0x004010f0,521,city_compute_connection_bonus_candidate_weight,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Computes one city-side weight for the connection-bonus news and placement lanes. The helper rejects early when the city subtype field `[this+0x23e]` is nonzero, then builds a base float from the city-side scalar fields `[this+0x306]`, `[this+0x30a]`, and `[this+0x30e]`. When the optional stack company id is nonzero it also resolves the city's derived coordinates through `0x00455800` and `0x00455810`, probes the live world root at `0x0062c120` through `0x0044e270`, and rejects the city unless the selected company passes the follow-on world-side ownership or access check through `0x00424010`. The helper then scans the live placed-structure collection at `0x006cec20`, filters peers through `0x0041f6e0` plus the linked-instance class test `0x0047de00 -> 0x0040c990 == 1`, counts qualifying linked sites in the city, and detects whether one rival company already has an eligible linked site there. The final weight is scaled down by the inverse of `(qualifying_site_count + 1)` and then further damped when rival ownership is present, so the current grounded meaning is a city connection-bonus opportunity weight rather than a simple population or size score. Current grounded callers are the company-side news sweep at `0x00406050` and one neighboring setup-side branch at `0x00404d90`.","objdump + caller xrefs + callsite inspection + city-bonus correlation"
0x004013f0,177,world_run_company_start_or_city_connection_chooser_with_region_field_0x2d_temporarily_cleared_if_rule_0x4b07,map,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Small world-side wrapper above the broader chooser `0x00404ce0`. When scenario slot `[0x006cec78+0x4b07]` is nonzero, the helper walks all `0x18` live region records in `0x006cfc9c`, snapshots dword `[region+0x2d]` into one stack buffer, and temporarily zeros that field across every live entry. It then runs `0x00404ce0(1, 0, 0)` and restores the original `[region+0x2d]` values before returning the chooser result. Current grounded caller is the startup-side branch at `0x00407592`, and current atlas correlation ties slot `0x4b07` to the editor rule `AI Ignore Territories At Startup`, so this is the safest current read for the temporary territory-field suppression wrapper rather than a generic region iterator.","llvm-objdump + local disassembly + caller correlation + region-collection correlation + scenario-rule correlation"
0x004014b0,1194,company_try_buy_unowned_industry_near_city_and_publish_news,simulation,thiscall,inferred,objdump + callsite inspection + RT3.lng strings,2,"Company-side acquisition and headline helper beneath the broader periodic company service pass at `0x004019e0`. The function requires at least two linked transit sites through `company_count_linked_transit_sites` `0x00426590`, rejects when scenario finance toggle `[0x006cec78+0x4abf]` is set, and then scans the live building or structure collection at `0x0062b26c` for the best current acquisition target. Current grounded candidate filters are: the record must not already have an owner in `[site+0x276]`, its linked candidate subtype gate through `0x0040d360` must identify subtype `4`, the company-specific price or affordability metric from `0x0040d540` must stay below the current company metric window, and the record must be at least three years old from `[site+0x3d5]`. Surviving candidates are scored through local profitability or demand helpers around `0x0040cac0`, `0x0042c820`, `0x00455f60`, and the current company support scalar, and the best surviving site id is then committed through `0x004269b0`. On success the helper localizes the acquired structure type through `localization_lookup_display_label_by_stem_or_fallback` `0x0051c920`, resolves the nearby city or region entry through `0x004220b0`, and emits RT3.lng `2880` `%1 has bought a %2 near %3` through the shell news helper at `0x004554e0`. This is now the strongest current match for the acquisition-side sibling beneath the broader company periodic pass, though some lower structure-side helper semantics remain open.","objdump + callsite inspection + RT3.lng strings + acquisition-news correlation + structure-scan correlation"
0x00401860,221,company_query_cached_linked_transit_route_anchor_entry_id,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Returns one cached route-entry anchor id used by the linked-transit company cache family. The helper first validates the cached id at `[this+0x0d35]` against the live route-entry collection `0x006cfca8`, requiring the resolved record to carry this company id in word `[entry+0x22e]` and byte value `2` in `[entry+0x216]`; otherwise it clears the cache to `-1`. When the cache is empty but the three company-side count lanes `[this+0x7664]`, `[this+0x7668]`, and `[this+0x766c]` still sum positive, it scans the route-entry collection for the first record that satisfies those same owner and class predicates and then caches the record's linked anchor id from `[entry+0x202]`. Current grounded caller is `placed_structure_is_linked_transit_site_reachable_from_company_route_anchor` `0x004801a0`, where the returned route-entry id is used as the company-side anchor for the narrower linked-transit reachability gate.","objdump + caller xrefs + callsite inspection + route-entry-anchor correlation"
0x00401940,152,company_reset_linked_transit_caches_and_reseed_empty_train_routes,simulation,thiscall,inferred,objdump + callsite inspection + linked-transit correlation,2,"Small linked-transit reset helper beneath the broader company service family. The function clears the two company-side linked-transit cache timestamps at `[this+0x0d3e]` and `[this+0x0d3a]`, immediately re-enters `company_service_linked_transit_site_caches` `0x00409720`, and then walks the live train collection `0x006cfcbc` for company-owned trains. For owned trains in operating modes `0x0a` or `0x13` it removes every existing route-list entry through `train_route_list_remove_entry_and_compact` `0x004b3000`; when the route list is empty it then re-enters `train_try_append_linked_transit_autoroute_entry` `0x00409770`. Current grounded meaning is a local linked-transit cache reset plus empty-route reseed pass rather than a broader train-service sweep.","objdump + callsite inspection + linked-transit correlation + train-route-reset correlation"
0x004019e0,611,company_service_periodic_city_connection_finance_and_linked_transit_lanes,simulation,thiscall,inferred,objdump + callsite inspection + caller correlation + RT3.lng strings,2,"Broader periodic company-side service pass above the currently grounded city-connection, finance, and linked-transit lanes. The helper first rejects inactive or special-case companies through `[this+0x3f]` and `0x00425b90`, clears the transient company-side latches at `[this+0x0d17]`, `[this+0x0d18]`, and `[this+0x0d56]`, and temporarily mirrors one locomotive-derived byte from `[this+0x0d17]` into scenario field `[0x006cec78+0x4c74]` while the earlier route-building side of the body runs, restoring the original scenario value on exit. Current evidence now bounds those byte latches more narrowly: `[this+0x0d17]` is this transient route-search preference override, currently seeded only when `company_select_preferred_available_locomotive_id` `0x004078a0` resolves one locomotive whose engine-type dword `[record+0x10]` equals `2`; wider engine-type evidence now makes that best-read as the electric lane, since the linked approval helper around `0x0041d550` dispatches the same `0/1/2` field across three scenario opinion slots while the local language family `706..709` and help text `3848` bound the player-facing triplet as `Steam`, `Diesel`, and `Electric`. The route-search side is tighter now too: this mirrored byte is not just reusing a display preference slot abstractly, it feeds the same initial path-sweep branch in `route_entry_collection_run_initial_candidate_path_sweep` `0x0049bd40` that explicit route-policy byte `4` uses, selecting the larger `1.8` quality multiplier instead of `1.4` before the later acceptance checks. `[this+0x0d18]` is the city-connection announcement-side latch reused by `company_evaluate_and_publish_city_connection_bonus_news` `0x00406050`; and `[this+0x0d56]` is the linked-transit train-service latch later set by the train-add, train-upgrade, and route-builder-side cache-refresh family around `0x00409830`, `0x00409300`, and `0x0040457e -> 0x004093d0`. The ordering matters too: this owner clears those latches up front, runs the city-connection and linked-transit branches first, and only later enters `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`, so the finance helper is reading same-cycle side-channel state rather than stale long-lived flags. It then gates and schedules several narrower service families: the city-connection announcement side through `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0` and `company_evaluate_and_publish_city_connection_bonus_news` `0x00406050`; the acquisition-side sibling through `company_try_buy_unowned_industry_near_city_and_publish_news` `0x004014b0`; the linked-transit train side through `company_balance_linked_transit_train_roster` `0x00409950`; the broader annual finance and governance helper through `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`; and the linked-transit cache refresh tail through either `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` or `company_rebuild_linked_transit_autoroute_site_score_cache` `0x00407bd0` depending on current scenario mode byte `[0x006cec78+0x0f]`. This name stays intentionally conservative: it is the broader periodic owner above those lanes, not a fully split policy map yet.","objdump + callsite inspection + caller correlation + RT3.lng strings + linked-transit correlation + city-connection correlation + acquisition correlation + latch correlation + sequencing correlation + temporary-route-preference correlation + locomotive-choice correlation + engine-type correlation + route-search-threshold correlation"
0x004078a0,815,company_select_preferred_available_locomotive_id,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Selects one preferred locomotive id for the current company from the live locomotive collection at `0x006ada84`. The helper iterates the live locomotive records, applies company-and-chairman availability gating through the linked approval family around `0x0041d550`, accumulates one weighted preference score from locomotive fields `[record+0x20]`, `[+0x28]`, `[+0x18]`, `[+0x1c]`, `[+0x0c]`, and the linked class or era record at `[record+0x72]`, and keeps the strongest surviving locomotive id, falling back to `locomotive_collection_select_best_era_matched_non_electric_fallback_id` `0x00461cd0` when no scored candidate survives. Current grounded callers are the periodic company service pass `0x004019e0`, the temporary route-side mode chooser around `0x00402d5f`, the linked-transit train-upgrade news helper `0x00409300`, and the linked-transit train-add helper `0x00409830`. Current evidence now also bounds one route-policy side effect above it: `0x004019e0` only arms its temporary `[company+0x0d17] -> [0x006cec78+0x4c74]` override when the chosen locomotive record carries engine-type value `2` in `[record+0x10]`, which now best aligns with the electric lane rather than an unnamed class slot.","objdump + caller xrefs + callsite inspection + locomotive-collection correlation + preferred-choice correlation + engine-type correlation"
0x00401c50,3016,company_evaluate_annual_finance_policy_and_publish_news,simulation,thiscall,inferred,objdump + callsite inspection + RT3.lng strings,2,"Large annual company finance-policy helper beneath the broader periodic service pass at `0x004019e0`. The earliest creditor-pressure or bankruptcy lane is now bounded more tightly: it requires scenario mode `0x0c`, the bankruptcy toggle `[0x006cec78+0x4a8f]` to be clear, at least `13` years since the last bankruptcy stamp at `[this+0x163]`, and at least `4` years since founding year `[this+0x157]`. It then scans the last three years of derived finance lanes through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0`, accumulating the net-profits lane `0x2b`, counting one three-year failure condition from the revenue aggregate `0x2c`, selecting one negative cash-and-debt stress ladder `-600000 / -1100000 / -1600000 / -2000000` from the current slot-`0x2c` band split at roughly `120000 / 230000 / 340000`, requiring the current support-adjusted share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` to be at least `15` or `20` depending on whether all three years failed, checking the current fuel-cost lane in slot `0x09` against `0.08` times that ladder, and requiring both `edi >= 2` plus the three-year slot-`0x2b` accumulator to clear one final `-60000` threshold before it commits bankruptcy through `company_declare_bankruptcy_and_halve_bond_debt` `0x00425a90` and formats RT3.lng `2881` `%1 has declared bankruptcy!`. The helper also has one later deep-distress fallback bankruptcy lane on the no-action fallthrough before the build-`1.03+` stock-issue branch: with the same bankruptcy toggle clear, current cash below `-300000`, at least `3` years since founding, no recent automatic finance action already chosen, the first three recent net-profits lanes each at or below `-20000`, and at least `5` years since the last bankruptcy stamp, it commits the same bankruptcy path and news family again. The later debt-capital restructuring family mutates the live company through `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, `company_issue_bond_and_record_terms` `0x004275c0`, `company_repurchase_public_shares_and_reduce_capital` `0x004273c0`, and `company_issue_public_shares_and_raise_capital` `0x00427450`, then formats the RT3.lng `2882..2886` headlines `%1 has refinanced %2 of debt.`, `%1 has refinanced %2 of debt and borrowed %3 on top of that.`, `%1 has refinanced %2 and paid off a further %3 of debt.`, `%1 has paid off %2 of its debt.`, and `%1 has borrowed %2 in debt.` The message-side tail is tighter now too: it accumulates total retired principal in one counter and total newly issued principal in another, then chooses the debt headline family by comparing those two totals directly: equal -> `2882` refinance only, issued greater -> `2883` refinance plus extra borrowing, retired greater -> `2884` refinance plus additional payoff, issued zero -> `2885` debt payoff only, and retired zero with issued positive -> `2886` straight new borrowing. The middle annual bond lane is tighter now too: when the bond toggle `[+0x4a8b]` is clear, it first simulates full bond repayment through repeated `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, then uses the resulting cash-side window with the fixed `-250000` and `-30000` thresholds plus the broader linked-transit train-service latch `[this+0x0d56]` to decide whether to stage one or more `500000` principal, `30`-year bond issues through `company_issue_bond_and_record_terms` `0x004275c0`. The repurchase lane is distinct from the later share-issue path: when the city-connection announcement-side latch `[this+0x0d18]` is set, editor growth setting `2` does not suppress it, and the stock toggle `[+0x4a87]` is clear, it starts from one `1000`-share batch and one default factor `1.0`, can replace that with a linked-chairman personality scalar `([table byte * 39] + 300) / 400`, scales that factor by `1.6` when growth setting `[0x006cec78+0x4c7c] == 1`, uses the resul
0x00402c90,19,placed_structure_resolve_linked_candidate_record,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,2,"Tiny placed-structure-to-candidate resolver over the global candidate collection at `0x0062b268`. The helper reads one candidate id from `[this+0x173]`, re-enters the shared indexed-collection record resolver at `0x00518140`, and returns the resulting candidate record pointer. Current grounded caller is the BuildingDetail-side branch at `0x00506441`, where it is used immediately after resolving one placed-structure record from `0x0062b2fc`. This now looks like the direct placed-structure linked-candidate accessor rather than another anonymous local helper.","objdump + caller xrefs + callsite inspection + collection-resolver correlation"
0x00402cb0,3457,city_connection_try_build_route_with_optional_direct_site_placement,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Shared heavy route-builder and optional direct-placement helper beneath the city-connection route and news family. The function starts at a clean prologue at `0x00402cb0`, seeds one builder-state latch band at `[this+0xf5]`, `[this+0xf6]`, `[this+0xf8]`, `[this+0xfa]`, `[this+0xfc]`, and `[this+0x10a]`, and then splits into three grounded internal lanes. The first is an early route-entry search or synthesis lane through `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` over the global route-entry store `0x006cfca8`, which can seed the builder-state block and succeed without placing a new site. The second is a single-endpoint direct-placement lane around `0x00403d92..0x00403ef3`: it scans the live placed-structure collection `0x0062b2fc` for `Maintenance` and `ServiceTower` stems, projects one candidate placement through `0x00417840`, validates it through `0x004197e0`, and then commits through the first direct placement branch `0x00403ed5 -> placed_structure_collection_allocate_and_construct_entry` `0x004134d0` -> `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`. The third is a later paired-endpoint fallback lane around `0x00403f41..0x00404489`: it seeds two endpoint candidates from the same `Maintenance` and `ServiceTower` stem scan, builds one temporary route-entry candidate list, iterates that list against span and year-scaled step terms, projects trial placements through `0x00417840`, and on success commits through the second direct placement branch `0x0040446b -> 0x004134d0 -> 0x0040ef10` before clearing a small exclusion window in the temporary list. Outside those lanes it also re-enters geometry, region, and route-store helpers around `0x004423a0`, `0x00482e00`, `0x004931e0`, `0x00494310`, and the global route-entry stores `0x006cfcb4` / `0x006cfca8`, and it can still unwind through route-state cleanup without committing new placed structures. Current grounded external callers are still entirely in the city-connection family: the compact region-entry wrapper `city_connection_bonus_try_compact_route_builder_from_region_entry` `0x00404640`, the peer-route candidate builder `city_connection_bonus_build_peer_route_candidate` `0x004046a0`, the direct region-entry pair wrapper `city_connection_try_build_route_between_region_entry_pair` `0x00404c60`, and the direct retry paths inside `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0`. This now bounds the old unresolved `0x00403xxx..0x00404631` placement chooser as one shared city-connection route or placement helper with a cleaner internal policy split, even though some lower helper semantics remain open.","objdump + caller xrefs + callsite inspection + placement-correlation + route-builder correlation + Maintenance/ServiceTower scan correlation + route-entry search correlation"
0x004046a0,1388,city_connection_bonus_build_peer_route_candidate,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Reusable candidate builder beneath the city-connection bonus news and status family. The helper starts from one region or city entry in collection `0x0062bae0`, rounds that entry's two normalized coordinate terms through `0x00455800/0x00455810 -> 0x005a10d0`, and then re-enters `city_connection_bonus_select_first_matching_peer_site` `0x00420280` with both selector flags forced on so it can recover one representative peer site. When a peer is found it resolves that site's derived coordinates through `0x0047df30/0x0047df50 -> 0x005a10d0`. If the caller supplies a live explicit route-anchor tuple, the helper first tries the heavy builder `0x00402cb0` directly with that tuple and, when no peer was found, falls back to the smaller wrapper `0x00404640`. If neither early path succeeds it builds one mixed local candidate list in 10-byte stack records from both global route stores `0x006cfcb4` and `0x006cfca8`: the first pass appends the two endpoint ids from each dense pair record, while the second appends the six-byte route-entry ids stepped by `+0x06`. It then marks each candidate's byte `+0x04` for route-anchor eligibility only when the site is class `2`, still has no competing runtime or route-owner state in the `0x020e..0x0244` band, and passes the `0x0048a1c0/0x0048a1a0/0x0048f290` route-anchor tests against the selected peer coordinates. The scoring tail skips ineligible or peer-owned entries, prefers the smallest span from `[site+0x206/+0x20a/+0x20e]` and the peer-coordinate rectangle, optionally upgrades the chosen route anchor through `0x0048e3c0`, and finally retries `0x00402cb0` with the best surviving candidate. Current grounded callers are the wider company-side city-connection bonus sweep at `0x00406050` and one neighboring branch at `0x00406b73`, which makes this the shared peer-route candidate builder above the city bonus peer-selector family rather than a direct UI formatter.","objdump + caller xrefs + callsite inspection + peer-selector correlation + route-builder correlation + candidate-list correlation + route-anchor-eligibility correlation"
0x00404640,82,city_connection_bonus_try_compact_route_builder_from_region_entry,map,thiscall,inferred,objdump + caller inspection + route-builder correlation,3,"Small route-builder helper beneath `city_connection_bonus_build_peer_route_candidate` `0x004046a0`. The helper resolves one caller-supplied region or city entry id through collection `0x0062bae0`, derives that entry's compact coordinate pair through `0x00401000`, reads one explicit route-anchor or peer-site id from `[this+0x00]`, and then re-enters the heavier route builder at `0x00402cb0` with that resolved coordinate pair plus default wildcard arguments `-1/0/-1` in the remaining route slots. Current grounded caller is the city-connection bonus candidate builder at `0x004047bf`, where this helper is used as the smaller fallback path when the earlier explicit-anchor route attempt does not apply. This now looks like the compact region-entry wrapper around the shared route builder rather than a generic coordinate helper.","objdump + caller inspection + route-builder correlation + city-bonus fallback correlation"
0x00404c60,124,city_connection_try_build_route_between_region_entry_pair,map,fastcall,inferred,objdump + caller inspection + route-builder correlation,3,"Compact fastcall route-builder above the shared route store at `0x006cfca8`. The helper resolves the two caller-supplied region or city entry ids through collection `0x0062bae0`, derives both endpoint coordinate pairs through `0x00401000`, and then re-enters the heavier route builder at `0x00402cb0` with those two endpoints plus the caller's remaining stack-side policy tuple. Current grounded callers are the pair-selection sweeps inside `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0`, where it is used both for the early dense score matrix and the later selected-pair retry. This now looks like the direct region-entry pair wrapper around the shared route builder rather than another anonymous internal callsite.","objdump + caller inspection + route-builder correlation + pair-selection correlation"
0x00404ce0,3124,simulation_try_select_and_publish_company_start_or_city_connection_news,simulation,fastcall,inferred,objdump + caller inspection + RT3.lng strings,3,"Broad fastcall city-pair chooser and news publisher above `city_connection_try_build_route_between_region_entry_pair` `0x00404c60`. When the stack company-id argument is zero the helper sweeps up to `0xa0` region-or-city entries from `0x0062bae0`; when it is nonzero it first validates that company through collection `0x0062be10`, stat family `0x2329` mode `0x0d` via `0x0042a5d0`, and the territory-access gate `0x00424010`. Eligible city entries are filtered through `city_connection_bonus_exists_matching_peer_site` `0x00420030`, weighted through `city_compute_connection_bonus_candidate_weight` `0x004010f0`, damped by map-size terms, territory access, and current region flags, and stored into temporary score bands. The helper then builds one dense pair matrix, repeatedly re-enters `0x00404c60` to validate candidate city pairs, can update one company-side selected endpoint pair through `0x00426f20`, and finally publishes shell news through `0x004554e0`. Current grounded publication ids are `2889` `%1 has started a new company - the %2` and `2890` `%1 has connected %2 to %3.`. Current grounded callers are `0x00401455`, which temporarily clears region-state dwords `[0x006cfc9c+0x2d]` before a global pass, and `0x00401b36`, which re-enters the same chooser with the active company and linked chairman after the smaller company-side city-connection bonus lane falls through. This now looks like the broader company-start-or-city-connection headline chooser above the smaller city-connection bonus sweep at `0x00406050` rather than another anonymous route-builder.","objdump + caller inspection + RT3.lng strings + route-builder correlation + pair-selection correlation + publication-path correlation"
0x00405920,189,company_query_min_linked_site_distance_to_xy,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Queries the minimum distance from one company to an input X or Y point pair. The helper walks the live placed-structure collection at `0x006cec20`, keeps only sites whose linked company id from `placed_structure_query_linked_company_id` at `0x0047efe0` matches `[this+0x00]`, samples each surviving site's derived coordinates through `0x0047ded0` and `0x0047df00`, and then computes one scalar distance against the caller-supplied coordinate pair through `0x0051dbe0`. It returns the minimum observed distance across all linked sites, clamped to a floor of `1.0` when a closer or degenerate result would go lower. The current grounded caller is `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, where this helper provides the distance term later blended into each city candidate score.","objdump + caller xrefs + callsite inspection + distance-term correlation"
0x00406050,2966,company_evaluate_and_publish_city_connection_bonus_news,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Broader company-side city-connection bonus sweep above `city_connection_bonus_build_peer_route_candidate` at `0x004046a0`. The function first builds one announcement-value floor from several company-side helpers: stat family `0x2329` mode `0x0d` through `0x0042a5d0`, the wider company-state reader `0x00426ef0`, linked transit-site count `company_count_linked_transit_sites` `0x00426590`, the unlock gate `company_connection_bonus_lane_is_unlocked` `0x00427590`, and the bounded value ladder `company_compute_connection_bonus_value_ladder` `0x00425320`. It also enforces the version gate `0x00482e00 >= 0x67`, a transit-count cap `< 4`, and a minimum weighted city-value threshold above `50000`. Once those gates hold it walks the region-or-city collection at `0x0062bae0`, derives one per-city opportunity score from the city-side weight `city_compute_connection_bonus_candidate_weight` `0x004010f0`, the chairman-profile-scaled company metric, and current normalized city coordinates from `0x00455800/0x00455810`, and then keeps the best candidate ids in the persistent ten-entry band rooted at `[this+0x0d42]`. A second sweep validates those entries by re-entering `city_connection_bonus_build_peer_route_candidate`, then re-samples each surviving candidate's three route-anchor lanes `[site+0x206/+0x20a/+0x20e]`, counts reachable flagged peers, accumulates one integer bonus total through `0x0048b100`, refreshes transient route state through `0x0048f4c0`, and preserves `[site+0x240]` across that refresh on version `>= 0x67`. When at least one validated winner survives it publishes the winning score into company stat slot `0x0f` through `0x0042a040`, formats the city and company name lanes through `0x0051c000/0x0051b700/0x005193f0/0x00518de0`, and then emits localized news through `0x004554e0`. Current grounded publication ids remain `2888` `%1 has connected to %2.`, `2890` `%1 has connected %2 to %3.`, and `2921` `%1 has put a station in %2, but to win the %3 connection bonus, this station must be connected to ANOTHER city.`. When no winner survives it falls out without that publish and the surrounding caller can use the separate pending-bonus owner at `0x004358d0`. This is now the first grounded announcement owner above the city-connection bonus status formatter and peer-selector pair rather than just an anonymous caller around `0x004064c0`.","objdump + caller inspection + RT3.lng strings + peer-route candidate correlation + publication-path correlation + score-component correlation + validation-sweep correlation"
0x00407bd0,1697,company_rebuild_linked_transit_autoroute_site_score_cache,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Slower per-company follow-on above the fast linked-transit peer cache. The helper stamps the current scenario tick into `[this+0x0d3a]`, then walks the live placed-structure collection and keeps only sites whose company-side cache cell at `[site+0x5bd][company_id]` is present and eligible. For each such site it refreshes the cache-cell tick at `+0x0a`, zeroes the three accumulated float lanes at `+0x0e`, `+0x12`, and `+0x16`, and then rebuilds those lanes from two phases. First it uses `placed_structure_count_candidates_with_local_service_metrics` `0x0047e330`, `0x0047e620`, and the issue-opinion helper `0x00437d20` to populate bounded candidate-local amount bands at stack `0x1a0..` and normalized scaling bands at `0x350..`. Then it re-enters the per-site peer buffer at cache `+0x06`, resolves each peer site's live service words through `0x0047de20`, and only keeps candidate lanes whose local amount still exceeds the peer baseline. The surviving excess amount accumulates raw into cache float `+0x12`, while the continuity share at peer float `+0x09` and route-step count at peer dword `+0x05` feed a second step-biased weighted accumulator in cache float `+0x0e` through the local `+0x28` denominator bias. A later grouped promotion pass chooses the strongest adjacent candidate bands and folds their weighted contribution into cache float `+0x16`, which is the final site-ranking lane consumed by the downstream site selector. That split now matters for the tracker compatibility question too: the pre-`1.03` versus `1.03+` pair-metric dispatcher at `0x004a65b0` can perturb peer step counts and continuity share, but on current evidence that only flows into the weighted `+0x0e` and promoted `+0x16` lanes, not the raw `+0x12` amount total. Current grounded callers are the company-side mode gate at `0x00401c2a`, the timed wrapper at `0x00409766`, and the fast-cache tail path at `0x004093cd`. This now reads as the slower autoroute-site score rebuild over the linked-transit peer cache family rather than an unnamed tail call.","objdump + caller xrefs + callsite inspection + linked-transit score-cache correlation + linked-transit consumer correlation + version-compatibility impact correlation"
0x00408280,255,company_select_best_owned_linked_transit_site_by_autoroute_score,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Selects one owned linked transit site from the company-side autoroute cache family. The helper walks the live placed-structure collection, keeps only sites whose company cache cell `[site+0x5bd][company_id]` is present and eligible, whose linked company id matches the current company, and which still pass the station-or-transit gate `0x0047fd50`. It then ranks the surviving sites by cache float `[cell+0x16]`, applying a small bonus when the placed-structure-side lanes `[site+0x5c1]` and `[site+0x5c5]` are both clear, and returns the winning site id or `-1` when no candidate survives. Current grounded caller is `company_build_linked_transit_autoroute_entry` `0x00408380`, where this helper provides the fallback start site when the caller does not already supply one.","objdump + caller xrefs + callsite inspection + linked-transit autoroute correlation"
0x00408380,3215,company_build_linked_transit_autoroute_entry,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Builds one `0x33`-byte train route-list entry from the company-side linked-transit autoroute caches. When the caller-supplied site id is absent or invalid, the helper first falls back to `company_select_best_owned_linked_transit_site_by_autoroute_score` `0x00408280`. It then walks the chosen site's peer buffer from `[site+0x5bd][company_id]+0x06`, recomputes grouped candidate-local deltas against the peer site's service words from `0x0047de20`, chooses the strongest surviving peer site, and finally formats one route-list record into the caller-owned output buffer: it clears the `0x33`-byte record, preserves the low nibble of flag byte `+0x28`, writes the chosen target site id into word `+0x29`, seeds the route-kind dword at `+0x24` with `0x384`, and fills the remaining route-anchor or metadata lanes through the auxiliary route-entry tracker family at `0x006cfcb4` when a linked train record is supplied. The downstream effect boundary is tighter now too: because this builder ranks peer-site candidates from the weighted peer-derived bands rather than the raw site totals, the pre-`1.03` versus `1.03+` tracker metric split is now best read as perturbing autoroute peer choice and seeded route-entry selection here, not the later company-wide train-pressure target at `0x00408f70`. Current grounded callers are `train_try_seed_route_list_from_company_linked_transit_sites` `0x00409770` and two neighboring stack-built retry branches in the same family. This now looks like the shared route-entry builder above the linked-transit autoroute cache rather than another raw site query.","objdump + caller xrefs + callsite inspection + route-list-entry correlation + linked-transit autoroute correlation + version-compatibility impact correlation"
0x00408f70,864,company_compute_owned_linked_transit_site_score_total,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Aggregates one company-side linked-transit train-pressure target from the placed-structure cache family. The helper walks the live placed-structure collection at `0x006cec20`, keeps only records whose company-specific cache cell `[site+0x5bd][company_id]` is present and eligible, whose linked company id matches the current company, and which still pass the narrower station-or-transit gate `0x0047fd50`, then accumulates the raw site score float at cache offset `+0x12` across the surviving sites while also retaining the first two representative site pointers and the eligible-site count. It then converts that raw total into the returned roster target through a year-dependent divisor ladder, later year-side multipliers, and site-count bands. On build `1.03+`, when exactly two eligible sites survive, it also measures the inter-site distance between those retained sites and applies an extra distance-side scaling branch before the final train-balance comparison. The compatibility boundary is now tighter too: because this helper sums cache `+0x12` rather than the weighted `+0x0e` or promoted `+0x16` lanes, current evidence says the pre-`1.03` versus `1.03+` tracker metric split does not directly change this company-wide roster target except through any earlier coarse candidate-survival effects, not through the step-count or continuity-weighting lanes themselves. Current grounded caller is the linked-transit train-roster balancer at `0x00409950`, where this returned float is compared against the current owned-train count and train-age heuristics before the add, upgrade, or removal branches run.","objdump + caller xrefs + callsite inspection + linked-transit score-total correlation + linked-transit consumer correlation + version-compatibility impact correlation"
