wait until level load
search for dialogue string in memory
follow in dump
first byte in dump -> follow in disassembler
first byte in dump -> breakpint -> hardware, access -> byte
set break condition
eax==93f884 || ebx==93f884 || ecx==93f884 || edx==93f884 || ebp==93f884 || esp==93f884 || esi==93f884 || edi==93f884

klllllllll

setting this breakpoint leads to the discovery of d56a7f
which is hit for every new line of dialogue to process

use d56a7f for subsequent runs to find the dialogue line in memory,
then set the original breakpoint described above
and keep F9'ing until a couple letters have appeared

the scripted breakpoint will hit 12 times for each screen refresh

counting from 0=a after a screen refresh,
the kth run will affect the first letter,
the lth run will affect all remaining letters

74806225 accesses start of dialogue line at kth run, located in kernelbase.dll
  ce1e7f accesses start of dialogue line at lth run, located in kengeki.exe

when 74806225 is at Youmu: (esi is umu:) and text is edited, Yoaaaa
when 74806225 is at dialoge (esi is 5th char), HHHHnnnnnnn...

text is rendered when 74806225 esi leaves FPS string,
which is occasionally processed in the middle of dialogue lines

b0 = first char
74806225 esi e0 d
  ce1e7f ebx e0 e
74806225 esi e1 f
  ce1e7f ebx e1 g
ccccccccccccccccdfggggggg
0 2 4 6 8 a c e 0 2 4

74806225 is part of MultiByteToWideChar called from c41e8e
mbwc entry at 766851a0 jumps to 74805d90
calls getcphashnode at some point

a 94 c6 94 요
c 5c d5 5c 한
e 00 ae 00 글

cl = 8bit low
ch = 2nd 8bit
cx = 16 bit
ecx = 32bit
lcx = 64 bit

   901 385
 c_932 3a4 ja-JP sjis
 c_949     ko-KR euc-kr
c_1256     ar-AE

74806225 reads single-byte character into eax
7480622a copies wordptr ds:[ebx+eax*2] to cx (ecx 16LSB),
         ebx is 1c into C:\windows\System32\C_932.NLS
7480622e copies dwordptr ss:[ebp-18] to eax,
         ebp:12ff4d4 [ebp-18]=[12ff4bc]=4081D805
74806231 copies cx to wordptr ss:[ebp-10],
         ebp:12ff4d4 [ebp-10]=[12ff4c4]=16104538=esi=aaaaaa

codecave at 3770000 to replace c_932 at c150000 ... 377001c

a original value
b esi at 5th char, base+4 (z1 a)b
  single iteration from rflo
c before rfloP
d during rfloP
e after rfloP

didn't draw, trying again

e   first value entering rflo
a = 20 first hit of rflo
b = 21 second hit
c = 22 first hit rfloP
d   23 second hit
e = 23 rflo
f   24 rfloP
g = 24 rflo
h   25 rfloP
i = 25 rfloP after
j   26 rfloP
k = 26 rfloP after
=   abcegikkk

z   20 p2 b1
y   20 p2
x   20 p1 b1
w   20 p1
v = 20 p0
u   20 p2 c1
t   20 r1
s   20 r1 after
r   20 r1 b65
q   20 r1 b93
p   20 r1 ba2
o   20 r1 c18
n   20 r1 c32
m   20 p2 c1 after
=   vmmm

a   21 p1
b   22 p2 c1
c   22 p2 c1 after
d   23 p2 b1
e   23 p2 (b1 after)
f   23 p1 b1
g   23 p1
h   23 p1 b1 after
i   23 p2 c1
k   23 p2 c1 after

a   p0
b   76616083
c   after
d = p1 after
e   p0
f   76616083
g = after
h   read remain
=   zdghhh


a   orig
b   p1
c   p1 after
d   p1 b1 after
e   p2 c1
f   p2


a   p1
b   p1 after
c   p1 b1 (actually p2)
d = p2 after
e   1331f32
f   p2 c1
g   p2 c1 after
=   dgggg


a p1
b p2 after 18
c p2 c1 19
d p2
e p2 after
f 82
g 85
h 91
i 9f
j c5
k c8
l ca
m cf
n d2
o d5
p d8
q db
r de
s e1
t e4
u e7
v ec
w 00
x 05
y 2c
= abeyyy


a p2
b 7d
c ecx
d 7f
e 82
f 85
g 91 ecx
h 91
= ghhh

cl = 8lsb
dl = 8msb
eax = numBytes
cl = [ebx]
dl = [ebx+1]

after return from rflo-p2,
set eax=2 and [ebx] ucs2le, 94 c6

ebp after decode
-1c numBytes
+ c byte1
+ d byte2
+1c floatval
+28 floatval
-34 floatval
-30 floatval
-2c floatval
-28 floatval
- 4 floatval const?

0:char 1:floats 2:e 3:str 4:??? esp:??? edi=data
render3 0:??? 1,edx:char 2:floats 3:e 4:str 5:??? esp:??? edi,ecx=data

[ecx+c]==31
1 4C644A0 c089 佳
2 4C56690 6083 チ





117fdaf: jmp 0x13eec30
117fd84: nop

0x13eec30:
mov esp, ebp
pop ebp
ret 4

01181F1E | D9 45 D8 | fld dword ptr ss:[ebp-28]  | push 1.0f
01181F21 | D8 4D F4 | fmul dword ptr ss:[ebp-C]  | *= 1.0f
01181F24 | D9 5D D8 | fstp dword ptr ss:[ebp-28] | put back in [ebp-28]

fld dword ptr [ebx]
123effc