No clue if I've done it correctly. Probably not.
Anyway I've "traced" some damage calculating function down to 005C79C0. As usual there.
push ebp
mov ebp, esp
sub esp, 14h
mov eax, [ebp+arg_0]
xor ecx, ecx
mov cl, [eax+5]
push ecx
mov edx, [ebp+arg_0]
push edx
call Calc_Dam1
add esp, 8
mov [ebp+var_C], eax
mov eax, [ebp+arg_0]
xor ecx, ecx
mov cl, [eax+5]
add ecx, 1
push ecx
mov edx, [ebp+arg_0]
push edx
call Calc_Dam1
add esp, 8
mov [ebp+var_8], eax
mov eax, [ebp+var_C]
imul eax, 64h
mov ecx, [ebp+arg_0]
xor edx, edx
mov dx, [ecx+24h]
mov ecx, edx
cdq
idiv ecx
sub eax, 64h
mov [ebp+var_14], eax
mov edx, [ebp+var_14]
push edx
call Calc_Dam2
add esp, 4
mov [ebp+var_10], eax
mov eax, [ebp+arg_0]
xor ecx, ecx
mov cx, [eax+24h]
mov [ebp+var_4], ecx
mov eax, [ebp+var_8]
sub eax, [ebp+var_C]
mov edx, [ebp+var_10]
xor ecx, ecx
mov cl, byte_98E6C4[edx]
imul eax, ecx
cdq
mov ecx, 64h // Defense calculation?
idiv ecx
mov edx, [ebp+var_4]
add edx, eax
mov [ebp+var_4], edx
cmp [ebp+var_4], 270Fh // damage cap check
jle short loc_5C7A62 // if less then 9999 skip next step
mov [ebp+var_4], 270Fh // otherwise set damage to 9999
loc_5C7A62:
mov eax, [ebp+arg_0]
mov cx, word ptr [ebp+var_4]
mov [eax+24h], cx
mov esp, ebp
pop ebp
retn
I thought I'd get the thing to compile back before I started investigating what goes on to verify that I do have the correct set of data.