0x00409300,200,company_publish_train_upgrade_news,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,3,"Formats and publishes the linked-transit train-upgrade news item. After one scenario gate through `[0x006cec78+0x4a97]`, the helper chooses one preferred locomotive id through `0x004078a0`, resolves the caller-supplied train id through the live train collection `0x006cfcbc`, formats the old and new locomotive names through the locomotive collection `0x006ada84` and the name helper at `0x00461ca0`, and then emits RT3.lng id `2897` `%1 has just upgraded a %2 to a %3.` through the shell news helper at `0x004554e0`. It finally sets the byte latch at `[company+0x0d56]`. Current grounded callers are the train-roster balancer at `0x00409950` and one neighboring branch at `0x00409b52`, so this now reads as the shared company-side train-upgrade headline helper rather than an anonymous news formatter.","objdump + caller xrefs + callsite inspection + RT3.lng strings + train-upgrade news correlation"
0x004093d0,837,company_rebuild_linked_transit_site_peer_cache,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Per-company fast refresh over the placed-structure-side linked-transit peer cache. The helper stamps the current scenario tick from `[0x006cec78+0x15]` into `[this+0x0d3e]`, then walks the live placed-structure collection at `0x006cec20`. For each site it resolves the company-specific cache cell from the site's pointer table `[site+0x5bd][company_id]`, marks the cell present, clears its eligible byte, and frees any prior peer-record buffer at `+0x06`. It then marks a site eligible when it passes the station-or-transit gate `0x0047fd50`, the linked-instance class test `0x0047de00 -> 0x0040c990 == 1`, and either already belongs to this company through `placed_structure_query_linked_company_id` `0x0047efe0` or survives the neighboring route-anchor reachability gate `0x004801a0` plus the minimum-distance threshold built from `company_query_min_linked_site_distance_to_xy` `0x00405920`. In the second pass each eligible site receives a zeroed `(eligible_count*0x0d)+1` byte peer buffer at cache offset `+0x06`, and the helper fills one `0x0d`-byte record per eligible peer: byte `+0x00` is a route-side reachability flag, dword `+0x01` stores the peer site id, dword `+0x05` stores the returned route-step count from `aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks` `0x004a6630`, and float `+0x09` stores the normalized continuity share computed from that step count and the companion mismatch-count output of the same helper. The function then tails into the heavier company-side follow-on at `0x00407bd0`. Current grounded callers are the company-side world or service wrapper `0x00409742`, the mode-gated company pass at `0x00401c23`, the route-builder-side company refresh at `0x0040457e`, and the active-company collection sweep `0x00429c5b`.","objdump + caller xrefs + callsite inspection + linked-transit cache correlation + placed-structure cache-cell correlation + route-step-count correlation + continuity-ratio correlation"
0x00409720,80,company_service_linked_transit_site_caches,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Timed service wrapper above the two company-side linked-transit cache lanes. The helper refreshes the fast peer cache through `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` when `[this+0x0d3e]` is zero or older than `0x7ff80` ticks, and otherwise refreshes the slower follow-on lane at `0x00407bd0` when `[this+0x0d3a]` is zero or older than `0x31380` ticks. Current grounded direct callers are `0x004097b8`, which re-enters it after one larger local mode change, and several neighboring company-side service paths. This now looks like the bounded timed owner for the company-side linked-transit cache family rather than another anonymous small wrapper.","objdump + caller xrefs + callsite inspection + timed-service correlation"
0x00409770,88,train_try_append_linked_transit_autoroute_entry,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Attempts to append one linked-transit autoroute entry onto a live train route list. After validating the train-side state and one current route-kind gate through `0x004a8840`, the helper clears one local staging byte, re-enters `company_service_linked_transit_site_caches` `0x00409720` on the owning company, and then asks `company_build_linked_transit_autoroute_entry` `0x00408380` for a single staged `0x33`-byte route-list record using the current anchor site id at `[this+0x0a0]`. On success it either appends that record through `train_route_list_insert_staged_entry_at_index` `0x004b3160` and refreshes the new trailing selection through `train_route_list_select_entry_and_refresh_linked_site_state` `0x004b2f00`, or when the list is already at the local two-entry cap it rotates the target slot via `[this+0x08] mod [this+0x04]` and overwrites that `0x33`-byte entry in place. The weighted linked-transit cache lanes stay indirect here too: this helper inherits ranked site and peer choice only through `0x00408380`, not by reading cache `+0x0e/+0x16` itself. Current grounded caller is the company-side service sweep at `0x004019cc`, so this now reads as the single-entry train-side autoroute append helper rather than a two-entry seeding pass.","objdump + caller xrefs + callsite inspection + linked-transit autoroute correlation + train-route-list correlation + weighted-consumer-boundary correlation"
0x00409830,274,company_try_add_linked_transit_train_and_publish_news,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,3,"Local add-train branch beneath the linked-transit company train-roster balancer. The helper first respects scenario gate `[0x006cec78+0x4aa3]`, clears and seeds one staged route-entry buffer through `0x004b2ba0`, services the owning company's linked-transit caches, asks `company_build_linked_transit_autoroute_entry` `0x00408380` for two route-list entries, inserts those entries through `train_route_list_insert_staged_entry_at_index` `0x004b3160`, chooses one preferred locomotive id through `0x004078a0`, and then hands the staged route plus locomotive choice into the train-construction helper at `0x004b2140`. On success it emits RT3.lng id `2896` `%1 has added a new train (%2) at %3` through `0x004554e0` and sets the byte latch at `[company+0x0d56]`. The weighted linked-transit cache lanes stay indirect here too: this add-train path inherits ranked site and peer choice only through the two `0x00408380` builder calls, while the separate roster-pressure decision above it still comes from raw cache `+0x12` through `0x00408f70`. Current grounded callers are the local add branches inside `company_balance_linked_transit_train_roster` `0x00409950`, while multiplayer callers package opcode `0x75` instead.","objdump + caller xrefs + callsite inspection + RT3.lng strings + linked-transit train-add correlation + weighted-consumer-boundary correlation"
0x00409950,923,company_balance_linked_transit_train_roster,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Balances one company's linked-transit train roster against the linked-site cache family. The helper first requires at least one linked transit site through `company_count_linked_transit_sites` `0x00426590`, then computes one aggregate train-pressure target through `company_compute_owned_linked_transit_site_score_total` `0x00408f70` and counts currently owned trains through `company_count_owned_trains` `0x004264c0`. It walks the live train collection `0x006cfcbc`, keeps only trains owned by the current company, derives one year-dependent age scalar from current scenario year `[0x006cec78+0x0d]`, and applies that scaled age against two thresholds. Very old trains above the upper band are either removed outright through the train collection vtable when the roster already exceeds target, or upgraded in place through `company_publish_train_upgrade_news` `0x00409300` when the target still needs capacity. Mid-age trains above the lower band can trigger one narrower upgrade branch when the roster is still below target. After pruning, it computes the remaining deficit between the aggregate target and the owned-train count, then repeatedly either packages multiplayer opcode `0x75` through `0x00469d30` or locally re-enters `company_try_add_linked_transit_train_and_publish_news` `0x00409830` until that deficit collapses, with one later add-train retry branch when the residual target is still high enough. Current grounded callers are the company-side service sweep at `0x00401b9d` and a neighboring company wrapper at `0x004097b8`, so this now looks like the live train-balance owner above the linked-transit autoroute and news helpers rather than an unnamed local maintenance pass.","objdump + caller xrefs + callsite inspection + linked-transit train-balance correlation + linked-transit consumer correlation"
0x004264c0,96,company_count_owned_trains,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Counts the live trains owned by the current company. The helper walks the train collection at `0x006cfcbc`, compares each record's owning company byte at `[train+0x51]` against `[this+0x00]`, and returns the number of matches. Current grounded callers are the linked-transit train-roster balancer at `0x00409950` and the `LoadScreen.win` company train-list page at `0x004e7670`, where the count gates the no-trains fallback before the detailed roster rows are built.","objdump + caller xrefs + callsite inspection + company-owned train count correlation"
0x00426590,135,company_count_linked_transit_sites,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Counts the live linked placed structures for this company that also pass the station-or-transit gate. The helper walks the placed-structure collection at `0x006cec20`, keeps only peers whose linked company id from `placed_structure_query_linked_company_id` at `0x0047efe0` matches `[this+0x00]`, requires the linked-instance class byte through `0x0047de00 -> 0x0040c990 == 1`, and optionally enforces the narrower station-or-transit predicate through `0x0047fd50` when the caller passes a nonzero stack flag. The current grounded caller is `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, where the helper contributes the current linked transit-site count used in the bonus-value ladder and later building-density caps.","objdump + caller xrefs + callsite inspection + connection-bonus count correlation"
0x00427590,47,company_credit_rating_score_meets_threshold_5,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small boolean gate over the bounded company credit-rating score at `0x00425320`. The helper rejects immediately when scenario-state flag `0x006cec78+0x4a8b` is set or when the company-side count or age-like field `[this+0x5b]` has reached `0x14`; otherwise it computes the zero-argument credit-rating score and returns true only when the resulting integer value is at least `5`. Current grounded callers are `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050` and the neighboring branch around `0x004064a9`, so this is currently safest as a small reusable threshold gate over the same debt-market or company-strength score rather than a dedicated shell-only bond predicate.","objdump + caller xrefs + callsite inspection + credit-rating correlation + threshold-gate correlation"
0x00409e80,192,world_set_selected_year_and_refresh_calendar_presentation_state,simulation,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small world-side year setter beneath the periodic step family and the later world-entry staged-profile rehydrate band. The helper stores the caller-supplied selected absolute calendar counter at `[this+0x15]`, resolves the paired mixed-radix calendar-point tuple through `0x0051d460` into `[this+0x0d/+0x11]`, recomputes several derived year-fraction or presentation scalars rooted at `[this+0x0bfa]`, refreshes the live shell controller at `0x006d4024` through `0x0051f070`, `0x00527c70`, and `0x00527c20`, and updates the controller's cached doubled-year field at `[controller+0x2c]`. When the unpacked year field at `[this+0x0d]` actually changes it also re-enters `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`. Current grounded callers are the smaller periodic-step wrapper at `0x0040a150`, the larger simulation-advance family through `0x0040a590/0x0040ab50`, and the late staged-profile rehydrate lane inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared selected-year/calendar refresh helper rather than a one-off world-entry setter.","objdump + caller inspection + local disassembly + periodic-step correlation + world-entry rehydrate correlation + year-bucket-companion correlation + calendar-counter model correlation"
0x0040a590,892,simulation_service_periodic_boundary_work,simulation,cdecl,inferred,objdump + analysis-context,3,"Periodic simulation-maintenance dispatcher inside the world-step family. It switches on the local calendar or phase byte at [this+0x0f] routes one heavy mode through the larger recurring service branch at 0x0040a160 falls back to the simpler one-step advance at 0x00409e80 for other modes and runs several global manager sweeps across 0x0062be10 0x006ceb9c 0x006cfcbc 0x006cec20 and 0x0062bae0 before handing control back to the enclosing stepper. The pre-recipe scalar seam is tighter here now too: after the year and threshold refresh strip, the helper derives one bounded bucket from the selected-year gap `[world+0x0d] - [world+0x05]`, reads the corresponding float from the five-slot table `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, applies the later bucket-specific scale cuts, adds one fixed bias, and multiplies the running scalar `[world+0x0bde]` by that result before it refreshes the live company and profile collections. Its scenario-runtime handoff is now explicit too: the grounded calls at `0x0040a276`, `0x0040a55f`, `0x0040a6cb`, and `0x0040a7a3` re-enter `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kinds `1`, `0`, `3`, and `2` respectively. The route-style lane is tighter here now too: the neighboring recurring branch at `0x0040a91f` re-enters `placed_structure_collection_refresh_quarter_subset_route_style_state` `0x00413580`, then later drives the same runtime-effect collection loop with trigger kinds `5` and `4` at `0x0040a930` and `0x0040a9ac`. One conditional branch also re-enters shell_map_file_world_bundle_coordinator at 0x00445de0 which keeps the save-or-package family connected to the live simulation cadence.",objdump + analysis-context + caller xrefs + runtime-effect trigger-kind correlation + pre-recipe-scalar-table correlation
0x0040ab50,339,simulation_advance_to_target_calendar_point,simulation,cdecl,inferred,objdump + analysis-context,3,"Advances the active world state toward one caller-selected mixed-radix calendar target while guarded by the recursion counter at `0x0062b240`. The helper compares the current local calendar-point tuple fields `[this+0x0d]`, `[this+0x0f]`, `[this+0x11]`, and `[this+0x14]` against a target resolved through `0x0051d550` and `0x0051d5f0`, then either recurses in larger `0x168`-sized chunks or advances through the smaller periodic step family rooted at `0x00409e80` and `0x0040a9c0`. Current tuple evidence now bounds this as the same mixed-radix counter family used by `0x0051d3c0/0x0051d460`: a packed year-plus-subfield calendar point rather than a plain year or month-only target. Each successful step notifies the live world root at `0x0062c120` through `0x00450030`. Grounded callers include the frame-time accumulator at `0x00439140`, the larger fast-forward helper at `0x00437b20`, and one shell UI command path.","objdump + analysis-context + caller xrefs + calendar-counter model correlation"
0x0040aeb0,79,support_collection_construct_seed_counters_and_clear_large_sideband,map,thiscall,inferred,objdump + world-load correlation + local disassembly,3,"World-load constructor for the support family later published at `0x0062b244`. The helper seeds the indexed collection base through `0x00517ce0/0x00518570` with grounded parameters `(record_size=0, initial_slots=5, growth=0x0a, id_base=0)`, installs vtable `0x005c8a0c`, clears the large sideband rooted at `[this+0x90]`, seeds `[this+0x8c] = 0x270f` and `[this+0x88] = 0`, and then tails into `0x0040acb0` for the remaining local initialization. Current grounded caller is the world-load allocation strip inside `0x00438c70`, where the resulting object is stored into global `0x0062b244`.","objdump + world-load correlation + local disassembly + constructor-parameter reconstruction"
0x0040af00,146,support_collection_release_entry_and_decrement_world_type_counters,map,thiscall,inferred,objdump + world-shutdown correlation + local disassembly + field xrefs,3,"Per-entry release helper beneath the support collection rooted at `0x0062b244`. After resolving the live entry through `0x00518140`, the helper uses entry byte `[entry+0x261]` to choose which live world counter to decrement: nonzero entries decrement `[0x006cec78+0x4c9e]`, zero entries decrement `[0x006cec78+0x4c9a]`. Both counters are then clamped back to nonnegative. When the released entry matches the active world-view side subject at `[0x0062be68+0x60]`, the helper clears that focus through `0x004349f0(0, 0)` before releasing the entry's local runtime through `0x004584e0` and erasing it from the collection through `0x00518a30`. Current grounded caller is `support_collection_release_entries_and_collection_storage` `0x0040b720`, which uses this as the collection-side release callback on old-world teardown.","objdump + world-shutdown correlation + local disassembly + field xrefs + support-entry-release correlation"
0x0040b010,77,support_collection_find_first_live_entry_matching_stem_string,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small support-collection lookup helper over the fixed sideband at `[this+0x90]`. The helper scans up to `0x20` live `0x5c`-byte sideband rows, compares the caller-supplied zero-terminated stem against each row through `0x005a57cf`, and returns the first matching entry id by tail-calling `support_collection_allocate_entry_from_sideband_slot` `0x0040afa0` with the matching slot index. When no sideband row matches it returns `0`. Current grounded callers are the two goose-side owners `0x0040b0b0` and `0x0040b2d0`, both of which query the stem literal at `0x005c8a2c` `goose`.","objdump + caller inspection + local disassembly + sideband-layout correlation + stem-literal correlation"
0x0040b0b0,540,support_collection_try_spawn_goose_entry_in_primary_counter_lane,map,thiscall,inferred,objdump + caller inspection + local disassembly + stem-literal correlation,3,"Periodic support-entry owner beneath `simulation_advance_to_target_calendar_point` `0x0040ab50`. The helper rejects when scenario gate `[0x006cec78+0x46c38]` is live, derives one year-bucket quota from current year `[0x006cec78+0x0d]`, optionally scales that quota down for larger map areas from `[0x0062c120+0x2155/+0x2159]`, and then refuses to continue when the current live primary counter `[0x006cec78+0x4c9a]` already exceeds that quota. It next walks the collection sideband and selects the strongest empty `goose` row whose year window admits the current year, using one random threshold branch before the final choice. On success it materializes a live entry through `support_collection_allocate_entry_from_sideband_slot` `0x0040afa0`, increments `[0x006cec78+0x4c9a]`, seeds one world-space triplet from the selected entry through `0x00455800`, `0x00455810`, `0x0051b700`, and `0x00518de0`, and then forwards the finished local payload into the runtime-object collection at `0x006acd34` through `0x004554e0`. Current grounded caller is the year-step branch at `0x0040ab04`, where this owner runs beside the selector sibling `0x0040b2d0` and the collection-wide entry service pass `0x0040b060`.","objdump + caller inspection + local disassembly + stem-literal correlation + year-window correlation + counter-field correlation"
0x0040b2d0,675,support_collection_select_or_spawn_goose_entry_id,map,thiscall,inferred,objdump + caller inspection + local disassembly + command-caller correlation,3,"Selector-side sibling of `support_collection_try_spawn_goose_entry_in_primary_counter_lane` `0x0040b0b0`. The helper first rejects under the same scenario gate `[0x006cec78+0x46c38]`; when the caller-supplied force flag is clear it additionally requires live counter `[0x006cec78+0x4c9e] <= 0x60` and one random float branch against the caller-supplied threshold. It then resolves the first live `goose` sideband row through `support_collection_find_first_live_entry_matching_stem_string` `0x0040b010`, increments `[0x006cec78+0x4c9e]`, derives one world-space triplet and heading window from the created entry, and returns the selected live support-entry id to the caller after seeding the same runtime-object follow-on family. Current grounded callers are the shell focus command `shell_command_focus_subject_from_collection_0x62b244_via_selector_0x40b2d0` `0x00441360`, the matching command-registration branch at `0x0046461d`, and the periodic year-step lane at `0x0040ab12`, so this is the strongest current read for the support-side selector or spawn owner that feeds shell focus and open commands rather than a pure periodic spawner.","objdump + caller inspection + local disassembly + command-caller correlation + stem-literal correlation + counter-field correlation"
0x0040b5d0,199,support_collection_refresh_records_from_tagged_bundle,map,thiscall,inferred,objdump + world-load correlation + local disassembly + tag correlation,3,"Bundle-load sibling for the support family rooted at `0x0062b244`. The helper reads tagged sections `0x2af9/0x2afa/0x2afb` through repeated `0x00531360` calls, refreshes the collection-side metadata through `0x00518680`, and then walks every live entry, dispatching each record through entry vtable slot `+0x40` with the active bundle handle before closing the final tag. Current grounded callers are the world-entry runtime bringup strip `0x00443a50` and the neighboring tagged world-load family, where this support collection is rehydrated beside the region, territory, and event managers.","objdump + world-load correlation + local disassembly + tag correlation + per-entry-load correlation"
0x0040b6a0,118,support_collection_serialize_tagged_records_into_bundle,map,thiscall,inferred,objdump + package-save correlation + local disassembly + tag correlation,3,"Package-save sibling for the support family rooted at `0x0062b244`. The helper opens the three tagged sections `0x2af9/0x2afa/0x2afb` through repeated `0x00531340` calls, serializes the collection payload through `0x00517d90`, and then walks every live entry, dispatching each record through entry vtable slot `+0x44` with the active bundle handle before closing the final tag. Current grounded caller is `shell_map_file_world_bundle_coordinator` `0x00445de0`, which emits this family in the fixed package-save order.","objdump + package-save correlation + local disassembly + tag correlation + per-entry-save correlation"
0x0040b720,59,support_collection_release_entries_and_collection_storage,map,thiscall,inferred,objdump + world-shutdown correlation + local disassembly,3,"Release-side companion to `support_collection_construct_seed_counters_and_clear_large_sideband` `0x0040aeb0`. The helper reinstalls vtable `0x005c8a0c`, walks all live entries, releases each one through `0x0040af00`, re-enters `0x00518600`, and then tails into the common collection teardown `0x00518bd0`. Current grounded caller is the ordered world-root shutdown strip `0x00434300`.","objdump + world-shutdown correlation + local disassembly + companion correlation + live-entry-release sweep"
0x0040c950,18,placed_structure_construct_concrete_specialization_vtable_5c8c50,map,thiscall,inferred,objdump + allocator caller correlation + constructor chain inspection,2,"Small constructor thunk used by the shared placed-structure allocator `0x004134d0`. The helper first re-enters `0x0045b680`, which seeds the common placed-structure base table `0x005cb4c0`, clears the derived field band `[this+0x23a..+0x26a]`, and re-enters the older base initializer `0x00455610`; it then installs the concrete placed-structure specialization table `0x005c8c50` and returns `this`. Current grounded callers are the live allocator path at `0x004134d0` and the temporary stack-object path at `0x00413363`, so this is the safest current read for the concrete placed-structure constructor thunk beneath the shared placement family rather than a standalone helper object constructor.","objdump + allocator caller correlation + constructor chain inspection + vtable install correlation"
0x0040c970,11,placed_structure_reset_concrete_specialization_to_base_vtable_5cb4c0,map,thiscall,inferred,objdump + allocator caller correlation + destructor chain inspection,2,"Small cleanup or destructor-style thunk paired with `0x0040c950`. The helper briefly reinstalls the concrete specialization table `0x005c8c50`, then immediately tails into `0x0045b040`, which demotes the record back to the common base table `0x005cb4c0` and re-enters the base cleanup path `0x00455650`. Current grounded callers are the stack-object teardown sites at `0x00413363` and `0x0041353a`, both immediately before freeing or unwinding the temporary placed-structure object, so this is the safest current read for the specialization-to-base cleanup thunk rather than another constructor.","objdump + allocator caller correlation + destructor chain inspection + vtable demotion correlation"
0x0040c980,5,placed_structure_serialize_concrete_specialization_payload_via_0x45b560,map,thiscall,inferred,objdump + vtable scan + serializer chain inspection,2,"Tiny serializer thunk in the concrete placed-structure specialization table `0x005c8c50`. The helper simply tails into `0x0045b560`, which first re-enters the common base serializer `0x004559d0` and then emits the derived payload bracketed by tags `0x5dc1/0x5dc2` over fields `[this+0x23e]`, `[this+0x242]`, `[this+0x246]`, `[this+0x24e]`, and `[this+0x252]`. This is the safest current read for the specialization-side serializer entry rather than an independent data-writer.","objdump + vtable scan + serializer chain inspection"
0x0040cbc0,4,placed_structure_clear_shared_byte42_state_flag,map,thiscall,inferred,objdump + local disassembly,2,"Tiny raw setter over shared placed-structure byte `[this+0x42]`, storing literal `0`. The byte is also manipulated by the linked-peer route-entry toggle pair `0x0040dba0/0x0040dbf0` and read back through the raw getter `0x0040cbf0`, so this is the safest current read for the direct clear accessor over that shared site-state byte rather than a standalone semantic owner.","objdump + local disassembly + neighboring accessor correlation"
0x0040cbd0,4,placed_structure_set_shared_byte42_state_flag,map,thiscall,inferred,objdump + local disassembly,2,"Tiny raw setter over shared placed-structure byte `[this+0x42]`, storing literal `1`. The byte is also manipulated by the linked-peer route-entry toggle pair `0x0040dba0/0x0040dbf0` and read back through the raw getter `0x0040cbf0`, so this is the safest current read for the direct set accessor over that shared site-state byte rather than a standalone semantic owner.","objdump + local disassembly + neighboring accessor correlation"
0x0040cbe0,3,runtime_object_false_stub_vtable_5cfd00_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-false virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0040cbf0,5,placed_structure_query_shared_byte42_state_flag,map,thiscall,inferred,objdump + local disassembly,2,"Tiny raw getter over shared placed-structure byte `[this+0x42]`, zero-extending that byte into `EAX`. Current local evidence keeps this on the same byte-lane as the direct setters `0x0040cbc0/0x0040cbd0` and the linked-peer route-entry toggle pair `0x0040dba0/0x0040dbf0`, so this is the safest current read for the direct query accessor over that shared site-state byte.","objdump + local disassembly + neighboring accessor correlation"
0x0040cc00,6,runtime_object_true_stub_vtable_5cfd00_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-true virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0040cc10,3,placed_structure_specialization_false_stub_vtable_5c8c50_slot0,map,thiscall,inferred,objdump + vtable scan,1,"Tiny pure-false stub in the concrete placed-structure specialization table `0x005c8c50`. The helper clears `EAX` and returns immediately, with no field access or side effects. Current evidence only grounds it as one literal-false virtual slot beneath the specialization, so the note stays structural rather than semantic.","objdump + vtable scan"
0x0040cc20,3,placed_structure_specialization_false_stub_vtable_5c8c50_slot1,map,thiscall,inferred,objdump + vtable scan,1,"Second tiny pure-false stub in specialization table `0x005c8c50`. Like the neighboring false slots, it simply clears `EAX` and returns. Current evidence grounds this only as a literal-false virtual slot rather than a named predicate.","objdump + vtable scan"
0x0040cc30,3,placed_structure_specialization_false_stub_vtable_5c8c50_slot2,map,thiscall,inferred,objdump + vtable scan,1,"Third tiny pure-false stub in specialization table `0x005c8c50`. The helper only returns `0`, with no field reads or writes. Current evidence keeps the row at that structural predicate-slot level.","objdump + vtable scan"
0x0040cc40,32,placed_structure_subject_candidate_is_subtype1,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small shared candidate-profile predicate adjacent to the `0x005c8c50` specialization cluster. The helper follows candidate or profile id `[this+0x173]` through collection `0x0062b268`, reads candidate subtype byte `[candidate+0x32]`, and returns `1` only when that subtype equals `1`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where the returned boolean becomes one of the two mode inputs for `0x00415020`. This is the safest current read for a subtype-`1` predicate over the linked candidate/profile chain rather than a specialization-vtable slot.","objdump + caller inspection + local disassembly + candidate-subtype correlation"
0x0040cc60,26,placed_structure_subject_candidate_query_flag_byte_ba,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny shared candidate-profile accessor adjacent to the specialization cluster. The helper follows id `[this+0x173]` through candidate collection `0x0062b268` and returns byte `[candidate+0xba]`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where the byte is only used as a boolean mode input. Current evidence keeps the field at the raw candidate-byte level, so the note stays deliberately raw.","objdump + caller inspection + local disassembly + candidate-byte-field correlation"
0x0040cc80,42,placed_structure_subject_candidate_is_subtype1_class3,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared candidate-profile predicate over the same `[this+0x173] -> 0x0062b268` chain as `0x0040cc40`. The helper returns `1` only when candidate subtype byte `[candidate+0x32]` equals `1` and candidate class byte `[candidate+0x8c]` equals `3`. Current grounded caller is `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, where this branch helps select the flagged-region float-stat mode beneath `0x00415020`. This is the safest current read for the combined subtype-`1` plus class-`3` predicate rather than a direct specialization method.","objdump + caller inspection + local disassembly + candidate-subtype correlation + candidate-class correlation"
0x0040ccb0,14,placed_structure_has_cached_linked_site_id,map,thiscall,inferred,objdump + vtable scan + local disassembly,2,"Small specialization-side predicate over cached linked-site id `[this+0x2a8]`. The helper returns `1` when that dword is nonzero and `0` otherwise. Because it sits directly in the `0x005c8c50` vtable beside the linked-peer UI and route-anchor family, this is the safest current read for the specialization's cached-linked-site-id presence predicate rather than a broader linked-site resolver.","objdump + vtable scan + local disassembly + linked-site-field correlation"
0x0040ccc0,6,placed_structure_specialization_true_stub_vtable_5c8c50_slot,map,thiscall,inferred,objdump + vtable scan,1,"Tiny pure-true stub in specialization table `0x005c8c50`. The helper loads literal `1` into `EAX` and returns immediately. Current evidence keeps it at the literal-true virtual-slot level beneath the specialization.","objdump + vtable scan"
0x0040ccd0,30,world_grid_resolve_cell_pointer_by_xy_indices,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small world-grid address calculator over the live world root at `0x0062c120`. The helper multiplies the caller-supplied Y-like index by world width `[this+0x2145]`, adds the X-like index, scales the resulting linear slot by fixed cell stride `0x1d7`, and returns the corresponding cell pointer under base `[this+0x2129]`. Current grounded callers include the placed-structure cargo-service bitset sweep around `0x0042c386`, several world-grid or overlay-side passes at `0x004525bc..0x00452bb2`, and one later shell-side caller at `0x004df4d4`, so this is the safest current read for the shared `(x,y) -> world-cell*` resolver rather than an object-specific helper.","objdump + caller inspection + local disassembly + world-grid correlation + cell-stride correlation"
0x0040ccf0,23,placed_structure_query_linked_instance_candidate_class_byte,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small linked-instance candidate-class reader adjacent to the specialization cluster. The helper first resolves one linked instance through `0x0047de00`, then follows that instance's vtable `+0x80` owner chain, and finally returns candidate class byte `[candidate+0x8c]`. Current grounded callers include later world or UI-side branches at `0x00480fb5` and `0x004b03ce`, where the returned class is compared against `3` and `4`. This is the safest current read for a linked-instance candidate-class accessor rather than a general placed-structure vtable slot.","objdump + caller inspection + local disassembly + candidate-class correlation"
0x0040cd10,88,placed_structure_scan_center_cell_site_roster_when_shell_gate_enabled,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Gated center-cell site-roster sweep adjacent to the specialization cluster. The helper first requires shell or modal latch `[0x006cec74+0x1c3]` and creation-mode byte `[this+0x3d4] == 1`, then resolves the current subject's center world-grid cell through `0x00455f60`, reads the local roster count and packed site-id list at `[cell+0xeb]` and `[cell+0xef]`, and resolves each listed placed-structure id through collection `0x006cec20`. Current grounded caller is the broader collection walk at `0x00413860`, so this is the safest current read for a gated center-cell linked-site roster scan rather than another candidate predicate or direct vtable override.","objdump + caller inspection + local disassembly + center-cell roster correlation"
0x0040cd70,228,placed_structure_resolve_cached_source_and_candidate_ids_from_current_stem_or_warn,map,thiscall,inferred,objdump + local disassembly + string correlation + collection correlation,3,"Common specialization-side stem refresh helper beneath `0x0040ce60`. The helper clears cached ids `[this+0x3cc]` and `[this+0x3d0]`, scans source collection `0x0062b2fc` for a case-sensitive stem match against `[this+0x3ae]`, and on the first match stores the matched source id into `[this+0x3cc]` plus the corresponding candidate or profile id from `[source+0x173]` into `[this+0x3d0]`. When no source stem matches, it formats localized id `0x00ad` with the current stem buffer and publishes that warning through `0x0051e980`. Current local callers are the radio-stem canonicalizer `0x0040ce60` and the broader placed-structure constructor or geometry refresh family, so this is the safest current read for the cached source/candidate resolver beneath the `0x005c8c50` specialization rather than a generic geometry helper.","objdump + local disassembly + string correlation + collection correlation + cached-id-field correlation"
