[Release]Modify Magic and Rare Items Drop Rate (VSRO188)

[MeGaMaX]

Hello,

Since many people keep asking about it, on the other hand @exo keep asking me for it too, so here is the example function for the RareItems Drop

Note: Most of the silkroad uniques drop factor is hardcoded and limited for example the WhiteSnake can only drop from 1 to 3 elixirs, but Roc can drop between 50-300.

//****VSRO 188 Rare Items Drop Formula ASM Code****//

Spoiler:

00726A70 51 push ecx
00726A71 53 push ebx
00726A72 8B5C24 24 mov ebx, dword ptr [esp+0x24]
00726A76 85DB test ebx, ebx
00726A78 55 push ebp
00726A79 8B6C24 24 mov ebp, dword ptr [esp+0x24]
00726A7D 56 push esi
00726A7E 57 push edi
00726A7F 75 0F jnz short 00726A90
00726A81 E8 DAE02300 call 00964B60
00726A86 33C0 xor eax, eax
00726A88 5F pop edi
00726A89 5E pop esi
00726A8A 5D pop ebp
00726A8B 5B pop ebx
00726A8C 59 pop ecx
00726A8D C2 2000 retn 0x20
00726A90 0FB67424 20 movzx esi, byte ptr [esp+0x20]
00726A95 8BC6 mov eax, esi
00726A97 C1E8 04 shr eax, 0x4
00726A9A 83E8 00 sub eax, 0x0
00726A9D BF 01000000 mov edi, 0x1
00726AA2 897C24 2C mov dword ptr [esp+0x2C], edi
00726AA6 74 17 je short 00726ABF
00726AA8 2BC7 sub eax, edi
00726AAA 74 07 je short 00726AB3
00726AAC E8 AFE02300 call 00964B60
00726AB1 EB 0C jmp short 00726ABF
00726AB3 C74424 2C 09000>mov dword ptr [esp+0x2C], 0x9
00726ABB 8B7C24 2C mov edi, dword ptr [esp+0x2C]
00726ABF 8B4424 20 mov eax, dword ptr [esp+0x20]
00726AC3 50 push eax
00726AC4 E8 17740000 call 0072DEE0
00726AC9 83F8 01 cmp eax, 0x1
00726ACC 0F85 8A000000 jnz 00726B5C
00726AD2 8B7424 20 mov esi, dword ptr [esp+0x20]
00726AD6 56 push esi
00726AD7 B8 0C000000 mov eax, 0xC
00726ADC 8BCB mov ecx, ebx
00726ADE E8 AD740000 call 0072DF90
00726AE3 83F8 01 cmp eax, 0x1
00726AE6 75 1B jnz short 00726B03
00726AE8 56 push esi
00726AE9 B8 0C000000 mov eax, 0xC
00726AEE 8BCB mov ecx, ebx
00726AF0 E8 1B740000 call 0072DF10
00726AF5 85C0 test eax, eax
00726AF7 74 0A je short 00726B03
00726AF9 8B48 0C mov ecx, dword ptr [eax+0xC]
00726AFC 0FAFCF imul ecx, edi
00726AFF 894C24 2C mov dword ptr [esp+0x2C], ecx
00726B03 8B7C24 1C mov edi, dword ptr [esp+0x1C]
00726B07 85FF test edi, edi
00726B09 0F85 D8000000 jnz 00726BE7
00726B0F 56 push esi
00726B10 8D47 01 lea eax, dword ptr [edi+0x1]
00726B13 8BCB mov ecx, ebx
00726B15 E8 76740000 call 0072DF90
00726B1A 83F8 01 cmp eax, 0x1
00726B1D 75 1E jnz short 00726B3D
00726B1F 56 push esi
00726B20 8BCB mov ecx, ebx
00726B22 E8 E9730000 call 0072DF10
00726B27 8BD8 mov ebx, eax
00726B29 85DB test ebx, ebx
00726B2B 0F84 B6000000 je 00726BE7
00726B31 E8 02682B00 call 009DD338
00726B36 33D2 xor edx, edx
00726B38 F773 0C div dword ptr [ebx+0xC]
00726B3B EB 0D jmp short 00726B4A
00726B3D E8 F6672B00 call 009DD338
00726B42 99 cdq
00726B43 B9 E8030000 mov ecx, 0x3E8
00726B48 F7F9 idiv ecx
00726B4A 83FA 01 cmp edx, 0x1
00726B4D 0F85 94000000 jnz 00726BE7
