전투 데미지/명중 계산 추적

판정

확정 0x433f0e가 hit unit payload를 선택하고 unit byte 0..2/5/7을 전투 결과 필드로 넘기는 지점이다.
확정 hit unit byte[3]은 현재 추출된 모든 unit에서 0x00으로 고정되어 reserved/unused로 둔다.
확정 hit unit byte[4]는 target scope id다. 0x01 self/setup, 0x05 all allies, 0x06 all enemies, 0x09 one ally, 0x0a one enemy로 분리된다.
확정 0x433649는 payload hit-unit byte[4]를 읽고, 0x433545/0x4335c6은 이를 runtime actor +0x67 target selector에 쓴다.
확정 0x40fa6d는 target scope bit 0x08로 selected-target branch를 가르고, 0x40f57c action setup은 selected target latch 0x0059e347을 actor +0x61로 복사한다.
확정 0x433c99/0x433dc0은 actor +0x67 low nibble과 +0x61 selected target index로 target loop의 start/end actor index를 계산하고, 0x435538은 같은 selector로 hit-unit target loop를 돈다.
확정 hit unit byte[6]은 hit/avoid class index다. 0x4342e8..0x4342ee가 unit[6]을 읽어 target +0x36+index 명중 보정 테이블을 참조한다.
확정 byte[6] 0..3은 내부 명중 판정 class로 승격한다. 0=상단/공중/상승, 1=일반, 2=하단/지면/다운, 3=잡기/밀착 특수 판정이다.
확정 actor row +0x28..+0x2b는 target +0x36..+0x39 hit/avoid class table과 같은 계열의 전투 보정 테이블로 쓰인다.
확정 0x00546970은 hit unit family byte로 인덱싱되는 family handler table이다.
확정 0x4340ae는 target +0x6d result mode dispatcher이다. mode 0은 HP damage, mode 2는 HP recovery로 분기한다.
확정 0x4353f8은 target +0x08 current HP 감소 함수, 0x435295는 target +0x08 HP 회복 함수, 0x435356은 MP 회복 함수로 확인된다.
확정 payload status byte target +0x6c는 0x4344ab에서 성공/실패 검사를 거쳐 실패 시 0으로 지워진다.
확정 target +0x62 bit 0x20/0x08의 표시 분기는 battle_result_display_branch_review와 battle_result_helper_label_review에서 각각 full miss / guard-glancing chip result로 확정됐다.
확정 target +0x6e result value는 battle_damage_digit_display_review에서 btl_etc F54..F63 숫자 표시 입력으로 확정됐다.
확정 attacker +0x62 bit 0x10은 stat/random gate로 세워지는 alternate result bit이며, alternate damage formula와 0xc2 alt result sound/helper를 선택한 뒤 소비 시 지워진다.
확정 actor +0x28은 0x4343db에서 attacker-side RNG range/base로 쓰여 +0x62 bit 0x10 critical/alternate 판정을 만들고, 0x4344ab 상태 성공 gate에서도 attacker-side 계수로 참여한다. 상태창/장비/레벨업 운 경로와 분리된 숨은 전투 발동률 계수다.
확정 0x40ef16 result consumer는 +0x10일 때 stream +3 WLK를 읽고 helper runner 0x402321 / child script table [0x442da1+0x150] 경로를 사용한 뒤 +0x10을 지운다.
확정 battle_stat_flag_status_semantics_review에서 actor +0x1c/+0x20/+0x22/+0x24/+0x26은 공격력/방어력/기술력/순발력/운으로 승격됐다.
확정 critical은 별도 텍스트가 아니라 섬광·전용 사운드·높은 데미지로 인지된다는 수동 관찰이 있고, 이는 0x10의 alternate damage/result sound/helper 경로와 맞다.

미확정 critical alternate WLK id 14와 palette flash/fade child script는 확인됐다. 남은 것은 브라우저 러너에서 VM tick을 wall-clock ms로 환산하는 미세 타이밍이다.

계산 파이프라인

a6 target loop
0x433a30 target eligibility
0x433f0e hit unit select: payload + 0x16 + hitIndex*8
unit byte0..2 × attacker +0x80/+0x82/+0x84 -> attacker +0x70/+0x72/+0x74
unit byte3 -> reserved/unused constant 0x00 in current records
unit byte4 -> 0x433649 -> actor +0x67 target selector; selected target latch 0x0059e347 -> actor +0x61
unit byte5 -> target +0x6b family -> 0x00546970[family]
unit byte6 -> hit/avoid class index used against runtime actor +0x36 table
unit byte7 -> target +0x6c status effect id
family handler computes result into temporary +0x6e and target +0x6d mode
0x4340ae applies target result: damage/recover/display state
target +0x68 display update spawns target result object script and 0xc2 result sound