0x0040ce60,83,placed_structure_canonicalize_radio_station_stem_and_refresh_specialization_state,map,thiscall,inferred,objdump + local disassembly + string correlation,2,"Small specialization-side stem normalizer. The helper compares the site stem at `[this+0x3ae]` against the literal `Radio Station`, and when that compare matches it rewrites the same stem buffer to the compact form `RadioStation`. It then re-enters the common stem or geometry refresh helper `0x0040cd70` and the neighboring specialization-side follow-on `0x0045c150` with the caller-supplied stack argument. Current local evidence is strong enough to ground the `Radio Station -> RadioStation` normalization, but not the broader semantic role of the owning specialization table `0x005c8c50`, so this note stays narrow.","objdump + local disassembly + string correlation + neighboring specialization-method correlation"
0x0040cec0,18,placed_structure_resolve_cached_source_record_from_id3cc,map,thiscall,inferred,objdump + local disassembly,2,"Tiny cached-record resolver over source id `[this+0x3cc]`. The helper resolves and returns the corresponding entry through source collection `0x0062b2fc`. Current local callers sit on the `0x005c8c50` specialization side beside the stem refresh family, so this is the safest current read for the direct cached source-record resolver rather than another generic collection helper.","objdump + local disassembly + cached-id-field correlation"
0x0040cee0,18,placed_structure_resolve_cached_candidate_record_from_id3d0,map,thiscall,inferred,objdump + vtable scan + local disassembly,2,"Tiny cached-record resolver over candidate or profile id `[this+0x3d0]`. The helper resolves and returns the corresponding entry through collection `0x0062b268`. Because this function is itself a `0x005c8c50` vtable slot and directly follows the stem-refresh family, this is the safest current read for the specialization's cached candidate-record resolver rather than an unrelated collection bridge.","objdump + vtable scan + local disassembly + cached-id-field correlation"
0x0040cf00,527,placed_structure_build_secondary_specialization_transient_handle_with_four_slot_offsets,map,thiscall,inferred,objdump + local disassembly + transient-family correlation,2,"Heavier specialization-side transient build branch beneath the `0x005c8c50` table. The helper first requires creation-mode byte `[this+0x3d4] == 1` and live transient seed `[this+0x24e]`, then re-enters the neighboring cleanup gate `0x0045b370(1)`, derives one scaled float from current local geometry through `[this+0x14]`, `[this+0x21]`, `[this+0x3a]`, and the constant at `0x005c8cf4`, and allocates one new handle through `0x00475ed0` into `[this+0x25a]`. It then resolves a current world-position tuple through `0x00414450` and `0x0052e720`, publishes several local offset triplets through `0x00475010`, and configures four numbered channels on the new handle through `0x00475030` with selector ids `1..4`. Current evidence carries this row conservatively as the second transient-handle builder in the same specialization-side payload family as `0x0045c310/0x0045b210`.","objdump + local disassembly + transient-family correlation + geometry-derived offset correlation"
0x0040d170,56,placed_structure_build_primary_specialization_transient_when_candidate_flag4b_enabled,map,thiscall,inferred,objdump + local disassembly + candidate-flag correlation,2,"Small specialization-side hook that conditionally builds the primary transient handle through `0x0045c310`. The helper resolves the current candidate from cached stem id `[this+0x3cc]`, follows that candidate's profile or source id through `[entry+0x173]`, and reads dword flag `[candidate+0x4b]`. When that flag is nonzero it tail-calls `placed_structure_specialization_build_primary_transient_handle_from_payload_strings` `0x0045c310`; otherwise it returns immediately. This is the strongest current owner for the candidate-flag-gated primary transient build hook in the `0x005c8c50` specialization family.","objdump + local disassembly + candidate-flag correlation + transient-build correlation"
0x0040d1b0,56,placed_structure_release_primary_specialization_transient_when_candidate_flag4b_enabled,map,thiscall,inferred,objdump + local disassembly + candidate-flag correlation,2,"Release-side companion to `0x0040d170`. The helper resolves the same candidate chain from cached stem id `[this+0x3cc]`, reads dword flag `[candidate+0x4b]`, and when that flag is nonzero tail-calls `placed_structure_specialization_release_primary_transient_handle_and_siblings` `0x0045c3c0`; otherwise it returns immediately. Current evidence grounds this as the candidate-flag-gated release hook for the primary specialization transient rather than a generic cleanup entry.","objdump + local disassembly + candidate-flag correlation + transient-release correlation"
0x0040d1f0,23,placed_structure_resolve_linked_peer_record_from_cached_site_id,map,thiscall,inferred,objdump + local disassembly,3,"Tiny cached-record resolver over linked site id `[this+0x2a8]`. When that id is nonzero the helper resolves and returns the linked placed-structure record through collection `0x006cec20`; otherwise it returns null. Current grounded callers include the contextual status publisher `0x0040e4e0` and the linked-anchor service family, so this is the safest current read for the direct linked-peer resolver rather than another boolean gate.","objdump + local disassembly + linked-peer resolver correlation"
0x0040d210,26,placed_structure_resolve_owner_record_from_cached_owner_id,map,thiscall,inferred,objdump + local disassembly,2,"Tiny cached-record resolver over owner id `[this+0x276]`. When that id is nonzero the helper resolves and returns the corresponding record through collection `0x0062be10`; otherwise it returns null. Current local callers sit on the UI-facing specialization side near `0x0040e9d0`, so the safest current read is one direct owner-record resolver rather than a wider ownership test.","objdump + local disassembly + owner-resolver correlation"
0x0040dc40,1047,placed_structure_validate_station_detail_aux_candidate_action_and_optionally_apply_linked_site_mutation,map,thiscall,inferred,objdump + local disassembly + caller correlation + callsite inspection,4,"World-side validator and optional commit owner beneath the lower `StationDetail.win` action band. The helper first requires the current linked peer id `[this+0x2a8]` to resolve and pass `placed_structure_is_station_or_transit_site_class` `0x0047fd50`, then resolves the auxiliary candidate id from `0x0062b2fc`, the linked candidate root from `0x0062b268`, and computes one projected float cost scalar from candidate field `[candidate+0x22]`, the current owner company at `[this+0x276]`, current site coordinates through `0x00455800/0x00455810`, world scalar query `0x0044ad60`, and scenario-side scale owner `0x00436590(0x3b, ...)`. When the caller supplies the optional float out-pointer, that scalar is returned there. When the caller supplies the optional notice sink and the current owner company exists, the helper compares that scalar against company metric `(0x0d, 0x2329)` through `0x0042a5d0`; on failure it formats localized notice `0x0b52` through `0x005193f0` and returns failure without mutating local runtime state. The success-side path is tighter too: it derives projected offsets from the linked peer through `0x0047df30/0x0047df50`, materializes a packed projected cell list through `0x00417840`, replays that list into compact-grid mode `2` around `placed_structure_validate_projected_candidate_placement` `0x004197e0`, and then restores the temporary compact-grid bits through `0x004142c0/0x004142d0`. When placement fails it returns false; when placement succeeds and the optional notice sink is null it commits the linked-site mutation through `0x0040d1f0`, `0x00480710`, transient teardown or rebuild `0x0045b160/0x0045b9b0`, display-name or source refresh `0x00455750/0x0040cd70`, and local-runtime record rebuild `0x00418be0`, then posts the signed scalar into the owner company through `0x0042a040` and accumulates the running total in `[this+0x27a]`. Even on the validate-only path it still republishes the linked site anchor through `0x0040d1f0 -> 0x00480710` when the caller requested the confirmation-modal preview branch. Current grounded caller is the lower action dispatch inside `shell_station_detail_window_handle_message` `0x00505e50`.","objdump + local disassembly + caller correlation + callsite inspection + affordability-notice correlation + projected-placement correlation + linked-site-mutation correlation"
0x0040d230,60,placed_structure_has_linked_station_or_transit_peer,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Boolean linked-peer gate over one placed structure. The helper first requires the placed-structure vtable `+0x70` latch, then resolves optional linked site id `[this+0x2a8]` through the live placed-structure collection `0x006cec20`, and finally re-enters `placed_structure_is_station_or_transit_site_class` `0x0047fd50` on that linked peer. Current local callers include the broader `cargo id 0` bypass family and several neighboring linked-site maintenance branches, so this is the safest current read for the narrower linked-peer station-or-transit gate rather than a cargo-reference helper.","objdump + caller xrefs + local disassembly + linked-peer gate correlation"
0x0040d2d0,128,placed_structure_refresh_linked_peer_overlay_when_linked_peer_flagged,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Linked-peer visual or state refresh beneath the broader placed-structure rebuild family. The helper first re-enters placed-structure vtable `+0x54` with stack argument `0`, then requires scenario latch `[0x006cec78+0x4ae7]`, the placed-structure vtable `+0x70` linked-site-capable latch, and the narrower linked-peer class gate `0x0047fd50` over optional linked site id `[this+0x2a8]`. When the resolved linked peer carries nonzero byte `[peer+0x5bc]`, it re-enters placed-structure vtable `+0x58` on the current site with literal arguments `(0x5f, 0x5f, 0xff)`. Current grounded caller is `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, so this is the safest current read for a linked-peer-dependent overlay or status refresh rather than a cargo-side helper.","objdump + caller xrefs + local disassembly + linked-peer flag correlation"
0x0040d350,16,placed_structure_query_linked_instance_candidate_flag_byte_b9,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Tiny linked-instance candidate-field accessor adjacent to the linked-site helpers. The helper resolves one linked instance through `0x0047de00`, follows that instance's vtable `+0x80` owner chain, and returns signed candidate byte `[candidate+0xb9]`. Current grounded caller is the collection-side subtype-`4` sweep `0x00413b40`, where the returned byte is only tested against zero, so the note stays deliberately raw rather than overnaming candidate byte `0xb9`.","objdump + local disassembly + caller correlation + candidate-byte-field correlation"
0x0040d360,22,placed_structure_subject_candidate_is_subtype4,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small shared candidate-profile predicate adjacent to the linked-site helper strip. The function resolves the current subject's candidate through vtable slot `+0x80`, reads subtype byte `[candidate+0x32]`, and returns `1` only when that subtype equals `4`. Current grounded callers are the broader collection-side sweeps `0x00413750` and `0x00413b40`, so this is the safest current read for a subtype-`4` predicate over the current placed-structure subject rather than another specialization method.","objdump + local disassembly + caller correlation + candidate-subtype correlation"
0x0040e080,432,placed_structure_release_local_runtime_and_unlink_linked_site_followon_state,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Broader placed-structure release-side helper beneath the collection remove path. The function first resolves the current candidate through vtable slot `+0x80`; when subtype byte `[candidate+0x32]` equals `4` it removes the current site id `[this+0x2a4]` from proximity-bucket collection `0x006cec20` through `0x004814c0`. It then re-enters the placed-structure vtable `+0x70` latch and, when local mode byte `[this+0x3d4]` equals `1`, performs the linked-site cleanup follow-on: it resolves the specialization-side local record through `0x00455f60`, walks the linked peer-id roster at `[record+0xef]`, removes the current site id from each peer through `0x0047d810`, optionally resolves owner record `[this+0x276]` through collection `0x0062be10`, derives one signed scalar from `[this+0x27a]` plus candidate fields `[candidate+0x22/+0x43]`, and posts paired company-stat deltas through `0x0042a040` and `0x0042a080`. The tail also notifies the live route-link collection `0x006ada90` through `0x004681f0` when present. Current grounded caller is `placed_structure_collection_remove_entry_by_id_release_local_runtime_and_unlink` `0x00413550`, so this is the safest current read for the placed-structure release-and-unlink side owner rather than a generic destructor leaf.","objdump + local disassembly + caller correlation + linked-site cleanup correlation + company-stat correlation + proximity-bucket correlation"
0x0040dba0,66,placed_structure_clear_linked_route_entry_state_byte_and_dispatch_unbound_anchor_toggle,map,thiscall,inferred,objdump + caller xrefs + local disassembly + rdata method-table scan,2,"Small linked-site route-entry state helper. The function first requires the placed-structure vtable `+0x70` linked-site-capable latch, then resolves optional linked site id `[this+0x2a8]` through the placed-structure collection `0x006cec20`, forwards the resulting linked peer (or null) plus literal stack flag `1` into `0x0047dda0`, and finally clears local byte `[this+0x42]` to `0`. Current local callers are neighboring placed-structure maintenance branches, and the paired companion at `0x0040dbf0` performs the same route-entry dispatch with the opposite literal and byte writeback. A local `.rdata` scan now tightens the owner split too: `0x0040dba0` and `0x0040dbf0` each appear exactly once, together with getter `0x0040cbf0`, in one concrete placed-structure specialization table rooted at `0x005c8c50`, so this is now the safest current read for one half of a specialization-specific linked-site route-entry state toggle pair rather than a generic family-wide setter.","objdump + caller xrefs + local disassembly + linked-route-entry-toggle correlation + rdata method-table correlation + constructor-chain correlation"
0x0040dbf0,65,placed_structure_set_linked_route_entry_state_byte_and_dispatch_unbound_anchor_toggle,map,thiscall,inferred,objdump + caller xrefs + local disassembly + rdata method-table scan,2,"Companion linked-site route-entry state helper paired with `0x0040dba0`. The function first requires the placed-structure vtable `+0x70` linked-site-capable latch, resolves optional linked site id `[this+0x2a8]` through the placed-structure collection `0x006cec20`, forwards the resulting linked peer (or null) plus literal stack flag `0` into `0x0047dda0`, and finally sets local byte `[this+0x42]` to `1`. Current local callers are neighboring placed-structure maintenance branches. A local `.rdata` scan now shows that this paired override appears only in the same concrete placed-structure specialization table at `0x005c8c50` as `0x0040dba0` and `0x0040cbf0`, which keeps this on the specialization-specific linked-site route-entry side rather than on one generic shared-byte setter lane.","objdump + caller xrefs + local disassembly + linked-route-entry-toggle correlation + rdata method-table correlation + constructor-chain correlation"
0x0040e360,235,placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Subtype-specific local-runtime follow-on beneath `0x0040eba0` and `0x0040ee10`. The helper resolves the current placed structure's candidate from `[this+0x3cc]` through `0x0062b2fc` and `0x0062b268`, requires subtype byte `[candidate+0x32] == 1` plus candidate class byte `[candidate+0x8c] == 3`, then requires a linked site id at `[this+0x2a8]`. When the linked peer exists and its route-entry anchor at `[peer+0x08]` is live in collection `0x006cfca8`, the helper samples one anchor-side float through `0x0048aab0`, subtracts the fixed offset at `0x005c8738`, combines that result with the current placed structure's coordinate pair through `0x00455810` and `0x00455800`, and publishes the resulting triplet through the shared position setter `0x00530720`. Current grounded caller is the broader local side helper `0x0040ee10`, plus the heavier subtype-driven refresh path at `0x0040eba0`, so this is now the safest current read for the linked-site anchor position-triplet refresh beneath the placed-structure local-runtime family rather than a generic route query.","objdump + caller inspection + local disassembly + linked-site-anchor correlation + local-runtime correlation"
0x0040e450,131,placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small wrapper that rebuilds one placed structure's cloned local-runtime record from its current candidate stem and cached profile slot. The helper copies the current stem string from the candidate referenced by `[this+0x3cc]`, resolves the matching live candidate id through `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, seeds the projected-rectangle profile-slot cache from `[this+0x252]` through `placed_structure_cache_projected_rect_profile_slot_id` `0x00414470`, and then re-enters `placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds` `0x00418a60` with the current placed-structure pointer. It stores the returned cloned record into `[this+0x24e]`, refreshes the local cached profile slot from `[record+0x732]` into `[this+0x252]`, and ties the clone back to the owning placed structure through `[record+0x73a] = this`. Current grounded caller is the collection-wide wrapper `0x004133b0`, so this now reads as the cloned local-runtime rebuild helper for one live placed structure rather than an unowned stem lookup.","objdump + caller inspection + local disassembly + local-runtime-clone correlation + projected-rect-profile correlation"
0x0040e4e0,921,placed_structure_publish_contextual_status_text_for_linked_peer_and_selection_state,map,thiscall,inferred,objdump + local disassembly + localization-call correlation,2,"Large contextual status-text publisher in the same concrete placed-structure specialization family rooted at `0x005c8c50`. The helper first requires creation-mode byte `[this+0x3d4] == 1`, the specialization's linked-site-capable vtable `+0x70` latch, and several shell or modal gates under `0x006d1a8c` and `0x006d12f0`; it then branches across linked-peer checks through `placed_structure_has_linked_station_or_transit_peer` `0x0040d230`, world-mode fields `[0x0062c120+0x2171/+0x2175/+0x2179/+0x2181]`, current owner checks through `0x004337a0`, and candidate or linked-peer display-name lookups through `0x0051c920`. The resulting text is localized through ids such as `0x00af`, `0x00b0`, `0x00b1`, `0x00b2`, `0x00b3`, and `0x0afd`, assembled through `0x00518de0`, and finally pushed into the shell presenter `0x00538c70` with mode `3`. Several branches also trigger world-side follow-ons through `0x00452db0` and `0x00452fa0`, so this is best read as a contextual linked-peer or selection-status publisher with mode-specific side effects rather than a pure formatter.","objdump + local disassembly + localization-call correlation + linked-peer gate correlation + shell-presenter correlation"
0x0040e880,329,placed_structure_dispatch_primary_context_action_and_reset_status_presenter,map,thiscall,inferred,objdump + local disassembly + linked-peer gate correlation,2,"Primary context-action dispatcher paired with `placed_structure_publish_contextual_status_text_for_linked_peer_and_selection_state` `0x0040e4e0`. The helper first resets the active shell presenter through `0x00538c70` using the fixed token rooted at `0x005c87a8`, then reuses the same linked-site-capable vtable `+0x70` latch, creation-mode byte `[this+0x3d4] == 1`, linked-peer path `0x0040d230 -> 0x0047f310 -> 0x0048b660`, and world-mode gates `[0x0062c120+0x2175/+0x2179/+0x2181]` to dispatch one of several follow-ons including `0x00413620`, `0x00453510`, `0x00452db0`, and `0x00452fa0`. Current evidence grounds this as the specialization-side primary action or activation dispatcher that accompanies the contextual status publisher, not as another local-runtime refresh helper.","objdump + local disassembly + linked-peer gate correlation + shell-presenter correlation + world-mode branch correlation"
0x0040e9d0,464,placed_structure_format_context_label_or_owner_name_for_ui_query,map,thiscall,inferred,objdump + local disassembly + string correlation,2,"Query-style label formatter in the same specialization table `0x005c8c50`. The helper first short-circuits when vtable slot `+0x14` says the current object should not answer, then chooses between three outcomes: when shell branch `[0x006cec74+0x74]` is live it formats one localized label through id `0x00b4`, appends the fixed suffix `\\nAbsIndex %d`, copies that text into the caller buffer through `0x0051d8a0`, and returns `1`; under a narrower owner or company-state path gated by `[this+0x276]`, shell mode `[0x006cec74+0x253]`, the linked-site latch, and the active modal state at `0x006d12f0`, it resolves one company-side display label through `0x00426b10`, stores it through the caller out-pointer, and returns `2`; otherwise it falls back to `0x00455860`. This is therefore the safest current read for a specialization-side UI label or owner-name query wrapper rather than another action dispatcher.","objdump + local disassembly + string correlation + ui-query correlation"
0x0040eba0,620,placed_structure_set_world_coords_and_refresh_local_runtime_side_state,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Heavier placed-structure world-coordinate mutation helper above the local-runtime side refresh family. The function updates the current record's world position through `0x00455860`, recomputes cached grid coordinates `[this+0x388]` and `[this+0x38c]`, and rewrites the world-grid owner mapping through `0x0042c9f0` and `0x0042c9a0`. On the candidate subtype-`4` branch it also removes and then re-appends the current site to the nearby-transit proximity bucket family through `placed_structure_collection_remove_site_id_from_all_proximity_bucket_lists` `0x004814c0` and `placed_structure_collection_append_site_into_all_proximity_bucket_lists` `0x00481480`. After that it rebuilds the same local position or scalar triplet family later serviced by `0x0040ee10`, caches the accepted scalar pair in `[this+0x392]` and `[this+0x396]`, publishes the chosen triplet through the shared setter `0x00530720`, optionally refreshes the linked peer route-entry anchor through `0x00480710`, and finally tails into `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`. Current grounded callers include the broader rebuild paths `0x0040ef10` and `0x0040f6d0`, later site-mutation branches `0x00419110`, `0x0046ef40`, `0x004707da`, and `0x00473bf0`, plus shell-side subject updates around `0x00507cf0` and `0x00508bb0`, so this is now the safest current owner for world-coordinate updates plus local-runtime side-state refresh rather than a generic movement helper.","objdump + caller inspection + local disassembly + world-coordinate mutation correlation + local-runtime correlation + proximity-bucket correlation"
0x0040ee10,248,placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small placed-structure local-runtime side refresh over one live record. The helper samples the current structure coordinate pair through `0x00455800` and `0x00455810`, converts that pair through the basis at `0x006d4024`, `0x0051f090`, and `0x00534490` into one base scalar, and then conditionally adjusts that scalar when the linked candidate-side structure record keeps nonzero byte `[candidate+0xba]` via the rounded world-grid sampler `0x0044ae40` and the fixed subtractive offset at `0x005c8840`. When the auxiliary preview owner gate `shell_has_auxiliary_preview_owner` `0x00434050` is active, it rounds that scalar to an integer float. It then publishes the resulting position triplet through the shared setter `0x00530720` and tails into `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`. Current grounded callers are the collection-wide local-runtime refresh wrapper `0x004133b0` and the connected-component recursion tail `placed_structure_recursive_collect_connected_component_tile_bounds` `0x00415f20`, so this is now the strongest current owner for the per-site local-runtime position-triplet refresh rather than a generic coordinate helper.","objdump + caller inspection + local disassembly + local-runtime correlation + connected-component correlation"
0x0040ef10,1984,placed_structure_finalize_creation_or_rebuild_local_runtime_state,map,thiscall,inferred,objdump + caller inspection + placement and mutation correlation,3,"Broad placed-structure post-create or post-edit rebuild above the narrower route-style lane. The helper validates several linked-site and world-state preconditions before keeping the current site live, increments the global live-site count at `0x0062be40`, seeds runtime mode and year fields at `[this+0x390]`, `[this+0x3d4]`, and `[this+0x3d5]`, refreshes the adjacent site-status or overlay family through `0x0040d2d0`, and rebuilds one larger local owner or service bundle through `0x00418be0`, `0x0040eba0`, and the scalar-staging family `0x00475ed0` / `0x00474fe0` / `0x00475010` / `0x00475030` into fields such as `[this+0x24e]`, `[this+0x252]`, `[this+0x25a]`, and `[this+0x25e]`. Later in the same body it re-enters `0x0040db30`, and when the local latch at `[this+0x29e]` is still zero it also re-enters `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `1`. The tail is tighter now too: when creation-mode byte `[this+0x3d4]` equals `1`, the branch at `0x0040f692` triggers `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `6` just before the local live-site follow-on at `0x433b80`. Current grounded callers include the placement-side builders at `0x00403ef3` and `0x00404489`, later site-mutation paths at `0x0046f073` and `0x004707ff`, and one train-side site operation at `0x005098eb`, so this now looks like the broad post-create or post-edit runtime rebuild above route-style scoring and peer-link emission rather than a route-style-only helper.","objdump + caller inspection + placement and mutation correlation + route-style rebuild correlation + runtime-effect trigger-kind correlation"
0x0040f6d0,891,placed_structure_construct_entry_from_candidate_and_world_args,map,thiscall,inferred,objdump + constructor inspection + caller correlation,3,"Lower constructor beneath the shared placed-structure allocator at `0x004134d0`. The helper writes the new placed-structure id into `[this+0x2a4]`, clears a large band of local runtime fields, copies the candidate stem or label payload from the caller-supplied construction scratch record, initializes local world geometry through `0x0040cd70`, `0x0045b9b0`, `0x00455750`, and `0x00455720`, quantizes the input coordinates into the cached grid terms at `[this+0x388]` and `[this+0x38c]`, seeds the current scenario year into `[this+0x3d5]`, and initializes the class-weight lanes near `[this+0x28a]` from the linked candidate vtable owner. It then zeroes the local route-style and service-score bands, conditionally builds the first local owner or service record through `0x00418be0` and `0x0040eba0`, resolves the initial linked site id at `[this+0x2a8]` through `0x00481390` when the backing candidate subtype byte `[candidate+0x32]` is `1`, seeds region linkage through `0x0044a800` and `0x0041f7e0`, optionally re-enters `0x0040db30` for subtype `4`, and finally seeds the trailing random-like dwords at `[this+0x3d9]` and `[this+0x3dd]` from `0x518d70`. Current grounded caller is `placed_structure_collection_allocate_and_construct_entry` `0x004134d0`, so this is now the concrete placed-structure constructor rather than an anonymous lower helper beneath the placement-side builders.","objdump + constructor inspection + caller correlation + placed-structure runtime-state correlation"
0x0040fbe0,224,placed_structure_endpoint_pair_has_shared_route_entry_key,map,thiscall,inferred,objdump + caller inspection + world-grid chain comparison,3,"Boolean peer-test between one placed structure and one caller-supplied peer site id. The helper converts the current site and the peer site into their derived world-grid owner records through `0x00455800`, `0x00455810`, the world-grid tables rooted at `[0x0062c120+0x2129]`, and the placed-structure resolver `0x0040fa50`. It then compares the two route-entry chains rooted at `[cell+0x0ef]`, using the chain lengths at `[cell+0x0eb]`, and returns `1` on the first shared leading `u16` route-entry key; otherwise it returns `0`. Current grounded callers are the route-link emitter at `0x0040fef0`, where it blocks duplicate endpoint pairing before `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50`, and the neighboring cleanup sweep at `0x0040d2aa`, where it decides whether an existing site-owned route-link should be erased. This now looks like the shared duplicate-or-overlap test for the route-link family rather than a generic proximity check.","objdump + caller inspection + world-grid chain comparison + route-link duplicate-check correlation"
0x0040fef0,752,placed_structure_try_emit_best_route_style_peer_link_for_candidate_class,map,thiscall,inferred,objdump + caller inspection + placed-structure sweep inspection,3,"Scans the live placed-structure collection for one best peer site and emits a missing route-link for one caller-selected candidate class when a qualifying endpoint pair survives. The helper first derives one distance cap from the current placed-structure population size at `0x0062b26c`, scales that cap by the caller-supplied float, and then walks the live placed-structure ids in a wrapped pseudo-random order. Candidate peers must have a positive class-specific weight in the placed-structure lane `[peer+class*4+0x27e]`, differ from the source site, pass the linked-instance class gate `0x0040c990 == 1`, and lie inside the chosen distance window after the coordinate and span checks built from `0x00455800`, `0x00455810`, `0x00455f60`, and nearby math helpers. The strongest surviving peer is kept through a weighted comparison, and if one remains the helper re-enters `placed_structure_endpoint_pair_has_shared_route_entry_key` `0x0040fbe0`; only when that duplicate check fails does it call `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50` with the source site id from `[this+0x2a4]`, the chosen peer id, and the same candidate-class argument. Current grounded callers are the larger per-site world pass around `0x00410665` and the route-style grid contribution branch at `0x0042cafe`, so this now looks like the current peer-selection emitter for site-owned route-style links rather than a low-level allocator wrapper.","objdump + caller inspection + placed-structure sweep inspection + route-link emission correlation"
0x004101e0,6843,placed_structure_rebuild_route_style_candidate_scores_and_peer_links,map,thiscall,inferred,objdump + caller inspection + route-style emission correlation,3,"Large per-site rebuild pass above the route-style link emitter. The helper first requires the current placed structure to pass the linked-instance class gate `0x0040c990 == 1` and several scenario-state gates rooted at `0x006cec78` and `0x006cec7c`, then derives one set of per-class route-style score scalars from the current site's local state, scenario opinion multipliers through `0x00436590`, year-dependent dampers, and the placed-structure class-weight lanes near `[this+0x28a]`. The early compatibility side is tighter now too: it probes the current placed-structure stem against `Nuclear Power Plant`, `Electric Plant`, and `Recycling Plant`, stages three local boolean latches from those matches, and then clears the `Recycling Plant` latch again when the shared build-version query `0x00482e00` reports below `0x68` (`1.04`), so that stem-specific branch is now bounded as a post-`1.04` compatibility lane rather than one timeless route-style rule. For the first three route-style classes it conditionally re-enters `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0` with the caller-supplied mode flag and one computed float score. The function then continues into a larger descriptor-driven scoring phase over the current candidate's runtime descriptor array at `[candidate+0x37]`, building temporary score bands and normalizing them against the same local totals before later write-back. That later phase has another bounded version gate: on one descriptor-accumulation subbranch the helper consults `0x00482e00` again at `0x41109f`, and build `1.05+` (`>= 0x69`) skips one older fallback attenuation path that earlier builds still apply through the local multiplier tables. Current grounded callers are the local per-site branch at `0x0040f640`, which reaches it with stack flag `1`, and the broader placed-structure sweep at `0x004135e3`, which reaches it with stack flag `0`; this is therefore the strongest current owner for route-style candidate scoring and peer-link emission on one live placed structure rather than a narrow one-off helper.","objdump + caller inspection + route-style emission correlation + descriptor-loop inspection + version-gate correlation + stem-probe correlation"
0x004134d0,112,placed_structure_collection_allocate_and_construct_entry,map,thiscall,inferred,objdump + caller xrefs + constructor inspection,3,"Shared direct placement helper above the broader placed-structure runtime rebuild. The helper first obtains one temporary `0x3e1`-sized construction scratch object through `0x53b070` and `0x0040c950`, then allocates one live placed-structure entry from the current collection through `0x518900`, resolves the new record through `0x518140`, and finally re-enters the lower constructor at `0x0040f6d0` with the new entry id plus the caller-supplied coordinate and candidate payload tuple. Current grounded callers include the candidate-placement branches at `0x00403ed5`, `0x0040446b`, and `world_region_try_place_candidate_structure` `0x00422ee0`, plus later mutation or editor-side branches at `0x0046efbf`, `0x0047074b`, `0x00472bef`, `0x00472d03`, and `0x00508fd1`. This now looks like the shared placed-structure allocator and constructor entrypoint beneath the placement-side builders rather than a route-style-specific helper.","objdump + caller xrefs + constructor inspection + placement correlation"
0x00413550,32,placed_structure_collection_remove_entry_by_id_release_local_runtime_and_unlink,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small collection-side removal helper for the live placed-structure collection. It resolves the caller-supplied site id through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, re-enters `0x0040e080` to release the subject's local runtime and linked side state before removal, and then removes the id from the collection through `0x00518a30`. Current grounded caller is the broader placed-structure mutation branch at `0x00419110`, so this is the narrow remove-and-release sibling beneath the shared placed-structure collection family rather than a generic collection erase helper.","objdump + local disassembly + caller correlation + collection-removal correlation"
0x00413620,56,placed_structure_collection_refresh_linked_peer_overlay_when_linked_peer_flagged,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide sweep over the live placed-structure store that simply re-enters `placed_structure_refresh_linked_peer_overlay_when_linked_peer_flagged` `0x0040d2d0` for every live record. The helper walks every live entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, forwarding each record into the narrower linked-peer overlay refresh helper. Current grounded callers are the world-side preview linked-site setter `0x00452db0`, the broader preview or tool mode switch owner `0x00452fa0`, the specialization action dispatcher `0x0040e880`, and StationPlace cleanup `0x005079c0`, so this is the safest current read for the collection-side linked-peer overlay refresh sweep rather than another anonymous iterator.","objdump + local disassembly + caller correlation + collection-sweep correlation + linked-peer-overlay correlation"