00726B53 895424 1C mov dword ptr [esp+0x1C], edx
00726B57 E9 87000000 jmp 00726BE3
00726B5C 83E6 0F and esi, 0xF
00726B5F 83EE 03 sub esi, 0x3
00726B62 74 20 je short 00726B84
00726B64 83EE 01 sub esi, 0x1
00726B67 74 0E je short 00726B77
00726B69 83EE 04 sub esi, 0x4
00726B6C 75 54 jnz short 00726BC2
00726B6E 8BD7 mov edx, edi
00726B70 C1E2 04 shl edx, 0x4
00726B73 2BD7 sub edx, edi
00726B75 EB 45 jmp short 00726BBC
00726B77 8D04BD 00000000 lea eax, dword ptr [edi*4]
00726B7E 894424 2C mov dword ptr [esp+0x2C], eax
00726B82 EB 3E jmp short 00726BC2
00726B84 837B 28 10 cmp dword ptr [ebx+0x28], 0x10
00726B88 72 05 jb short 00726B8F
00726B8A 8B7B 14 mov edi, dword ptr [ebx+0x14]
00726B8D EB 03 jmp short 00726B92
00726B8F 8D7B 14 lea edi, dword ptr [ebx+0x14]
00726B92 BE B4FCAF00 mov esi, 00AFFCB4 ; ASCII "MOB_TQ_WHITESNAKE"
00726B97 E8 A400D0FF call 00426C40
00726B9C 85C0 test eax, eax
00726B9E 8B4424 2C mov eax, dword ptr [esp+0x2C]
00726BA2 75 11 jnz short 00726BB5
00726BA4 8BC8 mov ecx, eax
00726BA6 C1E1 04 shl ecx, 0x4
00726BA9 2BC8 sub ecx, eax
00726BAB 03C9 add ecx, ecx
00726BAD 03C9 add ecx, ecx
00726BAF 894C24 2C mov dword ptr [esp+0x2C], ecx
00726BB3 EB 0D jmp short 00726BC2
00726BB5 8BD0 mov edx, eax
00726BB7 C1E2 04 shl edx, 0x4
00726BBA 2BD0 sub edx, eax
00726BBC 03D2 add edx, edx
00726BBE 895424 2C mov dword ptr [esp+0x2C], edx
00726BC2 837C24 1C 00 cmp dword ptr [esp+0x1C], 0x0
00726BC7 75 16 jnz short 00726BDF
00726BC9 E8 6A672B00 call 009DD338
00726BCE 99 cdq
00726BCF B9 E8030000 mov ecx, 0x3E8
00726BD4 F7F9 idiv ecx
00726BD6 83FA 01 cmp edx, 0x1
00726BD9 75 04 jnz short 00726BDF
00726BDB 895424 1C mov dword ptr [esp+0x1C], edx
00726BDF 8B7424 20 mov esi, dword ptr [esp+0x20]
00726BE3 8B7C24 1C mov edi, dword ptr [esp+0x1C]
00726BE7 837C24 2C 00 cmp dword ptr [esp+0x2C], 0x0
00726BEC C74424 10 00000>mov dword ptr [esp+0x10], 0x0
00726BF4 ^ 0F8E 8CFEFFFF jle 00726A86
00726BFA 8D9B 00000000 lea ebx, dword ptr [ebx]
00726C00 8B5C24 30 mov ebx, dword ptr [esp+0x30]
00726C04 56 push esi
00726C05 E8 D6720000 call 0072DEE0
00726C0A 83F8 01 cmp eax, 0x1
00726C0D 75 40 jnz short 00726C4F
00726C0F 8B7424 20 mov esi, dword ptr [esp+0x20]
00726C13 56 push esi
00726C14 8BCB mov ecx, ebx
00726C16 E8 75730000 call 0072DF90
00726C1B 83F8 01 cmp eax, 0x1
00726C1E 75 2F jnz short 00726C4F
00726C20 56 push esi
00726C21 8BCB mov ecx, ebx
00726C23 E8 E8720000 call 0072DF10
00726C28 85C0 test eax, eax
00726C2A 0F84 32010000 je 00726D62
00726C30 8B50 10 mov edx, dword ptr [eax+0x10]
00726C33 D94424 34 fld dword ptr [esp+0x34]
00726C37 8B4424 24 mov eax, dword ptr [esp+0x24]
00726C3B 8B5C24 18 mov ebx, dword ptr [esp+0x18]
00726C3F 52 push edx
00726C40 51 push ecx
00726C41 D91C24 fstp dword ptr [esp]
00726C44 50 push eax
00726C45 53 push ebx
00726C46 8BC7 mov eax, edi
00726C48 E8 A3D8FFFF call 007244F0
00726C4D EB 1F jmp short 00726C6E