Actor/Target 필드 근거

offset	역할	근거
`+0x08`	current HP	0x4353f8 subtracts from it; 0x435295 adds to it
`+0x0a`	max HP	0x435295 clamps +0x08 to it
`+0x0e`	current MP	0x435356 adds to it
`+0x10`	max MP	0x435356 clamps +0x0e to it
`+0x28`	숨은 상태/크리티컬 발동률 계수	0x4343db에서 attacker-side RNG range/base로 쓰이고 +0x62 bit 0x10 판정을 만든다. 0x4344ab 상태 성공 gate에서도 attacker-side 계수로 읽힌다. 상태창/장비/레벨업 운 경로에는 나타나지 않는다
`+0x58`	special action family switch	0x433f0e alternate table 0x546a38 path if nonzero
`+0x59`	skill id	0x433f0e payload table index
`+0x61`	selected target actor index	0x40f65f copies selected target latch 0x0059e347 into actor +0x61; 0x433c99/0x433dc0/0x435538 consume it as a single-target range
`+0x62`	battle result/status flags	0x20/0x08 branch flags, 0x10 alternate-result, 0x40 zero-HP/death, 0x80 unavailable/down state
`+0x68`	display update flag	state/result functions set it to 1
`+0x6a`	target last skill id	0x433f0e copies attacker +0x59 into target +0x6a
`+0x6b`	hit family id	unit byte5 is copied here and indexes target resistance table
`+0x6c`	status effect/result id	unit byte7 copied here; 0x4344ab may clear it when the status gate fails
`+0x6d`	result apply mode	0x4340ae switch: 0 damage, 1 no apply, 2 recovery
`+0x6e`	result value	runtime damage number; 0x4353f8/0x435295 consume it
`unit byte[4]`	target scope id	0x433649 reads payload +0x16 + hitIndex*8 + 4, 0x433545/0x4335c6 write it to actor +0x67, 0x40fa6d uses bit 0x08 to branch into nested target-selection script
`unit byte[6]`	hit/avoid class index	0x4342e8 reads unit[6], then 0x4342ee indexes target actor +0x36+unitByte6. Labels: 0=상단/공중/상승, 1=일반, 2=하단/지면/다운, 3=잡기/밀착 특수
`+0x70/+0x72/+0x74`	unit-scaled attack components	unit bytes 0..2 multiply attacker +0x80/+0x82/+0x84
`+0x80/+0x82/+0x84`	skill/context coefficients	source operands for unit byte0..2 scaling

Payload Unit 요약

기술 레코드 281개, hit unit 452개.

family 0x10: 1540x12: 760x16: 580x11: 270x13: 250x15: 240x14: 140x17: 130x19: 90x20: 70x28: 60x21: 50x29: 40x25: 40x18: 30x01: 30x02: 30x2f: 30x03: 30x24: 20x27: 20x26: 10x2a: 10x2c: 1

status 0x00 none: 3660x02 휙날아감: 270x01 넘어짐: 260x03 행동정지: 220x04 독: 60x05 마비: 5

target scope byte[4] 0x0a: 2630x06: 1400x01: 460x09: 20x05: 1

hit/avoid class byte[6] 0x01: 3610x00: 430x02: 310x03: 17

Family Handler 그룹

handler	개수	families	해석
`0x004357d0`	22	0x00, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x30	default/no-op or shared fallback
`0x0043414d`	10	0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19	common physical damage family
`0x00434a4a`	9	0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2c	character mode/buff gauge family
`0x004357db`	8	0x32, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f	small special handler family
`0x0043487a`	3	0x20, 0x21, 0x23	recovery-like family: HP/MP branch by family
`0x0043485e`	1	0x01	simple flag set family
`0x0043497d`	1	0x22	pose/state reset family
`0x00434cbb`	1	0x2d	pose cycle family
`0x00434d8d`	1	0x2e	random pose/timer family
`0x00434e29`	1	0x2f	clear fields +0x2f..+0x31
`0x00000000`	1	0x31	unclassified family
`0x004357e6`	1	0x33	small special handler family
`0x00435810`	1	0x34	small special handler family
`0x0043583c`	1	0x35	small special handler family
`0x004358ab`	1	0x36	small special handler family
`0x004358d5`	1	0x37	small special handler family
`0x0043590d`	1	0x38	small special handler family

