSH 30 ; |Arg1 = 00000030
00424C91 |. E8 1CC0FFFF CALL 00420CB2 ; \00420CB2
00424C96 |. 83C4 08 ADD ESP,8
00424C99 |. EB 57 JMP SHORT 00424CF2
420CB2的08栈的30表示加移动、31加爆发、33加士气、35加能力、37加防御，五种上升效果都执行一次后，霸气就正式完成了，然后跳到后面。
效果标识80HP恢复效果从这里开始
00424C9B |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424C9E |. 81E1 FF000000 AND ECX,0FF
00424CA4 |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424CA7 |. 33C0 XOR EAX,EAX
00424CA9 |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424CAD |. 8BC8 MOV ECX,EAX
00424CAF |. 6BC9 24 IMUL ECX,ECX,24
00424CB2 |. 81C1 502C4B00 ADD ECX,004B2C50
00424CB8 |. E8 D3DF0400 CALL 00472C90
00424CBD |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424CC0 |. 81E1 FF000000 AND ECX,0FF
00424CC6 |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424CC9 |. 2B848A 8400000>SUB EAX,DWORD PTR DS:[EDX+ECX*4+84]
00424CD0 |. 50 PUSH EAX ; /Arg1
00424CD1 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; |
00424CD4 |. 25 FF000000 AND EAX,0FF ; |
00424CD9 |. 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C] ; |
00424CDC |. 33D2 XOR EDX,EDX ; |
00424CDE |. 8A5401 0D MOV DL,BYTE PTR DS:[ECX+EAX+D] ; |
00424CE2 |. 8BCA MOV ECX,EDX ; |
00424CE4 |. 6BC9 24 IMUL ECX,ECX,24 ; |
00424CE7 |. 81C1 502C4B00 ADD ECX,004B2C50 ; |
00424CED |. E8 DBA90100 CALL 0043F6CD ; \0043F6CD
472C90是获取武将当前的HP，43F6CD是将08栈的值加进武将当前的HP中（不超过加上装备的最大值）。
00424CF2 |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00424CF5 |. 25 FF000000 AND EAX,0FF
00424CFA |. 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C]
00424CFD |. 33D2 XOR EDX,EDX
00424CFF |. 8A9401 5502000>MOV DL,BYTE PTR DS:[ECX+EAX+255]
00424D06 |. 85D2 TEST EDX,EDX
00424D08 |. 0F84 FD000000 JE 00424E0B
00424D0E |. E8 CD770000 CALL 0042C4E0
00424D13 |. 6A 01 PUSH 1 ; /Arg2 = 00000001
00424D15 |. 6A 7C PUSH 7C ; |Arg1 = 0000007C
00424D17 |. B9 B0694B00 MOV ECX,004B69B0 ; |
00424D1C |. E8 59F90400 CALL 0047467A ; \0047467A
00424D21 |. 6A 02 PUSH 2 ; /Arg1 = 00000002
00424D23 |. B9 181B4B00 MOV ECX,004B1B18 ; |
00424D28 |. E8 13E6FDFF CALL 00403340 ; \00403340
00424D2D |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00424D30 |. 25 FF000000 AND EAX,0FF
00424D35 |. 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C]
00424D38 |. 33D2 XOR EDX,EDX
00424D3A |. 8A5401 0D MOV DL,BYTE PTR DS:[ECX+EAX+D]
00424D3E |. 8BCA MOV ECX,EDX
00424D40 |. 6BC9 24 IMUL ECX,ECX,24
00424D43 |. 81C1 502C4B00 ADD ECX,004B2C50
00424D49 |. E8 12E6FDFF CALL 00403360
00424D4E |. 50 PUSH EAX ; /Arg1
00424D4F |. 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C] ; |
00424D52 |. 81C1 CB020000 ADD ECX,2CB ; |
00424D58 |. E8 4318FEFF CALL 004065A0 ; \004065A0
00424D5D |. 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]
00424D60 |. 8A88 CC020000 MOV CL,BYTE PTR DS:[EAX+2CC]
00424D66 |. 51 PUSH ECX ; /Arg2
00424D67 |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C] ; |
00424D6A |. 8A82 CB020000 MOV AL,BYTE PTR DS:[EDX+2CB] ; |
00424D70 |. 50 PUSH EAX ; |Arg1
00424D71 |. B9 50424B00 MOV ECX,004B4250 ; |
00424D76 |. E8 C4020300 CALL 0045503F ; \0045503F
00424D7B |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424D7E |. 81E1 FF000000 AND ECX,0FF
00424D84 |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424D87 |. 33C0 XOR EAX,EAX
00424D89 |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424D8D |. 8BC8 MOV ECX,EAX
00424D8F |. 6BC9 24 IMUL ECX,ECX,24
00424D92 |. 81C1 502C4B00 ADD ECX,004B2C50
00424D98 |. E8 C3E5FDFF CALL 00403360
00424D9D |. 50 PUSH EAX ; /Arg1
00424D9E |. B9 50424B00 MOV ECX,004B4250 ; |
00424DA3 |. E8 2BF70200 CALL 004544D3 ; \004544D3
00424DA8 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424DAB |. 81E1 FF000000 AND ECX,0FF
00424DB1 |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424DB4 |. 33C0 XOR EAX,EAX
00424DB6 |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424DBA |. 8BC8 MOV ECX,EAX
00424DBC |. 6BC9 24 IMUL ECX,ECX,24
00424DBF |. 81C1 502C4B00 ADD ECX,004B2C50
00424DC5 |. E8 96E5FDFF CALL 00403360
00424DCA |. 66:8B08 MOV CX,WORD PTR DS:[EAX]
00424DCD |. 51 PUSH ECX ; /Arg1
00424DCE |. E8 ABAC0200 CALL 0044FA7E ; \0044FA7E
00424DD3 |. 83C4 04 ADD ESP,4
00424DD6 |. 8945 E8 MOV DWORD PTR SS:[EBP-18],EAX
00424DD9 |. 8955 EC MOV DWORD PTR SS:[EBP-14],EDX
00424DDC |. 8B55 E8 MOV EDX,DWORD PTR SS:[EBP-18]
00424DDF |. 8955 F0 MOV DWORD PTR SS:[EBP-10],EDX
00424DE2 |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
00424DE5 |. 8945 F4 MOV DWORD PTR SS:[EBP-C],EAX
00424DE8 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424DEB |. 81E1 FF000000 AND ECX,0FF
00424DF1 |. 8B55 E4 MOV EDX,DWORD PTR SS:[EBP-1C]
00424DF4 |. 33C0 XOR EAX,EAX
00424DF6 |. 8A440A 0D MOV AL,BYTE PTR DS:[EDX+ECX+D]
00424DFA |. 50 PUSH EAX ; /Arg3
00424DFB |. 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C] ; |
00424DFE |. 51 PUSH ECX ; |Arg2
00424DFF |. 8B55 F0 MOV EDX,DWORD PTR SS:[EBP-10] ; |
00424E02 |. 52 PUSH EDX ; |Arg1
00424E03 |. E8 179D0100 CALL 0043EB1F ; \0043EB1F
00424E08 |. 83C4 0C ADD ESP,0C
00424E0B |>^E9 AFFCFFFF JMP 00424ABF
各种效果处理完后，经过一堆不想研究的代码后，跳到前面继续循环。
00424E10 |> 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C]
00424E13 |. C780 AC040000 >MOV DWORD PTR DS:[EAX+4AC],1
00424E1D |. 8BE5 MOV ESP,EBP
00424E1F |. 5D POP EBP
00424E20 \. C3 RETN
00424E21 . F5484200 DD 004248F5 ; Switch table used at 004248EE
00424E25 . 0E494200 DD 0042490E
00424E29 . 26494200 DD 00424926
00424E2D . 3F494200 DD 0042493F
00424E31 . 55494200 DD 00424955
00424E35 . 6A494200 DD 0042496A
00424E39 . 80494200 DD 00424980
00424E3D . 214B4200 DD 00424B21 ; Switch table used at 00424B1A
00424E41 . B24B4200 DD 00424BB2
00424E45 . 924B4200 DD 00424B92
00424E49 . D24B4200 DD 00424BD2
00424E4D . F24B4200 DD 00424BF2
00424E51 . 9B4C4200 DD 00424C9B
00424E55 . 124C4200 DD 00424C12
00424E59 . F24C4200 DD 00424CF2
00424E5D . 00 DB 00 ; Index table to switch 00424E3D
00424E5E . 01 DB 01
00424E5F . 02 DB 02
00424E60 . 03 DB 03
00424E61 . 07 DB 07
00424E62 . 04 DB 04
00424E63 . 07 DB 07
00424E64 . 07 DB 07
00424E65 . 07 DB 07
00424E66 . 07 DB 07
00424E67 . 07 DB 07
00424E68 . 07 DB 07
00424E69 . 07 DB 07
00424E6A . 07 DB 07
00424E6B . 07 DB 07
00424E6C . 07 DB 07
00424E6D . 07 DB 07
00424E6E . 05 DB 05
00424E6F . 07 DB 07
00424E70 . 07 DB 07
00424E71 . 07 DB 07
00424E72 . 07 DB 07
00424E73 . 07 DB 07
00424E74 . 07 DB 07
00424E75 . 07 DB 07
00424E76 . 07 DB 07
00424E77 . 07 DB 07
00424E78 . 07 DB 07
00424E79 . 07 DB 07
00424E7A . 07 DB 07
00424E7B . 07 DB 07
00424E7C . 07 DB 07
00424E7D . 07 DB 07
00424E7E . 07 DB 07
00424E7F . 07 DB 07
00424E80 . 07 DB 07
00424E81 . 07 DB 07
00424E82 . 07 DB 07
00424E83 . 07 DB 07
00424E84 . 07 DB 07
00424E85 . 07 DB 07
00424E86 . 07 DB 07
00424E87 . 07 DB 07
00424E88 . 07 DB 07
00424E89 . 07 DB 07
00424E8A . 07 DB 07
00424E8B . 07 DB 07
00424E8C . 07 DB 07
00424E8D . 07 DB 07
00424E8E . 07 DB 07
00424E8F . 07 DB 07
00424E90 . 07 DB 07
00424E91 . 07 DB 07
00424E92 . 07 DB 07
00424E93 . 07 DB 07
00424E94 . 07 DB 07
00424E95 . 07 DB 07
00424E96 . 07 DB 07
00424E97 . 07 DB 07
00424E98 . 07 DB 07
00424E99 . 07 DB 07
00424E9A . 07 DB 07
00424E9B . 07 DB 07
00424E9C . 07 DB 07
00424E9D . 06 DB 06
[b][size=2]十三、四神之白虎[/size][/b]
00425978 |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0042597B |. C681 54020000 >MOV BYTE PTR DS:[ECX+254],0BF
00425982 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00425985 |. E8 89EBFFFF CALL 00424513
0042598A |. EB 0A JMP SHORT 00425996
00424513 /$ 55 PUSH EBP
00424514 |. 8BEC MOV EBP,ESP
00424516 |. 83EC 14 SUB ESP,14
00424519 |. 56 PUSH ESI
0042451A |. 894D F4 MOV DWORD PTR SS:[EBP-C],ECX
0042451D |. C645 F8 00 MOV BYTE PTR SS:[EBP-8],0
00424521 |. C645 FC 00 MOV BYTE PTR SS:[EBP-4],0
00424525 |. EB 08 JMP SHORT 0042452F
00424527 |> 8A45 FC /MOV AL,BYTE PTR SS:[EBP-4]
0042452A |. 04 01 |ADD AL,1
0042452C |. 8845 FC |MOV BYTE PTR SS:[EBP-4],AL
0042452F |> 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
00424532 |. 81E1 FF000000 |AND ECX,0FF
00424538 |. 83F9 73 |CMP ECX,73
0042453B |. 0F8D 85000000 |JGE 004245C6
00424541 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
00424544 |. 81E1 FF000000 |AND ECX,0FF
0042454A |. 6BC9 24 |IMUL ECX,ECX,24
0042454D |. 81C1 502C4B00 |ADD ECX,004B2C50
00424553 |. E8 3847FFFF |CALL 00418C90
00424558 |. 25 FF000000 |AND EAX,0FF
0042455D |. 83F8 02 |CMP EAX,2
00424560 |. 75 5F |JNZ SHORT 004245C1
00424562 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
00424565 |. 81E1 FF000000 |AND ECX,0FF
0042456B |. 6BC9 24 |IMUL ECX,ECX,24
0042456E |. 81C1 502C4B00 |ADD ECX,004B2C50
00424574 |. E8 9721FEFF |CALL 00406710
00424579 |. 8BF0 |MOV ESI,EAX
0042457B |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C]