00726C4F D94424 34 fld dword ptr [esp+0x34]
00726C53 8B5424 18 mov edx, dword ptr [esp+0x18]
00726C57 6A 01 push 0x1
00726C59 51 push ecx
00726C5A 8B4C24 2C mov ecx, dword ptr [esp+0x2C]
00726C5E D91C24 fstp dword ptr [esp]
00726C61 51 push ecx
00726C62 52 push edx
00726C63 8BC7 mov eax, edi
00726C65 E8 86D8FFFF call 007244F0
00726C6A 8B5C24 18 mov ebx, dword ptr [esp+0x18]
00726C6E 8BC8 mov ecx, eax
00726C70 85C9 test ecx, ecx
00726C72 0F8C EA000000 jl 00726D62
00726C78 85FF test edi, edi
00726C7A 74 09 je short 00726C85
00726C7C 83FF 01 cmp edi, 0x1
00726C7F 74 04 je short 00726C85
00726C81 33C0 xor eax, eax
00726C83 EB 05 jmp short 00726C8A
00726C85 B8 01000000 mov eax, 0x1
00726C8A 83C7 06 add edi, 0x6
00726C8D 6BFF 34 imul edi, edi, 0x34
00726C90 50 push eax
00726C91 8B4424 28 mov eax, dword ptr [esp+0x28]
00726C95 50 push eax
00726C96 8B4424 30 mov eax, dword ptr [esp+0x30]
00726C9A 03FB add edi, ebx
00726C9C 57 push edi
00726C9D E8 7ED4FFFF call 00724120
00726CA2 8BF8 mov edi, eax
00726CA4 85FF test edi, edi
00726CA6 0F84 B2000000 je 00726D5E
00726CAC 8B37 mov esi, dword ptr [edi]
00726CAE 85F6 test esi, esi
00726CB0 0F84 A8000000 je 00726D5E
00726CB6 8B46 08 mov eax, dword ptr [esi+0x8]
00726CB9 3B45 28 cmp eax, dword ptr [ebp+0x28]
00726CBC 74 13 je short 00726CD1
00726CBE F605 3C04D200 0>test byte ptr [0xD2043C], 0x1
00726CC5 74 05 je short 00726CCC
00726CC7 8945 28 mov dword ptr [ebp+0x28], eax
00726CCA EB 05 jmp short 00726CD1
00726CCC E8 8FDE2300 call 00964B60
00726CD1 837D 28 00 cmp dword ptr [ebp+0x28], 0x0
00726CD5 75 05 jnz short 00726CDC
00726CD7 E8 84DE2300 call 00964B60
00726CDC 66:8B86 8000000>mov ax, word ptr [esi+0x80]
00726CE3 A8 02 test al, 0x2
00726CE5 0F85 AB000000 jnz 00726D96
00726CEB 8AC8 mov cl, al
00726CED 80E1 1C and cl, 0x1C
00726CF0 80F9 0C cmp cl, 0xC
00726CF3 0F85 9D000000 jnz 00726D96
00726CF9 24 60 and al, 0x60
00726CFB 3C 20 cmp al, 0x20
00726CFD 0F85 93000000 jnz 00726D96
00726D03 53 push ebx
00726D04 E8 F7D6FFFF call 00724400
00726D09 3A45 2C cmp al, byte ptr [ebp+0x2C]
00726D0C 74 1D je short 00726D2B
00726D0E F605 3C04D200 0>test byte ptr [0xD2043C], 0x1
00726D15 74 0F je short 00726D26
00726D17 8B55 0C mov edx, dword ptr [ebp+0xC]
00726D1A 834D 08 08 or dword ptr [ebp+0x8], 0x8
00726D1E 8845 2C mov byte ptr [ebp+0x2C], al
00726D21 8955 0C mov dword ptr [ebp+0xC], edx
00726D24 EB 05 jmp short 00726D2B
00726D26 E8 35DE2300 call 00964B60
00726D2B 807D 2C 08 cmp byte ptr [ebp+0x2C], 0x8
00726D2F 76 0E jbe short 00726D3F
00726D31 E8 2ADE2300 call 00964B60
00726D36 B1 08 mov cl, 0x8
00726D38 8BC5 mov eax, ebp
00726D3A E8 A18ED0FF call 0042FBE0
00726D3F 0FB686 A8010000 movzx eax, byte ptr [esi+0x1A8]
00726D46 0FB64D 2C movzx ecx, byte ptr [ebp+0x2C]
00726D4A 3B4C83 FC cmp ecx, dword ptr [ebx+eax*4-0x4]
00726D4E 7F 0E jg short 00726D5E
00726D50 56 push esi
00726D51 33C0 xor eax, eax
00726D53 8BCD mov ecx, ebp