Family Table 상세

family	handler	분류	unit 수	status	target scope	샘플
`0x00`	`0x004357d0`	default/no-op or shared fallback	0
`0x01`	`0x0043485e`	simple flag set family	3	0x00 none x3	0x01 x3	아타호 도주 0x3a :: 00 00 00 00 01 01 01 00 린샹 도주 0x2f :: 00 00 00 00 01 01 01 00 스마슈 도주 0x23 :: 00 00 00 00 01 01 01 00
`0x02`	`0x004357d0`	default/no-op or shared fallback	3	0x00 none x3	0x01 x3	아타호 방어 0x3b :: 00 00 00 00 01 02 01 00 린샹 방어 0x30 :: 00 00 00 00 01 02 01 00 스마슈 방어 0x24 :: 00 00 00 00 01 02 01 00
`0x03`	`0x004357d0`	default/no-op or shared fallback	3	0x00 none x3	0x01 x3	스마슈 인법·몸감추기 0x26 :: 46 00 00 00 01 03 01 00 공용/적 몸감추기 0x03 :: 00 00 00 00 01 03 01 00 공용/적 인법·몸감추기 0x7a :: 46 00 00 00 01 03 01 00
`0x04`	`0x004357d0`	default/no-op or shared fallback	0
`0x05`	`0x004357d0`	default/no-op or shared fallback	0
`0x06`	`0x004357d0`	default/no-op or shared fallback	0
`0x07`	`0x004357d0`	default/no-op or shared fallback	0
`0x08`	`0x004357d0`	default/no-op or shared fallback	0
`0x09`	`0x004357d0`	default/no-op or shared fallback	0
`0x0a`	`0x004357d0`	default/no-op or shared fallback	0
`0x0b`	`0x004357d0`	default/no-op or shared fallback	0
`0x0c`	`0x004357d0`	default/no-op or shared fallback	0
`0x0d`	`0x004357d0`	default/no-op or shared fallback	0
`0x0e`	`0x004357d0`	default/no-op or shared fallback	0
`0x0f`	`0x004357d0`	default/no-op or shared fallback	0
`0x10`	`0x0043414d`	common physical damage family	154	0x00 none x122 0x01 넘어짐 x14 0x02 휙날아감 x16 0x03 행동정지 x2	0x06 x46 0x0a x108	아타호 정권 0x01 :: 64 64 64 00 0a 10 01 00 아타호 돌려차기 0x02 :: 6e 6e 5a 00 0a 10 01 00 아타호 던지기 0x03 :: 78 4b 3c 00 0a 10 03 02 아타호 다리후리기 0x04 :: 5a 41 69 00 0a 10 02 01 아타호 호격권 0x0a :: 78 78 9b 00 0a 10 01 00
`0x11`	`0x0043414d`	common physical damage family	27	0x00 none x16 0x01 넘어짐 x1 0x02 휙날아감 x6 0x04 독 x2 0x05 마비 x2	0x0a x27	린샹 손톱공격 0x01 :: 64 64 64 00 0a 11 01 00 린샹 안면백조권 0x09 :: 41 00 7d 00 0a 11 01 00 린샹 안면백조권 0x09 :: 41 00 7d 00 0a 11 01 00 린샹 안면백조권 0x09 :: 4b 64 73 00 0a 11 01 00 린샹 안면백조권 0x0a :: 46 00 7d 00 0a 11 01 00
`0x12`	`0x0043414d`	common physical damage family	76	0x00 none x63 0x01 넘어짐 x6 0x02 휙날아감 x3 0x03 행동정지 x4	0x06 x30 0x0a x46	린샹 안면백조권 0x0b :: 55 78 6e 00 0a 12 01 00 린샹 안면백조권 0x0c :: 5a 82 69 00 0a 12 01 00 린샹 맹호열지조 0x1b :: 8e 64 af 00 0a 12 02 01 린샹 유미쌍조 0x20 :: 67 7d 9b 00 06 12 00 00 린샹 유미쌍조 0x21 :: 6c 82 a5 00 06 12 00 00
`0x13`	`0x0043414d`	common physical damage family	25	0x00 none x21 0x01 넘어짐 x4	0x06 x15 0x0a x10	아타호 염가열소 0x21 :: 91 00 fa 00 0a 13 01 00 아타호 비기·맹호유성각 0x33 :: 78 87 96 00 06 13 01 01 아타호 비기·맹호유성각 0x34 :: 7d 8c af 00 06 13 01 01 아타호 비기·맹호유성각 0x35 :: 82 91 c8 00 06 13 01 01 아타호 비기·맹호유성각 0x36 :: 87 96 e1 00 06 13 01 01
`0x14`	`0x0043414d`	common physical damage family	14	0x00 none x13 0x01 넘어짐 x1	0x06 x11 0x0a x3	린샹 꼬챙이 꿰기 0x06 :: 6e 64 5f 00 0a 14 01 00 린샹 빙조권 0x19 :: 82 00 c8 00 0a 14 01 00 린샹 창룡파 0x2c :: 70 00 96 00 06 14 01 00 스마슈 마구베기 0x03 :: 6e 6e 5a 00 0a 14 01 00 스마슈 냉도투무 0x21 :: 7d 00 c8 00 06 14 01 00
`0x15`	`0x0043414d`	common physical damage family	24	0x00 none x18 0x02 휙날아감 x1 0x03 행동정지 x5	0x06 x18 0x0a x6	아타호 호포권 0x2b :: 6f 0f 7d 00 06 15 01 00 아타호 호포권 0x2c :: 74 1e 82 00 06 15 01 00 아타호 호포권 0x2d :: 79 2d 91 00 06 15 01 00 아타호 호포권 0x2e :: 7e 3c 8c 00 06 15 01 00 린샹 암각·영상뢰화 0x28 :: 7a 00 c8 00 06 15 01 03
`0x16`	`0x0043414d`	common physical damage family	58	0x00 none x58	0x0a x58	아타호 비기·맹호광파참 0x1a :: 5a af c8 00 0a 16 01 00 아타호 비기·맹호광파참 0x1a :: 50 00 c8 00 0a 16 01 00 아타호 비기·맹호광파참 0x1a :: 46 00 c8 00 0a 16 01 00 아타호 비기·맹호광파참 0x1b :: 64 c8 e1 00 0a 16 01 00 아타호 비기·맹호광파참 0x1b :: 55 00 e1 00 0a 16 01 00
`0x17`	`0x0043414d`	common physical damage family	13	0x00 none x1 0x03 행동정지 x10 0x05 마비 x2	0x06 x10 0x0a x3	아타호 맹호의 울부짖음 0x27 :: 37 32 c8 00 06 17 01 03 아타호 맹호의 울부짖음 0x28 :: 46 37 c8 00 06 17 01 03 아타호 맹호의 울부짖음 0x29 :: 55 3c c8 00 06 17 01 03 아타호 맹호의 울부짖음 0x2a :: 64 41 c8 00 06 17 01 03 아타호 노익장 대폭발 0x39 :: 82 78 b4 00 06 17 01 03
`0x18`	`0x0043414d`	common physical damage family	3	0x00 none x1 0x03 행동정지 x1 0x04 독 x1	0x06 x2 0x0a x1	아타호 주구격 0x37 :: 4b 32 7d 00 06 18 01 03 공용/적 썩은 점액 0x08 :: 64 64 64 00 0a 18 01 00 공용/적 독액 0x0e :: 5f 64 c8 00 06 18 01 04