0042457E |. 8B4A 08 |MOV ECX,DWORD PTR DS:[EDX+8]
00424581 |. E8 8A21FEFF |CALL 00406710
00424586 |. 3BF0 |CMP ESI,EAX
00424588 |. 75 37 |JNZ SHORT 004245C1
0042458A |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
0042458D |. 8A48 0C |MOV CL,BYTE PTR DS:[EAX+C]
00424590 |. 51 |PUSH ECX ; /Arg2
00424591 |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C] ; |
00424594 |. 8A02 |MOV AL,BYTE PTR DS:[EDX] ; |
00424596 |. 50 |PUSH EAX ; |Arg1
00424597 |. E8 DEC3FFFF |CALL 0042097A ; \0042097A
0042459C |. 83C4 08 |ADD ESP,8
0042459F |. 85C0 |TEST EAX,EAX
004245A1 |. 75 02 |JNZ SHORT 004245A5
004245A3 |.^EB 82 |JMP SHORT 00424527
004245A5 |> 8B4D F8 |MOV ECX,DWORD PTR SS:[EBP-8]
004245A8 |. 81E1 FF000000 |AND ECX,0FF
004245AE |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C]
004245B1 |. 8A45 FC |MOV AL,BYTE PTR SS:[EBP-4]
004245B4 |. 88440A 0D |MOV BYTE PTR DS:[EDX+ECX+D],AL
004245B8 |. 8A4D F8 |MOV CL,BYTE PTR SS:[EBP-8]
004245BB |. 80C1 01 |ADD CL,1
004245BE |. 884D F8 |MOV BYTE PTR SS:[EBP-8],CL
004245C1 |>^E9 61FFFFFF \JMP 00424527
前面部分与砂暴类似，判断同一方中哪些人物会受到白虎的影响。
004245C6 |> C645 FC 00 MOV BYTE PTR SS:[EBP-4],0
004245CA |. EB 09 JMP SHORT 004245D5
004245CC |> 8A55 FC /MOV DL,BYTE PTR SS:[EBP-4]
004245CF |. 80C2 01 |ADD DL,1
004245D2 |. 8855 FC |MOV BYTE PTR SS:[EBP-4],DL
004245D5 |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004245D8 |. 25 FF000000 |AND EAX,0FF
004245DD |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
004245E0 |. 33D2 |XOR EDX,EDX
004245E2 |. 8A5401 0D |MOV DL,BYTE PTR DS:[ECX+EAX+D]
004245E6 |. 81FA FF000000 |CMP EDX,0FF
004245EC |. 0F84 47010000 |JE 00424739
004245F2 |. 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4]
004245F5 |. 25 FF000000 |AND EAX,0FF
004245FA |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
004245FD |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C]
00424600 |. 8A4402 0D |MOV AL,BYTE PTR DS:[EDX+EAX+D]
00424604 |. 8841 0C |MOV BYTE PTR DS:[ECX+C],AL
00424607 |. 6A 00 |PUSH 0 ; /Arg3 = 00000000
00424609 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C] ; |
0042460C |. 8A51 01 |MOV DL,BYTE PTR DS:[ECX+1] ; |
0042460F |. 52 |PUSH EDX ; |Arg2
00424610 |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C] ; |
00424613 |. 8A08 |MOV CL,BYTE PTR DS:[EAX] ; |
00424615 |. 51 |PUSH ECX ; |Arg1
00424616 |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C] ; |
00424619 |. 33C0 |XOR EAX,EAX ; |
0042461B |. 8A42 0C |MOV AL,BYTE PTR DS:[EDX+C] ; |
0042461E |. 8BC8 |MOV ECX,EAX ; |
00424620 |. 6BC9 24 |IMUL ECX,ECX,24 ; |
00424623 |. 81C1 502C4B00 |ADD ECX,004B2C50 ; |
00424629 |. E8 1A7F0100 |CALL 0043C548 ; \0043C548
0042462E |. F7D8 |NEG EAX
00424630 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
00424633 |. 81E1 FF000000 |AND ECX,0FF
00424639 |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C]
0042463C |. 89848A 8400000>|MOV DWORD PTR DS:[EDX+ECX*4+84],EAX
计算HP恢复量。
00424643 |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
00424646 |. 8A08 |MOV CL,BYTE PTR DS:[EAX]
00424648 |. 51 |PUSH ECX ; /Arg3
00424649 |. 6A 02 |PUSH 2 ; |Arg2 = 00000002
0042464B |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C] ; |
0042464E |. 33C0 |XOR EAX,EAX ; |
00424650 |. 8A42 0C |MOV AL,BYTE PTR DS:[EDX+C] ; |
00424653 |. 6BC0 24 |IMUL EAX,EAX,24 ; |
00424656 |. 05 502C4B00 |ADD EAX,004B2C50 ; |
0042465B |. 50 |PUSH EAX ; |Arg1
0042465C |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C] ; |
0042465F |. 8B49 08 |MOV ECX,DWORD PTR DS:[ECX+8] ; |
00424662 |. E8 496E0100 |CALL 0043B4B0 ; \0043B4B0
00424667 |. 85C0 |TEST EAX,EAX
00424669 |. 74 1E |JE SHORT 00424689
0042466B |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
0042466E |. 81E2 FF000000 |AND EDX,0FF
00424674 |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
00424677 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
0042467A |. 8A89 54020000 |MOV CL,BYTE PTR DS:[ECX+254]
00424680 |. 888C10 5502000>|MOV BYTE PTR DS:[EAX+EDX+255],CL
00424687 |. EB 14 |JMP SHORT 0042469D
00424689 |> 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
0042468C |. 81E2 FF000000 |AND EDX,0FF
00424692 |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
00424695 |. C68410 5502000>|MOV BYTE PTR DS:[EAX+EDX+255],0
计算命中率。
0042469D |> 8A4D FC |MOV CL,BYTE PTR SS:[EBP-4]
004246A0 |. 51 |PUSH ECX ; /Arg1
004246A1 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C] ; |
004246A4 |. E8 52C8FFFF |CALL 00420EFB ; \00420EFB
004246A9 |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C]
004246AC |. 3B82 D0020000 |CMP EAX,DWORD PTR DS:[EDX+2D0]
004246B2 |. 76 11 |JBE SHORT 004246C5
004246B4 |. 8A45 FC |MOV AL,BYTE PTR SS:[EBP-4]
004246B7 |. 50 |PUSH EAX ; /Arg1
004246B8 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C] ; |
004246BB |. E8 3BC8FFFF |CALL 00420EFB ; \00420EFB
004246C0 |. 8945 F0 |MOV DWORD PTR SS:[EBP-10],EAX
004246C3 |. EB 0C |JMP SHORT 004246D1
004246C5 |> 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
004246C8 |. 8B91 D0020000 |MOV EDX,DWORD PTR DS:[ECX+2D0]
004246CE |. 8955 F0 |MOV DWORD PTR SS:[EBP-10],EDX
004246D1 |> 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
004246D4 |. 8B4D F0 |MOV ECX,DWORD PTR SS:[EBP-10]
004246D7 |. 8988 D0020000 |MOV DWORD PTR DS:[EAX+2D0],ECX
004246DD |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
004246E0 |. E8 A6CBFFFF |CALL 0042128B
004246E5 |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C]
004246E8 |. 3B82 D4020000 |CMP EAX,DWORD PTR DS:[EDX+2D4]
004246EE |. 76 0D |JBE SHORT 004246FD
004246F0 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
004246F3 |. E8 93CBFFFF |CALL 0042128B
004246F8 |. 8945 EC |MOV DWORD PTR SS:[EBP-14],EAX
004246FB |. EB 0C |JMP SHORT 00424709
004246FD |> 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C]
00424700 |. 8B88 D4020000 |MOV ECX,DWORD PTR DS:[EAX+2D4]
00424706 |. 894D EC |MOV DWORD PTR SS:[EBP-14],ECX
00424709 |> 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C]
0042470C |. 8B45 EC |MOV EAX,DWORD PTR SS:[EBP-14]
0042470F |. 8982 D4020000 |MOV DWORD PTR DS:[EDX+2D4],EAX
00424715 |. 8A4D FC |MOV CL,BYTE PTR SS:[EBP-4]
00424718 |. 51 |PUSH ECX ; /Arg1
00424719 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C] ; |
0042471C |. E8 82CCFFFF |CALL 004213A3 ; \004213A3
00424721 |. 8B55 FC |MOV EDX,DWORD PTR SS:[EBP-4]
00424724 |. 81E2 FF000000 |AND EDX,0FF
0042472A |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
0042472D |. 898491 D802000>|MOV DWORD PTR DS:[ECX+EDX*4+2D8],EAX
00424734 |.^E9 93FEFFFF \JMP 004245CC
经过获得各种经验的处理后，跳回到前面继续循环。
00424739 |> 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
0042473C |. E8 7ECDFFFF CALL 004214BF
动画处理
接下来是HP恢复和异常状态的取消处理。
00424741 |. C645 FC 00 MOV BYTE PTR SS:[EBP-4],0
00424745 |. EB 09 JMP SHORT 00424750
00424747 |> 8A55 FC /MOV DL,BYTE PTR SS:[EBP-4]
0042474A |. 80C2 01 |ADD DL,1
0042474D |. 8855 FC |MOV BYTE PTR SS:[EBP-4],DL
00424750 |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00424753 |. 25 FF000000 |AND EAX,0FF
00424758 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
0042475B |. 33D2 |XOR EDX,EDX
0042475D |. 8A5401 0D |MOV DL,BYTE PTR DS:[ECX+EAX+D]
00424761 |. 81FA FF000000 |CMP EDX,0FF
00424767 |. 0F84 91000000 |JE 004247FE
0042476D |. 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4]
00424770 |. 25 FF000000 |AND EAX,0FF
00424775 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
00424778 |. 33D2 |XOR EDX,EDX
0042477A |. 8A9401 5502000>|MOV DL,BYTE PTR DS:[ECX+EAX+255]
00424781 |. 85D2 |TEST EDX,EDX
00424783 |. 74 74 |JE SHORT 004247F9
00424785 |. 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4]
00424788 |. 25 FF000000 |AND EAX,0FF
0042478D |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
00424790 |. 33D2 |XOR EDX,EDX
00424792 |. 8A5401 0D |MOV DL,BYTE PTR DS:[ECX+EAX+D]
00424796 |. 8BCA |MOV ECX,EDX
00424798 |. 6BC9 24 |IMUL ECX,ECX,24
0042479B |. 81C1 502C4B00 |ADD ECX,004B2C50
004247A1 |. E8 EAE40400 |CALL 00472C90
004247A6 |. 8B4D FC |MOV ECX,DWORD PTR SS:[EBP-4]
004247A9 |. 81E1 FF000000 |AND ECX,0FF
004247AF |. 8B55 F4 |MOV EDX,DWORD PTR SS:[EBP-C]
004247B2 |. 2B848A 8400000>|SUB EAX,DWORD PTR DS:[EDX+ECX*4+84]
004247B9 |. 50 |PUSH EAX ; /Arg1
004247BA |. 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4] ; |
004247BD |. 25 FF000000 |AND EAX,0FF ; |
004247C2 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C] ; |
004247C5 |. 33D2 |XOR EDX,EDX ; |
004247C7 |. 8A5401 0D |MOV DL,BYTE PTR DS:[ECX+EAX+D] ; |
004247CB |. 8BCA |MOV ECX,EDX ; |
004247CD |. 6BC9 24 |IMUL ECX,ECX,24 ; |
004247D0 |. 81C1 502C4B00 |ADD ECX,004B2C50 ; |
004247D6 |. E8 F2AE0100 |CALL 0043F6CD ; \0043F6CD