00726D55 E8 36080000 call 00727590
00726D5A 85C0 test eax, eax
00726D5C 75 22 jnz short 00726D80
00726D5E 8B7C24 1C mov edi, dword ptr [esp+0x1C]
00726D62 8B4424 10 mov eax, dword ptr [esp+0x10]
00726D66 83C0 01 add eax, 0x1
00726D69 3B4424 2C cmp eax, dword ptr [esp+0x2C]
00726D6D 894424 10 mov dword ptr [esp+0x10], eax
00726D71 ^ 0F8D 0FFDFFFF jge 00726A86
00726D77 8B7424 20 mov esi, dword ptr [esp+0x20]
00726D7B ^ E9 80FEFFFF jmp 00726C00
00726D80 6A 00 push 0x0
00726D82 55 push ebp
00726D83 56 push esi
00726D84 E8 17090000 call 007276A0
00726D89 B8 01000000 mov eax, 0x1
00726D8E 5F pop edi
00726D8F 5E pop esi
00726D90 5D pop ebp
00726D91 5B pop ebx
00726D92 59 pop ecx
00726D93 C2 2000 retn 0x20
00726D96 66:8B86 8000000>mov ax, word ptr [esi+0x80]
00726D9D A8 02 test al, 0x2
00726D9F 75 10 jnz short 00726DB1
00726DA1 8AD0 mov dl, al
00726DA3 80E2 1C and dl, 0x1C
00726DA6 80FA 0C cmp dl, 0xC
00726DA9 75 06 jnz short 00726DB1
00726DAB 24 60 and al, 0x60
00726DAD 3C 60 cmp al, 0x60
00726DAF 74 05 je short 00726DB6
00726DB1 E8 AADD2300 call 00964B60
00726DB6 6A 00 push 0x0
00726DB8 6A 00 push 0x0
00726DBA 8BC5 mov eax, ebp
00726DBC E8 BF8DD0FF call 0042FB80
00726DC1 807D 58 00 cmp byte ptr [ebp+0x58], 0x0
00726DC5 74 1E je short 00726DE5
00726DC7 F605 3C04D200 0>test byte ptr [0xD2043C], 0x1
00726DCE 74 10 je short 00726DE0
00726DD0 8B45 0C mov eax, dword ptr [ebp+0xC]
00726DD3 834D 08 20 or dword ptr [ebp+0x8], 0x20
00726DD7 C645 58 00 mov byte ptr [ebp+0x58], 0x0
00726DDB 8945 0C mov dword ptr [ebp+0xC], eax
00726DDE EB 05 jmp short 00726DE5
00726DE0 E8 7BDD2300 call 00964B60
00726DE5 807D 2C 00 cmp byte ptr [ebp+0x2C], 0x0
00726DE9 74 1E je short 00726E09
00726DEB F605 3C04D200 0>test byte ptr [0xD2043C], 0x1
00726DF2 74 10 je short 00726E04
00726DF4 8B4D 0C mov ecx, dword ptr [ebp+0xC]
00726DF7 834D 08 08 or dword ptr [ebp+0x8], 0x8
00726DFB C645 2C 00 mov byte ptr [ebp+0x2C], 0x0
00726DFF 894D 0C mov dword ptr [ebp+0xC], ecx
00726E02 EB 05 jmp short 00726E09
00726E04 E8 57DD2300 call 00964B60
00726E09 6A 00 push 0x0
00726E0B 6A 00 push 0x0
00726E0D 8BC5 mov eax, ebp
00726E0F E8 EC8ED0FF call 0042FD00
00726E14 8B7F 0C mov edi, dword ptr [edi+0xC]
00726E17 3B7D 38 cmp edi, dword ptr [ebp+0x38]
00726E1A 74 28 je short 00726E44
00726E1C F605 3C04D200 0>test byte ptr [0xD2043C], 0x1
00726E23 74 1A je short 00726E3F
00726E25 8B55 0C mov edx, dword ptr [ebp+0xC]
00726E28 834D 08 04 or dword ptr [ebp+0x8], 0x4
00726E2C 897D 38 mov dword ptr [ebp+0x38], edi
00726E2F 8955 0C mov dword ptr [ebp+0xC], edx
00726E32 B8 01000000 mov eax, 0x1
00726E37 5F pop edi
00726E38 5E pop esi
00726E39 5D pop ebp
00726E3A 5B pop ebx
00726E3B 59 pop ecx
00726E3C C2 2000 retn 0x20
00726E3F E8 1CDD2300 call 00964B60
00726E44 5F pop edi
00726E45 5E pop esi
00726E46 5D pop ebp
00726E47 B8 01000000 mov eax, 0x1
00726E4C 5B pop ebx
00726E4D 59 pop ecx
00726E4E C2 2000 retn 0x20