`0x19`	`0x0043414d`	common physical damage family	9	0x00 none x4 0x02 휙날아감 x1 0x04 독 x3 0x05 마비 x1	0x06 x8 0x0a x1	린샹 흑영권 0x1a :: 73 6e 96 00 0a 19 02 02 공용/적 장궁 0x1b :: 5a 64 c8 00 06 19 03 04 공용/적 장궁 0x58 :: 5f 64 c8 00 06 19 01 05 공용/적 마권사암각 0x66 :: 46 00 78 00 06 19 01 00 공용/적 마권사암각 0x66 :: 46 00 6e 00 06 19 01 00
`0x1a`	`0x004357d0`	default/no-op or shared fallback	0
`0x1b`	`0x004357d0`	default/no-op or shared fallback	0
`0x1c`	`0x004357d0`	default/no-op or shared fallback	0
`0x1d`	`0x004357d0`	default/no-op or shared fallback	0
`0x1e`	`0x004357d0`	default/no-op or shared fallback	0
`0x1f`	`0x004357d0`	default/no-op or shared fallback	0
`0x20`	`0x0043487a`	recovery-like family: HP/MP branch by family	7	0x00 none x7	0x01 x5 0x05 x1 0x09 x1	아타호 기합일발 0x3c :: 6e 00 00 00 01 20 01 00 린샹 기공회복 0x31 :: 82 00 00 00 09 20 01 00 린샹 기공대회복 0x33 :: 78 00 00 00 05 20 01 00 스마슈 신격방어 0x27 :: 7d 00 00 00 01 20 01 00 공용/적 회복 0x04 :: 6e 7d c8 00 01 20 01 00
`0x21`	`0x0043487a`	recovery-like family: HP/MP branch by family	5	0x00 none x5	0x01 x5	아타호 천조족 0x3d :: 32 00 00 00 01 21 01 00 아타호 천조족 0x3e :: 3c 00 00 00 01 21 01 00 아타호 천조족 0x40 :: 46 00 00 00 01 21 01 00 아타호 천조족 0x41 :: 50 00 00 00 01 21 01 00 공용/적 천조족 0x71 :: 3c 00 00 00 01 21 01 00
`0x22`	`0x0043497d`	pose/state reset family	1	0x00 none x1	0x09 x1	린샹 기공독치료 0x32 :: 00 00 00 00 09 22 01 00
`0x23`	`0x0043487a`	recovery-like family: HP/MP branch by family	1	0x00 none x1	0x01 x1	아타호 주 백약지장 0x3f :: 91 00 00 00 01 23 01 00
`0x24`	`0x00434a4a`	character mode/buff gauge family	2	0x00 none x2	0x01 x2	아타호 조금 취한 철권 0x1e :: 00 00 00 00 01 24 01 00 아타호 천조족 0x3d :: 00 00 00 00 01 24 01 00
`0x25`	`0x00434a4a`	character mode/buff gauge family	4	0x00 none x4	0x01 x4	아타호 지옥 다리후리기 0x1f :: 00 00 00 00 01 25 01 00 아타호 주구격 0x37 :: 00 00 00 00 01 25 01 00 아타호 천조족 0x3e :: 00 00 00 00 01 25 01 00 공용/적 천조족 0x71 :: 00 00 00 00 01 25 01 00
`0x26`	`0x00434a4a`	character mode/buff gauge family	1	0x00 none x1	0x01 x1	아타호 마시기 0x05 :: 00 00 00 00 01 26 01 00
`0x27`	`0x00434a4a`	character mode/buff gauge family	2	0x00 none x2	0x01 x2	아타호 만취한 철권 0x20 :: 00 00 00 00 01 27 01 00 아타호 주 백약지장 0x3f :: 00 00 00 00 01 27 01 00
`0x28`	`0x00434a4a`	character mode/buff gauge family	6	0x00 none x6	0x01 x6	아타호 마시기 0x06 :: 00 00 00 00 01 28 01 00 아타호 염가열소 0x21 :: 00 00 00 00 01 28 01 00 아타호 취호염무 0x38 :: 00 00 00 00 01 28 01 00 아타호 천조족 0x40 :: 00 00 00 00 01 28 01 00 공용/적 취호염무 0x6f :: 00 00 00 00 01 28 01 00
`0x29`	`0x00434a4a`	character mode/buff gauge family	4	0x00 none x4	0x01 x4	아타호 마시기 0x07 :: 00 00 00 00 01 29 01 00 아타호 인사불성 철권 0x22 :: 00 00 00 00 01 29 01 00 아타호 노익장 대폭발 0x39 :: 00 00 00 00 01 29 01 00 아타호 천조족 0x41 :: 00 00 00 00 01 29 01 00
`0x2a`	`0x00434a4a`	character mode/buff gauge family	1	0x00 none x1	0x01 x1	아타호 마시기 0x08 :: 00 00 00 00 01 2a 01 00
`0x2b`	`0x00434a4a`	character mode/buff gauge family	0
`0x2c`	`0x00434a4a`	character mode/buff gauge family	1	0x00 none x1	0x01 x1	아타호 마시기 0x09 :: 00 00 00 00 01 2c 01 00
`0x2d`	`0x00434cbb`	pose cycle family	1	0x00 none x1	0x01 x1	스마슈 눈요기 0x25 :: 00 00 00 00 01 2d 01 00
`0x2e`	`0x00434d8d`	random pose/timer family	1	0x00 none x1	0x01 x1	린샹 도발 0x05 :: 0a fa fa 00 01 2e 01 00
`0x2f`	`0x00434e29`	clear fields +0x2f..+0x31	3	0x00 none x3	0x01 x3	린샹 수경 0x34 :: 00 00 00 00 01 2f 01 00 공용/적 수경 0x25 :: 00 00 00 00 01 2f 01 00 공용/적 수경 0x3c :: 00 00 00 00 01 2f 01 00
`0x30`	`0x004357d0`	default/no-op or shared fallback	0
`0x31`	`0x00000000`	unclassified family	0
`0x32`	`0x004357db`	small special handler family	0
`0x33`	`0x004357e6`	small special handler family	0
`0x34`	`0x00435810`	small special handler family	0
`0x35`	`0x0043583c`	small special handler family	0
`0x36`	`0x004358ab`	small special handler family	0
`0x37`	`0x004358d5`	small special handler family	0
`0x38`	`0x0043590d`	small special handler family	0
`0x39`	`0x004357db`	small special handler family	0
`0x3a`	`0x004357db`	small special handler family	0
`0x3b`	`0x004357db`	small special handler family	0
`0x3c`	`0x004357db`	small special handler family	0
`0x3d`	`0x004357db`	small special handler family	0
`0x3e`	`0x004357db`	small special handler family	0
`0x3f`	`0x004357db`	small special handler family	0