004247DB |. 8B45 FC |MOV EAX,DWORD PTR SS:[EBP-4]
004247DE |. 25 FF000000 |AND EAX,0FF
004247E3 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
004247E6 |. 8A5401 0D |MOV DL,BYTE PTR DS:[ECX+EAX+D]
004247EA |. 52 |PUSH EDX ; /Arg2
004247EB |. 8B45 F4 |MOV EAX,DWORD PTR SS:[EBP-C] ; |
004247EE |. 8A08 |MOV CL,BYTE PTR DS:[EAX] ; |
004247F0 |. 51 |PUSH ECX ; |Arg1
004247F1 |. E8 2FC6FFFF |CALL 00420E25 ; \00420E25
004247F6 |. 83C4 08 |ADD ESP,8
004247F9 |>^E9 49FFFFFF \JMP 00424747
004247FE |> 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
00424801 |. C782 AC040000 >MOV DWORD PTR DS:[EDX+4AC],1
0042480B |. 5E POP ESI
0042480C |. 8BE5 MOV ESP,EBP
0042480E |. 5D POP EBP
0042480F \. C3 RETN
[/font]
[color=Silver][[i] 本帖最后由 godtype 于 2010-4-30 20:31 编辑 [/i]][/color]
2010-3-26 22:10
godtype
[font=宋体][b][size=3]第四部分 后续处理，HP和MP的增减，经验的增加，升级处理函数[/size][/b]
00422F0D /$ 55 PUSH EBP
00422F0E |. 8BEC MOV EBP,ESP
00422F10 |. 83EC 20 SUB ESP,20
00422F13 |. 56 PUSH ESI
00422F14 |. 894D EC MOV DWORD PTR SS:[EBP-14],ECX
00422F17 |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
00422F1A |. 83B8 AC040000 >CMP DWORD PTR DS:[EAX+4AC],0
00422F21 |. 0F84 12020000 JE 00423139
00422F27 |. 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14]
00422F2A |. 33D2 XOR EDX,EDX
00422F2C |. 8A11 MOV DL,BYTE PTR DS:[ECX]
取出策略编号
00422F2E |. 8BCA MOV ECX,EDX
00422F30 |. 6BC9 46 IMUL ECX,ECX,46
00422F33 |. 81C1 C0F44A00 ADD ECX,004AF4C0
00422F39 |. E8 922B0000 CALL 00425AD0
00422F3E |. 25 FF000000 AND EAX,0FF
00422F43 |. 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX
4AF4C0是策略的内存地址开始，每个策略占用46个字节，第8个字节是MP的消耗量，425AD0就是取出这个值，保存到[EBP-8]里面。
00422F46 |. 6A 31 PUSH 31 ; /Arg1 = 00000031
00422F48 |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14] ; |
00422F4B |. 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4] ; |
00422F4E |. E8 B64AFEFF CALL 00407A09 ; \00407A09
00422F53 |. 85C0 TEST EAX,EAX
00422F55 |. 74 1E JE SHORT 00422F75
检查使用策略者是否带有特效号31的装备，没有就跳过。
00422F57 |. 6A 31 PUSH 31 ; /Arg1 = 00000031
00422F59 |. 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14] ; |
00422F5C |. 8B49 04 MOV ECX,DWORD PTR DS:[ECX+4] ; |
00422F5F |. E8 8E4BFEFF CALL 00407AF2 ; \00407AF2
00422F64 |. 8AC8 MOV CL,AL
00422F66 |. 81E1 FF000000 AND ECX,0FF
00422F6C |. 8B45 F8 MOV EAX,DWORD PTR SS:[EBP-8]
00422F6F |. 99 CDQ
00422F70 |. F7F9 IDIV ECX
00422F72 |. 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX
如果策略者带有特效号31的装备，就取出特效效果值，然后用MP消耗量除以这个效果值，得出节约后的MP消耗量，继续保存到[EBP-8]中。注意原版中白羽扇的特效效果值是2，所以除以2就是节约一半的MP量。后来的各种改版引擎才改成百分比计算。
00422F75 |> 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
00422F78 |. 52 PUSH EDX
00422F79 |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
00422F7C |. 8B48 08 MOV ECX,DWORD PTR DS:[EAX+8]
00422F7F |. E8 BCF80400 CALL 00472840
00422F84 |. 50 PUSH EAX ; |Arg1
00422F85 |. E8 14CB0500 CALL 0047FA9E ; \0047FA9E
00422F8A |. 83C4 08 ADD ESP,8
00422F8D |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
47FA9E是将08栈的数值减去0C栈的数值，如果小于等于0则输出为0。在这里是将当前MP减去MP消耗量，即使用策略后剩余的MP量，保存到[EBP-4]里面。
00422F90 |. C745 F0 000000>MOV DWORD PTR SS:[EBP-10],0
00422F97 |. C745 F4 000000>MOV DWORD PTR SS:[EBP-C],0
将[EBP-10]和[EBP-C]置零
00422F9E |. 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14]
00422FA1 |. 8A11 MOV DL,BYTE PTR DS:[ECX]
00422FA3 |. 8855 E8 MOV BYTE PTR SS:[EBP-18],DL
00422FA6 |. 807D E8 14 CMP BYTE PTR SS:[EBP-18],14
00422FAA |. 74 0B JE SHORT 00422FB7
00422FAC |. 807D E8 16 CMP BYTE PTR SS:[EBP-18],16
00422FB0 |. 74 65 JE SHORT 00423017
00422FB2 |. E9 B2000000 JMP 00423069
检查是否使用编号14和编号16的策略。
下面的代码是如果使用的是编号14的策略，即吸HP策略的代码：
00422FB7 |> 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
00422FBA |. 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4]
00422FBD |. E8 5942FEFF CALL 0040721B
00422FC2 |. 8BF0 MOV ESI,EAX
00422FC4 |. 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14]
00422FC7 |. 8B49 08 MOV ECX,DWORD PTR DS:[ECX+8]
00422FCA |. E8 C1FC0400 CALL 00472C90
00422FCF |. 2BF0 SUB ESI,EAX
使用策略者的HP最大值减去当前的HP值。
00422FD1 |. 8B55 EC MOV EDX,DWORD PTR SS:[EBP-14]
00422FD4 |. 39B2 84000000 CMP DWORD PTR DS:[EDX+84],ESI
00422FDA |. 7D 0E JGE SHORT 00422FEA
比较一下，攻击第一个敌人所产生的伤害值是否大于或等于前面减出来的数值。
00422FDC |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
00422FDF |. 8B88 84000000 MOV ECX,DWORD PTR DS:[EAX+84]
00422FE5 |. 894D E4 MOV DWORD PTR SS:[EBP-1C],ECX
00422FE8 |. EB 1D JMP SHORT 00423007
如果小于，就将攻击第一个敌人所产生的伤害值保存到[EBP-1C]里面。
00422FEA |> 8B55 EC MOV EDX,DWORD PTR SS:[EBP-14]
00422FED |. 8B4A 04 MOV ECX,DWORD PTR DS:[EDX+4]
00422FF0 |. E8 2642FEFF CALL 0040721B
00422FF5 |. 8BF0 MOV ESI,EAX
00422FF7 |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
00422FFA |. 8B48 08 MOV ECX,DWORD PTR DS:[EAX+8]
00422FFD |. E8 8EFC0400 CALL 00472C90
00423002 |. 2BF0 SUB ESI,EAX
00423004 |. 8975 E4 MOV DWORD PTR SS:[EBP-1C],ESI
如果大于或等于，就将前面减出来的数值保存到[EBP-1C]里面
00423007 |> 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C]
0042300A |. 894D F0 MOV DWORD PTR SS:[EBP-10],ECX
0042300D |. 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
00423010 |. F7DA NEG EDX
00423012 |. 8955 F4 MOV DWORD PTR SS:[EBP-C],EDX
00423015 |. EB 5A JMP SHORT 00423071
将[EBP-1C]的值保存到[EBP-10]里面，将[EBP-8]的值取反后保存到[EBP-C]里面。
下面的代码是如果使用的是编号16的策略，即吸MP策略的代码：
00423017 |> 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
0042301A |. 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4]
0042301D |. E8 2842FEFF CALL 0040724A
00423022 |. 2B45 FC SUB EAX,DWORD PTR SS:[EBP-4]
使用策略者的MP最大值减去使用策略后剩余的MP值。
00423025 |. 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14]
00423028 |. 3981 84000000 CMP DWORD PTR DS:[ECX+84],EAX
0042302E |. 7D 0E JGE SHORT 0042303E
比较一下，攻击第一个敌人所产生的伤害值是否大于或等于前面减出来的数值。
00423030 |. 8B55 EC MOV EDX,DWORD PTR SS:[EBP-14]
00423033 |. 8B82 84000000 MOV EAX,DWORD PTR DS:[EDX+84]
00423039 |. 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX
0042303C |. EB 11 JMP SHORT 0042304F
如果小于，就将攻击第一个敌人所产生的伤害值保存到[EBP-20]里面。
0042303E |> 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14]
00423041 |. 8B49 04 MOV ECX,DWORD PTR DS:[ECX+4]
00423044 |. E8 0142FEFF CALL 0040724A
00423049 |. 2B45 FC SUB EAX,DWORD PTR SS:[EBP-4]
0042304C |. 8945 E0 MOV DWORD PTR SS:[EBP-20],EAX
如果大于或等于，就将前面减出来的数值保存到[EBP-20]里面
0042304F |> 8B55 E0 MOV EDX,DWORD PTR SS:[EBP-20]
00423052 |. 8955 F4 MOV DWORD PTR SS:[EBP-C],EDX
00423055 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00423058 |. 0345 F4 ADD EAX,DWORD PTR SS:[EBP-C]
0042305B |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
0042305E |. 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
00423061 |. 2B4D F8 SUB ECX,DWORD PTR SS:[EBP-8]
00423064 |. 894D F4 MOV DWORD PTR SS:[EBP-C],ECX
00423067 |. EB 08 JMP SHORT 00423071
将[EBP-20]的值保存到[EBP-C]里面，同时加进[EBP-4]，即使用策略后剩余的MP值，然后[EBP-C]的值减去[EBP-8]的值后保存回[EBP-C]里面。
如果不是使用吸HP或MP策略的代码：
00423069 |> 8B55 F8 MOV EDX,DWORD PTR SS:[EBP-8]
0042306C |. F7DA NEG EDX
0042306E |. 8955 F4 MOV DWORD PTR SS:[EBP-C],EDX
[EBP-8]取反后保存到[EBP-C]里面
00423071 |> 6A 01 PUSH 1 ; /Arg2 = 00000001
00423073 |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14] ; |
00423076 |. 8A48 01 MOV CL,BYTE PTR DS:[EAX+1] ; |
00423079 |. 51 PUSH ECX ; |Arg1
0042307A |. B9 50424B00 MOV ECX,004B4250 ; |
0042307F |. E8 8C1E0300 CALL 00454F10 ; \00454F10
00423084 |. 6A 01 PUSH 1 ; /Arg8 = 00000001
00423086 |. 6A 00 PUSH 0 ; |Arg7 = 00000000
00423088 |. 8B55 EC MOV EDX,DWORD PTR SS:[EBP-14] ; |
0042308B |. 8B82 D4020000 MOV EAX,DWORD PTR DS:[EDX+2D4] ; |
00423091 |. 50 PUSH EAX ; |Arg6
00423092 |. 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14] ; |
00423095 |. 8B91 D0020000 MOV EDX,DWORD PTR DS:[ECX+2D0] ; |
0042309B |. 52 PUSH EDX ; |Arg5
0042309C |. 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C] ; |
0042309F |. F7D8 NEG EAX ; |
004230A1 |. 50 PUSH EAX ; |Arg4
004230A2 |. 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10] ; |
004230A5 |. F7D9 NEG ECX ; |
004230A7 |. 51 PUSH ECX ; |Arg3
004230A8 |. 8B55 EC MOV EDX,DWORD PTR SS:[EBP-14] ; |
004230AB |. 8A42 0C MOV AL,BYTE PTR DS:[EDX+C] ; |
004230AE |. 50 PUSH EAX ; |Arg2
004230AF |. 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14] ; |
004230B2 |. 8A51 01 MOV DL,BYTE PTR DS:[ECX+1] ; |
004230B5 |. 52 PUSH EDX ; |Arg1
004230B6 |. E8 C9D80200 CALL 00450984 ; \00450984
004230BB |. 83C4 20 ADD ESP,20
进行HPMP的加减、经验的增加的动画处理。
004230BE |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
004230C1 |. 8B48 08 MOV ECX,DWORD PTR DS:[EAX+8]
004230C4 |. E8 C7FB0400 CALL 00472C90
004230C9 |. 0345 F0 ADD EAX,DWORD PTR SS:[EBP-10]
004230CC |. 50 PUSH EAX ; /Arg1
004230CD |. 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14] ; |