Note: Rare Items Drop is 1000
SR_GameServer.exe Address:
// Try to drop a rare item with a chance of 1/1000.

Spoiler:

00726B43 B9 E8030000 mov ecx, 0x3E8

/************************************************/

//****VSRO 188 Magic Items Drop Formula ASM Code****//

Spoiler:

007276A0 6A FF push -0x1
007276A2 68 D3C8AA00 push 00AAC8D3
007276A7 64:A1 00000000 mov eax, dword ptr fs:[0]
007276AD 50 push eax
007276AE 83EC 60 sub esp, 0x60
007276B1 53 push ebx
007276B2 55 push ebp
007276B3 56 push esi
007276B4 57 push edi
007276B5 A1 8015C600 mov eax, dword ptr [0xC61580]
007276BA 33C4 xor eax, esp
007276BC 50 push eax
007276BD 8D4424 74 lea eax, dword ptr [esp+0x74]
007276C1 64:A3 00000000 mov dword ptr fs:[0], eax
007276C7 8BAC24 84000000 mov ebp, dword ptr [esp+0x84]
007276CE 85ED test ebp, ebp
007276D0 75 17 jnz short 007276E9
007276D2 68 E8B7B000 push 00B0B7E8 ; ASCII "_AddMagicOptions() pRefItem is Null Pointer Error!"
007276D7 68 00000002 push 0x2000000
007276DC E8 5FEF2000 call 00936640
007276E1 83C4 08 add esp, 0x8
007276E4 E8 77D42300 call 00964B60
007276E9 8BB424 88000000 mov esi, dword ptr [esp+0x88]
007276F0 85F6 test esi, esi
007276F2 75 17 jnz short 0072770B
007276F4 68 1CB8B000 push 00B0B81C ; ASCII "_AddMagicOptions() pItem is Null Pointer Error!"
007276F9 68 00000002 push 0x2000000
007276FE E8 3DEF2000 call 00936640
00727703 83C4 08 add esp, 0x8
00727706 E8 55D42300 call 00964B60
0072770B 807E 58 00 cmp byte ptr [esi+0x58], 0x0
0072770F BB 01000000 mov ebx, 0x1
00727714 74 1D je short 00727733
00727716 841D 3C04D200 test byte ptr [0xD2043C], bl
0072771C 74 10 je short 0072772E
0072771E 8B46 0C mov eax, dword ptr [esi+0xC]
00727721 834E 08 20 or dword ptr [esi+0x8], 0x20
00727725 C646 58 00 mov byte ptr [esi+0x58], 0x0
00727729 8946 0C mov dword ptr [esi+0xC], eax
0072772C EB 05 jmp short 00727733
0072772E E8 2DD42300 call 00964B60
00727733 8B8424 8C000000 mov eax, dword ptr [esp+0x8C]
0072773A 85C0 test eax, eax
0072773C C74424 28 00000>mov dword ptr [esp+0x28], 0x0
00727744 74 06 je short 0072774C
00727746 8B08 mov ecx, dword ptr [eax]
00727748 894C24 28 mov dword ptr [esp+0x28], ecx
0072774C 0FB785 80000000 movzx eax, word ptr [ebp+0x80]
00727753 B1 02 mov cl, 0x2
00727755 84C1 test cl, al
00727757 75 18 jnz short 00727771
00727759 8AD0 mov dl, al
0072775B 80E2 1C and dl, 0x1C
0072775E 80FA 0C cmp dl, 0xC
00727761 75 0E jnz short 00727771
00727763 24 60 and al, 0x60
00727765 3C 20 cmp al, 0x20
00727767 75 08 jnz short 00727771
00727769 388D 89000000 cmp byte ptr [ebp+0x89], cl
0072776F 74 1C je short 0072778D
00727771 844C24 28 test byte ptr [esp+0x28], cl
00727775 75 16 jnz short 0072778D
00727777 E8 BC5B2B00 call 009DD338
0072777C 99 cdq
0072777D B9 65000000 mov ecx, 0x65
00727782 F7F9 idiv ecx
00727784 83FA 1E cmp edx, 0x1E
00727787 0F8F 6D030000 jg 00727AFA
0072778D 0FB6BD 3C050000 movzx edi, byte ptr [ebp+0x53C]
00727794 897C24 40 mov dword ptr [esp+0x40], edi
00727798 897C24 14 mov dword ptr [esp+0x14], edi
0072779C BE 04000000 mov esi, 0x4
007277A1 E8 925B2B00 call 009DD338
007277A6 99 cdq
007277A7 B9 06000000 mov ecx, 0x6
007277AC F7F9 idiv ecx
007277AE 03D3 add edx, ebx
007277B0 3BFA cmp edi, edx
007277B2 7E 06 jle short 007277BA
007277B4 895424 14 mov dword ptr [esp+0x14], edx
007277B8 8BFA mov edi, edx
007277BA 2BF3 sub esi, ebx
007277BC ^ 75 E3 jnz short 007277A1
007277BE 3BFB cmp edi, ebx
007277C0 7D 08 jge short 007277CA
007277C2 895C24 14 mov dword ptr [esp+0x14], ebx
007277C6 8BFB mov edi, ebx
007277C8 EB 0A jmp short 007277D4
007277CA 3BF9 cmp edi, ecx
007277CC 7C 06 jl short 007277D4
007277CE 894C24 14 mov dword ptr [esp+0x14], ecx