주요 함수

0x00433a30 target eligibility gate (confirmed path helper)

a6가 대상에게 0x433f0e를 호출하기 전에 쓰는 대상 가능 여부 검사. target +0x62 bit 0x80과 attacker +0x58/+0x59를 본다.

offsets +0x08 +0x0c +0x58 +0x59 +0x62

data refs -

calls

flag ops

433a3e: 8a 48 62 mov cl,BYTE PTR [eax+0x62]

  433a30:	55                   	push   ebp
  433a31:	8b ec                	mov    ebp,esp
  433a33:	83 ec 08             	sub    esp,0x8
  433a36:	53                   	push   ebx
  433a37:	56                   	push   esi
  433a38:	57                   	push   edi
  433a39:	8b 45 0c             	mov    eax,DWORD PTR [ebp+0xc]
  433a3c:	33 c9                	xor    ecx,ecx
...
  433a3e:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]

0x00433f0e hit unit loader and family dispatcher (strong static evidence)

skill payload를 찾고 hitIndex(0x0059e2a4)로 8-byte hit unit을 고른다. unit byte0..2를 attacker +0x80/+0x82/+0x84와 곱해 +0x70/+0x72/+0x74에 저장하고, family table 0x00546970으로 분기한다.

offsets +0x01 +0x02 +0x04 +0x05 +0x07 +0x08 +0x0c +0x58 +0x59 +0x62 +0x6a +0x6b +0x6c +0x6e +0x70 +0x72 +0x74 +0x80 +0x82 +0x84 +0x4d2488 +0x546970 +0x546a38

data refs 0x004d2488 0x004d2494 0x00546970 0x00546a38 0x0059e2a4

calls

0x00546a38 433f69: ff 14 8d 38 6a 54 00 call DWORD PTR [ecx*4+0x546a38]
0x00546970 43409f: ff 14 8d 70 69 54 00 call DWORD PTR [ecx*4+0x546970]

flag ops

433f1c: 8a 48 62 mov cl,BYTE PTR [eax+0x62]
433f25: 88 48 62 mov BYTE PTR [eax+0x62],cl
433f2d: 8a 48 62 mov cl,BYTE PTR [eax+0x62]
433f36: 88 48 62 mov BYTE PTR [eax+0x62],cl

  433f0e:	55                   	push   ebp
  433f0f:	8b ec                	mov    ebp,esp
  433f11:	83 ec 0c             	sub    esp,0xc
  433f14:	53                   	push   ebx
  433f15:	56                   	push   esi
  433f16:	57                   	push   edi
  433f17:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  433f1a:	33 c9                	xor    ecx,ecx
...
  433f1c:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  433f25:	88 48 62             	mov    BYTE PTR [eax+0x62],cl
  433f2d:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  433f36:	88 48 62             	mov    BYTE PTR [eax+0x62],cl
  433f43:	66 c7 40 6e 00 00    	mov    WORD PTR [eax+0x6e],0x0
  433f69:	ff 14 8d 38 6a 54 00 	call   DWORD PTR [ecx*4+0x546a38]
  433f90:	8b 04 8d 88 24 4d 00 	mov    eax,DWORD PTR [ecx*4+0x4d2488]
  433fb2:	a1 94 24 4d 00       	mov    eax,ds:0x4d2494
  433fe2:	66 a1 a4 e2 59 00    	mov    ax,ds:0x59e2a4
  434080:	88 41 6b             	mov    BYTE PTR [ecx+0x6b],al
  43408c:	88 41 6c             	mov    BYTE PTR [ecx+0x6c],al
  43409f:	ff 14 8d 70 69 54 00 	call   DWORD PTR [ecx*4+0x546970]

0x004340ae target result mode dispatcher (strong static evidence)

target +0x6d가 0이면 0x4353f8(HP 감소) 후 0x434e84(상태/피격 자세), 2이면 0x435295(HP 회복), 1이면 적용 없이 종료한다.

offsets +0x08 +0x62 +0x6d +0x6e

data refs -

calls

0x004353f8 4340e9: e8 0a 13 00 00 call 0x4353f8
0x00434e84 4340f5: e8 8a 0d 00 00 call 0x434e84
0x00435295 434113: e8 7d 11 00 00 call 0x435295

flag ops

4340bc: 8a 48 62 mov cl,BYTE PTR [eax+0x62]

  4340ae:	55                   	push   ebp
  4340af:	8b ec                	mov    ebp,esp
  4340b1:	83 ec 04             	sub    esp,0x4
  4340b4:	53                   	push   ebx
  4340b5:	56                   	push   esi
  4340b6:	57                   	push   edi
  4340b7:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  4340ba:	33 c9                	xor    ecx,ecx
...
  4340bc:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  4340d2:	8a 48 6d             	mov    cl,BYTE PTR [eax+0x6d]
  4340e0:	66 8b 40 6e          	mov    ax,WORD PTR [eax+0x6e]
  4340e9:	e8 0a 13 00 00       	call   0x4353f8
  4340f5:	e8 8a 0d 00 00       	call   0x434e84
  43410a:	66 8b 40 6e          	mov    ax,WORD PTR [eax+0x6e]
  434113:	e8 7d 11 00 00       	call   0x435295

0x0043414d common physical family coordinator (strong static evidence)

family 0x10..0x19의 공통 진입점. result value를 초기화하고, branch flag 0x20/0x08, alt-result flag 0x10, status byte +0x6c, damage routine을 순서대로 처리한다.