004230D0 |. 8B49 08 MOV ECX,DWORD PTR DS:[ECX+8] ; |
004230D3 |. E8 F5C50100 CALL 0043F6CD ; \0043F6CD
使用策略者HP的实际增加处理
004230D8 |. 8B55 FC MOV EDX,DWORD PTR SS:[EBP-4]
004230DB |. 52 PUSH EDX ; /Arg1
004230DC |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14] ; |
004230DF |. 8B48 08 MOV ECX,DWORD PTR DS:[EAX+8] ; |
004230E2 |. E8 27C60100 CALL 0043F70E ; \0043F70E
使用策略者MP的实际加减处理
004230E7 |. 6A 01 PUSH 1
004230E9 |. 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14]
004230EC |. 8B49 04 MOV ECX,DWORD PTR DS:[ECX+4]
004230EF |. E8 5C35FEFF CALL 00406650
004230F4 |. 25 FF000000 AND EAX,0FF ; |
004230F9 |. 8B55 EC MOV EDX,DWORD PTR SS:[EBP-14] ; |
004230FC |. 0382 D0020000 ADD EAX,DWORD PTR DS:[EDX+2D0] ; |
00423102 |. 50 PUSH EAX ; |Arg1
00423103 |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14] ; |
00423106 |. 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4] ; |
00423109 |. E8 4258FEFF CALL 00408950 ; \00408950
使用策略者自身经验的增加处理，达到升级所需的经验就会升级。
0042310E |. 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14]
00423111 |. 8B91 D4020000 MOV EDX,DWORD PTR DS:[ECX+2D4]
00423117 |. 52 PUSH EDX ; /Arg2
00423118 |. 6A 00 PUSH 0 ; |Arg1 = 00000000
0042311A |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14] ; |
0042311D |. 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4] ; |
00423120 |. E8 B151FEFF CALL 004082D6 ; \004082D6
使用策略者的武器经验的增加处理，达到升级所需的经验就会升级。
00423125 |. 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14]
00423128 |. 8B49 08 MOV ECX,DWORD PTR DS:[ECX+8]
0042312B |. E8 40C50300 CALL 0045F670
00423130 |. 50 PUSH EAX ; /Arg1
00423131 |. E8 CB680500 CALL 00479A01 ; \00479A01
00423136 |. 83C4 04 ADD ESP,4
00423139 |> 5E POP ESI
0042313A |. 8BE5 MOV ESP,EBP
0042313C |. 5D POP EBP
0042313D \. C3 RETN
[/font]
[color=Silver][[i] 本帖最后由 godtype 于 2010-5-6 19:47 编辑 [/i]][/color]
2010-3-26 22:11
godtype
[b][size=3]第五部分 策略伤害计算和策略命中率[/size][/b]
[b][size=2]一、策略命中率计算[/size][/b]
43B73F是命中率计算，一共有3个参数与 ECX（497AF8+8H，即使用策略武将的战场内存地址）。08栈为0时才是实际计算命中率，为1时是平时鼠标移过去显示命中率用的；0C栈是当前被攻击武将的战场内存；10栈是策略编号。
[font=宋体]
0043B73F /$ 55 PUSH EBP
0043B740 |. 8BEC MOV EBP,ESP
0043B742 |. 83EC 38 SUB ESP,38
0043B745 |. 56 PUSH ESI
0043B746 |. 894D D4 MOV DWORD PTR SS:[EBP-2C],ECX
0043B749 |. C745 F4 000000>MOV DWORD PTR SS:[EBP-C],0
0043B750 |. C745 E0 000000>MOV DWORD PTR SS:[EBP-20],0
将使用策略武将的战场内存地址保存到[EBP-2C]中，然后将[EBP-C]和[EBP-20]清零。
0043B757 |. 837D 08 00 CMP DWORD PTR SS:[EBP+8],0
0043B75B |. 74 0D JE SHORT 0043B76A
0043B75D |. 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+C]
0043B760 |. E8 4B0BFEFF CALL 0041C2B0
0043B765 |. 8845 D3 MOV BYTE PTR SS:[EBP-2D],AL
0043B768 |. EB 09 JMP SHORT 0043B773
0043B76A |> 8B45 D4 MOV EAX,DWORD PTR SS:[EBP-2C]
0043B76D |. 8A48 04 MOV CL,BYTE PTR DS:[EAX+4]
0043B770 |. 884D D3 MOV BYTE PTR SS:[EBP-2D],CL
0043B773 |> 8A55 D3 MOV DL,BYTE PTR SS:[EBP-2D]
0043B776 |. 8855 EC MOV BYTE PTR SS:[EBP-14],DL
0043B779 |. 837D 08 00 CMP DWORD PTR SS:[EBP+8],0
0043B77D |. 74 0B JE SHORT 0043B78A
0043B77F |. 8B45 D4 MOV EAX,DWORD PTR SS:[EBP-2C]
0043B782 |. 8A48 04 MOV CL,BYTE PTR DS:[EAX+4]
0043B785 |. 884D D2 MOV BYTE PTR SS:[EBP-2E],CL
0043B788 |. EB 0B JMP SHORT 0043B795
0043B78A |> 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+C]
0043B78D |. E8 1E0BFEFF CALL 0041C2B0
0043B792 |. 8845 D2 MOV BYTE PTR SS:[EBP-2E],AL
0043B795 |> 8A55 D2 MOV DL,BYTE PTR SS:[EBP-2E]
0043B798 |. 8855 FC MOV BYTE PTR SS:[EBP-4],DL
以上一段是用来判断出使用策略武将（攻击方）和目标武将（防御方）的战场编号，分别单字节保存到[EBP-14]和[EBP-4]中
0043B79B |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
0043B79E |. 25 FF000000 AND EAX,0FF
0043B7A3 |. 6BC0 24 IMUL EAX,EAX,24
0043B7A6 |. 05 502C4B00 ADD EAX,004B2C50
0043B7AB |. 8945 E8 MOV DWORD PTR SS:[EBP-18],EAX
计算出攻击方的战场内存地址，保存到[EBP-18]中。
0043B7AE |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
0043B7B1 |. 81E1 FF000000 AND ECX,0FF
0043B7B7 |. 6BC9 24 IMUL ECX,ECX,24
0043B7BA |. 81C1 502C4B00 ADD ECX,004B2C50
0043B7C0 |. 894D D8 MOV DWORD PTR SS:[EBP-28],ECX
计算出防御方的战场内存地址，保存到[EBP-28]中。
0043B7C3 |. 8B4D E8 MOV ECX,DWORD PTR SS:[EBP-18]
0043B7C6 |. E8 A53E0200 CALL 0045F670
0043B7CB |. 6BC0 48 IMUL EAX,EAX,48
0043B7CE |. 05 681B4A00 ADD EAX,004A1B68
0043B7D3 |. 8945 DC MOV DWORD PTR SS:[EBP-24],EAX
计算出攻击方的武将DATA内存地址，保存到[EBP-24]中。
0043B7D6 |. 8B4D D8 MOV ECX,DWORD PTR SS:[EBP-28]
0043B7D9 |. E8 923E0200 CALL 0045F670
0043B7DE |. 6BC0 48 IMUL EAX,EAX,48
0043B7E1 |. 05 681B4A00 ADD EAX,004A1B68
0043B7E6 |. 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
计算出防御方的武将DATA内存地址，保存到[EBP-1C]中。
0043B7E9 |. 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10]
0043B7EC |. 81E1 FF000000 AND ECX,0FF
0043B7F2 |. 6BC9 46 IMUL ECX,ECX,46
0043B7F5 |. 81C1 C0F44A00 ADD ECX,004AF4C0
0043B7FB |. E8 202B0000 CALL 0043E320
0043B800 |. 8845 F8 MOV BYTE PTR SS:[EBP-8],AL
不起实际作用的多余代码，仅仅是取出所用策略的类型，保存到[EBP-8]中。
0043B803 |. 6A 00 PUSH 0 ; /Arg4 = 00000000
0043B805 |. 8A55 FC MOV DL,BYTE PTR SS:[EBP-4] ; |
0043B808 |. 52 PUSH EDX ; |Arg3
0043B809 |. 8A45 EC MOV AL,BYTE PTR SS:[EBP-14] ; |
0043B80C |. 50 PUSH EAX ; |Arg2
0043B80D |. 8A4D 10 MOV CL,BYTE PTR SS:[EBP+10] ; |
0043B810 |. 51 PUSH ECX ; |Arg1
0043B811 |. E8 0C4CFEFF CALL 00420422 ; \00420422
0043B816 |. 83C4 10 ADD ESP,10
0043B819 |. 85C0 TEST EAX,EAX
0043B81B |. 75 07 JNZ SHORT 0043B824
0043B81D |. 33C0 XOR EAX,EAX
0043B81F |. E9 40030000 JMP 0043BB64
420422前面的部分提过了。
0043B824 |> 6A 08 PUSH 8 ; /Arg1 = 00000008
0043B826 |. 8B4D D8 MOV ECX,DWORD PTR SS:[EBP-28] ; |
0043B829 |. E8 B2AEFCFF CALL 004066E0 ; \004066E0
0043B82E |. 85C0 TEST EAX,EAX
0043B830 |. 74 25 JE SHORT 0043B857
检查防御方是否进入08混乱状态，如果没有就跳到后面。
0043B832 |. 8B55 10 MOV EDX,DWORD PTR SS:[EBP+10]
0043B835 |. 81E2 FF000000 AND EDX,0FF
0043B83B |. 83FA 09 CMP EDX,9
0043B83E |. 74 17 JE SHORT 0043B857
0043B840 |. 8B45 10 MOV EAX,DWORD PTR SS:[EBP+10]
0043B843 |. 25 FF000000 AND EAX,0FF
0043B848 |. 83F8 15 CMP EAX,15
0043B84B |. 74 0A JE SHORT 0043B857
0043B84D |. B8 64000000 MOV EAX,64
0043B852 |. E9 0D030000 JMP 0043BB64
判断使用的是否09H和15H编号的策略，即原版中的海啸和晕眩。如果不是这两个策略，则直接输出EAX=100，表示混乱状态下必定命中；如果是这两个策略则不受混乱状态影响。
0043B857 |> 8B4D E8 MOV ECX,DWORD PTR SS:[EBP-18]
0043B85A |. E8 843D0000 CALL 0043F5E3
0043B85F |. 8BF0 MOV ESI,EAX
0043B861 |. 8B4D E8 MOV ECX,DWORD PTR SS:[EBP-18]
0043B864 |. E8 163E0000 CALL 0043F67F
0043B869 |. 03F0 ADD ESI,EAX
0043B86B |. 8975 F4 MOV DWORD PTR SS:[EBP-C],ESI
43F5E3是取出武将带辅助装备以及升降状态的精神力数值，43F67F是取士气数值，加起来就是取出攻击方的精神力+士气之和，保存到[EBP-C]中。
0043B86E |. 8B4D D8 MOV ECX,DWORD PTR SS:[EBP-28]
0043B871 |. E8 6D3D0000 CALL 0043F5E3
0043B876 |. 8BF0 MOV ESI,EAX
0043B878 |. 8B4D D8 MOV ECX,DWORD PTR SS:[EBP-28]
0043B87B |. E8 FF3D0000 CALL 0043F67F
0043B880 |. 03F0 ADD ESI,EAX
0043B882 |. 8975 E0 MOV DWORD PTR SS:[EBP-20],ESI
取出防御方的精神力+士气之和，保存到[EBP-20]中。
0043B885 |. 8B4D E0 MOV ECX,DWORD PTR SS:[EBP-20]
0043B888 |. D1E1 SHL ECX,1
0043B88A |. 394D F4 CMP DWORD PTR SS:[EBP-C],ECX
0043B88D |. 72 0C JB SHORT 0043B89B
0043B88F |. C745 F0 640000>MOV DWORD PTR SS:[EBP-10],64
0043B896 |. E9 90000000 JMP 0043B92B
0043B89B |> 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C]
0043B89E |. 3B55 E0 CMP EDX,DWORD PTR SS:[EBP-20]
0043B8A1 |. 72 20 JB SHORT 0043B8C3
0043B8A3 |. 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
0043B8A6 |. 50 PUSH EAX ; /Arg2
0043B8A7 |. 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C] ; |
0043B8AA |. 51 PUSH ECX ; |Arg1
0043B8AB |. E8 EE410400 CALL 0047FA9E ; \0047FA9E
0043B8B0 |. 83C4 08 ADD ESP,8
0043B8B3 |. 6BC0 0A IMUL EAX,EAX,0A
0043B8B6 |. 33D2 XOR EDX,EDX
0043B8B8 |. F775 E0 DIV DWORD PTR SS:[EBP-20]
0043B8BB |. 83C0 5A ADD EAX,5A
0043B8BE |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
0043B8C1 |. EB 68 JMP SHORT 0043B92B
0043B8C3 |> 8B55 E0 MOV EDX,DWORD PTR SS:[EBP-20]
0043B8C6 |. D1EA SHR EDX,1
0043B8C8 |. 3955 F4 CMP DWORD PTR SS:[EBP-C],EDX
0043B8CB |. 72 26 JB SHORT 0043B8F3
0043B8CD |. 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
0043B8D0 |. D1E8 SHR EAX,1
0043B8D2 |. 50 PUSH EAX ; /Arg2
0043B8D3 |. 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C] ; |
0043B8D6 |. 51 PUSH ECX ; |Arg1
0043B8D7 |. E8 C2410400 CALL 0047FA9E ; \0047FA9E
0043B8DC |. 83C4 08 ADD ESP,8
0043B8DF |. 6BC0 1E IMUL EAX,EAX,1E
0043B8E2 |. 8B4D E0 MOV ECX,DWORD PTR SS:[EBP-20]
0043B8E5 |. D1E9 SHR ECX,1
0043B8E7 |. 33D2 XOR EDX,EDX
0043B8E9 |. F7F1 DIV ECX
0043B8EB |. 83C0 3C ADD EAX,3C
0043B8EE |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
0043B8F1 |. EB 38 JMP SHORT 0043B92B
0043B8F3 |> 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
0043B8F6 |. 33D2 XOR EDX,EDX
0043B8F8 |. B9 03000000 MOV ECX,3
0043B8FD |. F7F1 DIV ECX
0043B8FF |. 50 PUSH EAX ; /Arg2
0043B900 |. 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C] ; |