007277D2 8BF9 mov edi, ecx
007277D4 3BFB cmp edi, ebx
007277D6 7D 06 jge short 007277DE
007277D8 895C24 14 mov dword ptr [esp+0x14], ebx
007277DC EB 1C jmp short 007277FA
007277DE 8B4C24 40 mov ecx, dword ptr [esp+0x40]
007277E2 3BCB cmp ecx, ebx
007277E4 8BC3 mov eax, ebx
007277E6 7C 02 jl short 007277EA
007277E8 8BC1 mov eax, ecx
007277EA 3BF8 cmp edi, eax
007277EC 7C 0C jl short 007277FA
007277EE 3BCB cmp ecx, ebx
007277F0 895C24 14 mov dword ptr [esp+0x14], ebx
007277F4 7C 04 jl short 007277FA
007277F6 894C24 14 mov dword ptr [esp+0x14], ecx
007277FA 0FB785 80000000 movzx eax, word ptr [ebp+0x80]
00727801 0FB7F8 movzx edi, ax
00727804 66:894424 3C mov word ptr [esp+0x3C], ax
00727809 8B5424 3C mov edx, dword ptr [esp+0x3C]
0072780D 81E7 00F8FFFF and edi, 0xFFFFF800
00727813 C1EA 07 shr edx, 0x7
00727816 C1E7 05 shl edi, 0x5
00727819 83E2 0F and edx, 0xF
0072781C 0BFA or edi, edx
0072781E 80BD 88000000 0>cmp byte ptr [ebp+0x88], 0x4
00727825 72 05 jb short 0072782C
00727827 E8 34D32300 call 00964B60
0072782C 0FB685 88000000 movzx eax, byte ptr [ebp+0x88]
00727833 8D3440 lea esi, dword ptr [eax+eax*2]
00727836 8D34B5 E078D100 lea esi, dword ptr [esi*4+0xD178E0]
0072783D 8D5C24 3C lea ebx, dword ptr [esp+0x3C]
00727841 8D4424 34 lea eax, dword ptr [esp+0x34]
00727845 897C24 3C mov dword ptr [esp+0x3C], edi
00727849 E8 F2440000 call 0072BD40
0072784E 8B5424 34 mov edx, dword ptr [esp+0x34]
00727852 8B46 04 mov eax, dword ptr [esi+0x4]
00727855 33DB xor ebx, ebx
00727857 3BD3 cmp edx, ebx
00727859 0F84 3F030000 je 00727B9E
0072785F 3BD6 cmp edx, esi
00727861 0F85 37030000 jnz 00727B9E
00727867 8B4C24 38 mov ecx, dword ptr [esp+0x38]
0072786B 3BC8 cmp ecx, eax
0072786D 0F94C0 sete al
00727870 84C0 test al, al
00727872 0F94C0 sete al
00727875 84C0 test al, al
00727877 0F84 7D020000 je 00727AFA
0072787D 3B4A 04 cmp ecx, dword ptr [edx+0x4]
00727880 75 05 jnz short 00727887
00727882 E8 293C0000 call 0072B4B0
00727887 8D71 10 lea esi, dword ptr [ecx+0x10]
0072788A 3BF3 cmp esi, ebx
0072788C 897424 3C mov dword ptr [esp+0x3C], esi
00727890 0F84 64020000 je 00727AFA
00727896 68 B07B7200 push 00727BB0
0072789B 68 B0907200 push 007290B0
007278A0 6A 02 push 0x2
007278A2 6A 0C push 0xC
007278A4 8D4424 68 lea eax, dword ptr [esp+0x68]
007278A8 50 push eax
007278A9 E8 295B2B00 call 009DD3D7
007278AE 895C24 7C mov dword ptr [esp+0x7C], ebx
007278B2 8B4424 28 mov eax, dword ptr [esp+0x28]
007278B6 83E0 02 and eax, 0x2
007278B9 895C24 1C mov dword ptr [esp+0x1C], ebx
007278BD 894424 28 mov dword ptr [esp+0x28], eax
007278C1 74 0F je short 007278D2
007278C3 8B8C24 8C000000 mov ecx, dword ptr [esp+0x8C]
007278CA 0FB651 14 movzx edx, byte ptr [ecx+0x14]
007278CE 895424 14 mov dword ptr [esp+0x14], edx
007278D2 8B7C24 14 mov edi, dword ptr [esp+0x14]
007278D6 85FF test edi, edi
007278D8 7C 05 jl short 007278DF
007278DA 83FF 0C cmp edi, 0xC
007278DD 7E 18 jle short 007278F7
007278DF 57 push edi
007278E0 68 4CB8B000 push 00B0B84C ; ASCII "Item's MagParamNum(%d) is out of range!"
007278E5 68 01000002 push 0x2000001
007278EA E8 51ED2000 call 00936640
007278EF 83C4 0C add esp, 0xC
007278F2 E8 69D22300 call 00964B60
007278F7 33D2 xor edx, edx
007278F9 3BFA cmp edi, edx
007278FB 895424 20 mov dword ptr [esp+0x20], edx
007278FF 0F8E 20020000 jle 00727B25
00727905 8B8C24 8C000000 mov ecx, dword ptr [esp+0x8C]
0072790C 83C1 18 add ecx, 0x18
0072790F 894C24 24 mov dword ptr [esp+0x24], ecx
00727913 8B46 04 mov eax, dword ptr [esi+0x4]
00727916 3BC2 cmp eax, edx
00727918 0F84 90010000 je 00727AAE
0072791E 8B76 08 mov esi, dword ptr [esi+0x8]
00727921 2BF0 sub esi, eax