0x00413660,117,placed_structure_collection_publish_owner_match_color_through_vtable_slot_0x58,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Collection-wide color-publish sweep over live placed structures keyed by one caller-supplied owner id. For each live entry, the helper reads owner field `[site+0x276]`; when that field is nonzero it compares it against the caller argument, converts the boolean result into a packed color through `0x0051dfc0`, and forwards the split RGB lanes into placed-structure vtable slot `+0x58`. Current local evidence grounds this as a collection-side owner-match color sweep rather than a linked-site or route-style helper, so the note stays deliberately structural.","objdump + local disassembly + caller correlation + owner-field correlation + color-publish correlation"
0x004136e0,112,placed_structure_collection_publish_scaled_candidate_field_0x3f_through_vtable_slot_0x54_for_nonlinked_entries,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Collection-wide scalar-publish sweep over the live placed-structure store. The helper skips entries whose vtable `+0x70` linked-site-capable latch is nonzero, then resolves the current candidate through vtable slot `+0x80`, keeps only entries with nonzero dword `[candidate+0x3f]`, derives one float through `0x0040fcc0`, quantizes it through `0x0051dfc0`, and forwards the resulting scalar into placed-structure vtable slot `+0x54`. Current local evidence grounds this as a non-linked-entry candidate-field scalar publish sweep rather than a narrower status or cargo helper.","objdump + local disassembly + caller correlation + candidate-field correlation + scalar-publish correlation"
0x00413750,256,placed_structure_collection_refresh_mode3_or_mode6_linked_site_preview_membership,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide owner for the shared linked-site preview membership sweep used by the world-side preview families. The helper walks every live placed structure through the indexed-collection accessors and then splits by candidate subtype. On the subtype-`4` branch it requires `placed_structure_subject_candidate_is_subtype4` `0x0040d360`, tests the current site id `[site+0x2a4]` against the caller-supplied linked-site token through `0x00481500`, and then either activates the site through vtable slot `+0x54` with scenario scalar `[0x006cec78+0x66ba]` or clears it through vtable slot `+0x58(0,0,0)`. On the non-subtype-`4` branch it resolves the current center world-grid cell through `world_region_resolve_center_world_grid_cell` `0x00455f60`, scans the six-byte site roster at `[cell+0xeb/+0xef]`, optionally filters that roster by the caller-supplied token, keeps the smallest float lane from each matching row, and activates the site through vtable slot `+0x54` when a match survives; otherwise it tails into `placed_structure_refresh_linked_peer_overlay_when_linked_peer_flagged` `0x0040d2d0`. Current grounded callers are the preview linked-site setter `0x00452db0` and the broader preview or tool mode switch owner `0x00452fa0`, so this is the safest current read for the collection-side mode-`3/6` linked-site preview membership refresh rather than a plain id-indexed lookup.","objdump + local disassembly + caller correlation + preview-mode correlation + center-cell-roster correlation + subtype4 correlation"
0x00413860,72,placed_structure_collection_scan_center_cell_site_rosters_when_shell_gate_enabled,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide sweep over the live placed-structure store that simply re-enters `placed_structure_scan_center_cell_site_roster_when_shell_gate_enabled` `0x0040cd10` for every live record. The helper first checks shell latch `[0x006cec74+0x1c3]`, then walks every live entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, forwarding each record into the narrower center-cell roster scan. Current grounded callers are the zero-depth optional collection-refresh dispatcher `0x00433b80` and the broader post-load collection families around `0x004384d0`, so this is the clearest current owner for the collection-side linked-site center-cell roster sweep rather than another anonymous refresh stub.","objdump + local disassembly + caller correlation + collection-sweep correlation + center-cell-roster correlation"
0x004138b0,62,placed_structure_collection_remove_route_links_for_sites_whose_center_cell_roster_contains_u16_token,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide route-link cleanup sweep over the live placed-structure store keyed by one caller-supplied `u16` token. The helper walks every live entry through the indexed-collection accessors and re-enters `0x0040d270` on each record. That narrower helper resolves the current center world-grid cell through `0x0040fa50`, requires `world_grid_cell_has_packed_u16_token_in_6byte_roster` `0x0042b2d0` to find the caller token in the cell's six-byte roster, and then walks the site's owned route-link chain at `[site+0x272]`, erasing overlapping links through the route-link collection owner `0x006ada90` whenever `placed_structure_endpoint_pair_has_shared_route_entry_key` `0x0040fbe0` says the current link already shares the same route-entry key. Current local evidence grounds this as the collection-side route-link cleanup sweep keyed by one center-cell roster token rather than a generic route-style iterator.","objdump + local disassembly + caller correlation + route-link cleanup correlation + center-cell-token correlation"
0x004138f0,69,placed_structure_collection_count_entries_with_cached_candidate_id_0x3d0,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small live-collection counter over the placed-structure store. The helper walks every live entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, compares cached dword `[entry+0x3d0]` against the caller-supplied id, and returns the number of matches. Current grounded callers are the year-threshold owner `0x00435b50` and a later world-side site sweep around `0x004d2600`, so this is the safest current read for the cached-candidate-id match counter rather than a generic collection size helper.","objdump + local disassembly + caller correlation + cached-candidate-id correlation"
0x00413940,93,placed_structure_collection_sum_source_field_0x141_by_cached_candidate_id_with_floor1,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small placed-structure aggregation helper over the live collection. The helper walks every live entry through the indexed-collection accessors, filters by cached dword `[entry+0x3d0] == caller_id`, resolves the matching entry's source record through `placed_structure_resolve_source_record_from_current_stem` `0x0040cec0`, reads source dword `[source+0x141]`, floors that value to at least `1`, and accumulates the result. Current grounded caller is `structure_candidate_accumulate_positive_cargo_summary_channels_scaled_by_link_count` `0x0041e7be`, where this sum acts as the positive link-count scale factor above the four cargo-summary banks, so this is the safest current read for the source-field aggregation sibling rather than a generic count helper.","objdump + local disassembly + caller correlation + source-field correlation + cargo-summary correlation"
0x004139a0,95,placed_structure_collection_count_entries_with_linked_station_or_transit_peer,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide counter over the live placed-structure store that counts only entries passing the narrower linked-peer station-or-transit gate. The helper walks every live entry through the indexed-collection accessors, first requires the linked-instance class gate `0x0040c990 == 1`, and then requires `placed_structure_has_linked_station_or_transit_peer` `0x0040d230` before incrementing the returned total. Current grounded callers sit in the same linked-site reporting strip as the neighboring class-specific counters, so this is the safest current read for the collection-side linked-peer station-or-transit counter rather than a generic class scan.","objdump + local disassembly + caller correlation + linked-peer gate correlation + station-or-transit correlation"
0x00413a00,146,placed_structure_collection_count_linked_site_entries_with_peer_candidate_class3,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide counter over the linked-site-capable subset of live placed structures that counts only peers whose linked candidate class byte is `3`. The helper walks every live entry through the indexed-collection accessors, requires the linked-instance class gate `0x0040c990 == 1`, then requires the placed-structure vtable `+0x70` latch, resolves the cached linked peer through `placed_structure_resolve_linked_peer_record_from_cached_site_id` `0x0040d1f0`, follows that peer into the linked instance owner `0x0047de00`, and increments the total only when candidate class byte `[candidate+0x8c]` equals `3`. Current grounded callers sit in the same linked-site reporting strip as the neighboring counters, so this is the safest current read for the class-`3` linked-peer counter rather than a broader collection predicate.","objdump + local disassembly + caller correlation + linked-peer resolver correlation + candidate-class correlation"
0x00413aa0,146,placed_structure_collection_count_linked_site_entries_with_peer_candidate_class4,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide companion to `0x00413a00` over the same linked-site-capable subset of live placed structures. The helper walks every live entry through the indexed-collection accessors, requires the linked-instance class gate `0x0040c990 == 1`, requires the placed-structure vtable `+0x70` latch, resolves the cached linked peer through `placed_structure_resolve_linked_peer_record_from_cached_site_id` `0x0040d1f0`, and increments the total only when that peer's resolved candidate class byte `[candidate+0x8c]` equals `4`. Current grounded callers sit in the same linked-site reporting strip as the class-`3` sibling, so this is the safest current read for the class-`4` linked-peer counter rather than another anonymous collection walk.","objdump + local disassembly + caller correlation + linked-peer resolver correlation + candidate-class correlation"
0x00413b40,124,placed_structure_collection_count_subtype4_entries_without_linked_instance_candidate_flag_b9,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide counter over the live placed-structure subset that passes both the linked-instance class gate and the subtype-`4` candidate predicate. The helper walks every live entry through the indexed-collection accessors, requires `0x0040c990 == 1`, requires `placed_structure_subject_candidate_is_subtype4` `0x0040d360`, and then increments the returned total only when `placed_structure_query_linked_instance_candidate_flag_byte_b9` `0x0040d350` returns zero. Current local evidence grounds this as the subtype-`4` companion counter adjacent to the linked-peer class counters rather than overnaming candidate byte `0xb9`.","objdump + local disassembly + caller correlation + subtype4 correlation + candidate-byte-field correlation"
0x0041d550,574,locomotive_era_and_engine_type_pass_company_policy_gate,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + engine-type correlation,2,"Policy gate beneath the preferred-locomotive chooser and its non-electric fallback. The helper operates on one locomotive-era or availability record whose linked locomotive id sits at `[this+0x126]`. On the fuller policy path, reached when record field `[this+0x41]` is `2` or `3`, it first respects several scenario-state locks rooted at `[0x006cec74+0x180]`, `[0x006cec78+0x4c8c]`, `[0x006cec7c+0x82]`, and `[0x006cec74+0x247]`, then resolves the linked locomotive record from `0x006ada84` and dispatches its engine-type dword `[locomotive+0x10]` across three scenario opinion slots through `scenario_state_sum_issue_opinion_terms_raw` `0x00436710`: `0x1c6`, `0x1c7`, and `0x1c8`, which current evidence now best aligns with the steam, diesel, and electric lanes. It also special-cases the locomotive stem at `[locomotive+0x34]` against the local string `WhaleL`; current data-file correlation now ties that stem to the `Orca NX462` locomotive family and its `WhaleL_NE` asset set, and when that compare hits the helper explicitly zeros the accumulated issue-opinion result before the later availability checks, so that family loses the positive-opinion shortcut rather than taking a bonus branch. It then consults one neighboring locomotive-derived issue or policy id through `0x00442a85`, and applies a late scenario availability triplet from `[0x006cec78+0x4c97..0x4c99]` against three per-record bytes `[this+0x30..0x32]` plus record field `[this+0x7b]`. That triplet now has a stronger player-facing read: the same three scenario bytes are the live editor-policy fields owned by `map_editor_locomotive_availability_panel_construct` `0x004cd680` and `map_editor_locomotive_availability_panel_handle_message` `0x004cf0d0`, and their localized labels `2863..2865` are `All Steam Locos Avail.`, `All Diesel Locos Avail.`, and `All Electric Locos Avail.`. The current gate is narrower than a plain override: when the issue-opinion result stays positive and none of those three editor bytes are enabled, that positive result alone seeds the local availability flag; but once any of the editor family bytes is nonzero, the helper instead requires one matching intersection between the per-record family bytes `[this+0x30..0x32]` and the corresponding scenario bytes `0x4c97..0x4c99`. Independent of that family check, record field `[this+0x7b]` can still carry the path into the later year-window gate. On the simpler path it falls straight to an era-window gate using the current scenario year with floor `0x726` against `[this+0x105]` and `[this+0x109]`, plus one current-month-like check from `[0x006cec78+0x0f]`. The helper returns `1` when the era and engine family pass those combined scenario, opinion, availability, and year gates; otherwise `0`. Current grounded callers are `company_select_preferred_available_locomotive_id` `0x004078a0` and `locomotive_collection_select_best_era_matched_non_electric_fallback_id` `0x00461cd0`.","objdump + caller xrefs + callsite inspection + engine-type correlation + year-window correlation + scenario-gate correlation + editor-locomotive-availability correlation + WhaleL carveout correlation + engine-data correlation"
0x00417790,160,map_angle_rotate_grid_offset_pair_into_world_offset_pair,map,cdecl,inferred,objdump + callsite inspection + math-table correlation,2,"Small angle-table rotation helper beneath the placement projection family. The helper normalizes the caller-supplied heading float into the engine's cyclic angle domain, indexes one sine or cosine-like basis table under `0x006d4024`, and then applies that basis pair to the caller-supplied X or Y grid offsets before writing the rotated world-space offset pair through the two out-pointers. Current grounded caller is `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, so this now looks like the low-level offset-rotation helper rather than a generic trig wrapper.","objdump + callsite inspection + math-table correlation"
0x00417840,205,placed_structure_project_candidate_grid_extent_offset_by_rotation,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Projects one candidate-sized local grid extent into rotated world-space X or Y offsets for placement and mutation previews. The helper resolves the caller-supplied placed-structure id through the current collection, pulls one local grid basis pair through `0x00413d80`, reads the linked candidate footprint bytes `[candidate+0xb8]` and `[candidate+0xb9]`, converts those grid extents into local offset terms, and then re-enters `map_angle_rotate_grid_offset_pair_into_world_offset_pair` `0x00417790` with the caller-supplied heading float to produce the rotated output pair. Current grounded callers include the city-connection placement chooser `0x00402cb0`, the placed-structure local rebuild lane at `0x0040de78`, subtype-`1` placement validation inside `0x004197e0`, and later world-side update branches at `0x00417b6f`, `0x00417e27`, `0x0041a250`, `0x0041a615`, `0x004802c6`, `0x00480875`, and `0x00480d50`. This now looks like the shared projected-footprint offset helper beneath placement validation rather than an unnamed geometry routine.","objdump + caller xrefs + callsite inspection + placement-correlation"
0x00417b40,986,route_entry_collection_try_reuse_covering_entry_for_site_coords_and_heading,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,3,"Tries to reuse one already-existing route entry from the global route-entry collection `0x006cfca8` for a caller-supplied site id, world-space point, and heading instead of synthesizing a new endpoint entry. The helper first projects the current candidate footprint through `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, probes the route-entry collection through `0x00494cb0`, and then subjects the returned entry plus its linked neighbors at `[entry+0x206/+0x20a/+0x20e]` to a tighter compatibility screen: `[entry+0x226]` must be clear, `[entry+0x222]` must be unset or already owned by the same site id, `[entry+0x20e]` must be `-1`, and the neighboring entries cannot already point back through the same side-link pattern selected by byte `[entry+0x201]`. When a candidate survives, the helper computes one accepted local heading and anchor offset through `0x0048bb40`, `0x005a1390`, `0x005a152e`, `0x0048a1a0`, `0x0048a1c0`, and `0x0051db80`, writes the accepted world-space pair and heading back through the caller out-pointers, optionally stores the reused route-entry id through stack arg `+0x2c`, and returns `1`; otherwise it returns `0`. Current grounded callers are the linked-site constructor `0x00480210`, the linked-site runtime refresh owner `0x00480710`, the broader route-anchor chooser around `0x0041a137`, and the StationPlace orientation-search helper `0x00508040`, so this is the safest current read for the reusable covering-route-entry search path rather than another route-synthesis owner.","objdump + caller xrefs + local disassembly + route-entry reuse correlation + linked-site correlation + station-place correlation"
0x004185a0,100,world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small world-grid mask helper beneath the neighboring projected-rectangle raster family. The helper walks one caller-supplied rectangle from the four dwords rooted at stack arg `+0x04`, reads the aligned float sample band from the caller buffer at stack arg `+0x08`, skips cells whose sample is still the sentinel `0x497423f0`, and otherwise toggles bit `0x01` in the grid-byte mask rooted at `[0x0062c120+0x2135]` by XORing it with the low bit of the caller-supplied byte flag at stack arg `+0x0c`. Current grounded callers are the higher projected-rectangle workers at `0x00418610`, `0x00418a60`, and `0x00418d40`, so this is now bounded as a non-sentinel mask-toggle helper rather than another generic grid writer.","objdump + caller inspection + local disassembly + grid-mask correlation"
0x00418610,584,world_grid_refresh_projected_rect_sample_band_and_flag_mask,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared projected-rectangle world-grid helper above the flagged-region float-stats refresher `0x00415020` and the non-sentinel mask-toggle helper `0x004185a0`. The function resolves one placed-structure record from the caller-supplied id, optionally clears an out flag, validates the current global scan rectangle at `0x0062b7a8..0x0062b7b4` against the live world bounds, and then derives the two boolean mode inputs for `0x00415020` from the linked candidate helpers `0x0040cc80`, `0x0040cc60`, and `0x0040cc40`. On success it repopulates the temporary float band at `0x0062b7d0` by sampling every cell in the rectangle through `0x00448aa0`, publishes the rectangle through `0x0044d410`, and on the single-sample path re-enters `0x004185a0` to toggle the corresponding bit-mask cells. The richer branch also probes the current candidate subtype and per-candidate flags, checks local neighborhood acceptance through `0x00414c50`, samples one midpoint float through `0x00448bd0`, and stamps one or more world-grid cells through `0x0044dca0`. Current grounded callers are the neighboring placed-structure runtime helper at `0x00418be0` and the placement validator `placed_structure_validate_projected_candidate_placement` `0x004197e0`, so the safest current read is a projected-rectangle sample-band and flag-mask refresh pass rather than a generic float scan.","objdump + caller inspection + local disassembly + world-grid sample-band correlation + placement-validator correlation"
0x00419110,234,placed_structure_collection_refresh_local_runtime_side_state_in_rect_from_cell_bucket_map,map,cdecl,inferred,objdump + caller xrefs + local disassembly + bucket-map correlation,3,"Rectangular placed-structure refresh wrapper over a hashed per-cell bucket map. The helper clamps the caller rectangle against live world dimensions `[0x0062c120+0x2155/+0x2159]`, packs each cell key as `(row << 16) | col`, resolves one bucket head through the caller-supplied map root at `[arg0+0x88]` and the shared hash lookup `0x0053dae0`, and then walks the returned linked chain. For every resolved bucket entry it forwards the stored coordinate pair from `[entry+0x04/+0x08]` plus two zero stack flags into `placed_structure_set_world_coords_and_refresh_local_runtime_side_state` `0x0040eba0` on the current placed-structure owner carried by that entry, so the current effect is a local-runtime side-state refresh across every bucketed site in the rectangle rather than a generic collection iterator. Current grounded caller is the edit-side branch at `0x004bc851`, immediately after the neighboring nibble and companion-float mutations, so this is the safest current read for the bucket-map-driven rect refresh wrapper rather than another world-grid brush helper.","objdump + caller xrefs + local disassembly + bucket-map correlation + local-runtime-side-state correlation"
0x00419200,41,world_grid_query_projected_rect_scratch_cell_dword_if_present,map,cdecl,inferred,objdump + caller xrefs + local disassembly + projected-rect correlation,3,"Tiny projected-rectangle scratch-bank getter over the temporary dword cell-value bank rooted at `0x0062b300`. When that bank exists, the helper flattens the caller-supplied cell coordinates through live world width `[0x0062c120+0x2155]` and returns the corresponding dword from the bank; otherwise it returns `0`. Current grounded caller is the later world-side branch at `0x0048af99`, which uses the returned nonzero test as one score or gating input, so this is the safest current read for the projected-rect scratch-cell dword getter rather than another permanent world-grid query.","objdump + caller xrefs + local disassembly + projected-rect correlation + scratch-bank correlation"
0x0041ab50,6,city_database_entry_constant_38_stub_vtable_5c9750_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot immediately before the city-database entry load and handle-refresh pair in table `0x005c9750`. The helper returns literal `38` in `EAX` and exits. Current evidence keeps the row at that fixed-return slot level.","objdump + vtable scan + local disassembly"
0x0041ab60,6,city_database_entry_constant_34_stub_vtable_5c9750_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot immediately before the city-database entry load and handle-refresh pair in table `0x005c9750`. The helper returns literal `34` in `EAX` and exits. Current evidence keeps the row at that fixed-return slot level.","objdump + vtable scan + local disassembly"
0x0041ab70,5,city_database_entry_load_tagged_payload_via_0x45c6f0,map,thiscall,inferred,objdump + vtable correlation + local disassembly,2,"Tiny city-database-entry-family loader thunk in the sibling vtable rooted at `0x005c9750`. The helper simply jumps into `0x0045c6f0`, which stages tag family `0x61a9/0x61aa/0x61ab`, restores two strings into `[this+0x32e]` and `[this+0x332]`, and iterates the child runtime band rooted at `[this+0x316]`. The table-family alignment is now direct: `city_database_entry_collection_refresh_records_from_tagged_bundle` `0x00474540` iterates its loaded records and dispatches vtable slot `+0x40`, which in `0x005c9750` resolves into the same record family immediately adjacent to this loader slot.","objdump + vtable correlation + local disassembly + city-database loader correlation"
0x0041ab80,127,city_database_entry_refresh_named_handle_and_return_scaled_primary_float,map,thiscall,inferred,objdump + caller inspection + local disassembly + city-database family correlation,2,"City-database-entry-family method in the sibling vtable rooted at `0x005c9750`. The helper clears and rebuilds one named handle under owner `0x006d4020`, stores the result into `[this+0x1c]`, queries three base floats through `0x0045c480`, and returns one scaled float derived from the first queried component and constant `0x005c97c0`. Current grounded callers are later world-side branches at `0x0046e4f7`, `0x004aafee`, and `0x004ab020`. The row is therefore carried conservatively as a named-handle refresh within the city-database collection family refreshed by `0x00474540` and serialized by `0x00474610`.","objdump + caller inspection + local disassembly + city-database family correlation"
0x0041ac00,3,city_database_entry_false_stub_vtable_5c9750_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0041ac10,3,city_database_entry_false_stub_vtable_5c9750_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0041ac20,3,city_database_entry_false_stub_vtable_5c9750_slot2,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Third tiny literal-false virtual slot adjacent to `0x0041ab80` in the city-database-entry table `0x005c9750`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0041ac30,6,city_database_entry_constant_10_stub_vtable_5c9750_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot in the city-database-entry table `0x005c9750`. The helper returns literal `10` in `EAX` and exits. Current evidence keeps the row at that fixed-return slot level.","objdump + vtable scan + local disassembly"
0x0041ac40,6,city_database_entry_true_stub_vtable_5c9750_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-true virtual slot adjacent to `0x0041ac30` in the city-database-entry table `0x005c9750`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0041ac50,6,city_database_entry_true_stub_vtable_5c9750_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second tiny literal-true virtual slot adjacent to `0x0041ac30` in the city-database-entry table `0x005c9750`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0041f5c0,134,world_region_load_tagged_payload_and_profile_collection_0x37f,map,thiscall,inferred,objdump + vtable scan + local disassembly + region-family correlation,2,"Payload-side virtual slot in the world-region record table rooted at `0x005c9a60`. The helper clamps scalar `[region+0x31b]` to at least `1.0`, clears `[region+0x317]` when that clamp fires, reloads the shared tagged string-triplet payload through `0x00455fc0`, allocates one `0x88`-byte indexed-collection object through `0x0053b070`, constructs that collection through `0x00518b90`, stores it into `[region+0x37f]`, and then forwards the caller-supplied bundle or stream context into that collection through `0x00518680`. The function returns the accumulated size from the payload reload plus collection load. Constructor-side evidence now ties `[region+0x37f]` to the same profile-collection family rebuilt by `0x00420e00` and `0x00420ed0`.","objdump + vtable scan + local disassembly + region-family correlation + profile-collection correlation"
0x0041f650,31,world_region_serialize_tagged_string_triplet_and_profile_collection_0x37f,map,thiscall,inferred,objdump + vtable scan + local disassembly + region-family correlation,2,"Small stream-side virtual slot in the same world-region record table `0x005c9a60`. The helper first emits the tagged string-triplet payload through `0x004559d0`, then forwards the same caller-supplied bundle or stream context into profile collection `[region+0x37f]` through `0x00517d90`. Constructor-side and rebuild-side evidence now tie that field to the live region profile subcollection rather than an anonymous dynamic helper.","objdump + vtable scan + local disassembly + region-family correlation + profile-collection correlation"
0x0041f680,25,world_region_refresh_global_preview_helper_and_dispatch_mode1_preview_handle_0x23a,map,thiscall,inferred,objdump + vtable scan + local disassembly + region-family correlation,2,"Small virtual slot in the world-region record table `0x005c9a60`. The helper first re-enters `0x00455de0`, which refreshes the current global preview or helper owner from the region's normalized coordinates and anchor triplet. It then loads preview handle `[region+0x23a]`, sets `ECX = 1`, and tails into `0x004cf830`, which allocates or refreshes one `0xa0`-byte helper object before forwarding both values into `0x004cf550`. Constructor-side evidence now grounds this family as the live world-region record cluster, so this note no longer needs the open subtype qualifier.","objdump + vtable scan + local disassembly + region-family correlation + global-preview-helper correlation"
0x0041f6a0,11,world_region_query_profile_collection_slot_count_field_0x37f,map,thiscall,inferred,objdump + local disassembly + region-family correlation,2,"Tiny world-region helper that treats field `[region+0x37f]` as one indexed collection and returns its current slot count through `indexed_collection_slot_count` `0x00517cf0`. Current grounded caller is `world_region_balance_structure_demand_and_place_candidates` `0x004235c0`, where it bounds one region-local profile or structure-count loop.","objdump + local disassembly + region-family correlation + profile-collection correlation"
0x0041f6b0,40,world_region_query_world_scalar_at_rounded_normalized_coords,map,thiscall,inferred,objdump + local disassembly + region-family correlation,2,"Small helper in the world-region record family. It queries the normalized secondary and primary coordinates through `0x00455810` and `0x00455800`, rounds both through `0x005a10d0`, then forwards the resulting integer pair plus the active world root `0x0062c120` into `0x0044afa0`. Current evidence is strong enough for the rounded region-coordinate world-scalar query shape, but not for a tighter semantic name for the returned scalar.","objdump + local disassembly + region-family correlation + world-scalar-query correlation"
0x0041f6e0,12,world_region_center_world_grid_cell_has_packed_u16_token,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small helper that resolves the current region's center world-grid cell through `world_region_resolve_center_world_grid_cell` `0x00455f60` and then tails into `world_grid_cell_has_packed_u16_token_in_6byte_roster` `0x0042b2d0` with the caller-supplied `u16` token. Current grounded callers include the city-connection bonus sweep `0x004010f0`, where it acts as a center-cell token probe rather than a broader route or ownership query.","objdump + local disassembly + caller correlation + packed-roster correlation"
0x0041f6f0,5,world_region_query_flag_byte_0x42,map,thiscall,inferred,objdump + local disassembly + field inspection,1,"Tiny raw byte getter over region field `[this+0x42]`. The helper zero-extends that byte into `EAX` and returns immediately, with no side effect. Current evidence keeps the row at the raw flag-byte level.","objdump + local disassembly + field inspection + region-family correlation"
0x0041f700,3,runtime_object_false_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-false virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper clears `EAX` and returns immediately, with no field access or side effect. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0041f710,6,runtime_object_true_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny literal-true virtual slot immediately after `0x0041f700` in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns `1` in `EAX` and exits immediately. Current evidence grounds it only as a constant-return slot.","objdump + vtable scan + local disassembly"
0x0041f720,136,world_region_publish_formatted_name_and_enter_preview_mode_0x12_when_world_state_0_or_0x15,map,thiscall,inferred,objdump + vtable scan + local disassembly + caller correlation,2,"Virtual slot in the world-region record table rooted at `0x005c9a60`. The helper formats the current name lane `[region+0x356]` into one stack-local shell text buffer through `0x005193f0` and `0x00518de0`, publishes that buffer through `0x00538c70`, and then checks world state `[0x0062c120+0x2175]`. When that state is `0` or `0x15`, it dispatches `world_switch_preview_or_tool_mode_and_seed_parameter_block` `0x00452fa0` with preview handle `[region+0x23a]`, literal action `0x12`, and the paired sentinel dwords `0x1869f/0x1869f`. Constructor-side evidence now grounds this family as the live world-region record cluster rather than an unnamed sibling subtype.","objdump + vtable scan + local disassembly + caller correlation + region-family correlation + world-mode branch correlation"
0x0041f7b0,42,world_region_publish_fixed_shell_payload_and_clear_preview_mode_when_world_state_0x12,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Small virtual slot in the same world-region record table `0x005c9a60`. The helper publishes the fixed payload at `0x005c87a8` through `0x00538c70`, then checks world state `[0x0062c120+0x2175]`; when that state equals `0x12`, it tails into `world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched` `0x00453510`. Current evidence is strong enough for the fixed-payload publish plus conditional preview-clear shape on the world-region family.","objdump + vtable scan + local disassembly + region-family correlation + world-mode branch correlation"
0x0041f7e0,35,world_region_prepend_linked_structure_site_id_into_cached_chain_head_field_0x383,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small world-region chain-link helper over cached head word `[region+0x383]`. The caller-supplied placed-structure record receives the old head id in `[site+0x270]`, and the current region then replaces `[region+0x383]` with that site's own placed-structure id `[site+0x2a4]`. Current grounded caller is `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, which reaches this helper while seeding the region linkage for one newly created site.","objdump + caller xrefs + local disassembly + region-link-chain correlation"
0x0041f810,51,world_region_resolve_live_linked_structure_from_cached_chain_head_field_0x383,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small resolver over region cached head word `[region+0x383]`. The helper first asks the live placed-structure collection `0x0062b26c` whether that `u16` id is still live through `0x00517d40`; when present it resolves and returns the corresponding placed-structure record through `0x00518140`, otherwise it returns null. Current grounded caller is the higher route-style or transient branch at `0x0043bd62`, which uses the returned linked structure before re-entering `0x0040cf00`.","objdump + caller xrefs + local disassembly + region-link-chain correlation"
0x0041f850,126,world_region_remove_linked_structure_site_from_cached_chain_and_clear_site_link_words_0x26e_0x270,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Removal-side companion to `0x0041f7e0` over the world-region linked-structure chain. The current region owns cached head word `[region+0x383]`, while the caller-supplied placed-structure record contributes its site id `[site+0x2a4]` and next-link word `[site+0x270]`. When the head equals that site id, the helper replaces `[region+0x383]` with the site's next link; otherwise it walks the current linked `u16` chain through collection `0x0062b26c` and each site's own `[record+0x270]` until it finds the predecessor, then patches that predecessor's next-link word to the site's successor. Before returning it clears both site link words `[site+0x26e]` and `[site+0x270]`. Current grounded caller is the placed-structure rebuild branch at `0x0040e25e`.","objdump + caller xrefs + local disassembly + region-link-chain correlation"