offsets +0x08 +0x0c +0x62 +0x6c +0x6e

data refs -

calls

0x00434218 434164: e8 af 00 00 00 call 0x434218
0x00427730 434190: e8 9b 35 ff ff call 0x427730
0x004343db 4341b7: e8 1f 02 00 00 call 0x4343db
0x00434737 4341d8: e8 5a 05 00 00 call 0x434737
0x0043461f 4341ed: e8 2d 04 00 00 call 0x43461f
0x004344ab 4341fd: e8 a9 02 00 00 call 0x4344ab

flag ops

434171: 8a 48 62 mov cl,BYTE PTR [eax+0x62]
434182: 8a 48 62 mov cl,BYTE PTR [eax+0x62]
4341c4: 8a 48 62 mov cl,BYTE PTR [eax+0x62]

  43414d:	55                   	push   ebp
  43414e:	8b ec                	mov    ebp,esp
  434150:	53                   	push   ebx
  434151:	56                   	push   esi
  434152:	57                   	push   edi
  434153:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  434156:	66 c7 40 6e 00 00    	mov    WORD PTR [eax+0x6e],0x0
  43415c:	8b 45 0c             	mov    eax,DWORD PTR [ebp+0xc]
...
  434156:	66 c7 40 6e 00 00    	mov    WORD PTR [eax+0x6e],0x0
  434164:	e8 af 00 00 00       	call   0x434218
  434171:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  434182:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  434190:	e8 9b 35 ff ff       	call   0x427730
  43419f:	66 89 41 6e          	mov    WORD PTR [ecx+0x6e],ax
  4341a6:	c6 40 6c 00          	mov    BYTE PTR [eax+0x6c],0x0
  4341b7:	e8 1f 02 00 00       	call   0x4343db
  4341c4:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  4341d8:	e8 5a 05 00 00       	call   0x434737
  4341ed:	e8 2d 04 00 00       	call   0x43461f
  4341fd:	e8 a9 02 00 00       	call   0x4344ab
  434208:	66 8b 40 6e          	mov    ax,WORD PTR [eax+0x6e]
  43420f:	66 89 41 6e          	mov    WORD PTR [ecx+0x6e],ax

0x00434218 hit/avoid branch flag test (confirmed hit/avoid branch)

attacker/target 전투 수치와 random(0x427730)을 비교해 target +0x62 bit 0x20 또는 0x08을 세운다. unit byte[6]을 target +0x36+index 명중 보정 테이블에 사용한다. 표시 분기는 full miss / guard-glancing chip result로 승격됐다.

offsets +0x04 +0x05 +0x06 +0x08 +0x0c +0x22 +0x24 +0x36 +0x59 +0x62 +0x74 +0x7c +0x4d2488

data refs 0x004d2488 0x004d2494 0x0059e2a4

calls

0x00427730 43432e: e8 fd 33 ff ff call 0x427730
0x00427730 434343: e8 e8 33 ff ff call 0x427730

flag ops

4343b4: 8a 48 62 mov cl,BYTE PTR [eax+0x62]
4343bd: 88 48 62 mov BYTE PTR [eax+0x62],cl
4343ca: 8a 48 62 mov cl,BYTE PTR [eax+0x62]
4343d3: 88 48 62 mov BYTE PTR [eax+0x62],cl

  434218:	55                   	push   ebp
  434219:	8b ec                	mov    ebp,esp
  43421b:	83 ec 20             	sub    esp,0x20
  43421e:	53                   	push   ebx
  43421f:	56                   	push   esi
  434220:	57                   	push   edi
  434221:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  434224:	33 c9                	xor    ecx,ecx
...
  434239:	8b 04 8d 88 24 4d 00 	mov    eax,DWORD PTR [ecx*4+0x4d2488]
  43425b:	a1 94 24 4d 00       	mov    eax,ds:0x4d2494
  43428b:	66 a1 a4 e2 59 00    	mov    ax,ds:0x59e2a4
  43432e:	e8 fd 33 ff ff       	call   0x427730
  434343:	e8 e8 33 ff ff       	call   0x427730
  4343b4:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  4343bd:	88 48 62             	mov    BYTE PTR [eax+0x62],cl
  4343ca:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  4343d3:	88 48 62             	mov    BYTE PTR [eax+0x62],cl

0x004343db alternate result / critical flag gate (static critical/alternate path grounded)

성공 시 attacker +0x62 bit 0x10을 세운다. 0xc2 handler가 이 비트로 normal/alt WLK operand를 고르고, user observation의 critical presentation(텍스트 없음, 섬광/전용음/높은 데미지)과 일치한다.

offsets +0x08 +0x0c +0x26 +0x28 +0x62 +0x72 +0x7e

data refs -

calls

0x00427730 434421: e8 0a 33 ff ff call 0x427730
0x00427730 434446: e8 e5 32 ff ff call 0x427730
0x00427730 43445b: e8 d0 32 ff ff call 0x427730
0x00427730 434468: e8 c3 32 ff ff call 0x427730

flag ops

43449a: 8a 48 62 mov cl,BYTE PTR [eax+0x62]
4344a3: 88 48 62 mov BYTE PTR [eax+0x62],cl

  4343db:	55                   	push   ebp
  4343dc:	8b ec                	mov    ebp,esp
  4343de:	83 ec 0c             	sub    esp,0xc
  4343e1:	53                   	push   ebx
  4343e2:	56                   	push   esi
  4343e3:	57                   	push   edi
  4343e4:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  4343e7:	66 8b 40 28          	mov    ax,WORD PTR [eax+0x28]
...
  434421:	e8 0a 33 ff ff       	call   0x427730
  434446:	e8 e5 32 ff ff       	call   0x427730
  43445b:	e8 d0 32 ff ff       	call   0x427730
  434468:	e8 c3 32 ff ff       	call   0x427730
  43449a:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  4344a3:	88 48 62             	mov    BYTE PTR [eax+0x62],cl

0x004344ab status success gate (strong static evidence)

payload status byte target +0x6c가 있으면 attacker/target 수치 및 target status resistance table(+0x39+status)을 비교한다. 실패하면 target +0x6c를 0으로 지운다.