00727923 C1FE 02 sar esi, 0x2
00727926 0F84 82010000 je 00727AAE
0072792C 33FF xor edi, edi
0072792E 395424 28 cmp dword ptr [esp+0x28], edx
00727932 895424 18 mov dword ptr [esp+0x18], edx
00727936 895424 30 mov dword ptr [esp+0x30], edx
0072793A 897C24 2C mov dword ptr [esp+0x2C], edi
0072793E 895424 34 mov dword ptr [esp+0x34], edx
00727942 74 3B je short 0072797F
00727944 8B31 mov esi, dword ptr [ecx]
00727946 8B51 04 mov edx, dword ptr [ecx+0x4]
00727949 8BC6 mov eax, esi
0072794B B1 20 mov cl, 0x20
0072794D E8 6E442D00 call 009FBDC0
00727952 894424 34 mov dword ptr [esp+0x34], eax
00727956 8D4424 18 lea eax, dword ptr [esp+0x18]
0072795A 50 push eax
0072795B 8D4C24 30 lea ecx, dword ptr [esp+0x30]
0072795F 51 push ecx
00727960 8D5424 38 lea edx, dword ptr [esp+0x38]
00727964 52 push edx
00727965 8BC6 mov eax, esi
00727967 8BCD mov ecx, ebp
00727969 E8 F2060000 call 00728060
0072796E 83C4 0C add esp, 0xC
00727971 85C0 test eax, eax
00727973 0F84 35010000 je 00727AAE
00727979 8B7C24 2C mov edi, dword ptr [esp+0x2C]
0072797D EB 0C jmp short 0072798B
0072797F E8 B4592B00 call 009DD338
00727984 99 cdq
00727985 F7FE idiv esi
00727987 895424 18 mov dword ptr [esp+0x18], edx
0072798B 8B6C24 5C mov ebp, dword ptr [esp+0x5C]
0072798F 8D5C24 18 lea ebx, dword ptr [esp+0x18]
00727993 8D4424 44 lea eax, dword ptr [esp+0x44]
00727997 8D7424 58 lea esi, dword ptr [esp+0x58]
0072799B E8 70180000 call 00729210
007279A0 8B08 mov ecx, dword ptr [eax]
007279A2 85C9 test ecx, ecx
007279A4 0F84 68010000 je 00727B12
007279AA 8BD6 mov edx, esi
007279AC 3BCA cmp ecx, edx
007279AE 0F85 5E010000 jnz 00727B12
007279B4 3968 04 cmp dword ptr [eax+0x4], ebp
007279B7 0F94C0 sete al
007279BA 84C0 test al, al
007279BC 0F94C0 sete al
007279BF 84C0 test al, al
007279C1 0F85 E0000000 jnz 00727AA7
007279C7 837C24 28 00 cmp dword ptr [esp+0x28], 0x0
007279CC 75 31 jnz short 007279FF
007279CE 8B4424 3C mov eax, dword ptr [esp+0x3C]
007279D2 8B48 04 mov ecx, dword ptr [eax+0x4]
007279D5 85C9 test ecx, ecx
007279D7 0F84 F8000000 je 00727AD5
007279DD 8B40 08 mov eax, dword ptr [eax+0x8]
007279E0 8B5424 18 mov edx, dword ptr [esp+0x18]
007279E4 2BC1 sub eax, ecx
007279E6 C1F8 02 sar eax, 0x2
007279E9 3BD0 cmp edx, eax
007279EB 0F83 E4000000 jnb 00727AD5
007279F1 8B2C91 mov ebp, dword ptr [ecx+edx*4]
007279F4 8BFD mov edi, ebp
007279F6 E8 157A0000 call 0072F410
007279FB 8BF8 mov edi, eax
007279FD EB 04 jmp short 00727A03
007279FF 8B6C24 30 mov ebp, dword ptr [esp+0x30]
00727A03 85FF test edi, edi
00727A05 0F84 9C000000 je 00727AA7
00727A0B 8B47 10 mov eax, dword ptr [edi+0x10]
00727A0E 8178 04 7065726>cmp dword ptr [eax+0x4], 0x6E726570
00727A15 75 0F jnz short 00727A26
00727A17 836C24 20 01 sub dword ptr [esp+0x20], 0x1
00727A1C 836C24 24 08 sub dword ptr [esp+0x24], 0x8
00727A21 E9 81000000 jmp 00727AA7
00727A26 8B8424 84000000 mov eax, dword ptr [esp+0x84]
00727A2D 8BDF mov ebx, edi
00727A2F E8 9C780000 call 0072F2D0
00727A34 85C0 test eax, eax
00727A36 74 6F je short 00727AA7
00727A38 817F 04 FFFF000>cmp dword ptr [edi+0x4], 0xFFFF
00727A3F 7C 05 jl short 00727A46
00727A41 E8 1AD12300 call 00964B60
00727A46 837C24 28 00 cmp dword ptr [esp+0x28], 0x0
00727A4B 0FB737 movzx esi, word ptr [edi]
00727A4E 74 16 je short 00727A66
00727A50 8B5C24 34 mov ebx, dword ptr [esp+0x34]
00727A54 8B7F 04 mov edi, dword ptr [edi+0x4]
00727A57 8BC5 mov eax, ebp
00727A59 E8 7292D9FF call 004C0CD0
00727A5E 85C0 test eax, eax
00727A60 74 78 je short 00727ADA
00727A62 8BC3 mov eax, ebx
00727A64 EB 0A jmp short 00727A70
00727A66 8B4F 10 mov ecx, dword ptr [edi+0x10]
00727A69 8B11 mov edx, dword ptr [ecx]