0x0041f8d0,55,world_region_clear_linked_structure_site_chain_from_head_field_0x383,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small chain-clear helper over region cached head word `[region+0x383]`. Starting from that `u16` head id, the helper repeatedly resolves each live placed-structure record through collection `0x0062b26c`, follows link word `[site+0x270]`, and clears both `[site+0x26e]` and `[site+0x270]` on every traversed record until the chain reaches zero. Current grounded caller is the release-side helper `0x00420670`, which uses this pass immediately before tailing into base cleanup `0x00455d20`.","objdump + caller xrefs + local disassembly + region-link-chain correlation"
0x0041f910,46,runtime_object_query_mode_gate_or_flag_byte_0x42_when_class0,map,thiscall,inferred,objdump + local disassembly + mode-gate correlation,2,"Small mode-gated flag query adjacent to the sibling runtime-object family. It first checks shell mode gate `0x004338c0` on the active scenario root `0x006cec78`; when that gate is inactive it returns literal `1`. When the gate is active it also returns `1` for nonzero class dword `[this+0x23e]`, and only on the class-0 path does it return byte `[this+0x42]`. This keeps the current note structural around the mode-gated runtime-flag query rather than overnaming the flag itself.","objdump + local disassembly + mode-gate correlation + field inspection"
0x00412af0,117,indexed_collection_find_live_entry_id_by_casefolded_name_at_field_0x04,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small indexed-collection lookup by casefolded name. The helper walks the live entries through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, compares the first byte of the caller string against entry field `[entry+0x04]` after normalizing both through `0x0051d660`, and then falls back to full string comparison through `0x005a57cf`. On the first exact match it returns that live entry id; otherwise it returns `0`. Current grounded caller is `0x00412b70`, which uses it over the structure-candidate pool `0x0062b268`.","objdump + local disassembly + caller correlation + collection-name-lookup correlation"
0x00412b70,35,indexed_collection_resolve_live_entry_by_casefolded_name_at_field_0x04,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small resolve-by-name wrapper over `indexed_collection_find_live_entry_id_by_casefolded_name_at_field_0x04` `0x00412af0`. It searches the current collection for the caller-supplied casefolded name, and when a live id is found it resolves and returns the backing record through `indexed_collection_resolve_live_entry_by_id` `0x00518140`; otherwise it returns null. Current grounded callers are the region-profile helpers `0x0041f940` and `0x0041f9b0`, where it resolves structure-candidate records from region-profile labels against the global candidate pool `0x0062b268`, plus the `.smp` restore lane inside `world_load_saved_runtime_state_bundle` `0x00446d40`, where each restored named candidate-availability record is kept only when its copied stem survives the fixed built-in rejects and resolves back into that same live candidate pool.","objdump + local disassembly + caller correlation + collection-name-lookup correlation + restore-side-name-validation correlation"
0x00412ba0,32,structure_candidate_collection_remove_entry_by_id_release_runtime_descriptor_tables,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small collection-side removal helper for the live structure-candidate pool. It resolves the caller-supplied candidate id through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, releases that candidate's dependent runtime descriptor and cargo-membership tables through `structure_candidate_release_runtime_descriptor_and_cargo_membership_tables` `0x00411cb0`, and then removes the id from the collection through `0x00518a30`. Current grounded callers sit in the same candidate rebuild and load strip as `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, so this is the narrow remove-and-release sibling for runtime-backed candidate records rather than a generic collection erase helper.","objdump + local disassembly + caller correlation + candidate-runtime-release correlation"
0x00412bd0,56,structure_candidate_collection_rebuild_cargo_membership_tables_counts_and_scaled_rate_bands_for_all_live_records,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide sweep over the live structure-candidate pool that simply re-enters `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` for every live record. The helper walks the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then refreshes each candidate's two compact cargo-membership tables at `[candidate+0x79c/+0x7a0]`, the paired counts at `[candidate+0x7a4/+0x7a8]`, and the scaled runtime rate band at `[candidate+0xa1..+0xb8]` from the already-materialized `0xbc` descriptor strip. Current grounded callers sit in the same rebuild and load family as `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, so this is the narrow collection-side cargo-summary rebuild sibling rather than a broader scenario projection owner.","objdump + local disassembly + caller correlation + cargo-summary-sweep correlation + candidate-table-field correlation"
0x00412c10,144,structure_candidate_collection_refresh_named_availability_latch_0x7ac_and_tail_into_cargo_economy_filter_refresh,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide refresh of candidate availability latch `[candidate+0x7ac]` beneath the startup and editor availability family. When scenario state `0x006cec78` exists, the helper walks every live candidate through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. Candidates whose paired availability bytes `[candidate+0xba]` or `[candidate+0xbb]` are already nonzero, or whose subtype byte `[candidate+0x32]` is not `2`, are forced to `[candidate+0x7ac] = 1`. The remaining subtype-`2` candidates query the scenario-side named availability table through `scenario_state_query_named_candidate_availability_record_value` `0x00434ea0` using the candidate stem at `[candidate+0x04]`, and store that returned override bit into `[candidate+0x7ac]`. When the live structure collection `0x0062ba8c` exists, the helper then tails into `structure_candidate_collection_refresh_cargo_economy_filter_flags` `0x0041eac0`, so the strongest current read is one candidate-availability refresh followed immediately by the dependent cargo-economy filter rebuild. Current grounded caller is `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20`, and the same startup-side candidate filter family later writes the same latch.","objdump + local disassembly + caller correlation + named-availability correlation + cargo-economy-followon correlation"
0x00412fb0,561,structure_candidate_collection_stream_load_rebuild_runtime_summaries_and_refresh_named_availability,map,thiscall,inferred,objdump + local disassembly + caller correlation,4,"Broader collection-load owner for the live structure-candidate pool rooted at `0x0062b268`. The helper opens one repeated tagged import source around the fixed stem `0x005c93fc` through the callback trio at `0x005c8190/0x005c8194/0x005c819c`, allocates or resolves each live candidate id through collection vtable slot `+0x04`, and then re-enters `structure_candidate_stream_load_runtime_record_and_rebuild_cargo_state` `0x004120b0` for every imported record. After the per-record loop it reprojects the scenario-side recipe runtime back into the same pool through `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, reruns the stem-policy sweep `0x00412ab0`, clears the collection aggregate quintet `[this+0x8c..+0x9c]`, and then accumulates the subtype-`3` record summary lanes `[candidate+0x8d/+0x91/+0x95/+0x99/+0x9d]` back into that collection-level band. A later fixed name-catalog sweep is tighter now too: for every non-subtype-`1` candidate whose availability bytes `[candidate+0xba]` and `[candidate+0xbb]` are both zero and whose live id stays within `0x6e`, the helper localizes the candidate stem at `[candidate+0x4f]` through `0x51c920`, formats localized string id `0x0b53`, copies up to `0x46` bytes into row `0x0061dbc2 + id*0x6e`, and stores that same live id into dword slot `0x0061dc09 + id*0x6e`. Only after that catalog rebuild does it re-enter `structure_candidate_collection_refresh_named_availability_latch_0x7ac_and_tail_into_cargo_economy_filter_refresh` `0x00412c10`. Current grounded caller is the constructor-side load owner `0x004131f0`, which stores the resulting collection at `0x0062b268`.","objdump + local disassembly + caller correlation + tagged-import-source correlation + collection-aggregate correlation + named-catalog correlation"
0x004131f0,49,structure_candidate_collection_construct_and_stream_load_runtime_records,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Constructor-side load owner for the live structure-candidate collection rooted at `0x0062b268`. The helper runs the shared collection base initializer `0x00517ce0`, installs vtable `0x005c93cc`, seeds the collection through `0x00518570` with literal configuration `(1, 0x7c8, 0x0a, 5, 1, 0, 0)`, and then immediately re-enters `structure_candidate_collection_stream_load_rebuild_runtime_summaries_and_refresh_named_availability` `0x00412fb0`. Current grounded caller is the world bring-up load branch at `0x00438c8e`, which allocates a `0xa0`-byte object and stores the result into global `0x0062b268`.","objdump + local disassembly + caller correlation + collection-constructor correlation"
0x00413230,39,placed_structure_collection_construct_empty_runtime_pool,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Constructor for the live placed-structure collection rooted at `0x0062b26c`. The helper runs the shared collection base initializer `0x00517ce0`, installs vtable `0x005c9414`, and seeds the collection through `0x00518570` with literal configuration `(0, 0, 0x0a, 0x14, 0, 0, 0)` before returning `this`. Current grounded caller is the world-entry bring-up branch at `0x00448871`, which allocates an `0x8c`-byte object and stores the result into global `0x0062b26c`.","objdump + local disassembly + caller correlation + collection-constructor correlation"
0x00413260,22,placed_structure_collection_release_and_free,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small destructor-side wrapper for the live placed-structure collection rooted at `0x0062b26c`. The helper reinstalls collection vtable `0x005c9414`, re-enters the shared collection release body `0x00518600`, and then tails into common collection teardown `0x00518bd0`. Current grounded caller is the world-release lane at `0x0044933d`, which clears the same global collection root during teardown.","objdump + local disassembly + caller correlation + collection-layout correlation"
0x00413280,291,placed_structure_collection_stream_load_tagged_entries_and_publish_progress,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Tagged stream-load owner for the live placed-structure collection at `0x0062b26c`. The helper reads the three tagged section markers `0x36b1`, `0x36b2`, and `0x36b3` through `0x00531360`, seeds the collection header through `0x00518680`, snapshots the current global progress scalar `0x00ccb9e8`, and then walks every live placed-structure entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. For each entry it materializes one temporary stack-local entry shim through `0x0040c950`, dispatches the load-side entry virtual `slot+0x40` with the caller bundle, advances `0x00ccb9e8` in one evenly distributed step from that saved base, re-enters `0x004834e0` on the active world root, and then tears the temporary shim back down through `0x0040c970`. Current grounded caller is the larger world-entry load path at `0x00444467`, where this helper is the concrete collection-side import owner rather than one bare tagged reader.","objdump + local disassembly + caller correlation + tagged-stream correlation + progress-publish correlation + temporary-entry-shim correlation"
0x00413440,129,placed_structure_collection_stream_save_tagged_entries,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Tagged stream-save owner for the live placed-structure collection at `0x0062b26c`. The helper writes the section markers `0x36b1`, `0x36b2`, and `0x36b3` through `0x00531340`, serializes the collection header through `0x00517d90`, emits the fixed side records at `0x005c9438` and `0x005c9420` through `0x00442660`, and then walks every live placed-structure entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` before dispatching each entry's save-side virtual `slot+0x44` with the caller bundle. Current grounded caller is the world-save path at `0x004452f5`, so this is the collection-side tagged save owner paired with `0x00413280` rather than another generic collection iterator.","objdump + local disassembly + caller correlation + tagged-stream correlation + collection-save correlation"
0x0041f940,88,world_region_count_structure_profiles_passing_availability_gate,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Counts the current region subcollection entries at `[region+0x37f]` whose backing candidate resolves through `0x00412b70` and passes the neighboring availability gate `0x0041f998`. The helper walks the live subcollection backward through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, increments the running count only for candidates that survive both gates, and returns that total. Current grounded caller is the editor-side region panel family around `0x004cbe19`, where it acts as the ungated companion to the stricter year-filtered counter `0x0041f9b0`.","objdump + local disassembly + caller correlation + region-subcollection correlation"
0x0041f998,23,structure_candidate_availability_gate_reject_subtype2_without_availability_word_or_recipe_runtime,map,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Tiny flag-setting predicate over one structure-candidate record. Candidates whose subtype byte `[candidate+0x32]` is not `2` pass immediately. Subtype-`2` candidates only pass when availability word `[candidate+0xba]` is nonzero or runtime recipe latch `[candidate+0x7ac]` is nonzero; when both are zero the helper leaves the zero flag set so its callers reject the candidate. Current grounded callers are the two region-profile counters `0x0041f940` and `0x0041f9b0`.","objdump + local disassembly + caller correlation + candidate-availability correlation"
0x0041f9b0,126,world_region_count_structure_profiles_matching_subtype_and_max_year_after_availability_gate,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Counts the current region subcollection entries at `[region+0x37f]` whose backing candidate resolves through `0x00412b70`, passes the neighboring availability gate `0x0041f998`, has subtype byte `[candidate+0x32]` equal to the caller-supplied subtype, and has year word `[candidate+0x26]` less than or equal to the caller-supplied max-year threshold. The helper walks the same live subcollection as `0x0041f940` through `0x00517cf0/0x00518380/0x00518140`, increments only when all four gates pass, and returns that stricter count. Grounded callers include the editor region panel around `0x004cbd41`, where it supplies the subtype-`2`, year-`0x726` companion count, and the later summary or warning pass at `0x004d0b1f`.","objdump + local disassembly + caller correlation + region-subcollection correlation + editor-panel correlation"
0x0041fa30,133,world_region_query_profile_weight_by_casefolded_label,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Linearly scans the current region subcollection `[region+0x37f]`, compares each live profile label against the caller-supplied casefolded string through `0x005a57cf`, and returns float field `[entry+0x1e]` from the first match. When no label matches, the helper returns the shared zero float at `0x005c8598`. The editor copy-industry and region-summary paths already ground `[entry+0x1e]` as the mutable profile-weight lane, so the safest read is a casefolded profile-weight query by label rather than a broader scalar lookup.","objdump + local disassembly + caller correlation + region-subcollection correlation + profile-weight correlation"
0x0041fac0,59,world_region_copy_nth_profile_label_and_weight_by_1_based_ordinal,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Resolves the caller-requested 1-based ordinal out of the current region subcollection root `[region+0x37f]`, copies the matched live profile label string into the caller buffer, and stores float field `[entry+0x1e]` through the caller-supplied out pointer. The helper uses `0x00518380/0x00518140` beneath the same subcollection root as `0x0041f940/0x0041fa30`, and grounded editor callers around `0x00421db7`, `0x00421ec7`, and `0x004d1817` use it as the ordinal enumerator for region profile labels plus weights. The current evidence is strong enough for a 1-based ordinal copy helper, not for a broader iterator name.","objdump + local disassembly + caller correlation + region-subcollection correlation + profile-weight correlation"
0x0041fb00,1130,world_region_class0_stamp_local_secondary_overlay_and_scored_refinement_pass,map,thiscall,inferred,objdump + caller xrefs + local disassembly + raster-helper correlation,3,"Heavy per-region helper used only on class-0 region records. The function skips any region whose class dword `[region+0x23e]` is nonzero, rounds the region's normalized coordinates through `0x00455800`, `0x00455810`, and `0x005a10d0`, derives one orientation bucket from `(x+y)&3`, and then runs two bounded local passes around that center. The first pass walks one orientation-dependent ring pattern from the static offset tables `0x00624b28/0x00624b48`, probes quarter-resolution secondary-raster cells through `0x00534e10`, and when that predicate stays clear marks the local secondary overlay through `0x004497a0(world, x, y, 1, 3, 1)`. The second pass scans a bounded square around the same center, scores each in-bounds cell through `math_measure_float_xy_pair_distance` `0x0051db80`, and then combines the local helper cluster `0x00534040`, `0x005340a0`, `0x00534100`, and `0x00533fe0` before returning. Current grounded callers are the region collection walk at `0x00421d04` and the earlier world-build special case at `0x0044308e`, where the same helper runs immediately before `world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids` `0x00421730`.","objdump + caller xrefs + local disassembly + raster-helper correlation + region-build correlation"
0x0041fff0,61,world_query_shell_mode2_or_thresholded_preview_scalar_gate,map,cdecl,inferred,objdump + caller xrefs + local disassembly + global-field correlation,2,"Small global gate over shell state `0x006cec74` and preview owner `0x0062be68`. The helper reads dword `[shell+0x2bb]` and returns `1` immediately when that mode equals `2`; when the mode is nonzero but not `2` it instead compares preview scalar `[0x0062be68+0x20]` against float threshold `0x005c9a9c` and returns `1` only when that comparison passes. Zero mode returns `0`. Current grounded callers are the scored world-scalar helper `0x0044afa0` and the city-connection status formatter band around `0x00420b09`, so the safest current read is the shared shell-mode-or-thresholded-preview gate rather than a region-only predicate.","objdump + caller xrefs + local disassembly + global-field correlation + threshold-gate correlation"
0x00455660,131,runtime_object_publish_world_anchor_triplet_from_normalized_xy_and_height_bias,map,thiscall,inferred,objdump + caller xrefs + local disassembly + sibling-vtable correlation,2,"Shared helper over the broader `0x23a` runtime-object family. The function scales the caller-supplied normalized coordinate pair through `0x005c8700`, converts that pair through world-basis owner `0x006d4024` plus `0x0051f090` and `0x00534490`, adds one caller-supplied integer height bias, optionally rounds that height when `shell_has_auxiliary_preview_owner` `0x00434050` is active, and publishes the resulting world-anchor triplet through `0x00530720`. It is used directly from both the city-entry side (`0x00455d09`, `0x00474253`) and the placed-structure specialization side through `0x0045b110`, so the safest current read is one shared world-anchor triplet publisher from normalized XY plus height bias rather than a city-only geometry helper.","objdump + caller xrefs + local disassembly + sibling-vtable correlation + world-anchor correlation"
0x004557b0,64,record_collection_release_global_iteration_root_0x6acd40_if_present,map,cdecl,inferred,objdump + caller xrefs + local disassembly,2,"Small release-side helper over the current global iteration root at `0x006acd40`. When that root is live the helper clears companion dword `0x006acd3c`, re-enters `0x0045b160` and `0x0045b040` on the pointed record, frees the record through `0x0053b080`, and finally clears `0x006acd40` itself. Current grounded callers include the shell detail-panel manager `0x004ddfc1`, the earlier world-side branch `0x00434a8c`, the building-detail side branch `0x004b6f64`, and later shell constructors at `0x00505dc6` and `0x005147e4`, so the safest current read is one shared global-iteration-root release helper rather than a tool-window-specific cleanup path.","objdump + caller xrefs + local disassembly + global-root correlation"
0x00455800,13,runtime_object_query_normalized_primary_coord,map,thiscall,inferred,objdump + caller xrefs + field inspection + sibling-vtable correlation,2,"Tiny float getter shared across the broader `0x23a` runtime-object family. The helper loads the float at `[this+0x1e2]`, divides it by scale constant `0x005c8700`, and returns the normalized result. It is used pervasively beside `0x00455810` from city-side, placed-structure, route-link, and world-grid callers, and now also appears under both the city-entry table `0x005c9750` and the sibling `Infrastructure` table `0x005cfd00`, so the safest current read is one normalized primary coordinate getter rather than a fully named X/Y accessor.","objdump + caller xrefs + field inspection + sibling-vtable correlation"
0x00455810,13,runtime_object_query_normalized_secondary_coord,map,thiscall,inferred,objdump + caller xrefs + field inspection + sibling-vtable correlation,2,"Tiny float getter paired with `0x00455800` across the broader `0x23a` runtime-object family. The helper loads the float at `[this+0x1ea]`, divides it by scale constant `0x005c8700`, and returns the normalized result. It is used pervasively beside `0x00455800` and appears under both the city-entry table `0x005c9750` and the sibling `Infrastructure` table `0x005cfd00`, so the safest current read is one normalized secondary coordinate getter rather than a fully named X/Y accessor.","objdump + caller xrefs + field inspection + sibling-vtable correlation"
0x00455930,148,runtime_object_serialize_two_triplet_scalar_bands,map,thiscall,inferred,objdump + local disassembly + serializer symmetry + sibling-vtable correlation,2,"Shared serializer over the broader `0x23a` runtime-object family. The helper first queries two triplet-like scalar bands through `0x0052e720` and `0x0052e880`, then writes the six resulting dwords to the caller-supplied bundle or stream through `0x00531030`. The grounded load-side stream counterpart is `0x00455870`, which reads those same six four-byte lanes back through `0x00531150` and republishes the resulting triplets. The same serializer slot appears in both the city-entry table `0x005c9750` and the sibling `Infrastructure` table `0x005cfd00`, so the safest current read is one shared serializer for two triplet scalar bands rather than a city-only stream helper.","objdump + local disassembly + serializer symmetry + sibling-vtable correlation"
0x004559d0,102,runtime_object_serialize_tagged_string_triplet_and_dispatch_slot_0x4c,map,thiscall,inferred,objdump + local disassembly + serializer symmetry + sibling-vtable correlation,2,"Shared tagged string-triplet serializer beneath the broader `0x23a` runtime-object family. The helper writes bracket tags `0x55f1/0x55f2/0x55f3` through `0x00531340`, emits the three string lanes `[this+0x206/+0x20a/+0x20e]` through `0x00531410`, dispatches vtable slot `+0x4c`, then re-enters `0x0052ec50` before writing the closing tag. Current grounded callers include the common placed-structure serializer path `0x0045b560` and the sibling-table wrapper `0x0041f650`, so this is the safest current read for the tagged string-triplet save-side helper rather than a load-side mirror.","objdump + local disassembly + serializer symmetry + sibling-vtable correlation + tagged-string correlation"
0x00455a40,3,record_collection_dispatch_entry_virtual_slot_0x44,map,thiscall,inferred,objdump + caller xrefs + local disassembly,1,"Tiny collection-side dispatcher that jumps directly through the current entry vtable slot `+0x44`. Current grounded caller is the linked-list sweep at `0x0048a766`, where it is used while iterating sibling records under `0x00556ef0/0x00556f00`. The safest current read is a raw `slot+0x44` dispatch helper rather than a more semantic serializer name.","objdump + caller xrefs + local disassembly + linked-list sweep correlation"
0x00455a50,28,record_collection_dispatch_entry_virtual_slot_0x40_and_clear_global_iteration_roots,map,thiscall,inferred,objdump + caller xrefs + local disassembly,1,"Small collection-side wrapper that pushes one caller argument into current entry vtable slot `+0x40`, then clears the three global roots at `0x006acd38`, `0x006acd3c`, and `0x006acd40`. Current grounded caller is the object-construction path at `0x0048dd77`, so the safest current read is a raw `slot+0x40` dispatch plus global-iteration-root reset helper rather than a more semantic load or attach name.","objdump + caller xrefs + local disassembly + global-root reset correlation"
0x00455a70,135,runtime_object_publish_current_position_triplet_with_height_bias,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small runtime-object helper that queries the current position pair through `0x0052e720`, converts that pair through `0x006d4024 -> 0x0051f090 -> 0x00534490`, adds one caller-supplied integer height bias, optionally rounds the result through `0x005a10d0` when `shell_has_auxiliary_preview_owner` `0x00434050` is active, and publishes the resulting triplet through `0x00530720`. Current grounded callers are the bounded-region sweeps at `0x00421fef` and `0x00461808`, which makes this the safest current read for a generic current-position triplet publisher rather than a city-entry-only helper.","objdump + caller xrefs + local disassembly + position-triplet correlation"
0x00455820,23,runtime_object_store_byte43_triplet_from_three_bytes_and_recurse_children,map,thiscall,inferred,objdump + local disassembly + wrapper inspection,2,"Tiny wrapper over `0x0052e680`. The helper forwards three caller-supplied byte lanes plus literal recursion flag `1`, causing the downstream packed-byte setter to write byte-triplet lane `[this+0x43]` and recurse across child list `[this+0x75]` when present. The safest current read is a convenience wrapper that seeds the shared packed-byte-triplet family from three explicit byte arguments.","objdump + local disassembly + wrapper inspection + packed-byte-family correlation"
0x00455840,23,runtime_object_store_byte43_triplet_from_packed_u24_and_recurse_children,map,thiscall,inferred,objdump + local disassembly + wrapper inspection,2,"Tiny wrapper over `0x0052e680`. The helper unpacks one caller-supplied dword into three byte lanes, forces recursion flag `1`, and forwards the result into the shared packed-byte setter for lane `[this+0x43]`. The safest current read is a convenience wrapper that seeds the shared packed-byte-triplet family from one packed `u24`-style value rather than three explicit byte arguments.","objdump + local disassembly + wrapper inspection + packed-byte-family correlation"
0x00455860,5,runtime_object_thunk_to_shared_formatter_0x530820,map,thiscall,inferred,objdump + local disassembly + caller correlation,1,"Tiny tail-jump thunk that forwards directly into `0x00530820`. Current grounded callers include the placed-structure UI formatter `0x0040e9d0` and the city-site connection-status formatter `0x004207d0`, so the safest current read is a shared fallback formatter thunk rather than a standalone owner.","objdump + local disassembly + caller correlation"
0x00455870,83,runtime_object_load_two_triplet_scalar_bands_from_stream_and_publish_them,map,thiscall,inferred,objdump + local disassembly + stream-load symmetry,2,"Shared load-side helper over the broader `0x23a` runtime-object family. The function reads six four-byte lanes from the caller-supplied stream through `0x00531150`, then publishes the first three as one triplet through `0x00530720` and the second three through `0x0052e8b0`. The accumulated return value is the summed byte count from those six `0x531150` reads. This is the strongest current load-side counterpart to `runtime_object_serialize_two_triplet_scalar_bands` `0x00455930` rather than an unrelated stream helper.","objdump + local disassembly + stream-load symmetry + triplet-publish correlation"
0x00455b20,72,runtime_object_initialize_base_0x23a_record_fields,map,thiscall,inferred,objdump + caller xrefs + local disassembly + field-layout correlation,2,"Shared base initializer for one `0x23a`-sized runtime object family. The helper installs base vtable `0x005cb1c0`, clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes the seven-dword block `[this+0x212..+0x22a]`, and re-enters `0x0052ecd0` before returning `this`. Current grounded callers include the city-entry temporary constructor `0x00474110`, multiple specialization loaders around `0x0045b683/0x0045c893`, and the object-construction path at `0x0048dd65`, so the safest current read is a shared base-field initializer rather than a city-only constructor.","objdump + caller xrefs + local disassembly + field-layout correlation + object-size correlation"
0x00455b00,1,runtime_object_noop_stub_vtable_5cfd00_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Literal no-op stub in the sibling `Infrastructure`-side table `0x005cfd00`. The function returns immediately with no field access or side effect. Current evidence keeps the row at that structural stub level.","objdump + vtable scan + local disassembly"
0x00455b10,1,runtime_object_noop_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second literal no-op stub in the sibling `Infrastructure`-side table `0x005cfd00`. The function returns immediately with no field access or side effect. Current evidence keeps the row at that structural stub level.","objdump + vtable scan + local disassembly"
0x00455b70,266,runtime_object_initialize_scalar_bands_from_optional_string_triplet_and_mode_defaults,map,thiscall,inferred,objdump + caller xrefs + local disassembly + field-layout correlation,2,"Shared initializer over the same `0x23a`-sized runtime object family. The helper clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes the seven-dword block `[this+0x212..+0x22a]`, re-enters `0x0052ecd0`, optionally copies up to three caller-supplied strings into `[this+0x206]`, `[this+0x20a]`, and `[this+0x20e]` through `0x0051d820`, synthesizes one default local token buffer when the middle string is absent through `0x00518de0`, chooses one effective mode string from the third or first input, derives one owner handle or transform token through `0x0051f090` unless the caller suppresses that path, and then re-enters `0x0052edf0` plus `0x0052e670` to seed the remaining runtime scalar band. Current grounded callers span the city-entry constructor `0x004741e3`, several specialization-side rebuilds, and later object constructors at `0x0048a299`, `0x0048a31d`, and `0x00490a79`, so the safest current read is a shared scalar-band initializer from optional string triplet plus mode defaults rather than a city-only helper.","objdump + caller xrefs + local disassembly + field-layout correlation + optional-string correlation + mode-default correlation"
0x00455fc0,250,runtime_object_load_tagged_string_triplet_and_reseed_scalar_bands,map,thiscall,inferred,objdump + local disassembly + serializer symmetry + sibling-vtable correlation,2,"Shared tagged-payload loader over the broader `0x23a` runtime-object family. The helper clears the scalar bands `[this+0x206/+0x20a/+0x20e/+0x22e/+0x232]`, zeroes `[this+0x212..+0x22a]`, re-enters `0x0052ecd0`, opens the tagged bracket `0x55f1..0x55f3`, reads three temporary strings through `0x00531380`, reseeds the runtime scalar band through `runtime_object_initialize_scalar_bands_from_optional_string_triplet_and_mode_defaults` `0x00455b70` with default float lanes `1.0/1.0` and flag `0`, then dispatches vtable slot `+0x48` and re-enters `0x0052ebd0`. Current grounded callers include the city-entry refresh helper `0x00474260` and the placed-structure specialization loader `0x0045c150`, so the safest current read is a shared tagged string-triplet loader plus scalar-band reseed rather than a city-only payload helper.","objdump + local disassembly + serializer symmetry + sibling-vtable correlation + scalar-band reseed correlation"
0x004560c0,53,runtime_object_query_nested_lookup_float_via_fields_0x14_0x3a_0x21,map,thiscall,inferred,objdump + local disassembly + field-chain correlation,1,"Small shared float query over the broader `0x23a` runtime-object family. When lookup root `[this+0x14]` is nonnull, the helper derives one nested table offset from `[this+0x3a]` and `[this+0x21]`, follows that chain, and returns the float at the resolved record's `+0x18`; otherwise it returns `0.0`. Current evidence grounds the lookup chain but not the higher semantic meaning of those fields, so the note stays deliberately structural.","objdump + local disassembly + field-chain correlation"
0x00418a60,372,placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small local-runtime record builder above the projected-rectangle and connected-component helpers. The function selects one template slot from the local runtime scratch family rooted at `0x0062b2f8` using index `0x0062ba74`, resolves one caller-supplied subject coordinate pair through `0x0052e720`, clones the chosen template block into one queued runtime record from the caller-owned list, refreshes its local side fields through `0x00415820`, and then re-enters `world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples` `0x004185a0` plus `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` over the cloned record's rectangle at `[record+0x4a0]`. It also refreshes several subject-link fields including `[record+0x742]`, `[record+0x74a]`, and the optional derived value at `[record+0x736]` through `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, then increments `0x0062ba74` and returns the cloned record. Current grounded caller is `0x0040e450`, which stores the result into `[site+0x24e]` and ties it back to the current placed-structure through `[record+0x73a]`, so this now looks like the current-subject local-runtime clone or refresh helper rather than another generic grid scan.","objdump + caller inspection + local disassembly + local-runtime-template correlation + projected-rect-profile correlation"
0x00418be0,346,placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader local-runtime record builder used during placed-structure construction and rebuild. The helper first resolves one live candidate id from the caller-supplied stem string through `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, then builds one projected runtime scratch payload through `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0`. It next re-enters `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, optionally refreshes one neighboring local scratch result through `placed_structure_render_local_runtime_overlay_payload_from_projected_bounds` `0x00418040`, and then copies the finished scratch block rooted at `0x0062b308` into one queued runtime record from the caller-owned list. After seeding the cloned record's link fields at `[record+0x742]`, `[record+0x74a]`, and `[record+0x736]`, it finally re-enters `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` when the record's rectangle at `[record+0x4a0]` is valid. Current grounded callers are `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, and the neighboring local-runtime refresh caller at `0x0040dc40`, so this is now the strongest current owner for building one placed-structure local runtime record from candidate stem plus projected scratch rather than an unnamed neighboring helper.","objdump + caller inspection + local disassembly + local-runtime-record correlation + overlay-payload correlation"
