org $C23BFA

jmp extra1
TYX
BIT $3DE8,X
jmp extra2


org $C2????

extra1:
TYX
BIT $3DD4,X
bne repeat
JMP $0E32      (Set status picked bytes 1 or 2)

extra2:
BNE repeat
ORA $3DE8,Y    (Set status picked bytes 3 or 4)
STA $3DE8,Y
RTS 

repeat:
JMP try_again  (either C2/3BD0 [slow], or C2/3BDE [would need
                to preserve X, probably taking 4 bytes].)

(21 extra bytes, so so)
(will repeat infinitely for Mind Blast if there're less than
 4 statuses marked in spell data.)

===========================

(EOR earlier than C2/3BFA could work, where $3DD4 or $3DE8 is
 just a subset of $11AA or $11AC.)

so it's the below variant without the #$FFFF instruction; just
EOR $11AA/$11AC with $3DD4,Y/$3DE8,Y.

will use 13 bytes free space.

not typing this crap out.

===========================

(what if they're somehow not a subset?  i.e. somebody edited
 code.)

org $C23BD0

CLC             ; tell routine to look at first two status bytes
JSR multi_520E  ; load statuses not-yet-marked for this entity,
                ;  then run C2/520E
STX $EE
SEC             ; tell routine to look at last two status bytes
JSR multi_520E  ; load statuses not-yet-marked for this entity,
                ;  then run C2/520E

; ---- Next 8 instructions unchanged from original, just shifted -----
; ----  up 4 bytes. --------

SEP #$20
TXA 
CLC 
ADC $EE         ; A = # of total statuses flagged in attack data that
                ;     haven't already been marked to be set on target
JSR $4B65       ; random number: 0 to A - 1
CMP $EE         ; Clear Carry if the random status we want to
                ;  set is in spell status byte 1 or 2;
                ;  Set Carry if it's in byte 3 or 4.
REP #$20        ; Set 16-bit Accumulator
PHP

; ----- more changed code starts here. ------

LDA $3DD4,Y    ; Statuses to Set, bytes 1-2
BCC skip       ; branch if we're now attempting to set a status from
               ;  byte 1 or 2
LDA $3DE8,Y    ; otherwise, use Statuses to Set from bytes 3-4
skip:
JSR multi      ; finish loading statuses not-yet-marked for this
               ;  entity from Carry-selected word of spell data

NOP            ; nowhere to put you

; ---- Next 7 instructions unchanged from original, kept in -----
; ----  place in case somebody wants to reach them.  --------

continue:
; JSR $522A      ; randomly pick a bit set in A
; PLP 
; BCS $3BFD
; JMP $0E32      ; Set status picked bytes 1 or 2
; ORA $3DE8,Y    ; Set status picked bytes 3 or 4
; STA $3DE8,Y
; RTS

; -------------------


org $C2????

multi_520E:
pea $520D       ; will execute multi below, then resume at C2/520E,
                ;  which sets X to number of statuses set by attack
                ;  (that aren't already marked) in a pair of bytes.
multi:
eor #$ffff
bcs secondPair  ; branch if attack attempting to set status from
                ;  byte 3 or 4
firstPair:
AND $11AA       ; A = $11AA AND NOT($3DD4).  i.e. spell status bytes
                ;  1 and 2 minus Statuses to Set bytes 1 and 2.
rts

secondPair:
AND $11AC       ; A = $11AC AND NOT($3DE8).  i.e. spell status bytes
                ;  3 and 4 minus Statuses to Set bytes 3 and 4.
rts

; 16 extra bytes