停在0x0041B657 :0041B657 8B4254 mov eax, dword ptr [edx+54] ;dword ptr [edx+54] 存放的就是当前人口上限 20 :0041B65A 33442404 xor eax, dword ptr [esp+04] :0041B65E 3DC8000000 cmp eax, 000000C8 ;呵呵 判断 是否超过了人口上限 0xC8=200 :0041B663 0F8FD3370A00 jg 004BEE3C ;如果超过了人口上限 则跳转到 跳转1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:004BEE41(U) | :0041B669 8B150840BC00 mov edx, dword ptr [00BC4008] ;没搞明白这几个地址干什么用的 :0041B66F 8B8A3C010000 mov ecx, dword ptr [edx+0000013C] :0041B675 8B891C030000 mov ecx, dword ptr [ecx+0000031C] ;此时ecx的值是 0xC8 :0041B67B 3BC1 cmp eax, ecx ;很显然 和0x0041B65E 作用一样 :0041B67D 0F8F08CD1600 jg 0058838B ;如果当前人口上限 超过了 ecx(0xC8) 则跳转到 跳转2 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00588426(U) | :0041B683 83C408 add esp, 00000008 :0041B686 C3 ret 跳转1 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0041B663(C) | :004BEE3C B8C8000000 mov eax, 000000C8