0x00419230,851,aux_candidate_collection_rebank_or_clone_records_by_availability_pass_and_refresh_owner_links,map,thiscall,inferred,objdump + local disassembly + caller correlation + collection-layout correlation,4,"Broader post-load follow-on refresh for the auxiliary or source record pool rooted at `0x0062b2fc`, reached directly from `aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons` `0x004196c0`. The helper first requires live scenario state `0x006cec78` and live structure-candidate pool `0x0062b268`, then runs two full passes keyed by the paired candidate availability bytes `[candidate+0xba]` and `[candidate+0xbb]`. Within each pass it scans the full auxiliary collection to find one current-bank template source record through owner-candidate dword `[entry+0x173]`, while separately trying to reuse one target slot whose prior ordinal field `[entry+0x187]` already equals the current ordinal. When no reusable slot exists it clones the current template body into the local stack image and allocates one fresh collection entry through vtable slot `+0x04`; otherwise it resolves the reusable target directly. If the chosen target differs from the current template source, the helper deep-copies the full fixed record body plus up to four optional heap payload planes at `[entry+0xcf]`, `[+0xd3]`, `[+0xd7]`, and `[+0xdb]`, with byte counts derived from footprint bytes `[entry+0xb8]` and `[entry+0xb9]` scaled by `<< 5`. It then stamps the current ordinal back into `[entry+0x187]`, formats one built-in label root from `0x005c93e8` for pass `0` or `0x005c93d8` for pass `1` into display buffer `[entry+0x22]` through `0x005a19c4`, mirrors that final text into the stem field at `[entry+0x04]`, scans the live candidate pool for an exact stem match, and stores the resolved owner-candidate id back into `[entry+0x173]`. The loop repeats for ordinals `0..11` in both passes. Current grounded caller is `0x004196c0`, so this is the safest current read for the load-side rebank-or-clone refresh that reprojects the imported `0x0062b2fc` records against live candidate availability rather than a generic collection copy helper.","objdump + local disassembly + caller correlation + collection-layout correlation + availability-pass correlation + ordinal-reuse correlation + deep-copy correlation + owner-link refresh correlation"
0x00419590,227,aux_candidate_collection_find_entry_id_by_station_detail_action_index_and_family,map,thiscall,inferred,objdump + local disassembly + caller correlation + station-detail-action correlation,3,"Resolves one auxiliary-candidate collection entry id from a small station-detail action key. The helper first formats one localized action stem by indexing the fixed string table at `0x005f3c6c` with the caller action index, then formats one second family-dependent string root from `0x005f3c80` with the caller family selector, concatenates those two local strings, and scans the live auxiliary collection for the first entry whose stem at `[entry+0x04]` matches that combined text through `0x005a57cf`. On success it returns the matching live entry id; otherwise it returns `0`. Current grounded caller is the lower `StationDetail.win` action band inside `shell_station_detail_window_handle_message` `0x00505e50`, where control `0xb3bd` selects family `1`, the sibling controls select family `2`, and the action index itself is derived from linked-site flag bits `[entry+0xc3]` before the resulting auxiliary id feeds the later world-side action query and confirmation-modal path.","objdump + local disassembly + caller correlation + station-detail-action correlation + localized-stem-table correlation"
0x00419680,46,aux_candidate_collection_release_templates_queues_and_indexed_storage,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Destructor-side wrapper for the auxiliary or source record pool rooted at `0x0062b2fc`. The helper first reinstalls vtable `0x005c9718`, re-enters `0x00416950` to walk and release every live entry plus the local-runtime scratch globals `0x0062b2f8`, `0x0062b300`, `0x0062ba58..0x0062ba74`, and the two owned helper bands at `[this+0x88]`, `[this+0x8c]`, and `[this+0x90]`, and only then tails into the shared indexed-collection teardown `0x00518bd0`. Current grounded caller is the world-release strip at `0x00434460`, where the same global root is cleared during runtime teardown, so this is the safest current read for the release-side companion to the `0x0062b2fc` collection load/save family rather than a generic collection destructor.","objdump + local disassembly + caller correlation + scratch-global correlation + teardown-order correlation"
0x004196c0,280,aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons,map,thiscall,inferred,objdump + local disassembly + caller correlation + tagged-import correlation,4,"Load-side constructor and import owner for the auxiliary or source record pool rooted at `0x0062b2fc`. The helper builds two temporary tagged import contexts around the fixed stem `0x005c93fc` through the callback trio `0x005c8190/0x005c8194/0x005c819c`, then repeatedly opens the next imported payload and re-enters `0x00414490` to decode one fixed source record into the local stack image. When that decode succeeds it dispatches the collection's allocate-or-insert vtable slot `+0x04` with the decoded record body, posts shell progress through `0x004834e0`, and continues until the tagged source is exhausted. After the import loop it re-enters `0x00419230` for the broader runtime follow-on refresh. Current grounded caller is the world-entry load branch at `0x00438c70`, where the resulting object is stored into global `0x0062b2fc`, so this is the safest current read for the load-side constructor plus stream-import companion to `aux_candidate_collection_serialize_records_into_bundle_payload` `0x00416a70` rather than a generic constructor wrapper.","objdump + local disassembly + caller correlation + tagged-import correlation + decode-owner correlation"
0x0041a990,184,aux_candidate_collection_allocate_helper_bands_and_tail_into_stream_load_refresh,map,thiscall,inferred,objdump + local disassembly + caller correlation + helper-band correlation,3,"Lower helper beneath the `0x0062b2fc` constructor family. The function clears scratch global `0x0062b304`, allocates and zero-initializes three owned helper bands, stores them into `[this+0x88]`, `[this+0x90]`, and `[this+0x8c]`, seeds those bands through `0x53dbf0` and `0x53dcf0` with literal capacities `0x65`, `0x08`, and `0x74e`, and then tail-jumps directly into `aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons` `0x004196c0`. Current grounded caller is the outer constructor `0x0041aa50`, so this is the safest current read for the helper-band allocator and import tail beneath the auxiliary or source record pool rather than a standalone collection owner.","objdump + local disassembly + caller correlation + helper-band correlation + import-tail correlation"
0x0041aa50,130,aux_candidate_collection_construct_seed_globals_and_helper_bands_then_import_records,map,thiscall,inferred,objdump + local disassembly + caller correlation + constructor correlation,3,"Constructor-side world-load owner for the auxiliary or source record pool rooted at `0x0062b2fc`. The helper runs the shared indexed-collection base initializer `0x00517ce0`, installs vtable `0x005c9718`, clears constructor-side globals `0x0062b2f0`, `0x0062b2f4`, and `0x0062b2f8`, zeroes the owned helper pointers `[this+0x88]`, `[this+0x8c]`, `[this+0x90]`, seeds `[this+0x98] = 1`, `[this+0x9c] = 0`, and the fixed float-like pair `[this+0xa0/+0xa4]`, resets shell-side dword `[0x006cec74+0x4fd]`, seeds the indexed-collection configuration through `0x00518570` with literal tuple `(1, 0x1a7, 0x0a, 5, 1, 0, 0)`, and then re-enters `aux_candidate_collection_allocate_helper_bands_and_tail_into_stream_load_refresh` `0x0041a990`. Current grounded caller is the world-entry load branch at `0x00438cc5`, which stores the finished object into global `0x0062b2fc`, so this is the current safest read for the real constructor above the `0x0062b2fc` load/import family rather than a generic collection allocator.","objdump + local disassembly + caller correlation + constructor correlation + world-load correlation"
0x004197e0,5232,placed_structure_validate_projected_candidate_placement,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy placement validator beneath the city-connection chooser and several direct mutation paths. The helper resolves one anchor placed-structure id from the current collection at `0x0062b2fc`, optionally validates the caller-supplied company through `0x0062be10`, scenario-state and shell-mode gates around `0x004338c0` and `[0x006cec7c+0x82]`, the current world tile through `0x00414bd0` and `0x00534e10`, and territory access through `0x00424010`, and then walks a large footprint-validation pass over the linked candidate record from `0x0062b268`. That deeper pass uses the candidate footprint bytes `[candidate+0xb8]` and `[candidate+0xb9]`, multiple temporary occupancy banks on the stack, route or road-side probes through `0x00448af0`, `0x004499c0`, and `0x00413df0`, and subtype-specific follow-on branches keyed by `[candidate+0x32]` plus optional route-entry and company-side arguments. The strongest current subtype-specific branch is `[candidate+0x32] == 1`, where the helper re-enters `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, checks route-entry ownership and company track-laying capacity through `0x004240a0`, tries one explicit track-attachment path through `0x00494cb0`, and then falls back to one steeper world-space sweep through `0x00448bd0`. In that branch the optional failure buffer now has a concrete station-attachment or upgrade-style family: `0x0b55` `2901` not enough room to upgrade the station, `0x0b56` `2902` ground not flat enough for the upgraded station, `0x0b57` `2903` not your track, `0x0b58` `2904` not enough available track laying capacity, `0x0b59` `2905` cannot connect to existing track but too close to lay new track, and `0x0b5a` `2906` ground too steep for this building, with older fallback strings `0x00be/0x00bf` still used on neighboring exits. The helper returns a placement-success boolean and is currently grounded as the shared go-or-no-go gate immediately before direct placement commits, without yet proving that every caller is station-only. Current grounded callers include both direct-placement lanes inside `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`, the placed-structure local rebuild branch at `0x0040dedb`, later mutation or editor-side branches at `0x00422afa`, `0x0046ef6b`, `0x0047070f`, `0x00472bcc`, `0x00472cd4`, and two shell-side callers at `0x00507f57` and `0x005083cc`.","objdump + caller xrefs + callsite inspection + company-access correlation + footprint-validation correlation + RT3.lng failure-text correlation"
0x00480210,448,placed_structure_construct_linked_site_record_from_anchor_and_coords,map,thiscall,inferred,objdump + caller inspection + constructor inspection,3,"Lower constructor beneath the linked-site allocator at `0x00481390`. The helper writes the new placed-structure id into `[this+0x00]`, stages one anchor or parent placed-structure id at `[this+0x04]`, clears the route-anchor field at `[this+0x08]`, the display-name buffer at `[this+0x46b]`, and several local list or scratch bands rooted at `[this+0x18]`, `[this+0x112]`, and `[this+0x5bd]`, then seeds local world-space state from the anchor site through `0x00455730`, `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, and the grid helper at `0x0040cec0`. It quantizes the caller-supplied coordinate pair into `[this+0x4a8]` and `[this+0x4ac]`, initializes one grid-keyed owner lane through `0x0042bbb0`, and then chooses an initial route-entry anchor into `[this+0x08]` through `0x00417b40` when one compatible route entry already covers the projected point window. When that early anchor path does not hold, the helper falls back into the neighboring literal-policy-`1` route-entry synthesis family around `0x00493cf0`: current caller correlation says that byte is the direct linked-site endpoint-anchor creation or replacement lane, after which the helper rebinds `[this+0x08]` through `0x0048abc0` and updates the boolean marker at `[this+0x46a]`. Current direct caller is `placed_structure_collection_allocate_and_construct_linked_site_record` `0x00481390`, which makes this the clearest current lower constructor for the linked-site records later published through `[site+0x2a8]`.","objdump + caller inspection + constructor inspection + route-anchor correlation + linked-site correlation + linked-site policy-byte split correlation"
0x0048a1e0,336,runtime_object_attach_infrastructure_child_with_optional_first_child_triplet_clone,map,thiscall,inferred,objdump + caller xrefs + local disassembly + rdata correlation,2,"Shared `Infrastructure` child-attach helper over the broader `0x23a` runtime-object family. The function first checks the caller's child list at `[this+0x08]`. When that list holds more than one child, it samples the first child's two triplet scalar bands through `0x0052e880` and `0x0052e720`, destroys the caller-selected prior child through vtable slot `+0x18(0)`, allocates a fresh `0x23a` object, installs vtable `0x005cfd00`, seeds it through `0x00455b70` with literal stem `Infrastructure`, attaches it back to the owner through `0x005395d0`, and republishes the sampled triplets through `0x0052e8b0` and `0x00530720`. When the owner has at most one child, it still allocates and seeds the same `Infrastructure` object but attaches it through `0x0053a5d0` without the cloned-triplet republish. Current grounded callers are the repeated builder branches around `0x004a2cde..0x004a37d9`, so this is the safest current read for attaching one seeded `Infrastructure` child with an optional first-child triplet clone rather than a subtype-specific UI helper.","objdump + caller xrefs + local disassembly + rdata correlation + child-attach correlation"
0x0048abc0,11,linked_site_set_route_entry_anchor_id_field_0x222,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny direct setter over linked-site dword `[this+0x222]`. The helper stores the caller-supplied route-entry id and returns. Current grounded callers are the linked-site constructor and refresh family at `0x00480210`, `0x00480bb0`, and nearby repair branches `0x00480463`, `0x00480968`, `0x00480ac1`, and `0x00480da1`, where this field is treated as the currently chosen route-entry anchor id. The safest current read is therefore a direct linked-site route-entry-anchor setter rather than a generic scalar write.","objdump + caller xrefs + local disassembly + route-anchor correlation"
0x0048abd0,1,linked_site_noop_stub,map,thiscall,inferred,objdump + local disassembly,1,"Literal no-op stub adjacent to the linked-site route-entry-anchor helpers. The function returns immediately with no field access or side effect. Current evidence keeps the row at that structural stub level.","objdump + local disassembly"
0x0048abe0,15,linked_site_query_mode_field_0x226_equals_2,map,thiscall,inferred,objdump + local disassembly,2,"Tiny predicate over linked-site dword `[this+0x226]`. The helper returns `1` only when that field equals literal `2`. Current local callers are still indirect through the linked-site vtable, so the field's player-facing meaning remains open; the safest current read is a direct `mode == 2` predicate over linked-site field `0x226`.","objdump + local disassembly + linked-site-field correlation"
0x0048dd50,359,runtime_object_rebuild_infrastructure_children_and_refresh_primary_child_slot,map,thiscall,inferred,objdump + local disassembly + caller correlation + rdata correlation,2,"Loop-driven `Infrastructure` child rebuild beneath the same `0x005cfd00` family. For each ordinal `0..count-1`, the helper allocates a fresh `Infrastructure` child, dispatches that child through `record_collection_dispatch_entry_virtual_slot_0x40_and_clear_global_iteration_roots` `0x00455a50`, and either tears the child down when the current ordinal is above `5` or attaches it back to the owner through `0x005395d0` after republishing the child's current triplet bands. When owner field `[this+0x248]` still points at the same ordinal index byte, it replaces that cached primary-child slot with the rebuilt child. After the loop it recomputes one grid anchor from current world-space fields, refreshes the current world cell through `0x00448a70`, conditionally re-enters `0x00493660` and `0x0048b660` when byte `[this+0x216]` equals `1`, and finally re-enters `0x0048b660` once more before returning. The current note stays structural because the user-facing subtype semantics remain open, but the `Infrastructure` child-rebuild ownership is strong.","objdump + local disassembly + caller correlation + rdata correlation + child-rebuild correlation"
0x0048e140,24,runtime_object_resolve_route_entry_from_field_0x206,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny direct resolver over owner dword `[this+0x206]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. Current grounded callers include the repeated `Infrastructure`-side builder family around `0x004a2cec` and the tracker regroup helper `0x004a4ff0`.","objdump + caller xrefs + local disassembly + route-entry-field correlation"
0x0048e160,24,runtime_object_resolve_route_entry_from_field_0x20a,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny direct resolver over owner dword `[this+0x20a]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. Current grounded callers include the repeated `Infrastructure`-side builder family around `0x004a2d15` and the tracker regroup helper `0x004a4ff0`.","objdump + caller xrefs + local disassembly + route-entry-field correlation"
0x0048e180,24,runtime_object_resolve_route_entry_from_field_0x20e,map,thiscall,inferred,objdump + local disassembly + route-entry-field correlation,2,"Tiny direct resolver over owner dword `[this+0x20e]`. When the current object is nonnull, the helper resolves that id through route-entry collection `0x006cfca8` and returns the resulting record; otherwise it returns null. It is the third direct sibling of `0x0048e140` and `0x0048e160` over the same triplet-backed route-entry field family.","objdump + local disassembly + route-entry-field correlation"
0x00490a3c,123,runtime_object_attach_optional_infrastructure_child_and_seed_three_position_lanes,map,thiscall,inferred,objdump + local disassembly + rdata correlation,2,"Optional `Infrastructure` child-attach branch beneath the same broader runtime-object family. When the caller-supplied payload stem is nonnull, the helper allocates a fresh `0x23a` object, installs vtable `0x005cfd00`, seeds it through `0x00455b70` with literal stem `Infrastructure`, and attaches it back to the current owner through `0x005395d0`. It then publishes two caller-supplied position lanes through `0x00539530`, one third lane through `0x0053a5b0`, and optionally stores the new child into owner field `[this+0x248]` when the trailing pointer argument is nonnull. The safest current read is therefore an optional `Infrastructure` child attach plus three-lane seed helper rather than a broader constructor for the whole owner object.","objdump + local disassembly + rdata correlation + child-attach correlation"
0x00413580,160,placed_structure_collection_refresh_quarter_subset_route_style_state,map,thiscall,inferred,objdump + caller inspection + collection-iteration inspection,3,"Collection-wide placed-structure sweep that refreshes one quartered subset of the route-style lane on each call. The helper derives one four-way start bucket from scenario byte `[0x006cec78+0x11]` through the local divide-by-seven ladder, then walks every fourth live placed-structure record in the collection from that starting slot, requiring each record to pass the linked-instance class gate `0x0040c990 == 1` before re-entering `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `0`. After each qualifying per-site rebuild it seeds the two trailing dword fields at `[site+0x3d9]` and `[site+0x3dd]` from `0x518d70`. Current grounded caller is the recurring simulation-maintenance branch at `0x0040a91f`, which makes this the strongest current owner for the periodic quarter-subset refresh of route-style peer-link state rather than a one-shot world-build pass.","objdump + caller inspection + collection-iteration inspection + periodic-cadence correlation + start-bucket correlation"
0x00414fa0,118,world_grid_count_flagged_cells_and_collect_float_samples,map,cdecl,inferred,objdump + callsite inspection,3,"Counts flagged cells inside the current global rectangular scan window rooted at `0x0062b7a8..0x0062b7b4` and collects one float sample per hit. The helper walks the byte-mask grid rooted through `0x0062c120+0x2135`, requires bit `0x01` on each scanned cell, reads the aligned float field through `0x00448aa0`, stores the samples into the caller buffer, and returns the number of collected entries. Current grounded caller is `0x00415020`, where this sample list is reduced into one mean value before the wider flagged-region pass continues.","objdump + callsite inspection + world-grid scan correlation"
0x00415020,1968,world_grid_refresh_flagged_region_float_extrema_and_mean,map,cdecl,inferred,objdump + caller inspection,3,"Refreshes one global flagged-region float summary family rooted at `0x0062b7b8`, `0x0062b7bc`, `0x0062b7c0`, and `0x0062b7c4`. The helper first resets the current extrema sentinels, seeds one region-dependent threshold from the world-side `0x0062b2fc+0x9c` latch, collects up to `0x80` flagged-cell float samples through `world_grid_count_flagged_cells_and_collect_float_samples` `0x00414fa0`, and reduces them to one average stored at `0x0062b7c4`. It then rescans the same flagged rectangle, updating the min and max extrema from per-cell float values while applying one build-`1.04+` compatibility branch at `0x41518e`: when no current mode override is active and the world-side latch at `0x0062b2fc+0x9c` is clear, builds below `1.04` still allow one older fallback acceptance path that later builds skip. The tail publishes one blended midpoint into `0x0062b7c0` and can reject the whole pass through the neighboring scenario or world-state gates before returning success. Current grounded caller is the higher world-grid worker at `0x0041870d`, so this is now bounded as the flagged-region float-stats refresher rather than one route-entry helper.","objdump + caller inspection + version-gate correlation + world-grid scan correlation"
0x004153f0,384,projected_rect_profile_slot_probe_template_cells_and_height_span,map,cdecl,inferred,objdump + caller xrefs + local disassembly + projected-rect correlation,3,"Shared probe beneath the projected-rectangle profile-slot selector `0x00415570`. The helper scans one fixed `8x8` template mask from `0x005edd30 + slot*8`, aligned around the current projected-rectangle origin, rejecting immediately when any required cell is out of bounds, already occupied in the temporary dword cell-value bank at `0x0062b300`, or fails the paired world-grid acceptance gates `0x00448af0(mode 0)` and `0x004499c0`. For every surviving required cell it samples the companion float grid through `0x00448aa0`, tracks local min and max values, and finally requires the sampled height span to exceed a threshold scaled from `0x005c9680`, using `1.0` or `5.0` depending on manager state `[0x0062bae0+0x88]`. Current grounded callers are the cached and iterative search paths inside `0x00415570`, so this is the strongest current read for the template-and-height-span acceptance probe rather than a generic float-range helper.","objdump + caller xrefs + local disassembly + projected-rect correlation + float-span correlation"
0x004156b0,384,placed_structure_build_projected_rect_profile_mask_bands_from_selected_slot,map,cdecl,inferred,objdump + caller xrefs + local disassembly + projected-rect correlation,3,"Builds the four projected-rectangle bitmask bands rooted at `[record+0xcf/+0xd3/+0xd7/+0xdb]` from the currently selected profile slot. The helper ensures the temporary dword cell-value bank at `0x0062b300` exists, defaults the target record to global scratch owner `0x0062b308` when the caller passes null, requires a live selected slot id at `[record+0x732]`, and then uses the fixed `8x8` template family at `0x005edd30` plus the selected profile record `[record+0x736]` to rasterize four mask planes across the candidate footprint dimensions `[record+0xb8/+0xb9/+0xba]`. As each plane is built, the helper records whether that plane received any bits through flags `[record+0x177/+0x17b/+0x17f/+0x183]`, and frees any empty plane buffer before returning; current callers seed `[record+0x736]` from `0x00413eb0` or `0x00415570` immediately before entering this helper. Grounded callers are the current-subject clone path `0x00418b36` and the broader projected-runtime scratch path `0x00418c68`, so this is the strongest current read for the selected-slot mask-band builder rather than a generic local-runtime allocator.","objdump + caller xrefs + local disassembly + projected-rect correlation + bitmask-band correlation"
0x00415f20,403,placed_structure_recursive_collect_connected_component_tile_bounds,map,thiscall,inferred,objdump + caller inspection,3,"Recursive connected-component bounds collector over linked placed-structure records. Starting from one placed-structure node, the helper expands four caller-owned tile-bound out slots from the record-local rectangle fields `[record+0x4a0..0x4ac]`, tags the record with the current component pass id at `[record+0x73e]`, then walks the component membership map rooted at `0x0062ba7c` to find adjacent records whose packed tile key falls inside the current rectangle and whose prior pass id differs. Matching adjacent records recurse through the same helper until the reachable component rectangle is exhausted. On return the helper also seeds one default local rectangle owner through `0x004159e0` when `[record+0x732] == -1`, then refreshes the neighboring runtime side through `0x0040ee10`. Current grounded callers are the wrapper at `0x004160c0` and internal recursive self-calls.","objdump + caller inspection + recursive-component correlation + placed-structure-bound correlation"
0x004160c0,168,placed_structure_collect_connected_component_tile_bounds_with_version_gate,map,cdecl,inferred,objdump + caller inspection,3,"Wrapper above `placed_structure_recursive_collect_connected_component_tile_bounds` `0x00415f20`. The helper initializes four tile-bound accumulators to sentinel values, increments one world-grid reentry depth counter at `0x0062c120+0x2205`, and then chooses between two paths. On builds `1.03` and earlier, or when scenario field `[0x006cec78+0x46c38]` is still clear, it re-enters the recursive component walk through `0x00415f20`; otherwise it skips that older walk entirely. In both cases it decrements the reentry counter and then expands the surviving rectangle by `2` tiles on each side before publishing it through `0x0044d410`. Current grounded caller is the route-entry-backed component wrapper at `0x004161a0`, so this now looks like the version-gated connected-component bounds collector rather than another generic tracker helper.","objdump + caller inspection + version-gate correlation + connected-component correlation"
0x00416170,345,placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tile-range wrapper above `placed_structure_collect_connected_component_tile_bounds_with_version_gate` `0x004160c0`. The helper seeds the current connected-component pass keys at `0x0062ba7c` and `0x0062ba80`, iterates the caller-supplied tile rectangle, allocates or reuses one small per-tile record from the caller-owned queue, and looks up the packed `(row << 16) | col` key through the component map rooted at `0x0062ba7c` via `0x0053dae0`. When one mapped component record exists and the current placed-structure owner at stack arg `+0x0c` still has `[site+0x732] == -1`, the world-side latch at `[0x0062b2fc+0x9c]` is clear, scenario field `[0x006cec74+0x4fd]` is clear, and the caller-supplied suppress-refresh flag at stack arg `+0x10` is zero, it follows the mapped component chain and re-enters `0x004160c0` for each linked record; otherwise it clears one world-grid byte through `0x00448a70`. The resolved or refreshed record is then stored back through `0x0053d9e0` and `0x0053d960`. Current grounded callers are the neighboring local-runtime passes at `0x00418a60` and `0x00418be0`, so this is now the strongest current owner for mapping one tile rectangle into connected-component records with optional bounds refresh rather than another bare recursive walk.","objdump + caller inspection + local disassembly + connected-component-map correlation"
0x00416830,164,aux_candidate_record_chain_callback_collect_unique_link_keys_into_save_queue,map,cdecl,inferred,objdump + local disassembly + caller correlation + queue-correlation,3,"Save-side callback beneath `aux_candidate_collection_serialize_records_into_bundle_payload` `0x00416a70`. The helper walks the caller record's linked chain rooted at `[entry+0x04]`, follows each node's forward link at `[node+0x04]` to the terminal node, and then chooses one dedupe key from either the raw terminal id or the transformed key `0x7fffffff - id` depending on the callback mode dword at `[arg+0x00]`. It probes the temporary scored-node set rooted at `0x0062ba58` through `0x53d440`, pushes only unique keys through `0x53d320`, and increments the queued-count latch at `0x0062ba64`. Current grounded caller is the save-side collection walk inside `0x00416a70`, so this is the safest current read for the unique link-key gather callback that seeds the temporary save queue rather than a generic chain iterator.","objdump + local disassembly + caller correlation + queue-correlation + dedupe-key correlation"
0x004168e0,106,aux_candidate_collection_release_entry_optional_mask_planes_and_erase,map,thiscall,inferred,objdump + local disassembly + caller correlation + field-layout correlation,3,"Per-entry release helper beneath the `0x0062b2fc` auxiliary or source record pool. The helper resolves one live entry by id through the collection vtable, frees any optional plane allocations still owned by that record at `[entry+0xcf]`, `[+0xd3]`, `[+0xd7]`, and `[+0xdb]`, and then erases the entry through the shared indexed-collection removal path `0x00518a30`. Current grounded caller is the broader collection teardown body `0x00416950`, so this is the safest current read for the per-entry optional-mask-plane release plus erase helper rather than a generic indexed-collection callback.","objdump + local disassembly + caller correlation + field-layout correlation + erase-path correlation"
0x00416950,283,aux_candidate_collection_release_live_entries_scratch_roots_and_helper_bands,map,thiscall,inferred,objdump + local disassembly + caller correlation + teardown-order correlation,4,"Broader release body beneath `aux_candidate_collection_release_templates_queues_and_indexed_storage` `0x00419680`. The helper walks every live entry in the `0x0062b2fc` collection, re-enters `0x004168e0` to free the per-entry optional planes and erase the slot, clears the shared scratch root `0x0062b300`, releases the temporary scored-node family rooted at `0x0062ba58..0x0062ba74`, and then tears down the three owned helper bands at `[this+0x88]`, `[this+0x8c]`, and `[this+0x90]` through the `0x53dbe0/0x53dcb0` release pair before freeing their backing roots. Current grounded caller is the destructor-side wrapper `0x00419680`, so this is the safest current read for the real live-entry plus scratch-band teardown body rather than a generic collection cleanup.","objdump + local disassembly + caller correlation + teardown-order correlation + helper-band correlation"
0x00416a70,621,aux_candidate_collection_serialize_records_into_bundle_payload,map,thiscall,inferred,objdump + caller inspection + local disassembly + bundle-save correlation,4,"Save-side collection owner for the auxiliary or source record pool rooted at `0x0062b2fc`, reached directly from the early package-save prelude `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`. The helper first allocates one temporary scored-node queue at `0x0062ba58`, clears the queued-count latch `0x0062ba64`, and walks collection field `[this+0x88]` through `0x53db20` with callback `0x00416830`, which scans each record's linked chain at `[entry+0x04]`, deduplicates the chain nodes through `0x53d440`, and pushes unique nodes into the queue through `0x53d320` while counting them in `0x0062ba64`. It then writes one leading `0x0c`-byte header whose first dword is the fixed tag `0xbabe`, derives one normalized world-space float pair through `0x00415370`, and drains the queued nodes through `0x53d390`. For each popped live record it serializes the fixed dword band at `[record+0x74a]`, `[+0x04]`, `[+0x08]`, `[+0x0c]`, `[+0x4b8]`, and `[+0x4bc]`, the counted inline dword run rooted at `[record+0x10]` with count `[record+0x49c]`, the fixed `0x10`-byte payload at `[record+0x4a0]`, the optional counted byte payload `[record+0x4c0]` with count `[record+0x4c4]`, the counted dword run rooted at `[record+0x4c8]` with count `[record+0x65c]`, the paired one-byte streams rooted at `[record+0x664]` and `[record+0x6c9]` with count `[record+0x72e]`, and the trailing dword at `[record+0x732]`. When the queue drains it releases the temporary scored-node queue and clears the scratch globals `0x0062ba58..0x0062ba74` plus cache slot `0x005ee030`. Current grounded caller is the fixed save-order branch at `0x0044528c`, immediately before chunk `0x3315`, so this is the safest current read for the direct package-save serializer over the `0x0062b2fc` record family rather than another tagged collection wrapper.","objdump + caller inspection + local disassembly + bundle-save correlation + scored-queue correlation + scratch-global correlation"
0x00416e20,156,indexed_collection_resolve_live_entry_id_by_stem_string,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small live-entry resolver over an indexed collection. The helper walks the live slot count through `indexed_collection_slot_count` `0x00517cf0`, fetches each live id through `indexed_collection_get_nth_live_entry_id` `0x00518380`, resolves the backing record through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and compares the caller-supplied string against the record stem at `[record+0x04]` through `0x005a57cf`. On success it returns the matching live id. On failure it emits localized id `189` through the shell string helpers and returns `-1`. Current grounded callers are the neighboring placed-structure local-runtime builders at `0x00418be0` and `0x0040e450`, plus one shell-side branch at `0x00507e80`, so this is now the strongest current match for a stem-to-live-id resolver rather than an unowned search loop.","objdump + caller inspection + local disassembly + stem-compare correlation"
0x00416ec0,1867,placed_structure_build_projected_runtime_scratch_from_candidate_and_coords,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Heavy projected-runtime scratch builder beneath the neighboring local placed-structure runtime family. The helper resolves one candidate record from the caller-supplied id, derives rotated footprint extents and centered world-space bounds from the caller-supplied coordinate and heading inputs, allocates and clears several temporary per-footprint mask bands on the stack, then walks up to four candidate-side shape or access sublanes rooted at `[candidate+0xcf]`, `[candidate+0xd3]`, `[candidate+0xd7]`, and `[candidate+0xdb]`. Within that deeper loop it projects rotated footprint cells through the basis pair at `0x006d4024`, rejects out-of-bounds or duplicate cells, checks multiple world-grid acceptance gates through `0x00448af0`, `0x00534e10`, `0x004499c0`, and `0x00413df0`, and marks the surviving cells into both temporary stack masks and the live world-grid byte lane at `[0x0062c120+0x2131]`. The tail publishes the finished scratch payload through `0x00416620`. Current grounded caller is `0x00418be0`, which then copies that scratch block into one queued local runtime record, so this is now the safest current name for the projected-runtime scratch builder rather than a generic placement validator.","objdump + caller inspection + local disassembly + projected-footprint correlation"