offsets +0x08 +0x0c +0x22 +0x26 +0x28 +0x39 +0x6c +0x72 +0x74 +0x7e

data refs -

calls

0x00427730 43456e: e8 bd 31 ff ff call 0x427730
0x00427730 434588: e8 a3 31 ff ff call 0x427730
0x00427730 4345b3: e8 78 31 ff ff call 0x427730
0x00427730 4345c0: e8 6b 31 ff ff call 0x427730
0x00427730 4345cf: e8 5c 31 ff ff call 0x427730

flag ops

  4344ab:	55                   	push   ebp
  4344ac:	8b ec                	mov    ebp,esp
  4344ae:	83 ec 14             	sub    esp,0x14
  4344b1:	53                   	push   ebx
  4344b2:	56                   	push   esi
  4344b3:	57                   	push   edi
  4344b4:	8b 45 0c             	mov    eax,DWORD PTR [ebp+0xc]
  4344b7:	33 c9                	xor    ecx,ecx
...
  4344b9:	8a 48 6c             	mov    cl,BYTE PTR [eax+0x6c]
  43455a:	8a 48 6c             	mov    cl,BYTE PTR [eax+0x6c]
  43456e:	e8 bd 31 ff ff       	call   0x427730
  434588:	e8 a3 31 ff ff       	call   0x427730
  43459e:	c6 40 6c 00          	mov    BYTE PTR [eax+0x6c],0x0
  4345b3:	e8 78 31 ff ff       	call   0x427730
  4345c0:	e8 6b 31 ff ff       	call   0x427730
  4345cf:	e8 5c 31 ff ff       	call   0x427730
  434611:	c6 40 6c 00          	mov    BYTE PTR [eax+0x6c],0x0

0x0043461f normal damage formula (strong static evidence)

attacker +0x70, +0x1c, target +0x7a, +0x20, target resistance table(+0x1c+family) 등을 사용해 temporary result +0x6e를 만든다. 최소값 보정 random(1..3)이 있다.

offsets +0x06 +0x08 +0x0c +0x1c +0x20 +0x6b +0x6e +0x70 +0x7a

data refs -

calls

0x00427730 4346d3: e8 58 30 ff ff call 0x427730
0x00427730 4346e4: e8 47 30 ff ff call 0x427730
0x00427730 43471f: e8 0c 30 ff ff call 0x427730

flag ops

  43461f:	55                   	push   ebp
  434620:	8b ec                	mov    ebp,esp
  434622:	83 ec 14             	sub    esp,0x14
  434625:	53                   	push   ebx
  434626:	56                   	push   esi
  434627:	57                   	push   edi
  434628:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  43462b:	33 c9                	xor    ecx,ecx
...
  434693:	8a 48 6b             	mov    cl,BYTE PTR [eax+0x6b]
  4346d3:	e8 58 30 ff ff       	call   0x427730
  4346e4:	e8 47 30 ff ff       	call   0x427730
  434709:	66 89 41 6e          	mov    WORD PTR [ecx+0x6e],ax
  434710:	0f bf 40 6e          	movsx  eax,WORD PTR [eax+0x6e]
  43471f:	e8 0c 30 ff ff       	call   0x427730
  43472e:	66 89 41 6e          	mov    WORD PTR [ecx+0x6e],ax

0x00434737 alternate/critical damage formula (static critical/alternate formula grounded)

normal damage와 유사하지만 계산 비율이 다르고, 낮은 결과에서 random(1..5) 보정 후 attacker +0x62 bit 0x10을 끈다. 0x10 result sound/helper 소비와 연결되는 critical/alternate damage formula다.

offsets +0x06 +0x08 +0x0c +0x1c +0x20 +0x62 +0x6b +0x6e +0x70 +0x7a

data refs -

calls

0x00427730 4347e9: e8 42 2f ff ff call 0x427730
0x00427730 4347fa: e8 31 2f ff ff call 0x427730
0x00427730 434835: e8 f6 2e ff ff call 0x427730

flag ops

43484d: 8a 48 62 mov cl,BYTE PTR [eax+0x62]
434856: 88 48 62 mov BYTE PTR [eax+0x62],cl

  434737:	55                   	push   ebp
  434738:	8b ec                	mov    ebp,esp
  43473a:	83 ec 14             	sub    esp,0x14
  43473d:	53                   	push   ebx
  43473e:	56                   	push   esi
  43473f:	57                   	push   edi
  434740:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  434743:	33 c9                	xor    ecx,ecx
...
  4347ab:	8a 48 6b             	mov    cl,BYTE PTR [eax+0x6b]
  4347e9:	e8 42 2f ff ff       	call   0x427730
  4347fa:	e8 31 2f ff ff       	call   0x427730
  43481f:	66 89 41 6e          	mov    WORD PTR [ecx+0x6e],ax
  434826:	0f bf 40 6e          	movsx  eax,WORD PTR [eax+0x6e]
  434835:	e8 f6 2e ff ff       	call   0x427730
  434844:	66 89 41 6e          	mov    WORD PTR [ecx+0x6e],ax
  43484d:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  434856:	88 48 62             	mov    BYTE PTR [eax+0x62],cl

0x00434e84 target state/pose display after damage (strong static evidence)

target +0x6c 상태 byte와 +0x62 flags를 보고 target +0x2a pose, +0x64 timer, +0x68 display update flag를 설정한다.