0043B903 |. 52 PUSH EDX ; |Arg1
0043B904 |. E8 95410400 CALL 0047FA9E ; \0047FA9E
0043B909 |. 83C4 08 ADD ESP,8
0043B90C |. 8BC8 MOV ECX,EAX
0043B90E |. 6BC9 1E IMUL ECX,ECX,1E
0043B911 |. 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
0043B914 |. 33D2 XOR EDX,EDX
0043B916 |. BE 03000000 MOV ESI,3
0043B91B |. F7F6 DIV ESI
0043B91D |. 8BF0 MOV ESI,EAX
0043B91F |. 8BC1 MOV EAX,ECX
0043B921 |. 33D2 XOR EDX,EDX
0043B923 |. F7F6 DIV ESI
0043B925 |. 83C0 1E ADD EAX,1E
0043B928 |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
根据攻防双方的精神力+士气，计算出正常情况下的命中率数字，保存到[EBP-10]中，过程就不详细说明了，都是一些加减乘除。注意47FA9E是不出现负数的减法，如果0C栈大于等于08栈，输出为0，否则08栈减0C栈输出。
0043B92B |> 6A 34 PUSH 34 ; /Arg1 = 00000034
0043B92D |. 8B4D DC MOV ECX,DWORD PTR SS:[EBP-24] ; |
0043B930 |. E8 D4C0FCFF CALL 00407A09 ; \00407A09
0043B935 |. 85C0 TEST EAX,EAX
0043B937 |. 74 21 JE SHORT 0043B95A
判断攻击方是否带有特效号为34的装备，没有就跳过。
0043B939 |. 6A 64 PUSH 64 ; /Arg3 = 00000064
0043B93B |. 6A 34 PUSH 34 ; |/Arg1 = 00000034
0043B93D |. 8B4D DC MOV ECX,DWORD PTR SS:[EBP-24] ; ||
0043B940 |. E8 ADC1FCFF CALL 00407AF2 ; |\00407AF2
0043B945 |. 25 FF000000 AND EAX,0FF ; |
0043B94A |. 50 PUSH EAX ; |Arg2
0043B94B |. 8B55 F0 MOV EDX,DWORD PTR SS:[EBP-10] ; |
0043B94E |. 52 PUSH EDX ; |Arg1
0043B94F |. E8 35410400 CALL 0047FA89 ; \0047FA89
0043B954 |. 83C4 0C ADD ESP,0C
0043B957 |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
攻击方身上带有特效号为34的装备，就从这件装备中取出特效效果值，然后再加上正常命中率，上限不超过100，即47FA89的10栈的64H就是上限值，建议加大些，因为下面还有减少命中率的装备。最后得出的命中率保存回[EBP-10]中。
0043B95A |> 6A 36 PUSH 36 ; /Arg1 = 00000036
0043B95C |. 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C] ; |
0043B95F |. E8 A5C0FCFF CALL 00407A09 ; \00407A09
0043B964 |. 85C0 TEST EAX,EAX
0043B966 |. 74 1F JE SHORT 0043B987
判断防御方是否带有特效号为36的装备，没有就跳过。
0043B968 |. 6A 36 PUSH 36 ; /Arg1 = 00000036
0043B96A |. 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C] ; |
0043B96D |. E8 80C1FCFF CALL 00407AF2 ; \00407AF2
0043B972 |. 25 FF000000 AND EAX,0FF
0043B977 |. 50 PUSH EAX ; /Arg2
0043B978 |. 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10] ; |
0043B97B |. 50 PUSH EAX ; |Arg1
0043B97C |. E8 1D410400 CALL 0047FA9E ; \0047FA9E
0043B981 |. 83C4 08 ADD ESP,8
0043B984 |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
防御方身上带有特效号为36的装备，就从这件装备中取出特效效果值，然后让正常命中率减去这个特效效果值，下限最低为0。最后得出的命中率保存回[EBP-10]中。
0043B987 |> 6A 37 PUSH 37 ; /Arg1 = 00000037
0043B989 |. 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C] ; |
0043B98C |. E8 78C0FCFF CALL 00407A09 ; \00407A09
0043B991 |. 85C0 TEST EAX,EAX
0043B993 |. 74 1F JE SHORT 0043B9B4
0043B995 |. 6A 37 PUSH 37 ; /Arg1 = 00000037
0043B997 |. 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C] ; |
0043B99A |. E8 53C1FCFF CALL 00407AF2 ; \00407AF2
0043B99F |. 25 FF000000 AND EAX,0FF
0043B9A4 |. 50 PUSH EAX ; /Arg2
0043B9A5 |. 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10] ; |
0043B9A8 |. 51 PUSH ECX ; |Arg1
0043B9A9 |. E8 F0400400 CALL 0047FA9E ; \0047FA9E
0043B9AE |. 83C4 08 ADD ESP,8
0043B9B1 |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
特效号37与前面的36同理。由于特效号37在计算物理攻击的命中率的代码中也有出现，所以才会命名为“辅助全防御”，也因此可以与特效36的“辅助策略防御”以及特效35的“辅助攻击防御”同时使用。
0043B9B4 |> 8B55 10 MOV EDX,DWORD PTR SS:[EBP+10]
0043B9B7 |. 81E2 FF000000 AND EDX,0FF
0043B9BD |. 8955 CC MOV DWORD PTR SS:[EBP-34],EDX
0043B9C0 |. 837D CC 43 CMP DWORD PTR SS:[EBP-34],43
0043B9C4 |. 0F87 52010000 JA 0043BB1C
判断策略编号是否大于43H，大于就直接跳到最后面。
0043B9CA |. 8B4D CC MOV ECX,DWORD PTR SS:[EBP-34]
0043B9CD |. 33C0 XOR EAX,EAX
0043B9CF |. 8A81 07BC4300 MOV AL,BYTE PTR DS:[ECX+43BC07]
0043B9D5 |. FF2485 6BBB430>JMP DWORD PTR DS:[EAX*4+43BB6B]
跟着是进行分支表的跳转。43BC07开始是按全策略编号将命中类型进行排列，43BB6B开始是每四个字节按命中类型编号进行跳转的分支表。
举例：使用策略编号26H的八阵图。首先是 43BC07H + 26H = 43BC2DH ，读取出43BC2DH的数值—>1AH；然后是 1AH * 4 + 43BB6BH = 43BBD3H ，43BBD3H位置的值—>0043B9DC ；最后程序就会跳转到43B9DC这一行继续运行。
0043BB6B . 14BA4300 DD 0043BA14 类型0
0043BB6F . 19BA4300 DD 0043BA19 类型1
0043BB73 . 67BA4300 DD 0043BA67 类型2
0043BB77 . 7EBA4300 DD 0043BA7E 类型3
0043BB7B . 19BA4300 DD 0043BA19 类型4
0043BB7F . 67BA4300 DD 0043BA67 类型5
0043BB83 . 9FBA4300 DD 0043BA9F 类型6
0043BB87 . 19BA4300 DD 0043BA19 类型7
0043BB8B . 19BA4300 DD 0043BA19 类型8
0043BB8F . 19BA4300 DD 0043BA19 类型9
0043BB93 . 67BA4300 DD 0043BA67 类型A
0043BB97 . 7EBA4300 DD 0043BA7E 类型B
0043BB9B . E2BA4300 DD 0043BAE2 类型C
0043BB9F . 19BA4300 DD 0043BA19 类型D
0043BBA3 . 67BA4300 DD 0043BA67 类型E
0043BBA7 . 19BA4300 DD 0043BA19 类型F
0043BBAB . 67BA4300 DD 0043BA67 类型10
0043BBAF . 7EBA4300 DD 0043BA7E 类型11
0043BBB3 . 67BA4300 DD 0043BA67 类型12
0043BBB7 . 7EBA4300 DD 0043BA7E 类型13
0043BBBB . 67BA4300 DD 0043BA67 类型14
0043BBBF . 95BA4300 DD 0043BA95 类型15
0043BBC3 . 19BA4300 DD 0043BA19 类型16
0043BBC7 . 67BA4300 DD 0043BA67 类型17
0043BBCB . 7EBA4300 DD 0043BA7E 类型18
0043BBCF . 67BA4300 DD 0043BA67 类型19
0043BBD3 . DCB94300 DD 0043B9DC 类型1A
0043BBD7 . E8B94300 DD 0043B9E8 类型1B
0043BBDB . 30BA4300 DD 0043BA30 类型1C
0043BBDF . DCB94300 DD 0043B9DC 类型1D
0043BBE3 . 19BA4300 DD 0043BA19 类型1E
0043BBE7 . 19BA4300 DD 0043BA19 类型1F
0043BBEB . DCB94300 DD 0043B9DC 类型20
0043BBEF . 67BA4300 DD 0043BA67 类型21
0043BBF3 . DCB94300 DD 0043B9DC 类型22
0043BBF7 . 67BA4300 DD 0043BA67 类型23
0043BBFB . DCB94300 DD 0043B9DC 类型24
0043BBFF . DCB94300 DD 0043B9DC 类型25
0043BC03 . 1CBB4300 DD 0043BB1C 类型26
0043BC07 . 00 DB 00 焦热
0043BC08 . 01 DB 01 烈火
0043BC09 . 01 DB 01 火阵
0043BC0A . 02 DB 02 火龙
0043BC0B . 03 DB 03 爆焰
0043BC0C . 26 DB 26 浊流
0043BC0D . 04 DB 04 激流
0043BC0E . 04 DB 04 水阵
0043BC0F . 05 DB 05 水龙
0043BC10 . 06 DB 06 海啸
0043BC11 . 26 DB 26 旋风
0043BC12 . 07 DB 07 龙卷
0043BC13 . 26 DB 26 风阵
0043BC14 . 08 DB 08 风龙
0043BC15 . 08 DB 08 砂暴
0043BC16 . 26 DB 26 落石
0043BC17 . 09 DB 09 山岚
0043BC18 . 26 DB 26 地阵
0043BC19 . 0A DB 0A 地龙
0043BC1A . 26 DB 26 巨岩
0043BC1B . 0B DB 0B 吸血
0043BC1C . 0C DB 0C 晕眩
0043BC1D . 0D DB 0D 谍报
0043BC1E . 0D DB 0D 钝兵
0043BC1F . 0E DB 0E 大钝兵
0043BC20 . 0F DB 0F 虚脱
0043BC21 . 10 DB 10 大虚脱
0043BC22 . 10 DB 10 压迫
0043BC23 . 11 DB 11 大压迫
0043BC24 . 12 DB 12 咒骂
0043BC25 . 13 DB 13 大咒骂
0043BC26 . 14 DB 14 混乱1
0043BC27 . 15 DB 15 混乱2
0043BC28 . 16 DB 16 毒1
0043BC29 . 17 DB 17 毒2
0043BC2A . 17 DB 17 麻1
0043BC2B . 18 DB 18 麻2
0043BC2C . 19 DB 19 B禁咒
0043BC2D . 1A DB 1A 八阵图
0043BC2E . 1A DB 1A 援助
0043BC2F . 1A DB 1A 补给
0043BC30 . 1A DB 1A 队补
0043BC31 . 1A DB 1A 军补
0043BC32 . 1A DB 1A 远补
0043BC33 . 1A DB 1A 小MP
0043BC34 . 1A DB 1A 大MP
0043BC35 . 1B DB 1B 状态1
0043BC36 . 1C DB 1C 状态2
0043BC37 . 1D DB 1D 强行
0043BC38 . 26 DB 26 加敏1
0043BC39 . 1E DB 1E 加敏2
0043BC3A . 26 DB 26 加士1
0043BC3B . 1F DB 1F 加士2
0043BC3C . 20 DB 20 加力1
0043BC3D . 21 DB 21 加力2
0043BC3E . 22 DB 22 加防1
0043BC3F . 23 DB 23 加防2
0043BC40 . 24 DB 24 回归
0043BC41 . 26 DB 26 雨
0043BC42 . 26 DB 26 晴
0043BC43 . 26 DB 26 云
0043BC44 . 26 DB 26 气合
0043BC45 . 26 DB 26 冥想
0043BC46 . 26 DB 26 霸气
0043BC47 . 26 DB 26 青龙
0043BC48 . 26 DB 26 朱雀
0043BC49 . 26 DB 26 玄武
0043BC4A . 25 DB 25 白虎
命中类型1A、1D、20、22、24、25
0043B9DC |> C745 F0 640000>MOV DWORD PTR SS:[EBP-10],64
0043B9E3 |. E9 34010000 JMP 0043BB1C
命中率直接为100，无视之前的辅助加减装备与正常命中率。
命中类型1B
0043B9E8 |> 837D 08 00 CMP DWORD PTR SS:[EBP+8],0
0043B9EC |. 74 1A JE SHORT 0043BA08
0043B9EE |. 8B4D D8 MOV ECX,DWORD PTR SS:[EBP-28]
0043B9F1 |. E8 3A26FEFF CALL 0041E030
0043B9F6 |. 25 FF000000 AND EAX,0FF
0043B9FB |. 85C0 TEST EAX,EAX
0043B9FD |. 75 09 JNZ SHORT 0043BA08
0043B9FF |. C745 F0 000000>MOV DWORD PTR SS:[EBP-10],0
0043BA06 |. EB 07 JMP SHORT 0043BA0F
0043BA08 |> C745 F0 640000>MOV DWORD PTR SS:[EBP-10],64
0043BA0F |> E9 08010000 JMP 0043BB1C
恢复状态的策略专用，41E030是输出防御方的异常状态代码，如果是实际使用策略的时候就直接命中率为100；如果是显示命中率的时候，当输出的值为0，即没有异常状态，命中率就显示为0，否则命中率显示为100。
命中类型00，多余的设置，效果跟类型26是一样的，直接跳转到43BB1C位置
0043BA14 |> E9 03010000 JMP 0043BB1C
命中类型1、4、7、8、9、D等
0043BA19 |> 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
0043BA1C |. 6BC0 09 IMUL EAX,EAX,9
0043BA1F |. 33D2 XOR EDX,EDX
0043BA21 |. B9 0A000000 MOV ECX,0A
0043BA26 |. F7F1 DIV ECX
0043BA28 |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
0043BA2B |. E9 EC000000 JMP 0043BB1C
将之前计算出来的正常命中率进行乘以9再除以10的处理，即上限90%处理。
命中类型1C
0043BA30 |> 837D 08 00 CMP DWORD PTR SS:[EBP+8],0
0043BA34 |. 74 1A JE SHORT 0043BA50
0043BA36 |. 8B4D D8 MOV ECX,DWORD PTR SS:[EBP-28]
0043BA39 |. E8 F225FEFF CALL 0041E030
0043BA3E |. 25 FF000000 AND EAX,0FF
0043BA43 |. 85C0 TEST EAX,EAX
0043BA45 |. 75 09 JNZ SHORT 0043BA50
0043BA47 |. C745 F0 000000>MOV DWORD PTR SS:[EBP-10],0
0043BA4E |. EB 12 JMP SHORT 0043BA62
0043BA50 |> 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
0043BA53 |. 6BC0 09 IMUL EAX,EAX,9
0043BA56 |. 33D2 XOR EDX,EDX
0043BA58 |. B9 0A000000 MOV ECX,0A
0043BA5D |. F7F1 DIV ECX
0043BA5F |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
0043BA62 |> E9 B5000000 JMP 0043BB1C