0x00418040,1168,placed_structure_render_local_runtime_overlay_payload_from_projected_bounds,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Heavy local-runtime overlay-payload builder beneath the broader local-runtime record family. The helper derives one projected bounds rectangle through `0x004142e0` and `0x00417f20`, rejects very small payloads, allocates one temporary dword buffer, folds that buffer through `0x00415370`, and then walks the projected rectangle producing one packed dword payload per cell. Current bounded gates include a duplicate-entry or occupancy fast path keyed by `[var_10h]`, world-grid rejection through `0x004499c0`, and several distance- and ratio-shaped thresholds built from the projected rectangle geometry. On accepted cells it writes one four-byte packed value into the caller output stream. Current grounded caller is `placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch` `0x00418be0`, where the result is stored into `[0x0062b7c8]`, so this is now the safest current read for the local-runtime overlay payload renderer rather than a generic geometric sweep.","objdump + caller inspection + local disassembly + overlay-payload correlation"
0x00414470,10,placed_structure_cache_projected_rect_profile_slot_id,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tiny setter for the projected-rectangle profile-slot cache at `0x005ee030`. The helper just stores the caller-supplied dword into that global cache. Current grounded caller is `0x0040e450`, where the cached value is set immediately before the current-subject local-runtime clone path at `0x00418a60`.","objdump + caller inspection + local disassembly + global-cache correlation"
0x00414490,1063,aux_candidate_record_stream_decode_fixed_fields_and_optional_mask_planes,map,cdecl,inferred,objdump + local disassembly + caller correlation + field-layout correlation,4,"Low decode body beneath the `0x0062b2fc` auxiliary or source record import family. The helper reads the fixed record header and six `0x1e`-byte string bands into the caller record image at `[record+0x04]`, `[+0x22]`, `[+0x40]`, `[+0x5e]`, `[+0x7c]`, and `[+0x9a]`, imports the small scalar tail at `[+0xb8/+0xb9/+0xba/+0xbb/+0xbf/+0xc3/+0xc7/+0xcb/+0xcd]`, applies the two exact-stem fixups that rewrite `[record+0xcd]` to `0x81` or `0x9d`, and then derives one footprint-sized plane length from `[record+0xb8] * [record+0xb9] << 5`. It allocates and zeroes up to four optional heap planes at `[record+0xcf]`, `[+0xd3]`, `[+0xd7]`, and `[+0xdb]`, decodes the packed nibble or bitplane payload into those four buffers, stamps the corresponding presence latches at `[record+0x177]`, `[+0x17b]`, `[+0x17f]`, and `[+0x183]`, frees any plane whose decode path stayed empty, seeds `[record+0x1a3] = 1.0f`, and returns a success flag. Current grounded caller is `aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons` `0x004196c0`, so this is the current safest read for the fixed record decode plus optional mask-plane materializer rather than a generic stream helper.","objdump + local disassembly + caller correlation + field-layout correlation + optional-plane correlation"
0x00416620,521,placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Publishes one projected-runtime rectangle and its companion globals beneath the local-runtime scratch builder. The helper copies the current scratch owner id from `0x0062b304` into `0x0062b308`, stores the caller-supplied pair into `0x0062b30c/0x0062b310`, grows the active rectangle bounds at `0x0062b7ac` and `0x0062b7b4` when needed, clears one current index slot in `0x0062b318`, and then validates the rectangle against the route-entry store `0x006cfca8` through `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`. On failure it raises localized id `185`; on one special-candidate branch keyed by `[record+0x123]` it re-enters `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, either expands the rectangle by three cells on each side and refreshes the per-cell side tables through `world_grid_refresh_projected_rect_surface_and_region_byte_tables` `0x00414e10` or fails with localized id `186`; and on the ordinary branch it can scan the temporary cell-value bank at `0x0062b300` across the rectangle and fail with localized id `187` before again tailing into `0x00414e10`. Current grounded callers are `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0` and the placement validator `0x004197e0`, so this now looks like the projected-runtime rectangle publisher plus side-window validator rather than an anonymous scratch tail.","objdump + caller inspection + local disassembly + projected-rectangle-global correlation"
0x00415570,317,placed_structure_try_select_projected_rect_profile_slot,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small projected-rectangle profile selector beneath `0x00416620`. The helper ensures the temporary dword cell-value bank at `0x0062b300` exists, resets the shared slot id at `0x0062ba3a`, derives one companion value through `0x00413eb0` into `0x0062ba3e`, and then probes the current rectangle at `0x0062b7a8..0x0062b7b4` through repeated `0x004153f0` checks. One fast path reuses the cached selector at `0x005ee030`; one fallback seeds the same search from localized id `11` through `0x00518be0`; and one final iterative path scans slots `0..11` until the probe accepts. On success the helper writes the chosen slot id into `0x0062ba3a`, and the cache fast path also clears `0x005ee030` back to `-1` after consuming it. Current grounded caller is the special-candidate branch inside `0x00416620`, where the returned success decides whether the rectangle can be expanded and the companion byte tables refreshed. This is therefore best-read as a projected-rectangle profile-slot selector rather than a broad route or placement policy helper.","objdump + caller inspection + local disassembly + rectangle-probe correlation"
0x00414e10,200,world_grid_refresh_projected_rect_surface_and_region_byte_tables,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Refreshes two compact per-cell byte tables for the current projected rectangle rooted at `0x0062b7a8..0x0062b7b4`. The helper scans every cell in that rectangle, counts processed entries in `0x0062ba36`, writes one nibble-packed byte into the table at `0x0062b96c` from the paired world-grid queries `0x00534040` and `0x005340a0`, writes one companion byte into `0x0062b9d1` through `0x00533f80`, and zeroes both tables for out-of-bounds cells. Current grounded callers are the two success paths inside `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, so this is now the safest current read for the projected-rectangle per-cell surface or region byte refresh rather than a generic grid scan.","objdump + caller inspection + local disassembly + projected-rectangle-byte-table correlation"
0x00494240,195,route_entry_collection_query_rect_window_passes_entry_type_gate,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Rectangle-window gate over the route-entry collection `0x006cfca8`. The helper first derives one route-entry search window from the caller-supplied projected rectangle through `0x00449df0`, then scans every route-entry id in that window through `0x00492130` and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. It rejects when a covered entry owns byte `[entry+0x226]` outside the tolerated family, except for the caller-enabled permissive branch that still admits kinds `0x0c` and `0x0d`. Current grounded caller is `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, where a failing result produces localized id `185`, so this is now the strongest current read for the route-entry-type gate over the projected rectangle rather than a generic collection scan.","objdump + caller inspection + local disassembly + route-entry-window correlation"
0x00411cb0,30,structure_candidate_release_runtime_descriptor_and_cargo_membership_tables,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Tiny release-side helper beneath the port-or-warehouse candidate runtime family. The helper clears the two cargo-membership pointer tables at `[this+0x79c]` and `[this+0x7a0]` and then clears the descriptor-array pointer at `[this+0x37]`, all through the shared release helper `0x0053afd0`. Current grounded callers sit in the same candidate rebuild and teardown strip as `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, so this is the safest current read for the narrow descriptor-and-membership release sibling rather than a generic pointer scrub.","objdump + local disassembly + caller correlation + release-helper correlation"
0x00411ce0,99,structure_candidate_refresh_recipe_runtime_mode_flags_0x78c_0x790,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Post-import mode-flag classifier immediately beneath `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`. The helper clears candidate dwords `[this+0x78c]` and `[this+0x790]`, then only runs its descriptor scan when byte `[this+0x32]` equals `2`. In that mode it starts with `[this+0x78c] = 1`, walks every live `0xbc` runtime descriptor in `[this+0x37]`, sets `[this+0x790] = 1` when it finds any mode-`0` descriptor, and clears `[this+0x78c]` when it finds any mode-`0` descriptor whose subordinate-row count at `[desc+0x2c]` is zero. If the scan finishes without ever seeing a mode-`0` descriptor, it forces `[this+0x78c]` back to `1`. So the strongest current static read is a two-flag summary over the freshly imported recipe runtime strip: `[this+0x790]` records whether any mode-`0` runtime descriptor exists, while `[this+0x78c]` stays armed only for subtype-`2` cases where every mode-`0` descriptor carries at least one subordinate row, or where no mode-`0` descriptors exist at all. Current grounded caller is `0x00412d70`.","objdump + local disassembly + caller correlation + descriptor-scan correlation"
0x00411d50,58,structure_candidate_query_all_runtime_descriptors_are_mode0_and_any_direct_descriptor_exists,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Predicate over the candidate's current `0xbc` runtime descriptor strip. It walks all descriptors in `[this+0x37]` and returns true only when every descriptor keeps mode dword `[desc+0x00] == 0` and at least one descriptor also has subordinate-row count `[desc+0x2c] == 0`; any nonzero mode descriptor forces immediate failure. Current grounded callers are editor-side summary passes `0x004cbb3b` and `0x004d26d4`, where it acts as a narrower descriptor-pattern gate than the broader post-import flags `[this+0x78c/+0x790]`.","objdump + local disassembly + caller inspection + descriptor-pattern correlation"
0x00411d90,1,structure_candidate_post_collection_construct_noop_placeholder,map,thiscall,inferred,objdump + caller correlation,1,"Bare `ret` placeholder in the candidate bringup strip. Current grounded caller is the world-entry load branch at `0x00438ca0`, immediately after the live candidate pool `0x0062b268` is constructed and before the auxiliary candidate collection at `0x0062b2fc` is allocated. Current local evidence does not show any side effects beyond preserving that callsite boundary.","objdump + caller correlation + world-entry load-strip correlation"
0x00411da0,111,structure_candidate_try_copy_fixed_profile_slot_0x798_name_and_scalar_pair,map,thiscall,inferred,objdump + local disassembly + caller inspection + fixed-table inspection,2,"Reads one fixed metadata row selected by candidate slot `[this+0x798]` from table `0x005ed338..0x005edca4`. When that slot is not `-1` and the row's leading name pointer at `+0x04` is nonnull, the helper copies the pointed zero-terminated string to the caller buffer and writes the two adjacent scalar dwords from row offsets `+0x0c` and `+0x10` to the caller outparams before returning `1`; otherwise it returns `0`. Current grounded caller is the placed-structure specialization service around `0x0045b245`, so this is the safest current read for the fixed slot-`0x798` name-plus-scalar-pair accessor rather than a more specific asset-label decode.","objdump + local disassembly + caller inspection + fixed-table inspection"
0x00411e10,50,structure_candidate_try_query_positive_fixed_profile_slot_0x798_scalar_and_trailing_value,map,thiscall,inferred,objdump + local disassembly + caller inspection + fixed-table inspection,2,"Queries the same fixed metadata row selected by candidate slot `[this+0x798]` from table `0x005ed338..0x005edca4`. When the slot is valid and the row dword at offset `+0x14` is positive, the helper writes row dword `+0x20` to the caller outparam and returns `1`; otherwise it returns `0`. Current grounded caller is the timed placed-structure specialization variant service `0x0045baf0`, where it acts as a prerequisite gate before the heavier fixed-row payload copy sibling `0x00411e50`.","objdump + local disassembly + caller inspection + fixed-table inspection"
0x00411e50,133,structure_candidate_try_copy_fixed_profile_slot_0x798_name_and_scalar_triplet,map,thiscall,inferred,objdump + local disassembly + caller inspection + fixed-table inspection,2,"Reads the same fixed metadata row selected by candidate slot `[this+0x798]` from table `0x005ed338..0x005edca4`. When the slot is valid and row dword `+0x14` is positive, the helper copies the pointed zero-terminated string at row offset `+0x04` to the caller buffer, writes row dwords `+0x18`, `+0x1c`, and `+0x14` to the caller outparams, and returns `1`; otherwise it returns `0`. Current grounded caller is the timed placed-structure specialization variant service `0x0045baf0`, so this is the safest current read for the fixed slot-`0x798` name-plus-scalar-triplet accessor rather than a narrower effect-family decoder.","objdump + local disassembly + caller inspection + fixed-table inspection"
0x00411ee0,451,structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables,map,thiscall,inferred,objdump + callsite inspection + local disassembly,3,"Rebuilds the per-candidate cargo-membership tables and scaled per-cargo rate band after one runtime descriptor array has been materialized. The helper clears the two compact cargo-id tables at `[this+0x79c]` and `[this+0x7a0]`, their counts at `[this+0x7a4]` and `[this+0x7a8]`, and the thirteen-dword per-cargo accumulator band rooted at `[this+0x0a1]`, then fills one local `0x35`-byte scratch status array from the live `0xbc` descriptor strip in `[this+0x37]`. The year-status rule is tighter now too: with current scenario year `[0x006cec78+0x0d]`, or fallback year `0x709` when no live world is present, each subordinate cargo row is marked `2` only while `start_year <= current_year < end_year`; rows outside that active window still contribute status `1` as referenced cargo. The helper keeps the maximum status seen per remapped cargo id through `0x0062ba8c+0x9a`. The scaled-rate side is tighter in the same way: for descriptor mode `0` it multiplies each subordinate row amount by the shared production-cap float `[this+0x2a]` and divides by the descriptor amount `[desc+0x04]`, while nonzero-mode descriptors bypass that normalization and publish their row amount directly. After the scan it counts every cargo with scratch status `>= 1` into `[this+0x7a4]`, every cargo with status `>= 2` into `[this+0x7a8]`, allocates the two final `u16` id tables as `(count*2)+1`-byte buffers, zeroes them, and compacts the `status>=1` and `status>=2` sets into `[this+0x79c]` and `[this+0x7a0]` respectively. That keeps the stronger current split narrow and concrete: the first table is the referenced-cargo set, the second is the currently active-cargo set, and the per-cargo float band at `[this+0x0a1..+0x0b8]` is the same cap-scaled runtime rate band later queried by `0x004129d0`. Current grounded callers are the collection-wide rebuild sweeps at `0x00412bd0` and `0x00412d70`.","objdump + callsite inspection + local disassembly + scenario-state correlation + cargo-collection correlation + membership-table compaction correlation + year-window correlation"
0x004120b0,1119,structure_candidate_stream_load_runtime_record_and_rebuild_cargo_state,map,thiscall,inferred,objdump + local disassembly + caller correlation,4,"Stream-load owner for one live structure candidate record beneath the broader collection load path at `0x00412fb0`. The helper seeds runtime id `[this+0xe4]` from its first caller argument, clears the cargo-membership pointers and mode-summary band at `[this+0x79c..+0x7b0]`, sets the cached summary year `[this+0x788] = -1`, opens one named bundle slot through `0x00530c80`, and then reads the packed candidate body through repeated `0x00531150` calls. The fixed header import is tighter now too: it reads one outer dword header, then the candidate stem or display band at `[this+0x04]` length `0x1e`, the scalar fields at `[this+0x22]`, `[this+0x2a]`, and `[this+0x2e]`, the year words `[this+0x26/+0x28]`, byte `[this+0x32]`, and runtime descriptor count `[this+0x33]`. The descriptor strip itself is allocated as `count*0xbc + 1` bytes into `[this+0x37]`, then every `0xbc` slot is zeroed before the raw read. Descriptor import is tighter in the same way: mode-`0` descriptors immediately resolve their primary token string at `+0x08` back into cargo id `[desc+0x1c]`, subordinate-row descriptors resolve each row token at `+0x30 + row*0x1c` back into `[desc+0x44 + row*0x1c]`, and both paths clamp the descriptor start-year word `[desc+0x20]` upward to the resolved cargo availability floor at `[cargo+0x21]`. The later import band is explicit too: bundles at `>= 0x3ed` load `[this+0x3b..+0xbb]`, including the scalar strip `[this+0x3b/+0x3f/+0x43/+0x47/+0x4b]`, label band `[this+0x4f]`, summary quartet `[this+0x8c..+0xa0]`, per-cargo float lanes `[this+0xa1..+0xb8]`, and selector bytes `[this+0xb9..+0xbb]`; bundles at `>= 0x3f2` then load the wider `0x24`-byte trailer at `[this+0xc0]`, while older bundles keep that trailer in its narrow `0x02`-byte form. When `[this+0x4b]` is nonzero the helper also forces `[this+0x47] = 1.0`, rescales `[this+0x43]` from `[this+0x22]` through `0x005a10d0`, and clamps the final value to at least `0x1388`. After closing the slot through `0x00530a00` it re-enters `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` and `structure_candidate_refresh_recipe_runtime_mode_flags_0x78c_0x790` `0x00411ce0`, resets stem index `[this+0x798]` to `-1`, normalizes the candidate stem through the two built-in aliases at `0x005c8f94` and `0x005c8e4c`, and then scans the fixed row table `0x005ed338..0x005edca4` until it finds the matching stem index. Current grounded caller is the collection-wide stream-load path at `0x00412fb0`.","objdump + local disassembly + caller correlation + bundle-slot correlation + descriptor-year-floor correlation + stem-table correlation + version-gate correlation + field-width correlation"
0x00412510,72,structure_candidate_is_enabled_for_current_runtime_year_gate,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small enable-or-year gate beneath the live candidate cargo-summary family. The helper first requires latch `[this+0x7ac]` to be nonzero. When shell state `[0x006cec74+0x17c]` is already armed it returns true immediately; otherwise it consults the scenario-side runtime gate at `[0x006cec78+0x46c38]` and compares the current effective year from `[0x006cec78+0x05]` or `[0x006cec78+0x0d]` against candidate word `[this+0x26]`, returning true only when the scenario year has reached that threshold. Current grounded callers are the collection-side wrapper at `0x00413de0` and the linked-count cargo-summary accumulator at `0x0041e795`, so this is the safest current read for the candidate-side availability gate above `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650` rather than a general profile or editor predicate.","objdump + local disassembly + caller correlation + year-gate correlation"
0x00412560,144,structure_candidate_runtime_descriptor_is_active_for_current_year_and_selected_mode_bank,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Descriptor-level activity gate beneath the port or warehouse cargo runtime family. The helper first special-cases descriptor mode `0` by requiring the primary cargo id at `[desc+0x1c]` to map through the live cargo-availability latch at `0x0062ba8c[cargo].+0x16e`; it then requires the current scenario year at `[0x006cec78+0x0d]` to lie inside the inclusive descriptor year window `[desc+0x20]..[desc+0x22]`. The selected-bank split is tighter now too: when caller bank `0` is active the helper rejects descriptors whose dword gate `[desc+0x24]` is nonzero, while caller bank `1` rejects descriptors whose dword gate `[desc+0x28]` is nonzero. When special-condition slot `31` `Use Wartime Cargos` at `[0x006cec78+0x4afb]` is clear and the descriptor owns subordinate cargo rows, it also requires every subordinate cargo id in the `0x1c`-byte row band at `[desc+0x44]` to keep that same live cargo-availability latch `[cargo+0x16e]` nonzero. Current grounded callers are `structure_candidate_count_active_mode0_descriptors_with_live_subrows_for_selected_bank` at `0x004125f0`, `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, and neighboring world-side query branches around `0x0040fb8d`, `0x00410721`, and `0x00410b71`.","objdump + caller xrefs + callsite inspection + cargo-availability-latch correlation + selected-bank-gate correlation + special-condition correlation"
0x004125f0,87,structure_candidate_count_active_mode0_descriptors_with_live_subrows_for_selected_bank,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Counts the currently active mode-`0` runtime descriptors that still own at least one subordinate row for one caller-selected mode bank. The helper walks the current descriptor array at `[this+0x37]`, keeps only descriptors whose mode dword at `[desc+0x00]` is zero and whose subordinate row count at `[desc+0x2c]` is positive, and then reuses `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560` before incrementing the returned count. Current grounded caller is `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, where the resulting count is used to divide the shared production-cap float across the active mode-`0` descriptors that contribute cap-shared subordinate-row output.","objdump + caller xrefs + callsite inspection + cap-share-bank correlation"
0x00412650,543,structure_candidate_query_cargo_runtime_summary_channels,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,3,"Lazy per-candidate cargo summary query over the runtime descriptor array rebuilt from the editor's port or warehouse recipe books. On a year change it stamps the current scenario year into `[this+0x788]`, clears four `0x6a`-dword summary banks rooted at `[this+0x0e8]`, `[this+0x290]`, `[this+0x438]`, and `[this+0x5e0]`, and then walks every live `0xbc` descriptor across both mode banks `0` and `1` through `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560`. The bank split is tighter now too because it is driven first by descriptor mode and then by whether subordinate rows exist. Mode-`0` descriptors with no subordinate rows accumulate their primary cargo scalar `[desc+0x04]` into the direct primary-cargo bank rooted at `[this+0x03a]`, keyed by resolved cargo id `[desc+0x1c]`. Mode-`0` descriptors with subordinate rows first divide the shared production-cap float at `[this+0x2a]` by the active-descriptor count from `structure_candidate_count_active_mode0_descriptors_with_live_subrows_for_selected_bank` at `0x004125f0`, then publish that cap share into the primary-cargo bank rooted at `[this+0x0a4]`, again keyed by `[desc+0x1c]`, and finally scale each subordinate row amount `[desc+0x48+row*0x1c]` into the zero-mode subrow bank rooted at `[this+0x178]`, keyed by `[desc+0x44+row*0x1c]`. Nonzero-mode descriptors bypass the primary-cargo banks entirely and accumulate their subordinate-row amounts directly into the nonzero-mode subrow bank rooted at `[this+0x10e]`, keyed by `[desc+0x44+row*0x1c]`. The return epilogue reads one caller-selected cargo lane back out of those exact roots as four distinct out channels: direct primary-cargo scalar from `[this+0x03a]`, cap-share primary-cargo scalar from `[this+0x0a4]`, nonzero-mode subrow scalar from `[this+0x10e]`, and zero-mode cap-scaled subrow scalar from `[this+0x178]`. There is still no post-resolution failure guard between the importer writes and this consumer, so unresolved imported marker rows would still fall into the first summary-bank bucket here. Current caller-side evidence keeps that boundary narrow too: steady-state helpers do not probe cargo id `0` like an ordinary cargo lane, and the explicit `cargo id 0` placed-structure branch bypasses the normal cargo-reference helper for linked-site classification instead. Current grounded callers are the lightweight wrappers at `0x00412960` and `0x004129a0`, the cargo-membership helper at `0x004129d0`, and the broader world-side accumulator at `0x0041e7be`.","objdump + caller xrefs + local disassembly + callsite inspection + scenario-state correlation + year-stamp correlation + cargo-id-0 caller-boundary correlation"
0x00412960,49,structure_candidate_query_direct_and_normalized_supply_channels,map,thiscall,inferred,objdump + callsite inspection,3,"Tiny wrapper over `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. It forwards the caller's mode-bank and cargo id unchanged, then returns the sum of the wrapper's two supply-side out lanes rather than exposing all four summary channels directly. Current grounded steady-state caller is `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690`, where a positive result is treated as the direct-supply-side cargo presence test. The wrapper does not add any post-query special case for unresolved cargo bucket `0`; it just sums the returned supply-side floats.","objdump + callsite inspection + wrapper-correlation"
0x004129a0,45,structure_candidate_query_scaled_production_output_channel,map,thiscall,inferred,objdump + callsite inspection,3,"Tiny wrapper over `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. It forwards the caller's mode-bank and cargo id unchanged, then returns the single scaled production-output subrow channel without combining it with the neighboring supply lanes. Current grounded steady-state caller is `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690`, where a positive result is treated as the scaled-supply or production-side cargo presence test. Like the sibling wrapper at `0x00412960`, it does not special-case unresolved cargo bucket `0` after the underlying query returns.","objdump + callsite inspection + wrapper-correlation"
0x004129d0,179,structure_candidate_supports_or_references_cargo_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Returns whether the current runtime structure candidate materially references one requested cargo id. The helper first scans the compact secondary cargo-membership table rooted at `[this+0x7a0]` with count `[this+0x7a8]`; when no direct match is found it queries `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650` for mode bank `0` and treats the candidate as relevant when the returned nonzero-mode subrow channel plus zero-mode cap-scaled subrow channel are positive. One final fallback follows the global cargo remap at `0x0062ba8c+0x9a`: if the requested cargo has a valid remap target, the helper checks the two cached per-cargo accumulator bands rooted at `[this+0x0a1]` and `[this+0x0ad]` for that remapped index before deciding. The current caller picture is tighter too: the placed-structure sweep around `0x00452e60` only enters this helper when the requested cargo id is nonzero. When that sweep receives requested id `0`, it explicitly routes around the cargo-reference branch into a separate linked-site or station-or-transit gate over the current placed structure's subtype latch, linked site id `[site+0x2a8]`, and the narrower linked-site predicate at `0x0047fd50`. So this helper itself does not currently look like the intentional owner for a null-cargo query.","objdump + caller xrefs + callsite inspection + cargo-summary correlation + caller-branch correlation + linked-site-bypass correlation"
0x00412a90,22,structure_candidate_collection_destructor_reset_vtable_and_release_indexed_storage,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small destructor-side wrapper for the live structure-candidate pool rooted at `0x0062b268`. The helper first resets the collection vtable to `0x005c93cc`, then releases the indexed live-entry storage through `indexed_collection_release_slot_storage` `0x00518600` and tails into the common indexed-collection cleanup `0x00518bd0`. Current grounded caller is the global teardown branch at `0x00434480`, where the current candidate pool is destroyed immediately before the backing object is freed through `0x0053b080`.","objdump + local disassembly + caller correlation + global-pool-teardown correlation"
0x004128e0,119,structure_candidate_refresh_stem_overridable_policy_dword_0xbc,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small stem-table policy refresh beneath the candidate collection support family. The helper seeds `[this+0xbc]` with default `0x1869f`, overrides that default to `3` when post-import flag `[this+0x78c]` is armed, or to `4` when subtype byte `[this+0x32] == 2`, and then walks the fixed eight-byte `(stem_ptr, value)` table at `0x005edca8..0x005edd20`. Each row compares the candidate display stem at `[this+0x04]` against the table stem through `0x005a5f26`, and on the first exact match it overwrites `[this+0xbc]` with the paired table dword before returning. Current grounded caller is the collection-wide sweep `0x00412ab0`, so this is the safest current read for a stem-overridable policy dword refresh rather than a broader candidate rebuild owner.","objdump + local disassembly + caller correlation + stem-table correlation + post-import-flag correlation"
0x004128d4,12,aux_candidate_collection_find_entry_id_by_runtime_owner_id_e4,map,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Tiny resolver over the auxiliary collection at `0x0062b2fc`. The helper scans that collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, compares each live entry's owner or runtime id dword at `[entry+0x173]` against the caller candidate's runtime id `[candidate+0xe4]`, and returns the matching collection id or `0` when none match. Current grounded caller is the wrapper at `0x00413dd0`, so this is the safest current read for the auxiliary-record lookup by candidate runtime owner id rather than a broader collection service owner.","objdump + local disassembly + caller correlation + collection-scan correlation"
0x00413d80,68,aux_candidate_entry_query_owner_subtype1_grid_basis_pair_words_0xcb_0xcd,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small auxiliary-entry helper beneath the projected-footprint placement family. It resolves the owning structure candidate from the auxiliary entry's runtime-owner id dword `[entry+0x173]` through the live candidate pool `0x0062b268`, requires the resolved candidate subtype byte `[candidate+0x32]` to equal `1`, and on success copies candidate words `[candidate+0xcb]` and `[candidate+0xcd]` into the caller output pointers before returning `1`; all other cases return `0`. Current grounded caller is `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, where those two words act as the local grid basis pair beneath rotated footprint projection.","objdump + local disassembly + caller correlation + auxiliary-owner correlation + projected-footprint correlation"
0x00413dd0,18,aux_candidate_entry_owner_candidate_is_enabled_for_current_runtime_year_gate,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Tiny availability wrapper over one auxiliary candidate entry. The helper resolves the owning structure candidate from auxiliary dword `[entry+0x173]` through the live candidate pool `0x0062b268`, then tail-jumps into `structure_candidate_is_enabled_for_current_runtime_year_gate` `0x00412510`. Current grounded caller is the neighboring summary family around `0x00413de0`, so this is the narrow auxiliary-entry year-visibility gate rather than a broader collection query.","objdump + local disassembly + caller correlation + auxiliary-owner correlation + year-gate correlation"
0x00413df0,183,projected_rect_packed_cell_list_try_append_unique_xy_with_optional_highbit_flag_and_expand_quarter_bounds,map,fastcall,inferred,objdump + caller xrefs + local disassembly + global-field correlation,3,"Shared packed-cell cache helper beneath the projected-runtime scratch and placement-validator families. The helper treats `ECX` and `EDX` as one world-cell pair, combines them with the caller-supplied boolean or small mode in `EAX` into one packed dword, and then scans the temporary list rooted at `0x0062b318` for an existing entry whose low `31` bits already match the same cell pair. When no duplicate exists it appends the new packed dword, terminates the list with `-1`, and expands the coarse quarter-resolution bounds at `0x0062b7a8..0x0062b7b4` from the same cell pair shifted right by `2`. The top bit is deliberately ignored by the duplicate test, so the third argument is best read as an optional per-cell high-bit mark rather than part of the spatial key. Current grounded callers are the projected-footprint scan inside `0x004174dd..0x00417529`, the projected-runtime scratch builder `0x00416ec0`, and the later placement-validator subtype branch around `0x00419ee4`.","objdump + caller xrefs + local disassembly + projected-runtime correlation + global-field correlation"
0x00413bc0,435,station_place_format_preview_description_block_from_profile_text_and_rule_tables,map,thiscall,inferred,objdump + local disassembly + caller correlation + string-table correlation,3,"Formats the multiline description block consumed by the StationPlace preview panel. The helper starts by publishing the current placement record's text at `[record+0x40]` through `0x00518de0`, then uses repeated casefolded compares against record text `[record+0x7c]` and several fixed string tables rooted at `0x005f3c80`, `0x005c94c4`, `0x005c94a0`, and `0x005c947c` to decide which explanatory lines still need to be appended through the same text-publish path. One early branch also selects between format roots `0x005c94d4` and `0x005c94ec` based on dword `[record+0x141]`. Current grounded caller is `station_place_format_preview_panel` `0x00508730`, where this helper owns the paired description block for preview control `0x6984`. The safest current read is therefore a preview-description formatter over one placement profile and several fixed rule tables, rather than a generic message-box or region helper.","objdump + local disassembly + caller correlation + string-table correlation + StationPlace preview correlation"
0x00413eb0,95,placed_structure_lookup_projected_rect_profile_record_by_label_at_field_0x123,map,cdecl,inferred,objdump + local disassembly + caller correlation + table-layout correlation,3,"Lookup helper beneath the projected-rectangle profile-slot family. It walks the fixed `0x5ef3f0` table in `0xb0`-byte steps, compares each entry's active label pointer against the caller record text rooted at `[arg+0x123]` through `0x005a57cf`, and on the first match returns the enclosing table record base. When no match exists it returns null. Current grounded caller is `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, which uses the returned record to derive companion value `0x0062ba3e` before probing the projected rectangle. This is therefore the safest current read for the fixed projected-rectangle profile-record lookup rather than a broader string-table scan.","objdump + local disassembly + caller correlation + table-layout correlation + projected-rectangle correlation"