offsets +0x04 +0x08 +0x2a +0x43 +0x5e +0x62 +0x64 +0x66 +0x68 +0x6c +0x435119

data refs -

calls

0x00427730 434f90: e8 9b 27 ff ff call 0x427730
0x00427730 434fca: e8 61 27 ff ff call 0x427730
0x00427730 4350d3: e8 58 26 ff ff call 0x427730

flag ops

434e92: 8a 48 62 mov cl,BYTE PTR [eax+0x62]
434ea8: 8a 48 62 mov cl,BYTE PTR [eax+0x62]
434fa9: 8a 48 62 mov cl,BYTE PTR [eax+0x62]
434fb2: 88 48 62 mov BYTE PTR [eax+0x62],cl
434fed: 8a 48 62 mov cl,BYTE PTR [eax+0x62]
434ff6: 88 48 62 mov BYTE PTR [eax+0x62],cl
435028: 8a 48 62 mov cl,BYTE PTR [eax+0x62]
43505c: 8a 48 62 mov cl,BYTE PTR [eax+0x62]
435065: 88 48 62 mov BYTE PTR [eax+0x62],cl
435087: 8a 48 62 mov cl,BYTE PTR [eax+0x62]
435090: 88 48 62 mov BYTE PTR [eax+0x62],cl
4350b2: 8a 48 62 mov cl,BYTE PTR [eax+0x62]
4350bb: 88 48 62 mov BYTE PTR [eax+0x62],cl

  434e84:	55                   	push   ebp
  434e85:	8b ec                	mov    ebp,esp
  434e87:	83 ec 0c             	sub    esp,0xc
  434e8a:	53                   	push   ebx
  434e8b:	56                   	push   esi
  434e8c:	57                   	push   edi
  434e8d:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  434e90:	33 c9                	xor    ecx,ecx
...
  434e92:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  434ea8:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  434f50:	8a 48 6c             	mov    cl,BYTE PTR [eax+0x6c]
  434f7c:	8a 48 6c             	mov    cl,BYTE PTR [eax+0x6c]
  434f90:	e8 9b 27 ff ff       	call   0x427730
  434fa9:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  434fb2:	88 48 62             	mov    BYTE PTR [eax+0x62],cl
  434fca:	e8 61 27 ff ff       	call   0x427730
  434fed:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  434ff6:	88 48 62             	mov    BYTE PTR [eax+0x62],cl
  435028:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  43503e:	8a 48 6c             	mov    cl,BYTE PTR [eax+0x6c]
  43505c:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  435065:	88 48 62             	mov    BYTE PTR [eax+0x62],cl
  435087:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  435090:	88 48 62             	mov    BYTE PTR [eax+0x62],cl
  4350b2:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  4350bb:	88 48 62             	mov    BYTE PTR [eax+0x62],cl
  4350d3:	e8 58 26 ff ff       	call   0x427730

0x00435295 HP recovery apply (confirmed by field writes)

target +0x08 current HP를 +0x0a max HP까지 증가시키고, trace mode에서는 applied value를 +0x6e에 쓴다.

offsets +0x08 +0x0a +0x0c +0x62 +0x6e

data refs 0x0059e34d

calls

flag ops

4352ea: 8a 48 62 mov cl,BYTE PTR [eax+0x62]

  435295:	55                   	push   ebp
  435296:	8b ec                	mov    ebp,esp
  435298:	83 ec 04             	sub    esp,0x4
  43529b:	53                   	push   ebx
  43529c:	56                   	push   esi
  43529d:	57                   	push   edi
  43529e:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  4352a1:	33 c9                	xor    ecx,ecx
...
  4352ea:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  4352f9:	66 c7 40 6e 00 00    	mov    WORD PTR [eax+0x6e],0x0
  43530b:	66 89 41 6e          	mov    WORD PTR [ecx+0x6e],ax

0x00435356 MP recovery apply (confirmed by field writes)

target +0x0e current MP를 +0x10 max MP까지 증가시키고, trace mode에서는 applied value를 +0x6e에 쓴다.

offsets +0x08 +0x0c +0x0e +0x10 +0x6e

data refs 0x0059e34d

calls

flag ops

  435356:	55                   	push   ebp
  435357:	8b ec                	mov    ebp,esp
  435359:	83 ec 04             	sub    esp,0x4
  43535c:	53                   	push   ebx
  43535d:	56                   	push   esi
  43535e:	57                   	push   edi
  43535f:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  435362:	33 c9                	xor    ecx,ecx
...
  4353ad:	66 89 41 6e          	mov    WORD PTR [ecx+0x6e],ax

0x004353f8 HP damage apply (confirmed by field writes)

target +0x08 current HP에서 result를 빼고, 0 이하가 되면 HP 0, target +0x62 bit 0x40, death/knockout cleanup 0x4354eb를 호출한다.

offsets +0x04 +0x06 +0x08 +0x0a +0x0c +0x62

data refs -

calls

0x004354eb 43546e: e8 78 00 00 00 call 0x4354eb

flag ops

43545e: 8a 48 62 mov cl,BYTE PTR [eax+0x62]
435467: 88 48 62 mov BYTE PTR [eax+0x62],cl

  4353f8:	55                   	push   ebp
  4353f9:	8b ec                	mov    ebp,esp
  4353fb:	83 ec 04             	sub    esp,0x4
  4353fe:	53                   	push   ebx
  4353ff:	56                   	push   esi
  435400:	57                   	push   edi
  435401:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]
  435404:	33 c9                	xor    ecx,ecx
...
  43545e:	8a 48 62             	mov    cl,BYTE PTR [eax+0x62]
  435467:	88 48 62             	mov    BYTE PTR [eax+0x62],cl
  43546e:	e8 78 00 00 00       	call   0x4354eb

다음 작업

0x10 critical path의 WLK id 14 sound role과 palette flash/fade child script는 확정됐다. 남은 작업은 browser runner에서 VM tick 기반 섬광 지속시간을 wall-clock으로 맞추는 것이다.
browser 전투 엔진 반영은 지금 단계에서 HP/MP apply와 payload family/status/critical presentation 구조를 넣고, +0x28은 숨은 전투 발동률 계수로 표기한다.