同样是恢复状态的策略专用，只是命中率要进行上限90%的处理。
命中类型2、5、A、E等
0043BA67 |> 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
0043BA6A |. C1E0 02 SHL EAX,2
0043BA6D |. 33D2 XOR EDX,EDX
0043BA6F |. B9 05000000 MOV ECX,5
0043BA74 |. F7F1 DIV ECX
0043BA76 |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
0043BA79 |. E9 9E000000 JMP 0043BB1C
正常命中率上限80%的处理。
命中类型3、B、11、13
0043BA7E |> 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
0043BA81 |. 6BC0 03 IMUL EAX,EAX,3
0043BA84 |. 33D2 XOR EDX,EDX
0043BA86 |. B9 05000000 MOV ECX,5
0043BA8B |. F7F1 DIV ECX
0043BA8D |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
0043BA90 |. E9 87000000 JMP 0043BB1C
正常命中率上限60%的处理。
命中类型15
0043BA95 |> 8B55 F0 MOV EDX,DWORD PTR SS:[EBP-10]
0043BA98 |. D1EA SHR EDX,1
0043BA9A |. 8955 F0 MOV DWORD PTR SS:[EBP-10],EDX
0043BA9D |. EB 7D JMP SHORT 0043BB1C
正常命中率上限50%的处理。
命中类型6
0043BA9F |> 8B4D D8 MOV ECX,DWORD PTR SS:[EBP-28]
0043BAA2 |. E8 0908FEFF CALL 0041C2B0
0043BAA7 |. 25 FF000000 AND EAX,0FF
0043BAAC |. 85C0 TEST EAX,EAX
0043BAAE |. 74 18 JE SHORT 0043BAC8
检查防御方的战场编号是否为0（我军主将），如果是就命中率为0。
0043BAB0 |. 8B4D D8 MOV ECX,DWORD PTR SS:[EBP-28]
0043BAB3 |. E8 B83B0200 CALL 0045F670
0043BAB8 |. 8BF0 MOV ESI,EAX
0043BABA |. B9 902F4900 MOV ECX,00492F90
0043BABF |. E8 6CABFCFF CALL 00406630
0043BAC4 |. 3BF0 CMP ESI,EAX
0043BAC6 |. 75 09 JNZ SHORT 0043BAD1
检查防御方的武将编号是否剧本中设置的敌军主将，是就命中率为0。
0043BAC8 |> C745 F0 000000>MOV DWORD PTR SS:[EBP-10],0
0043BACF |. EB 0F JMP SHORT 0043BAE0
0043BAD1 |> 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
0043BAD4 |. 33D2 XOR EDX,EDX
0043BAD6 |. B9 03000000 MOV ECX,3
0043BADB |. F7F1 DIV ECX
0043BADD |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
0043BAE0 |> EB 3A JMP SHORT 0043BB1C
如果上述两个条件都不符合，则正常命中率除以3，即上限33.33处理。原版海啸专用。
命中类型C
0043BAE2 |> 8B4D D8 MOV ECX,DWORD PTR SS:[EBP-28]
0043BAE5 |. E8 C607FEFF CALL 0041C2B0
0043BAEA |. 25 FF000000 AND EAX,0FF
0043BAEF |. 85C0 TEST EAX,EAX
0043BAF1 |. 74 18 JE SHORT 0043BB0B
0043BAF3 |. 8B4D D8 MOV ECX,DWORD PTR SS:[EBP-28]
0043BAF6 |. E8 753B0200 CALL 0045F670
0043BAFB |. 8BF0 MOV ESI,EAX
0043BAFD |. B9 902F4900 MOV ECX,00492F90
0043BB02 |. E8 29ABFCFF CALL 00406630
0043BB07 |. 3BF0 CMP ESI,EAX
0043BB09 |. 75 09 JNZ SHORT 0043BB14
0043BB0B |> C745 F0 000000>MOV DWORD PTR SS:[EBP-10],0
0043BB12 |. EB 08 JMP SHORT 0043BB1C
0043BB14 |> 8B55 F0 MOV EDX,DWORD PTR SS:[EBP-10]
0043BB17 |. D1EA SHR EDX,1
0043BB19 |. 8955 F0 MOV DWORD PTR SS:[EBP-10],EDX
过程与前面的命中类型6相同，只是最后进行上限50%的处理。原版晕眩专用。
所有的分支表最后都跳到这里继续程序的运行，当中命中类型0和26都是直接到这里的，表示对正常命中率不进行任务的上限处理。
0043BB1C |> 8B45 10 MOV EAX,DWORD PTR SS:[EBP+10]
0043BB1F |. 25 FF000000 AND EAX,0FF
0043BB24 |. 83F8 14 CMP EAX,14
0043BB27 |. 75 1D JNZ SHORT 0043BB46
判断使用的是否为编号14H的策略，即原版诱惑。
0043BB29 |. 8B4D E8 MOV ECX,DWORD PTR SS:[EBP-18]
0043BB2C |. E8 3FF9FFFF CALL 0043B470
0043BB31 |. 25 FF000000 AND EAX,0FF
0043BB36 |. 83F8 0C CMP EAX,0C
0043BB39 |. 75 0B JNZ SHORT 0043BB46
如果是使用14H的策略，再判断攻击方是否大兵种编号0CH的兵种，即原版舞娘系。
0043BB3B |. 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10]
0043BB3E |. 6BC9 03 IMUL ECX,ECX,3
0043BB41 |. D1E9 SHR ECX,1
0043BB43 |. 894D F0 MOV DWORD PTR SS:[EBP-10],ECX
符合上面条件，则命中率乘以3再除以2，即上限150%处理。
0043BB46 |> 837D F0 64 CMP DWORD PTR SS:[EBP-10],64
0043BB4A |. 76 09 JBE SHORT 0043BB55
0043BB4C |. C745 C8 640000>MOV DWORD PTR SS:[EBP-38],64
0043BB53 |. EB 06 JMP SHORT 0043BB5B
0043BB55 |> 8B55 F0 MOV EDX,DWORD PTR SS:[EBP-10]
0043BB58 |. 8955 C8 MOV DWORD PTR SS:[EBP-38],EDX
0043BB5B |> 8B45 C8 MOV EAX,DWORD PTR SS:[EBP-38]
0043BB5E |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
0043BB61 |. 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
0043BB64 |> 5E POP ESI
0043BB65 |. 8BE5 MOV ESP,EBP
0043BB67 |. 5D POP EBP
0043BB68 \. C2 0C00 RETN 0C
最后是输出命中率，超过100的就要转成100再输出。
[b][size=2]二、策略伤害计算[/size][/b]
未完待续.......
........
........
[/font]
[color=Silver][[i] 本帖最后由 godtype 于 2011-2-13 11:40 编辑 [/i]][/color]
2010-3-26 22:11
godtype
[b][size=3]第六部分 使用限制[/size][/b]
[b][size=2]一、是否有天气或装备或HP的使用限制[/size][/b]
[font=宋体]41FEC9是全策略是否有天气、四神装备、HP的使用限制，由三个参数输入。其中10栈为是否可控，0是不可控，1是可控；0C栈是策略使用人的战场编号；08栈是策略编号。最后输出的EAX为0的表示不可使用。
0041FEC9 /$ 55 PUSH EBP
0041FECA |. 8BEC MOV EBP,ESP
0041FECC |. 83EC 14 SUB ESP,14
0041FECF |. 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C]
0041FED2 |. 25 FF000000 AND EAX,0FF
0041FED7 |. 6BC0 24 IMUL EAX,EAX,24
0041FEDA |. 05 502C4B00 ADD EAX,004B2C50
0041FEDF |. 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
策略使用人的战场内存地址存入[EBP-10]中。
0041FEE2 |. 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10]
0041FEE5 |. E8 86F70300 CALL 0045F670
0041FEEA |. 6BC0 48 IMUL EAX,EAX,48
0041FEED |. 05 681B4A00 ADD EAX,004A1B68
0041FEF2 |. 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX
策略使用人的DATA内存地址存入[EBP-8]中。
0041FEF5 |. C745 FC 010000>MOV DWORD PTR SS:[EBP-4],1
先将[EBP-4]赋值为1，用作最后输出是否可以使用的值。
0041FEFC |. 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]
0041FEFF |. 81E1 FF000000 AND ECX,0FF
0041FF05 |. 894D EC MOV DWORD PTR SS:[EBP-14],ECX
0041FF08 |. 837D EC 43 CMP DWORD PTR SS:[EBP-14],43
0041FF0C |. 0F87 A9040000 JA 004203BB
判断是否全部43H（67）个策略。
0041FF12 |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
0041FF15 |. 33D2 XOR EDX,EDX
0041FF17 |. 8A90 DE034200 MOV DL,BYTE PTR DS:[EAX+4203DE]
0041FF1D |. FF2495 C203420>JMP DWORD PTR DS:[EDX*4+4203C2]
根据策略编号从4203DE开始读出对应的策略限制编号，再按策略限制编号跳到对应的地址进行程序读取。
比如40H的青龙，就先从0042041E（40+4203DE）读出02，再按02对应的位置4203CA（02*4+4203C2）跳到41FF87继续程序程序读取。
004203C2 . 24FF4100 DD 0041FF24 ; Switch table used at 0041FF1D
004203C6 . 59FF4100 DD 0041FF59
004203CA . 87FF4100 DD 0041FF87
004203CE . A2004200 DD 004200A2
004203D2 . BC014200 DD 004201BC
004203D6 . D7024200 DD 004202D7
004203DA . BB034200 DD 004203BB
004203DE . 00 DB 00 ; Index table to switch 004203C2
004203DF . 00 DB 00
004203E0 . 00 DB 00
004203E1 . 00 DB 00
004203E2 . 00 DB 00
004203E3 . 06 DB 06
004203E4 . 06 DB 06
004203E5 . 06 DB 06
004203E6 . 06 DB 06
004203E7 . 06 DB 06
004203E8 . 06 DB 06
004203E9 . 06 DB 06
004203EA . 06 DB 06
004203EB . 06 DB 06
004203EC . 06 DB 06
004203ED . 06 DB 06
004203EE . 06 DB 06
004203EF . 06 DB 06
004203F0 . 06 DB 06
004203F1 . 06 DB 06
004203F2 . 06 DB 06
004203F3 . 06 DB 06
004203F4 . 06 DB 06
004203F5 . 06 DB 06
004203F6 . 06 DB 06
004203F7 . 06 DB 06
004203F8 . 06 DB 06
004203F9 . 06 DB 06
004203FA . 06 DB 06
004203FB . 06 DB 06
004203FC . 06 DB 06
004203FD . 06 DB 06
004203FE . 06 DB 06
004203FF . 06 DB 06
00420400 . 06 DB 06
00420401 . 06 DB 06
00420402 . 06 DB 06
00420403 . 06 DB 06
00420404 . 06 DB 06
00420405 . 06 DB 06
00420406 . 06 DB 06
00420407 . 06 DB 06
00420408 . 06 DB 06
00420409 . 06 DB 06
0042040A . 06 DB 06
0042040B . 06 DB 06
0042040C . 06 DB 06
0042040D . 06 DB 06
0042040E . 06 DB 06
0042040F . 06 DB 06
00420410 . 06 DB 06
00420411 . 06 DB 06
00420412 . 06 DB 06
00420413 . 06 DB 06
00420414 . 06 DB 06
00420415 . 06 DB 06
00420416 . 06 DB 06
00420417 . 06 DB 06
00420418 . 06 DB 06
00420419 . 06 DB 06
0042041A . 06 DB 06
0042041B . 06 DB 06
0042041C . 01 DB 01
0042041D . 06 DB 06
0042041E . 02 DB 02
0042041F . 03 DB 03
00420420 . 04 DB 04
00420421 . 05 DB 05
类型00，只在晴天与阴天可以使用。
0041FF24 |> B9 083D4B00 MOV ECX,004B3D08
0041FF29 |. E8 A6A20200 CALL 0044A1D4
0041FF2E |. 25 FF000000 AND EAX,0FF
0041FF33 |. 83F8 02 CMP EAX,2
0041FF36 |. 7C 1C JL SHORT 0041FF54
从44A1D4中读取当前天气，小于02的（00晴、01阴）表示可以使用。
0041FF38 |. 837D 10 00 CMP DWORD PTR SS:[EBP+10],0
0041FF3C |. 74 0F JE SHORT 0041FF4D
0041FF3E |. 68 80B74800 PUSH 0048B780 ; /Arg2 = 0048B780
0041FF43 |. 6A 02 PUSH 2 ; |Arg1 = 00000002
0041FF45 |. E8 4FF70000 CALL 0042F699 ; \0042F699
0041FF4A |. 83C4 08 ADD ESP,8
0041FF4D |> C745 FC 000000>MOV DWORD PTR SS:[EBP-4],0
0041FF54 |> E9 62040000 JMP 004203BB
大于等于02的（02小雨、03大雨、04雪）表示不可以使用，然后判断策略使用人是否可控的部队，可控的就会显示“在恶劣天气是无法法使用”的说明。最后将[EBP-4]赋值为0，跳到最后面输出。
类型01，冥想（减少自身当前HP来补充自身当前MP）专用。
0041FF59 |> 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10]
0041FF5C |. E8 2F2D0500 CALL 00472C90
0041FF61 |. 83F8 03 CMP EAX,3
0041FF64 |. 73 1C JNB SHORT 0041FF82
先判断自身当前HP是否大于等于3，是就可以使用，不于3就不可以使用。
0041FF66 |. 837D 10 00 CMP DWORD PTR SS:[EBP+10],0
0041FF6A |. 74 0F JE SHORT 0041FF7B
0041FF6C |. 68 98B74800 PUSH 0048B798 ; /Arg2 = 0048B798
0041FF71 |. 6A 02 PUSH 2 ; |Arg1 = 00000002
0041FF73 |. E8 21F70000 CALL 0042F699 ; \0042F699
0041FF78 |. 83C4 08 ADD ESP,8
0041FF7B |> C745 FC 000000>MOV DWORD PTR SS:[EBP-4],0
0041FF82 |> E9 34040000 JMP 004203BB
不可以使用的情况，参考前面的类型00。
类型02，青龙专用，其实就是带有指定装备且只限雨雪天（03、04、05）使用。
0041FF87 |> 6A 32 PUSH 32 ; /Arg1 = 00000032
0041FF89 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
0041FF8C |. E8 787AFEFF CALL 00407A09 ; \00407A09
0041FF91 |. 85C0 TEST EAX,EAX
0041FF93 |. 74 20 JE SHORT 0041FFB5
