Help with fixing the enchanted arrow.

The thing is, patch #7 is necessary.

I made patch #6, and now, if the hero has the Enchanted Ballista skill, the game will crash when attempting to fire.
It says the error is here: 0x00d360ea
This number is slightly larger than the size of the heroes.
Apparently, patch #7 modifies some kind of reference, and it's impossible without it.

Technically, I don't know the meaning of these patches, so you just need to find the correct number.

So, it's better to use the larger number because when the .exe file is launched, it is re-addressed with an offset in RAM of 00 40 0c 00, and thus the game actually crashes at address 00 93 54 ea (this is the address in the .exe).

There is no explicit indication of an address with a bunch of zeros in the additions; there is only indirect addressing, but what it refers to is another question!
00D360C4                 loc_D360C4:                             ; CODE XREF: 00D35FD9
00D360C4                 mov     edi, [ebp-0Ch]
00D360C7                 cmp     dword ptr [edi+484h], 0
00D360CE                 jz      short loc_D3610B
00D360D0                 mov     eax, [esi+1Ch]
00D360D3                 add     eax, 36h
00D360D6                 mov     edx, eax
00D360D8                 shl     edx, 4
00D360DB                 sub     edx, eax
00D360DD                 mov     eax, [ebp-18h]
00D360E0                 add     edx, ebx
00D360E2                 mov     ecx, [eax+edx*4]
00D360E5                 mov     edx, [ebp-50h]
00D360E8                 push    ecx
00D360E9                 mov     ecx, [ebp-64h]
00D360EC                 push    edx
00D360ED                 mov     edx, [ebp-24h]
00D360F0                 push    ecx
00D360F1                 mov     ecx, [ebp-14h]
00D360F4                 push    edx
00D360F5                 mov     edx, [esi]
00D360F7                 push    ecx
00D360F8                 mov     ecx, [ebp-10h]
00D360FB                 push    edx
00D360FC                 push    edi
00D360FD                 push    ecx
00D360FE                 lea     edx, [eax+0B34h]
00D36104                 mov     ecx, ebx
00D36106                 call    sub_D1C780

The game crashes at var_64 – some variable in the game; it is very likely that the address of the Enchanted Ballista mechanic procedure is stored there!

Try making patch #7 with the address 00 b8 e8 fc (there are a lot of zeros here) or with 00 b9 04 fc (and here the zeros alternate with ff)