00727A6B 8B42 08 mov eax, dword ptr [edx+0x8]
00727A6E FFD0 call eax
00727A70 8B7C24 1C mov edi, dword ptr [esp+0x1C]
00727A74 0FB7D6 movzx edx, si
00727A77 33F6 xor esi, esi
00727A79 0BC6 or eax, esi
00727A7B 8BB424 88000000 mov esi, dword ptr [esp+0x88]
00727A82 33C9 xor ecx, ecx
00727A84 0BCA or ecx, edx
00727A86 50 push eax
00727A87 51 push ecx
00727A88 E8 2372D0FF call 0042ECB0
00727A8D 8D4C24 18 lea ecx, dword ptr [esp+0x18]
00727A91 51 push ecx
00727A92 8D5424 50 lea edx, dword ptr [esp+0x50]
00727A96 83C7 01 add edi, 0x1
00727A99 52 push edx
00727A9A 8D5C24 60 lea ebx, dword ptr [esp+0x60]
00727A9E 897C24 24 mov dword ptr [esp+0x24], edi
00727AA2 E8 89160000 call 00729130
00727AA7 8BAC24 84000000 mov ebp, dword ptr [esp+0x84]
00727AAE 8B4424 20 mov eax, dword ptr [esp+0x20]
00727AB2 8B4C24 24 mov ecx, dword ptr [esp+0x24]
00727AB6 83C0 01 add eax, 0x1
00727AB9 83C1 08 add ecx, 0x8
00727ABC 3B4424 14 cmp eax, dword ptr [esp+0x14]
00727AC0 894424 20 mov dword ptr [esp+0x20], eax
00727AC4 894C24 24 mov dword ptr [esp+0x24], ecx
00727AC8 7D 4D jge short 00727B17
00727ACA 8B7424 3C mov esi, dword ptr [esp+0x3C]
00727ACE 33D2 xor edx, edx
00727AD0 ^ E9 3EFEFFFF jmp 00727913
00727AD5 E8 86E5FDFF call 00706060
00727ADA E8 81D02300 call 00964B60
00727ADF C74424 7C FFFFF>mov dword ptr [esp+0x7C], -0x1
00727AE7 68 B07B7200 push 00727BB0
00727AEC 6A 02 push 0x2
00727AEE 6A 0C push 0xC
00727AF0 8D4424 64 lea eax, dword ptr [esp+0x64]
00727AF4 50 push eax
00727AF5 E8 EB562B00 call 009DD1E5
00727AFA 33C0 xor eax, eax
00727AFC 8B4C24 74 mov ecx, dword ptr [esp+0x74]
00727B00 64:890D 0000000>mov dword ptr fs:[0], ecx
00727B07 59 pop ecx
00727B08 5F pop edi
00727B09 5E pop esi
00727B0A 5D pop ebp
00727B0B 5B pop ebx
00727B0C 83C4 6C add esp, 0x6C
00727B0F C2 0C00 retn 0xC
00727B12 E8 69200000 call 00729B80
00727B17 8B5C24 1C mov ebx, dword ptr [esp+0x1C]
00727B1B 83FB 0C cmp ebx, 0xC
00727B1E 7E 05 jle short 00727B25
00727B20 E8 3BD02300 call 00964B60
00727B25 837C24 28 00 cmp dword ptr [esp+0x28], 0x0
00727B2A 8B7424 40 mov esi, dword ptr [esp+0x40]
00727B2E 74 0F je short 00727B3F
00727B30 8B8424 8C000000 mov eax, dword ptr [esp+0x8C]
00727B37 85C0 test eax, eax
00727B39 74 04 je short 00727B3F
00727B3B 0FB670 14 movzx esi, byte ptr [eax+0x14]
00727B3F 3BDE cmp ebx, esi
00727B41 7E 09 jle short 00727B4C
00727B43 E8 18D02300 call 00964B60
00727B48 897424 1C mov dword ptr [esp+0x1C], esi
00727B4C 8B8424 88000000 mov eax, dword ptr [esp+0x88]
00727B53 8A4C24 1C mov cl, byte ptr [esp+0x1C]
00727B57 3A48 58 cmp cl, byte ptr [eax+0x58]
00727B5A 74 1D je short 00727B79
00727B5C F605 3C04D200 0>test byte ptr [0xD2043C], 0x1
00727B63 74 0F je short 00727B74
00727B65 8348 08 20 or dword ptr [eax+0x8], 0x20
00727B69 8848 58 mov byte ptr [eax+0x58], cl
00727B6C 8B48 0C mov ecx, dword ptr [eax+0xC]
00727B6F 8948 0C mov dword ptr [eax+0xC], ecx
00727B72 EB 05 jmp short 00727B79
00727B74 E8 E7CF2300 call 00964B60
00727B79 C74424 7C FFFFF>mov dword ptr [esp+0x7C], -0x1
00727B81 68 B07B7200 push 00727BB0
00727B86 6A 02 push 0x2
00727B88 6A 0C push 0xC
00727B8A 8D5424 64 lea edx, dword ptr [esp+0x64]
00727B8E 52 push edx
00727B8F E8 51562B00 call 009DD1E5
00727B94 B8 01000000 mov eax, 0x1
00727B99 ^ E9 5EFFFFFF jmp 00727AFC
00727B9E E8 9D380000 call 0072B440

Note: Magic Items Drop is 30% and this rate is not for the customized items in the database that were already given another values.
SR_GameServer.exe Address:
// If the random value came back over > 30 the whole function will go false.

Spoiler:

00727784 83FA 1E cmp edx, 0x1E

That's it ,
Greetings MeGaMaX.

[MentaL]

[furkan5429]

thank youu