先判断策略使用人身上是否有指定特效（32）的装备。
0041FF95 |. 6A 32 PUSH 32 ; /Arg1 = 00000032
0041FF97 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
0041FF9A |. E8 537BFEFF CALL 00407AF2 ; \00407AF2
0041FF9F |. 25 FF000000 AND EAX,0FF
0041FFA4 |. 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]
0041FFA7 |. 81E1 FF000000 AND ECX,0FF
0041FFAD |. 3BC1 CMP EAX,ECX
0041FFAF |. 0F84 B8000000 JE 0042006D
再判断该装备对应的DATA效果值是否等于策略编号，四神宝玉都要在DATA中设置对应的策略编号，否则就不能用了。如果DATA效果值与策略编号相等就跳到42006D进行天气判断。
如果DATA效果值与策略编号不相等就继续运行下面的代码，主要用作显示出“使用**策略需要**装备”的文字，不详细解释了。
0041FFB5 |> C645 F4 00 MOV BYTE PTR SS:[EBP-C],0
0041FFB9 |. EB 09 JMP SHORT 0041FFC4
0041FFBB |> 8A55 F4 /MOV DL,BYTE PTR SS:[EBP-C]
0041FFBE |. 80C2 01 |ADD DL,1
0041FFC1 |. 8855 F4 |MOV BYTE PTR SS:[EBP-C],DL
0041FFC4 |> 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
0041FFC7 |. 25 FF000000 |AND EAX,0FF
0041FFCC |. 83F8 68 |CMP EAX,68
0041FFCF |. 7D 4E |JGE SHORT 0042001F
0041FFD1 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
0041FFD4 |. 81E1 FF000000 |AND ECX,0FF
0041FFDA |. 6BC9 19 |IMUL ECX,ECX,19
0041FFDD |. 81C1 40114A00 |ADD ECX,004A1140
0041FFE3 |. E8 5895FEFF |CALL 00409540
0041FFE8 |. 25 FF000000 |AND EAX,0FF
0041FFED |. 83F8 32 |CMP EAX,32
0041FFF0 |. 75 2B |JNZ SHORT 0042001D
0041FFF2 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
0041FFF5 |. 81E1 FF000000 |AND ECX,0FF
0041FFFB |. 6BC9 19 |IMUL ECX,ECX,19
0041FFFE |. 81C1 40114A00 |ADD ECX,004A1140
00420004 |. E8 67DDFFFF |CALL 0041DD70
00420009 |. 25 FF000000 |AND EAX,0FF
0042000E |. 8B4D 08 |MOV ECX,DWORD PTR SS:[EBP+8]
00420011 |. 81E1 FF000000 |AND ECX,0FF
00420017 |. 3BC1 |CMP EAX,ECX
00420019 |. 75 02 |JNZ SHORT 0042001D
0042001B |. EB 02 |JMP SHORT 0042001F
0042001D |>^EB 9C \JMP SHORT 0041FFBB
0042001F |> 837D 10 00 CMP DWORD PTR SS:[EBP+10],0
00420023 |. 74 3F JE SHORT 00420064
00420025 |. 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
00420028 |. 81E1 FF000000 AND ECX,0FF
0042002E |. 6BC9 19 IMUL ECX,ECX,19
00420031 |. 81C1 40114A00 ADD ECX,004A1140
00420037 |. E8 D4F60300 CALL 0045F710
0042003C |. 50 PUSH EAX
0042003D |. 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]
00420040 |. 81E1 FF000000 AND ECX,0FF
00420046 |. 6BC9 46 IMUL ECX,ECX,46
00420049 |. 81C1 C0F44A00 ADD ECX,004AF4C0
0042004F |. E8 BCF60300 CALL 0045F710
00420054 |. 50 PUSH EAX ; |Arg3
00420055 |. 68 A4B74800 PUSH 0048B7A4 ; |Arg2 = 0048B7A4
0042005A |. 6A 02 PUSH 2 ; |Arg1 = 00000002
0042005C |. E8 38F60000 CALL 0042F699 ; \0042F699
00420061 |. 83C4 10 ADD ESP,10
00420064 |> C745 FC 000000>MOV DWORD PTR SS:[EBP-4],0
0042006B |. EB 30 JMP SHORT 0042009D
下面这部分判断天气是否是雨雪天。
0042006D |> B9 083D4B00 MOV ECX,004B3D08
00420072 |. E8 5DA10200 CALL 0044A1D4
00420077 |. 25 FF000000 AND EAX,0FF
0042007C |. 83F8 02 CMP EAX,2
0042007F |. 7D 1C JGE SHORT 0042009D
00420081 |. 837D 10 00 CMP DWORD PTR SS:[EBP+10],0
00420085 |. 74 0F JE SHORT 00420096
00420087 |. 68 B4B74800 PUSH 0048B7B4 ; /Arg2 = 0048B7B4
0042008C |. 6A 02 PUSH 2 ; |Arg1 = 00000002
0042008E |. E8 06F60000 CALL 0042F699 ; \0042F699
00420093 |. 83C4 08 ADD ESP,8
00420096 |> C745 FC 000000>MOV DWORD PTR SS:[EBP-4],0
0042009D |> E9 19030000 JMP 004203BB
类型03，朱雀专用，其实就是带有指定装备且只限晴天（00）使用。跟前面类型02相似，不详细解释了。
004200A2 |> 6A 32 PUSH 32 ; /Arg1 = 00000032
004200A4 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
004200A7 |. E8 5D79FEFF CALL 00407A09 ; \00407A09
004200AC |. 85C0 TEST EAX,EAX
004200AE |. 74 20 JE SHORT 004200D0
004200B0 |. 6A 32 PUSH 32 ; /Arg1 = 00000032
004200B2 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
004200B5 |. E8 387AFEFF CALL 00407AF2 ; \00407AF2
004200BA |. 25 FF000000 AND EAX,0FF
004200BF |. 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]
004200C2 |. 81E2 FF000000 AND EDX,0FF
004200C8 |. 3BC2 CMP EAX,EDX
004200CA |. 0F84 B8000000 JE 00420188
004200D0 |> C645 F4 00 MOV BYTE PTR SS:[EBP-C],0
004200D4 |. EB 08 JMP SHORT 004200DE
004200D6 |> 8A45 F4 /MOV AL,BYTE PTR SS:[EBP-C]
004200D9 |. 04 01 |ADD AL,1
004200DB |. 8845 F4 |MOV BYTE PTR SS:[EBP-C],AL
004200DE |> 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
004200E1 |. 81E1 FF000000 |AND ECX,0FF
004200E7 |. 83F9 68 |CMP ECX,68
004200EA |. 7D 4E |JGE SHORT 0042013A
004200EC |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
004200EF |. 81E1 FF000000 |AND ECX,0FF
004200F5 |. 6BC9 19 |IMUL ECX,ECX,19
004200F8 |. 81C1 40114A00 |ADD ECX,004A1140
004200FE |. E8 3D94FEFF |CALL 00409540
00420103 |. 25 FF000000 |AND EAX,0FF
00420108 |. 83F8 32 |CMP EAX,32
0042010B |. 75 2B |JNZ SHORT 00420138
0042010D |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
00420110 |. 81E1 FF000000 |AND ECX,0FF
00420116 |. 6BC9 19 |IMUL ECX,ECX,19
00420119 |. 81C1 40114A00 |ADD ECX,004A1140
0042011F |. E8 4CDCFFFF |CALL 0041DD70
00420124 |. 25 FF000000 |AND EAX,0FF
00420129 |. 8B55 08 |MOV EDX,DWORD PTR SS:[EBP+8]
0042012C |. 81E2 FF000000 |AND EDX,0FF
00420132 |. 3BC2 |CMP EAX,EDX
00420134 |. 75 02 |JNZ SHORT 00420138
00420136 |. EB 02 |JMP SHORT 0042013A
00420138 |>^EB 9C \JMP SHORT 004200D6
0042013A |> 837D 10 00 CMP DWORD PTR SS:[EBP+10],0
0042013E |. 74 3F JE SHORT 0042017F
00420140 |. 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
00420143 |. 81E1 FF000000 AND ECX,0FF
00420149 |. 6BC9 19 IMUL ECX,ECX,19
0042014C |. 81C1 40114A00 ADD ECX,004A1140
00420152 |. E8 B9F50300 CALL 0045F710
00420157 |. 50 PUSH EAX
00420158 |. 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]
0042015B |. 81E1 FF000000 AND ECX,0FF
00420161 |. 6BC9 46 IMUL ECX,ECX,46
00420164 |. 81C1 C0F44A00 ADD ECX,004AF4C0
0042016A |. E8 A1F50300 CALL 0045F710
0042016F |. 50 PUSH EAX ; |Arg3
00420170 |. 68 CCB74800 PUSH 0048B7CC ; |Arg2 = 0048B7CC
00420175 |. 6A 02 PUSH 2 ; |Arg1 = 00000002
00420177 |. E8 1DF50000 CALL 0042F699 ; \0042F699
0042017C |. 83C4 10 ADD ESP,10
0042017F |> C745 FC 000000>MOV DWORD PTR SS:[EBP-4],0
00420186 |. EB 2F JMP SHORT 004201B7
00420188 |> B9 083D4B00 MOV ECX,004B3D08
0042018D |. E8 42A00200 CALL 0044A1D4
00420192 |. 25 FF000000 AND EAX,0FF
00420197 |. 85C0 TEST EAX,EAX
00420199 |. 74 1C JE SHORT 004201B7
0042019B |. 837D 10 00 CMP DWORD PTR SS:[EBP+10],0
0042019F |. 74 0F JE SHORT 004201B0
004201A1 |. 68 DCB74800 PUSH 0048B7DC ; /Arg2 = 0048B7DC
004201A6 |. 6A 02 PUSH 2 ; |Arg1 = 00000002
004201A8 |. E8 ECF40000 CALL 0042F699 ; \0042F699
004201AD |. 83C4 08 ADD ESP,8
004201B0 |> C745 FC 000000>MOV DWORD PTR SS:[EBP-4],0
004201B7 |> E9 FF010000 JMP 004203BB
类型04，玄武专用，其实就是带有指定装备且只限阴天（01）使用。跟前面类型02、03相似，不详细解释了。
004201BC |> 6A 32 PUSH 32 ; /Arg1 = 00000032
004201BE |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
004201C1 |. E8 4378FEFF CALL 00407A09 ; \00407A09
004201C6 |. 85C0 TEST EAX,EAX
004201C8 |. 74 20 JE SHORT 004201EA
004201CA |. 6A 32 PUSH 32 ; /Arg1 = 00000032
004201CC |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
004201CF |. E8 1E79FEFF CALL 00407AF2 ; \00407AF2
004201D4 |. 25 FF000000 AND EAX,0FF
004201D9 |. 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]
004201DC |. 81E1 FF000000 AND ECX,0FF
004201E2 |. 3BC1 CMP EAX,ECX
004201E4 |. 0F84 B8000000 JE 004202A2
004201EA |> C645 F4 00 MOV BYTE PTR SS:[EBP-C],0
004201EE |. EB 09 JMP SHORT 004201F9
004201F0 |> 8A55 F4 /MOV DL,BYTE PTR SS:[EBP-C]
004201F3 |. 80C2 01 |ADD DL,1
004201F6 |. 8855 F4 |MOV BYTE PTR SS:[EBP-C],DL
004201F9 |> 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
004201FC |. 25 FF000000 |AND EAX,0FF
00420201 |. 83F8 68 |CMP EAX,68
00420204 |. 7D 4E |JGE SHORT 00420254
00420206 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
00420209 |. 81E1 FF000000 |AND ECX,0FF
0042020F |. 6BC9 19 |IMUL ECX,ECX,19
00420212 |. 81C1 40114A00 |ADD ECX,004A1140
00420218 |. E8 2393FEFF |CALL 00409540
0042021D |. 25 FF000000 |AND EAX,0FF
00420222 |. 83F8 32 |CMP EAX,32
00420225 |. 75 2B |JNZ SHORT 00420252
00420227 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
0042022A |. 81E1 FF000000 |AND ECX,0FF
00420230 |. 6BC9 19 |IMUL ECX,ECX,19
00420233 |. 81C1 40114A00 |ADD ECX,004A1140
00420239 |. E8 32DBFFFF |CALL 0041DD70
0042023E |. 25 FF000000 |AND EAX,0FF
00420243 |. 8B4D 08 |MOV ECX,DWORD PTR SS:[EBP+8]
00420246 |. 81E1 FF000000 |AND ECX,0FF
0042024C |. 3BC1 |CMP EAX,ECX
0042024E |. 75 02 |JNZ SHORT 00420252
00420250 |. EB 02 |JMP SHORT 00420254
00420252 |>^EB 9C \JMP SHORT 004201F0
00420254 |> 837D 10 00 CMP DWORD PTR SS:[EBP+10],0
00420258 |. 74 3F JE SHORT 00420299
0042025A |. 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
0042025D |. 81E1 FF000000 AND ECX,0FF
00420263 |. 6BC9 19 IMUL ECX,ECX,19
00420266 |. 81C1 40114A00 ADD ECX,004A1140
0042026C |. E8 9FF40300 CALL 0045F710
00420271 |. 50 PUSH EAX
