NPC头上说话简单原理

原作者：BLUE

NPC头上说话，其实找到NPC指针就可以做出来了，再调用这个函数：

呵呵~~~最近好忙，中午改了个调用，就实现这个了，没完善

* Referenced by a CALL at Address:
|:004D529F  
|
:004BB084 55                      push ebp
:004BB085 8BEC                    mov ebp, esp
:004BB087 83C4E0                  add esp, FFFFFFE0
:004BB08A 33C9                    xor ecx, ecx
:004BB08C 894DF4                  mov dword ptr [ebp-0C], ecx =》 辅助
:004BB08F 8955F8                  mov dword ptr [ebp-08], edx =》 字串
:004BB092 8945FC                  mov dword ptr [ebp-04], eax =》 SELF
:004BB095 8B45F8                  mov eax, dword ptr [ebp-08]
:004BB098 E8E38FF4FF              call 00404080 =》 字串处理
:004BB09D 33C0                    xor eax, eax
:004BB09F 55                      push ebp
:004BB0A0 6814B14B00              push 004BB114
:004BB0A5 64FF30                  push dword ptr fs:[eax]
:004BB0A8 648920                  mov dword ptr fs:[eax], esp
:004BB0AB 6A00                    push 00000000
:004BB0AD 68FFFFFF00              push 00FFFFFF
:004BB0B2 6A00                    push 00000000
:004BB0B4 8B45FC                  mov eax, dword ptr [ebp-04]
:004BB0B7 8D5015                  lea edx, dword ptr [eax+15]
:004BB0BA 8D45E0                  lea eax, dword ptr [ebp-20]
:004BB0BD E85679F4FF              call 00402A18

* Possible StringData Ref from Code Obj ->": "
                                  |
:004BB0C2 BA20B14B00              mov edx, 004BB120
:004BB0C7 8D45E0                  lea eax, dword ptr [ebp-20]
:004BB0CA B110                    mov cl, 10
:004BB0CC E81779F4FF              call 004029E8
:004BB0D1 8D55E0                  lea edx, dword ptr [ebp-20]
:004BB0D4 8D45F4                  lea eax, dword ptr [ebp-0C]

:004BB0D7 E8948DF4FF              call 00403E70
:004BB0DC 8D45F4                  lea eax, dword ptr [ebp-0C]
:004BB0DF 8B55F8                  mov edx, dword ptr [ebp-08]
:004BB0E2 E8ED8DF4FF              call 00403ED4
:004BB0E7 8B45F4                  mov eax, dword ptr [ebp-0C]
:004BB0EA 50                      push eax
:004BB0EB 33C9                    xor ecx, ecx
:004BB0ED 66BA2E27                mov dx, 272E
:004BB0F1 8B45FC                  mov eax, dword ptr [ebp-04]
:004BB0F4 E8C3DDFFFF              call 004B8EBC   =》   ~~~~~
:004BB0F9 33C0                    xor eax, eax
:004BB0FB 5A                      pop edx
:004BB0FC 59                      pop ecx
:004BB0FD 59                      pop ecx
:004BB0FE 648910                  mov dword ptr fs:[eax], edx
:004BB101 681BB14B00              push 004BB11B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004BB119(U)
|
:004BB106 8D45F4                  lea eax, dword ptr [ebp-0C]
:004BB109 BA02000000              mov edx, 00000002
:004BB10E E85D8BF4FF              call 00403C70   =》  总字串处理
:004BB113 C3                      ret

:004BB114 E94785F4FF              jmp 00403660
:004BB119 EBEB                    jmp 004BB106
:004BB11B 8BE5                    mov esp, ebp
:004BB11D 5D                      pop ebp
:004BB11E C3                      ret