00420272 |. 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]
00420275 |. 81E1 FF000000 AND ECX,0FF
0042027B |. 6BC9 46 IMUL ECX,ECX,46
0042027E |. 81C1 C0F44A00 ADD ECX,004AF4C0
00420284 |. E8 87F40300 CALL 0045F710
00420289 |. 50 PUSH EAX ; |Arg3
0042028A |. 68 F0B74800 PUSH 0048B7F0 ; |Arg2 = 0048B7F0
0042028F |. 6A 02 PUSH 2 ; |Arg1 = 00000002
00420291 |. E8 03F40000 CALL 0042F699 ; \0042F699
00420296 |. 83C4 10 ADD ESP,10
00420299 |> C745 FC 000000>MOV DWORD PTR SS:[EBP-4],0
004202A0 |. EB 30 JMP SHORT 004202D2
004202A2 |> B9 083D4B00 MOV ECX,004B3D08
004202A7 |. E8 289F0200 CALL 0044A1D4
004202AC |. 25 FF000000 AND EAX,0FF
004202B1 |. 83F8 01 CMP EAX,1
004202B4 |. 74 1C JE SHORT 004202D2
004202B6 |. 837D 10 00 CMP DWORD PTR SS:[EBP+10],0
004202BA |. 74 0F JE SHORT 004202CB
004202BC |. 68 00B84800 PUSH 0048B800 ; /Arg2 = 0048B800
004202C1 |. 6A 02 PUSH 2 ; |Arg1 = 00000002
004202C3 |. E8 D1F30000 CALL 0042F699 ; \0042F699
004202C8 |. 83C4 08 ADD ESP,8
004202CB |> C745 FC 000000>MOV DWORD PTR SS:[EBP-4],0
004202D2 |> E9 E4000000 JMP 004203BB
类型05，白虎专用，其实就是带有指定装备但没有任何天气限制。同样跟前面几种类型相似，不详细解释了。
004202D7 |> 6A 32 PUSH 32 ; /Arg1 = 00000032
004202D9 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
004202DC |. E8 2877FEFF CALL 00407A09 ; \00407A09
004202E1 |. 85C0 TEST EAX,EAX
004202E3 |. 74 20 JE SHORT 00420305
004202E5 |. 6A 32 PUSH 32 ; /Arg1 = 00000032
004202E7 |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
004202EA |. E8 0378FEFF CALL 00407AF2 ; \00407AF2
004202EF |. 25 FF000000 AND EAX,0FF
004202F4 |. 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]
004202F7 |. 81E2 FF000000 AND EDX,0FF
004202FD |. 3BC2 CMP EAX,EDX
004202FF |. 0F84 B6000000 JE 004203BB
00420305 |> C645 F4 00 MOV BYTE PTR SS:[EBP-C],0
00420309 |. EB 08 JMP SHORT 00420313
0042030B |> 8A45 F4 /MOV AL,BYTE PTR SS:[EBP-C]
0042030E |. 04 01 |ADD AL,1
00420310 |. 8845 F4 |MOV BYTE PTR SS:[EBP-C],AL
00420313 |> 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
00420316 |. 81E1 FF000000 |AND ECX,0FF
0042031C |. 83F9 68 |CMP ECX,68
0042031F |. 7D 4E |JGE SHORT 0042036F
00420321 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
00420324 |. 81E1 FF000000 |AND ECX,0FF
0042032A |. 6BC9 19 |IMUL ECX,ECX,19
0042032D |. 81C1 40114A00 |ADD ECX,004A1140
00420333 |. E8 0892FEFF |CALL 00409540
00420338 |. 25 FF000000 |AND EAX,0FF
0042033D |. 83F8 32 |CMP EAX,32
00420340 |. 75 2B |JNZ SHORT 0042036D
00420342 |. 8B4D F4 |MOV ECX,DWORD PTR SS:[EBP-C]
00420345 |. 81E1 FF000000 |AND ECX,0FF
0042034B |. 6BC9 19 |IMUL ECX,ECX,19
0042034E |. 81C1 40114A00 |ADD ECX,004A1140
00420354 |. E8 17DAFFFF |CALL 0041DD70
00420359 |. 25 FF000000 |AND EAX,0FF
0042035E |. 8B55 08 |MOV EDX,DWORD PTR SS:[EBP+8]
00420361 |. 81E2 FF000000 |AND EDX,0FF
00420367 |. 3BC2 |CMP EAX,EDX
00420369 |. 75 02 |JNZ SHORT 0042036D
0042036B |. EB 02 |JMP SHORT 0042036F
0042036D |>^EB 9C \JMP SHORT 0042030B
0042036F |> 837D 10 00 CMP DWORD PTR SS:[EBP+10],0
00420373 |. 74 3F JE SHORT 004203B4
00420375 |. 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
00420378 |. 81E1 FF000000 AND ECX,0FF
0042037E |. 6BC9 19 IMUL ECX,ECX,19
00420381 |. 81C1 40114A00 ADD ECX,004A1140
00420387 |. E8 84F30300 CALL 0045F710
0042038C |. 50 PUSH EAX
0042038D |. 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]
00420390 |. 81E1 FF000000 AND ECX,0FF
00420396 |. 6BC9 46 IMUL ECX,ECX,46
00420399 |. 81C1 C0F44A00 ADD ECX,004AF4C0
0042039F |. E8 6CF30300 CALL 0045F710
004203A4 |. 50 PUSH EAX ; |Arg3
004203A5 |. 68 14B84800 PUSH 0048B814 ; |Arg2 = 0048B814
004203AA |. 6A 02 PUSH 2 ; |Arg1 = 00000002
004203AC |. E8 E8F20000 CALL 0042F699 ; \0042F699
004203B1 |. 83C4 10 ADD ESP,10
004203B4 |> C745 FC 000000>MOV DWORD PTR SS:[EBP-4],0
类型06，无使用限制。
004203BB |> 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004203BE |. 8BE5 MOV ESP,EBP
004203C0 |. 5D POP EBP
004203C1 \. C3 RETN[/font]
[b][size=2]二、使用对象的限制[/size][/b]
未完待续。。。。。。
[color=Silver][[i] 本帖最后由 godtype 于 2013-3-11 11:20 编辑 [/i]][/color]
2010-3-26 22:13
godtype
占最后一坑，应该够了。
2010-3-26 22:43
阿尔法孝直
说实话，汇编我看得云里雾里的，还是把每一句翻译成C，这样我不看注释也能读懂。。。
2010-3-26 23:20
看这的是白痴
太感谢您了
2010-3-27 08:07
godtype
[quote]原帖由 [i]阿尔法孝直[/i] 于 2010-3-26 22:43 发表
说实话，汇编我看得云里雾里的，还是把每一句翻译成C，这样我不看注释也能读懂。。。 [/quote]
:hz1001:问题是我只会反汇编来改游戏，其他一概不懂，谁叫我当初读职中的时候选错科（学校有三大科：电子、电脑、电气，我读的是电子），到目前为止的计算机知识除了一小部分基础是有人教，其他都是自学回来的，身边会计算机的人都不懂语言类。
2010-3-27 08:10
godtype
[quote]原帖由 [i]cronnin[/i] 于 2010-3-27 08:01 发表
这些代码适用哪个版本的引擎? [/quote]
除非有特殊注明，否则都是MOD制作所用的最原始的水木清华版。
改版尤其是增加了策略类型的引擎都会对第二部分的这条函数进行压缩，因为位置不够用。
2010-3-27 08:25
阿尔法孝直
我读的也是电子，不过一开始学的是C，但是以后要不要学汇编就不大清楚了，这里推荐一个软件吧，IDA Pro，反汇编不错，如果装上插件Hex-Rays，可以直接反成C。
2010-3-27 08:35
godtype
IDA Pro 有没有可用的下载链接，一直都找不到可用的链接。
2010-3-28 12:19
a117398902
不知能否改动策略施展时对应的动画效果呢?
[color=Silver][[i] 本帖最后由 a117398902 于 2010-3-28 12:21 编辑 [/i]][/color]
2010-3-28 14:09
godtype
回复 #18 a117398902 的帖子
第二部分已经有提到了，4866C0开始就是动画编号。
2010-3-29 15:30
godtype
更新砂暴式全屏伤害、异常状态类和上升下降类。
2010-3-29 16:22
阿尔法孝直
真想看到最核心的部分——敌军AI。
希望坛子里走出“龙吟第二”
期待楼主分析孔明传。
2010-4-2 11:16
godtype
回复 #21 阿尔法孝直 的帖子
AI不是我强项，可以说是完全看不明白。
EKD2的确是有打算研究，不过短时间内应该没时间。
2010-4-2 11:18
godtype
更新5条函数，都是没有太多值得解释的内容。
接下来的是四个复合（或者叫复杂）策略：八阵、青龙、玄武、白虎。这些要慢慢解释。
2010-4-2 11:41
阿尔法孝直
[quote]原帖由 [i]godtype[/i] 于 2010-4-2 11:16 发表
AI不是我强项，可以说是完全看不明白。
EKD2的确是有打算研究，不过短时间内应该没时间。 [/quote]
嗯，很期待，来我这儿发，保证给你大大地精华。:hz1023:
2010-4-10 10:18
godtype
更新八阵图，顺便修正一下前面直接伤害里面写错的注解。
2010-4-12 10:51
godtype
再更新，四神之青龙，想修改青龙的攻击次数的就必看。
2010-4-30 20:33
godtype
更新玄武与白虎。
2011-2-13 11:41
godtype
本来没有打算更新的，正好有人问策略命中率，那就顺便更新一下。
2011-2-15 11:21
513633522
既然更新了 就保留下来再看
2013-3-11 11:24
godtype
补充天气、装备、HP限制
2013-3-11 13:42
WHITESHIP
填坑了，搭车问几个问题。
1、策略识别码里那些数字有什么规律，40、50、BF、FF等。如果这些数字没有什么含义的话，我改写代码就直接引用索引表425A3F里的类型好了。
2、DATA中设置的策略类型有什么作用？
除了天气判断，
以及命中设置里0043B800 |. 8845 F8 MOV BYTE PTR SS:[EBP-8],AL这一条多余代码，还有用没？没用我就把这字节改成伤害系数算了。
2013-3-11 15:11
godtype
回复 #30 WHITESHIP 的帖子
1跟最终效果有关，只不过我实在难以理解当年光荣的程序员为什么要这样设置，明明一个效果配一个识别码也不过十几个，偏要弄差不多200个。
2在前面提过了，的确在原版没有用。
2014-3-26 22:23
godtype
[font=宋体][size=3]无意中翻到这帖，刚好这几天在调整几个策略的伤害显示和受攻击后动作变化，简单写一下关于策略识别码。
0042202E |. 33C0 |XOR EAX,EAX
00422030 |. 8A840A 5502000>|MOV AL,BYTE PTR DS:[EDX+ECX+255]
00422037 |. 25 C0000000 |AND EAX,0C0
[color=Red]0042203C |. 83F8 40 |CMP EAX,40[/color]
0042203F |. 75 39 |JNZ SHORT Ekd5C.0042207A
00422041 |. 8B8D E0FEFFFF |MOV ECX,DWORD PTR SS:[EBP-120]
00422047 |. 81E1 FF000000 |AND ECX,0FF
0042204D |. 8B95 CCFEFFFF |MOV EDX,DWORD PTR SS:[EBP-134]
00422053 |. 33C0 |XOR EAX,EAX
00422055 |. 8A840A 5502000>|MOV AL,BYTE PTR DS:[EDX+ECX+255]
0042205C |. 8B8D CCFEFFFF |MOV ECX,DWORD PTR SS:[EBP-134]
00422062 |. 33D2 |XOR EDX,EDX
00422064 |. 8A91 54020000 |MOV DL,BYTE PTR DS:[ECX+254]
0042206A |. 3BC2 |CMP EAX,EDX
0042206C |. 75 0C |JNZ SHORT Ekd5C.0042207A
[color=Blue]0042206E |. C745 F0 001B00>|MOV DWORD PTR SS:[EBP-10],1B00[/color]
00422075 |. E9 20010000 |JMP Ekd5C.0042219A
前面的AND EAX,0C0，可以将策略识别码中的40--74全部置为40，80--BF全部置为80，其中这里的40就是判断是否对敌类策略。
最后的1B 00是SPC图中受攻击动作（第四帧）的开始地址。
0042207A |> 8B85 E0FEFFFF |MOV EAX,DWORD PTR SS:[EBP-120]
00422080 |. 25 FF000000 |AND EAX,0FF
00422085 |. 8B8D CCFEFFFF |MOV ECX,DWORD PTR SS:[EBP-134]
0042208B |. 33D2 |XOR EDX,EDX
0042208D |. 8A9401 5502000>|MOV DL,BYTE PTR DS:[ECX+EAX+255]
00422094 |. 81E2 C0000000 |AND EDX,0C0
[color=Red]0042209A |. 81FA 80000000 |CMP EDX,80[/color]
004220A0 |. 75 39 |JNZ SHORT Ekd5C.004220DB
004220A2 |. 8B85 E0FEFFFF |MOV EAX,DWORD PTR SS:[EBP-120]
004220A8 |. 25 FF000000 |AND EAX,0FF
004220AD |. 8B8D CCFEFFFF |MOV ECX,DWORD PTR SS:[EBP-134]
004220B3 |. 8A9408 5502000>|MOV DL,BYTE PTR DS:[EAX+ECX+255]
004220BA |. 8B85 CCFEFFFF |MOV EAX,DWORD PTR SS:[EBP-134]
004220C0 |. 8A88 54020000 |MOV CL,BYTE PTR DS:[EAX+254]
004220C6 |. 3AD1 |CMP DL,CL
004220C8 |. 74 05 |JE SHORT Ekd5C.004220CF
004220CA |. 80F9 88 |CMP CL,88
004220CD |. 75 0C |JNZ SHORT Ekd5C.004220DB
[color=Blue]004220CF |> C745 F0 002400>|MOV DWORD PTR SS:[EBP-10],2400[/color]
004220D6 |. E9 BF000000 |JMP Ekd5C.0042219A
这段跟前面的相似，当然这里的80就是判断是否对己类策略。
最后的24 00是SPC图中举起武器动作（第五帧）的开始地址。
PS：这段代码不是原版的，是我修正看护系策略后的代码。
004220DB |> 8B85 E0FEFFFF |MOV EAX,DWORD PTR SS:[EBP-120]
004220E1 |. 25 FF000000 |AND EAX,0FF
004220E6 |. 8B95 CCFEFFFF |MOV EDX,DWORD PTR SS:[EBP-134]
004220EC |. 33C9 |XOR ECX,ECX
004220EE |. 8A8C10 5502000>|MOV CL,BYTE PTR DS:[EAX+EDX+255]
004220F5 |. 85C9 |TEST ECX,ECX
004220F7 |. 0F85 98000000 |JNZ Ekd5C.00422195
最后这段就是当255的值为0，即策略不成功时的。后面没贴出来的代码就是根据武将朝向进行防御动作的绘画。[/size][/font]
2014-4-5 00:35
aaa132536
问几个问题：
1、我军释放策略时会弹出策略攻击范围框进行选择，而敌军释放策略时就不会，问一下敌军释放策略时跳过哪段代码哦。
2、我军、敌军选择完受策方后将所有受策方存入497AF8+D开始的字节，这段代码在哪里哦。
2014-4-5 09:01
godtype
回复 #33 aaa132536 的帖子
第三部分已经写清楚。
2014-4-5 09:22
aaa132536
回复 #34 godtype 的帖子
谢谢毅兄，原来再第三部分，我昨天一直在第二部分找，怪不得一直找不到