0x00412ab0,56,structure_candidate_collection_refresh_stem_overridable_policy_dword_0xbc,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide sweep over the live candidate manager that simply re-enters `structure_candidate_refresh_stem_overridable_policy_dword_0xbc` `0x004128e0` for every live record. The helper walks the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then refreshes the per-candidate dword `[candidate+0xbc]` from the current stem table and the current post-import flag state at `[candidate+0x78c]` plus subtype byte `[candidate+0x32]`. Current grounded callers sit in the same load and collection-service strip as `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70`, so this is the narrow collection-side owner above that stem policy refresh.","objdump + local disassembly + caller correlation + collection-sweep correlation + post-import-policy correlation"
0x00412d70,563,structure_candidate_collection_rebuild_runtime_records_from_scenario_state,map,thiscall,inferred,objdump + local disassembly + caller xrefs + callsite inspection,4,"Collection-wide runtime-state rebuild over the structure or candidate manager at `0x0062b268`. The helper runs two banked passes keyed by the paired availability bytes `[candidate+0xba]` and `[candidate+0xbb]`, and within each bank it steps through the twelve scenario-side recipe books at offsets `0x0fe7 + ordinal*0x4e1`. For each ordinal it scans the live candidate collection twice conceptually: one path remembers the last availability-qualified candidate in the current bank as the template source record, while the parallel reuse path looks for a candidate whose prior ordinal field `[candidate+0x794]` already equals the current ordinal so that same live slot can be reused. When no reusable target exists it allocates one fresh candidate record through collection vtable slot `+0x04` and zeroes its `0x1f2`-dword body; otherwise it resolves the reusable target and clears its dependent pointer fields `[candidate+0x79c]`, `[candidate+0x7a0]`, and `[candidate+0x37]`. When the chosen target differs from the bank template source, it clones the full `0x1f2`-dword template body first. It then seeds the rebuilt candidate from the active scenario state rooted at `0x006cec78`: `[candidate+0x794]` becomes the current ordinal, `[candidate+0xe4]` keeps the live collection id, `[candidate+0x33]` takes the imported recipe-line count from `[state+0x1024]`, `[candidate+0x2a]` takes the shared production-cap float from `[state+0x13d4]`, and `[candidate+0x37]` receives a freshly allocated copy of the packed `0xbc` descriptor array from `[state+0x1028]`. The label side is narrower than earlier notes too: this rebuild owner does not consult the scenario-side recipe-book name at `[state+0x0fe8]`. Instead it formats display stem `[candidate+0x04]` directly from one of the two fixed built-in roots `0x005c93d8` or `0x005c93e8`, chosen by availability bit `[candidate+0xba] & 1`, together with the current ordinal. After that projection it refreshes the dependent cargo summary tables through `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` `0x00411ee0` and the neighboring mode-flag pass `0x00411ce0`. Current grounded callers are the tail of `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630` and the larger collection load path at `0x00412fb0`, so this is the candidate-side bridge that projects editor recipe-book state into live runtime records rather than a generic collection copy loop.","objdump + local disassembly + caller xrefs + callsite inspection + scenario-state correlation + ordinal-reuse correlation + template-clone correlation + display-stem-correction"
0x00412ca0,192,world_region_pick_commercial_profile_label_by_region_rank,map,thiscall,inferred,objdump + strings + callsite inspection,4,"Selects one category-3 candidate label from the global structure pool `0x0062b268` for the current region bucket. The helper converts the caller-supplied region rank through the region-count manager at `0x0062bae0`, uses that derived bucket to read per-candidate weights from `[candidate+region_index*4+0x8d]`, repeatedly subtracts those weights across up to five passes while only considering pool entries whose category byte at `[candidate+0x32]` is `3`, and copies the chosen candidate name into the caller buffer. When no weighted category-3 candidate survives the sweep it falls back to the static token `Commercial` at `0x005c92e8`. A later region-stats panel lines the same third slot up with localized id `1040` `City Support`, so current evidence treats this as the low-level label picker for a broader city-support family whose fallback token happens to be `Commercial`. The current grounded caller is `world_region_balance_structure_demand_and_place_candidates` at `0x004235c0`.","objdump + rdata strings + callsite inspection + region stats disassembly + RT3.lng strings"
0x004133b0,132,placed_structure_collection_refresh_local_runtime_records_and_position_scalars,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Collection-wide wrapper above the placed-structure local-runtime clone and side-refresh helpers. The function first drains the queued placed-structure id list rooted at `0x0062ba64/0x0062ba6c/0x0062ba70` by reading the queue count through `placed_structure_local_runtime_site_id_queue_count` `0x00414480` and popping ids through `placed_structure_local_runtime_site_id_queue_pop_next` `0x00413f50`; for each popped id it resolves the owning placed structure through collection `0x0062b2fc` and re-enters `placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem` `0x0040e450`. It then pumps the scenario-side service at `0x004834e0`, walks every live placed structure in `0x0062b26c`, and re-enters `placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon` `0x0040ee10` on each one. The current grounded caller sits inside the `Setting up Players and Companies...` `319` lane of `world_run_post_load_generation_pipeline` immediately after the auxiliary route-entry tracker collection refresh on `0x006cfcb4` through `0x004a41b0`, and immediately before the flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0` plus the later route-entry post-pass `0x00491c20` on `0x006cfca8`. That makes this the clearest current owner for refreshing cloned local-runtime records plus the per-site position-scalar side pass rather than an anonymous collection sweep.","objdump + caller inspection + local disassembly + local-runtime-queue correlation + collection-refresh correlation + post-load-pipeline correlation"
0x00413f50,47,placed_structure_local_runtime_site_id_queue_pop_next,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Pop-next helper over the temporary placed-structure id queue rooted at `0x0062ba64/0x0062ba6c/0x0062ba70`. When queue storage exists and the current count at `0x0062ba64` is positive, the helper returns the current head dword from `0x0062ba70`, advances that cursor by four bytes, and decrements the count; otherwise it returns `-1`. Current grounded caller is `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, where the popped ids are resolved through collection `0x0062b26c` before cloned local-runtime records are rebuilt.","objdump + caller inspection + local disassembly + local-runtime-queue correlation"
0x00414230,24,intrusive_slist_push_head_and_increment_count,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny intrusive singly linked list helper over a three-dword owner rooted at `[this+0x00/+0x04/+0x08]`. The caller-supplied node pointer is linked at the head, the previous head becomes the new node's next pointer, tail `[this+0x04]` is seeded when the list was previously empty, and count `[this+0x08]` is incremented. Current grounded callers include the support-family owners around `0x00522933` and `0x005562d1`, so this is the safest current read for the common push-head helper rather than a projected-runtime-specific queue owner.","objdump + caller xrefs + local disassembly + intrusive-list correlation"
0x00414250,22,intrusive_slist_pop_head_and_decrement_count,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny intrusive singly linked list pop helper over the same three-dword owner as `0x00414230`. When the head is nonnull it unlinks the current head, updates tail `[this+0x04]` when the list becomes empty, and decrements count `[this+0x08]`. Current grounded callers include the support-family owners at `0x00556291` and `0x005562b6`, so this is the clearest current read for the common pop-head companion rather than a projected-runtime-specific queue helper.","objdump + caller xrefs + local disassembly + intrusive-list correlation"
0x00414270,64,world_replay_packed_projected_cell_list_into_compact_grid_mode2_with_set_or_clear,map,cdecl,inferred,objdump + caller xrefs + local disassembly + compact-grid correlation,3,"Iterates one sentinel-terminated packed projected-cell list and replays each entry into compact grid bank `2` through `0x004497a0`. Each packed dword contributes one `(x, y)` pair from its low and high `15`-bit halves; the caller-supplied stack flag decides whether the helper sets or clears the corresponding compact-grid bit, while the desired-state and mode operands are otherwise fixed. Current grounded callers are the paired wrappers `0x004142c0` and `0x004142d0`, and the surrounding placement-validator branch at `0x0040dea9/0x0040def8`, so this is the strongest current read for replaying one projected-cell list into compact-grid mode `2` rather than a generic packed-list walker.","objdump + caller xrefs + local disassembly + compact-grid correlation + placement-validator correlation"
0x004142c0,12,world_clear_packed_projected_cell_list_from_compact_grid_mode2,map,cdecl,inferred,objdump + caller xrefs + wrapper inspection,2,"Tiny clear-side wrapper over `world_replay_packed_projected_cell_list_into_compact_grid_mode2_with_set_or_clear` `0x00414270`. It forwards the caller's packed projected-cell list with stack flag `0`, which clears each covered bit from compact-grid bank `2`. Current grounded caller is the placement-validator prepass around `0x0040dea9`.","objdump + caller xrefs + wrapper inspection + compact-grid correlation"
0x004142d0,12,world_set_packed_projected_cell_list_into_compact_grid_mode2,map,cdecl,inferred,objdump + caller xrefs + wrapper inspection,2,"Tiny set-side wrapper over `world_replay_packed_projected_cell_list_into_compact_grid_mode2_with_set_or_clear` `0x00414270`. It forwards the caller's packed projected-cell list with stack flag `1`, which sets each covered bit in compact-grid bank `2`. Current grounded caller is the placement-validator cleanup path around `0x0040def8`.","objdump + caller xrefs + wrapper inspection + compact-grid correlation"
0x004142e0,102,packed_projected_cell_list_query_bounds_rect,map,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Bounds helper over one sentinel-terminated packed projected-cell list. The helper scans each packed cell dword, extracts the low and high `15`-bit coordinates, tracks inclusive minima and maxima, and writes the finished rectangle into the caller output struct as `(min_x, min_y, max_x, max_y)`. Current grounded callers are `placed_structure_render_local_runtime_overlay_payload_from_projected_bounds` `0x00418040`, the neighboring projected-payload path at `0x0041852c`, the multiplayer callback root `0x0046df75`, and the small rect-copy wrapper `0x00414450`, so this now reads as the shared bounds extractor for projected-cell lists rather than an anonymous geometry helper.","objdump + caller xrefs + local disassembly + projected-cell-list correlation"
0x00414480,6,placed_structure_local_runtime_site_id_queue_count,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tiny count getter over the temporary placed-structure id queue used by the local-runtime refresh family. The helper simply returns the current queue count at `0x0062ba64`. Current grounded caller is `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, where the returned count bounds the queue-drain loop before the later all-sites side refresh.","objdump + caller inspection + local disassembly + local-runtime-queue correlation"
0x0041aae0,28,linked_route_object_temp_record_construct_vtable_5c9748,simulation,thiscall,inferred,objdump + local disassembly + vtable correlation,2,"Tiny constructor-side helper for the stack-local temporary linked-route-object record used by the tagged bundle refresh owner `0x0041d3f0`. The helper re-enters the shared base initializer `0x0045c890` and then installs vtable `0x005c9748` before returning. Current grounded caller is the per-entry loop inside `linked_route_object_collection_refresh_records_from_tagged_bundle` `0x0041d3f0`, so this is the safest current read for the temporary `0x5c9748` record constructor rather than a reusable live collection owner.","objdump + local disassembly + vtable correlation + caller correlation"
0x0041ab00,14,linked_route_object_temp_record_reset_to_vtable_5c9748_and_release_base_payload,simulation,thiscall,inferred,objdump + local disassembly + vtable correlation,2,"Tiny release-side helper paired with `linked_route_object_temp_record_construct_vtable_5c9748` `0x0041aae0`. The helper restores vtable `0x005c9748` on the temporary stack-local record and then tails into the shared base release path `0x0045c460`. Current grounded caller is the per-entry loop inside `linked_route_object_collection_refresh_records_from_tagged_bundle` `0x0041d3f0`, where it tears the temporary record down after the destination entry consumes it through virtual slot `+0x40`.","objdump + local disassembly + vtable correlation + caller correlation"
0x0041d7a0,22,locomotive_era_collection_release_tagged_records_and_collection_storage,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Release-side wrapper for the locomotive-era collection rooted at `0x0062ba88`. The helper restores vtable `0x005c9824`, re-enters `0x00518600` to release collection-side entry state, and then tails into the shared indexed-collection teardown `0x00518bd0`. Current grounded caller is the world teardown owner `0x00434300`, where the same global root is cleared and freed during runtime shutdown, so this is the safest current read for the release companion to the era-collection load/save family rather than a generic collection destructor.","objdump + local disassembly + caller correlation + collection-teardown correlation"
0x0041d7c0,1520,locomotive_era_collection_stream_load_tagged_records_import_engine_type_content_and_seed_runtime_sidecars,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + tagged-import correlation,4,"Broader tagged import owner for the locomotive-era collection rooted at `0x0062ba88`, reached directly from constructor `0x0041e170`. The helper runs two outer passes over the repeated tagged source opened through callback trio `0x005c8190/0x005c8194/0x005c819c` around the fixed stem `0x005c993c`, validates one fixed field set against the built-in tag strings `0x005c9934..0x005c9884`, and when the record layout passes it dispatches collection vtable slot `+0x04` into `locomotive_era_collection_allocate_entry_import_tagged_record_and_seed_named_sidecar_handles` `0x0041de60` to allocate or insert one live `0x88`-byte era record. The imported live record keeps its fixed scalar and string bands in-place, owns one nested collection at `[entry+0x196]`, and the import owner seeds that nested collection by matching imported strings against the global named table at `[0x006d4020+0x429b8]` and pushing the resolved rows through `0x0053d110`. Current grounded caller is `locomotive_era_collection_construct_and_stream_load_tagged_records` `0x0041e170`. Current package-save inspection has still found no mirrored early world-bundle serializer for `0x0062ba88`, so the safest current read remains a world-load or content-import owner rather than a save-side collection twin.","objdump + local disassembly + caller correlation + tagged-import correlation + nested-sidecar correlation + era-collection correlation + package-save-order correlation"
0x0041e170,49,locomotive_era_collection_construct_and_stream_load_tagged_records,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + constructor correlation,3,"Constructor-side world-load owner for the locomotive-era collection rooted at `0x0062ba88`. The helper runs the shared indexed-collection base initializer `0x00517ce0`, installs vtable `0x005c9824`, seeds the collection through `0x00518570` with literal tuple `(1, 0x266, 0x0a, 5, 1, 0, 0)`, and then immediately re-enters `locomotive_era_collection_stream_load_tagged_records_and_seed_runtime_sidecars` `0x0041d7c0`. Current grounded caller is the world-entry load branch at `0x00438cf7`, which stores the finished object into global `0x0062ba88`, so this is the current safest read for the constructor above the era-collection tagged load seam rather than a generic collection allocator.","objdump + local disassembly + caller correlation + constructor correlation + world-load correlation"
0x0041d3f0,197,linked_route_object_collection_refresh_records_from_tagged_bundle,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + collection-family correlation,3,"Collection-wide tagged load owner for the linked-route-object family rooted at `0x0062ba84`. The helper opens the `0x4a39/0x4a3a/0x4a3b` bracket through `0x00531360`, refreshes collection-side metadata through `0x00518680`, then walks every live linked-route-object record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. For each live record it seeds one stack-local temporary entry through `0x0041aae0`, copies that temporary vtable into the destination record root, dispatches the destination record through virtual slot `+0x40`, and then tears the temporary record down through `0x0041ab00` before closing tag `0x4a3b`. Current grounded caller is the world-entry bringup branch at `0x0044452b`, where this helper runs directly on `0x0062ba84` between the placed-structure dynamic-side-buffer bundle lane and the live train collection load. This is the safest current read for the linked-route-object tagged load owner rather than another anonymous `0x5c9748`-family collection walk.","objdump + local disassembly + caller correlation + collection-family correlation + tag-family correlation"
0x0041d4c0,118,linked_route_object_collection_serialize_records_into_tagged_bundle,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + collection-family correlation,3,"Collection-wide tagged save owner for the linked-route-object family rooted at `0x0062ba84`. The helper emits tag family `0x4a39/0x4a3a/0x4a3b` through `0x00531340`, serializes collection-side metadata through `0x00517d90`, then walks every live linked-route-object record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` before dispatching each record through virtual slot `+0x44` with the caller bundle. Current grounded caller is the early package-save prelude at `0x00445433`, where it runs directly on `0x0062ba84` between the placed-structure dynamic-side-buffer tagged save and the live train collection serializer. This is the safest current read for the linked-route-object tagged save owner rather than another anonymous `0x5c9748`-family collection walk.","objdump + local disassembly + caller correlation + collection-family correlation + tag-family correlation"
0x0041ddc0,160,locomotive_era_collection_remove_entry_by_id_release_nested_sidecars_and_erase,simulation,thiscall,inferred,objdump + local disassembly + vtable correlation + caller correlation,3,"Per-entry release owner for the locomotive-era collection rooted at `0x0062ba88`, reached through vtable `0x005c9824` slot `+0x08`. The helper resolves the current live entry through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, releases the main sidecar handle at `[entry+0x12a]`, drops the nested handle band rooted at `[entry+0x19a]` through repeated `0x0053c000`, destroys the nested collection at `[entry+0x196]`, and then erases the live entry id through `0x00518a30`. Current grounded callers are the collection vtable and the broader release wrapper `0x0041d7a0`, so this is the safest current read for the era-entry remove-and-release owner rather than a generic collection delete leaf.","objdump + local disassembly + vtable correlation + caller correlation + nested-sidecar correlation"
0x0041de60,789,locomotive_era_collection_allocate_entry_import_tagged_record_and_seed_named_sidecar_handles,simulation,thiscall,inferred,objdump + local disassembly + vtable correlation + string correlation,3,"Per-record import allocator for the locomotive-era collection rooted at `0x0062ba88`, reached through vtable `0x005c9824` slot `+0x04` from `0x0041d7c0`. The helper allocates or inserts one live `0x88`-byte era entry through `0x00518900`, loads the engine-type content payload identified by the fixed stem `Data/EngineTypes/%1.cgo`, seeds one nested collection at `[entry+0x196]`, and resolves imported named rows against the global table at `[0x006d4020+0x429b8]` before committing the live sidecar handles. Current local strings and callers make this a content-import owner for one era record rather than a package-save restore sibling.","objdump + local disassembly + vtable correlation + string correlation + caller correlation + engine-type-content correlation"
0x0041e010,234,locomotive_era_collection_publish_intro_notice_and_service_current_year_type2_entries,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + year-gate correlation,3,"Immediate world-load follow-on over the locomotive-era collection rooted at `0x0062ba88`. When the early-year gate sees current year `[0x006cec78+0x0d] == 0x770` with start year `[+0x05] < 0x770` and runtime branch `[+0x46c38] == 0`, the helper first publishes the paired introductory text ids `0xcb/0xcc` through `0x00473f80`. It then only continues when the current year is at least `0x726`, scans every live era entry, keeps only records whose threshold year `[entry+0x105]` exactly matches the current year and whose type dword `[entry+0x41]` equals `2`, derives the current company or issue context through `0x004337b0/0x004337a0`, re-enters `locomotive_era_and_engine_type_pass_company_policy_gate` `0x0041d550`, and on success publishes the linked locomotive or era-side notice through `0x004337c0` with fixed text stem `0x005c87a8`. Current grounded caller is the same world-load and setup-side phase family that services the era collection after import, so this is the safest current read for the early intro-notice plus current-year type-`2` era-record service pass rather than a generic collection walk.","objdump + local disassembly + caller correlation + year-gate correlation + notice-publish correlation"
0x0041e100,103,locomotive_era_collection_find_first_live_entry_matching_type_and_current_year_window,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + year-window correlation,3,"Small live-entry query over the locomotive-era collection rooted at `0x0062ba88`. The helper walks every live entry through `0x00518380/0x00518140`, keeps only records whose type dword `[entry+0x41]` matches the caller-supplied selector, and then compares the current scenario year `[0x006cec78+0x0d]` against the record window `[entry+0x105..+0x109]`. On the first match it returns the corresponding live entry id through `0x00518380`; otherwise it returns zero. Current grounded callers sit in the neighboring era-collection policy and chooser strip, so this is the safest current read for the first-matching type-and-year-window query rather than a generic collection search helper.","objdump + local disassembly + caller correlation + year-window correlation + entry-type correlation"
0x0041e8e0,63,structure_candidate_collection_refresh_filter_and_year_visible_summary_blocks_from_packed_state,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small packed-state load wrapper over the live structure-candidate collection at `0x0062ba8c`. The helper opens two tagged packed blocks through `0x00531360` with ids `0x6979` and `0x697a`, forwards the caller's packed-state source plus side flag into `0x00518680`, and returns the combined consumed size. Current grounded caller is the later world-entry or restore-side branch at `0x00444375`, immediately after the candidate-count refresh family has run, so this is the safest current read for the candidate-summary packed-state load sibling rather than a direct count recompute helper.","objdump + local disassembly + caller correlation + packed-state correlation"
0x0041e930,48,structure_candidate_collection_serialize_filter_and_year_visible_summary_blocks,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small packed-state save wrapper over the same structure-candidate summary family at `0x0062ba8c`. The helper opens the tagged blocks `0x6979` and `0x697a` through `0x00531340`, forwards the caller's packed-state sink plus side flag into `0x00517d90`, and returns after both writes complete. Current grounded caller is the early package-save prelude `0x00444dd0`, which emits this save-side companion before the later tagged collection serializers, so this is the safest current read for the candidate-summary packed-state save sibling rather than a direct filter refresh helper.","objdump + local disassembly + caller correlation + packed-state correlation"
0x0041ede0,1784,structure_candidate_collection_stream_load_records_seed_name_catalogs_and_refresh_filter_sidebands,map,thiscall,inferred,objdump + local disassembly + caller correlation + collection-layout correlation,4,"Broader tagged import owner for the live structure-candidate collection rooted at `0x0062ba8c`, reached directly from constructor `0x0041f4e0` and the later reset-side sibling `0x0041f530`. The helper first clears the three named candidate id slots `[this+0x88/+0x8a/+0x8c]`, opens the repeated tagged source through callback trio `0x005c8190/0x005c8194/0x005c819c` around the fixed stems `0x005c9a08/0x005c9a10`, and reads up to `0x1f3` fixed `0xc9`-byte source records into one local stack array. It then lexicographically reorders that local array through repeated `0x005a57cf` compares before walking the sorted records and materializing live `0xd0`-byte candidate entries through collection vtable slot `+0x04`. For each live record it stamps the resolved id into `[entry+0x3e]`, derives the float-like policy triplet `[entry+0x4a/+0x4e/+0x52]` from imported scalar lanes and current shell mode, marks the three built-in named candidates through bytes `[entry+0x46..+0x49]` when the imported stem at `[entry+0x04]` matches `0x005c99f0`, `0x005c99d8`, or `0x005c99d0`, and writes the matching ids back into collection slots `[this+0x8a]`, `[this+0x88]`, and `[this+0x8c]`. The same import pass also seeds the fixed display-name catalogs rooted at `0x0061312c`, `0x00613173`, `0x006150f8`, and the twelve-row band rooted at `0x005f7f9f`. When the insertion sweep finishes it clears `[this+0x8e/+0x92/+0x96]` plus the full `[this+0x9a]` class-index band, rescans every live candidate name, stores the ids of the three built-in named candidates into `[this+0x92]`, `[this+0x8e]`, and `[this+0x96]`, writes the corresponding class markers `1/0/2` into `[this+0x9a + id*4]`, and then tails into `structure_candidate_collection_refresh_cargo_economy_filter_flags` `0x0041eac0`. Current grounded callers are `0x0041f4e0` and `0x0041f530`, so this is the safest current read for the real structure-candidate tagged load plus fixed-name catalog seed owner rather than a generic collection parser.","objdump + local disassembly + caller correlation + collection-layout correlation + tagged-import correlation + fixed-name-catalog correlation"
0x0041e970,121,structure_candidate_collection_refresh_filter_and_year_visible_counts,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide counter refresh over the live structure-candidate pool at `0x0062ba8c`. The helper clears aggregate counts `[this+0x242]` and `[this+0x31a]`, then walks all `0x35` candidate slots through the collection accessors. For each live slot it stores the cargo-economy or editor-filter flag `[entry+0x56]` into one per-slot band rooted at `[this+0x246]`, increments `[this+0x31a]` when that flag is nonzero, re-enters `structure_candidate_is_enabled_for_current_year` `0x0041e220`, stores that result into the paired per-slot band rooted at `[this+0x16e]`, and increments `[this+0x242]` when the year-visible gate succeeds. Current grounded callers include the periodic boundary-service path at `0x0040a56a`, the post-fast-forward setup tail at `0x00437192`, the cargo-economy filter refresh family at `0x0041eac0/0x0041f584`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring locomotive-side bridge at `0x00464aa8`, so this is the safest current read for the shared candidate-collection filter and year-visible count rebuild rather than a one-off world-entry helper.","objdump + local disassembly + caller correlation + candidate-count correlation + year-visible correlation"
0x0041f4e0,77,structure_candidate_collection_construct_and_stream_load_records_then_refresh_counts,map,thiscall,inferred,objdump + local disassembly + caller correlation + constructor correlation,3,"Constructor-side world-load owner for the live structure-candidate collection rooted at `0x0062ba8c`. The helper runs the shared indexed-collection base initializer `0x00517ce0`, installs vtable `0x005c997c`, clears the three named-candidate id slots `[this+0x88/+0x8a/+0x8c]`, seeds the collection through `0x00518570` with literal tuple `(1, 0xd0, 0x0a, 5, 1, 0, 0)`, and then immediately re-enters `structure_candidate_collection_stream_load_records_seed_name_catalogs_and_refresh_filter_sidebands` `0x0041ede0` plus `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`. Current grounded caller is the world-entry load branch at `0x00438c5c`, which stores the finished object into global `0x0062ba8c`, so this is the safest current read for the constructor above the structure-candidate tagged load seam rather than a generic collection allocator.","objdump + local disassembly + caller correlation + constructor correlation + world-load correlation"
0x0041f530,89,structure_candidate_collection_release_live_entries_reimport_tagged_records_and_refresh_counts,map,thiscall,inferred,objdump + local disassembly + caller correlation + reset-path correlation,3,"Reset-side sibling over the live structure-candidate collection at `0x0062ba8c`. When the collection currently holds live entries, the helper walks every live id through `0x00518380/0x00518140` and dispatches entry vtable slot `+0x08` to release per-entry state, then clears the three named-candidate id slots `[this+0x88/+0x8a/+0x8c]`, re-enters `structure_candidate_collection_stream_load_records_seed_name_catalogs_and_refresh_filter_sidebands` `0x0041ede0`, and finally reruns `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`. Current grounded callers are the later post-load count-refresh family and nearby world-entry restore branches, so this is the safest current read for the in-place candidate reset or reimport sibling rather than a standalone destructor.","objdump + local disassembly + caller correlation + reset-path correlation + entry-release correlation"
0x0041e9f0,87,cargo_collection_find_entry_id_by_exact_name,map,thiscall,inferred,objdump + local disassembly + collection-correlation,3,"Exact string matcher over the live cargo collection at `0x0062ba8c`. The helper walks the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, compares the caller-supplied token string against each entry name at `[cargo+0x04]` through `0x005a57cf`, and returns the first matching live cargo entry id from `0x00518380` or `0` on failure. Current grounded callers are the recipe-runtime importer `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630` and its neighboring collection service branches around `0x0041ea50`, so this now looks like the shared live cargo-name-to-id resolver beneath recipe import and setup-side cargo text matching rather than an anonymous collection walk.","objdump + local disassembly + collection-correlation + caller correlation + return-value correction"
0x0041ea50,179,structure_candidate_collection_run_post_load_local_service_setup_phase,map,cdecl,inferred,objdump + local disassembly + caller context,3,"Post-load world-generation subphase over the live structure-candidate collection at `0x0062ba8c`. The helper derives one modulo-`6` bucket from current world byte `[0x006cec78+0x0f]`, then walks the full collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. When the caller-supplied phase flag is zero it only dispatches candidates whose loop ordinal falls into that current modulo bucket; otherwise it runs the full pass. Every selected candidate is then forwarded into `structure_candidate_rebuild_local_service_metrics` `0x0041e2b0`. Current grounded callsite is the early candidate sweep inside `world_run_post_load_generation_pipeline` `0x004384d0` immediately before the localized progress update `Setting up Players and Companies...`, so this is a candidate-local post-load setup phase rather than a building-collection owner.","objdump + local disassembly + caller context + collection-correlation + modulo-bucket correlation"
0x0041e220,52,structure_candidate_is_enabled_for_current_year,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Common live-availability gate for one structure-candidate record. The helper first requires the cargo-economy or editor filter flag at `[this+0x56]` to be nonzero, then compares the current scenario year against the candidate threshold at `[this+0x21]`, using either `[0x006cec78+0x05]` or `[+0x0d]` depending on the runtime branch latched at `[0x006cec78+0x46c38]`. Current grounded callers include the collection counter refresh at `0x0041e970`, the placed-structure cargo-bitset sweep at `0x0042c690`, and several later shell or world-side candidate-selection branches, so this now looks like the shared year-and-filter gate beneath the editor's cargo-economy path rather than a setup-only helper.","objdump + caller xrefs + callsite inspection + cargo-economy filter correlation"
0x0041e650,142,structure_candidate_query_route_style_or_local_availability_metric,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + collection-correlation,3,"Returns one candidate-side float metric whose meaning splits on the route-style byte at `[this+0x46]`. When that byte is zero the helper simply returns the cached local float at `[this+0x5a]`. When it is nonzero it resolves one grouped routing-class value from candidate field `[this+0x3e]` through the structure-candidate collection side table at `0x0062ba8c+0x9a`, then walks collection `0x006ada90` through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` to count entries whose class byte at `[entry+0x10]` matches, whose state byte at `[entry+0x12]` carries bit `0x2`, and whose word at `[entry+0x08]` is zero. It returns that matched count divided by the fixed float constant at `0x005c8554`. Current grounded callers include two sortable-value branches inside `shell_load_screen_render_map_cargo_list_panel` at `0x004e9460` and one neighboring shell renderer around `0x004f46d0`, so this now looks like the shared route-style-versus-local availability metric beneath candidate cargo summaries rather than a generic price reader.","objdump + caller xrefs + callsite inspection + collection-correlation + route-style-byte correlation"
0x0041e7be,261,structure_candidate_accumulate_positive_cargo_summary_channels_scaled_by_link_count,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Broader world-side accumulator above `structure_candidate_query_cargo_runtime_summary_channels` `0x00412650`. For one caller-selected cargo id and mode bank it first queries the four returned summary channels, rejects immediately unless the direct primary-cargo scalar, cap-share primary-cargo scalar, nonzero-mode subrow scalar, and zero-mode cap-scaled subrow scalar are all strictly positive, then queries one linked-instance count through `0x00413940`. When that count is positive it multiplies each of the four channel values by the linked-instance count and accumulates those four scaled results into caller-owned floats before finally copying the finished quartet into candidate dwords `[candidate+0x8e/+0x92/+0x96/+0x9a]`; it also stamps the current scenario tick or year field from `[0x006cec78+0x15]` into `[candidate+0x8a]` after the outer loop completes. Current grounded callers are the broader placed-structure cargo service and world-side rebuild paths above the candidate projection family, so this is now the strongest current read for the first positivity-gated consumer that treats the four cargo-summary banks as one linked-count-scaled quartet rather than as independent query outputs.","objdump + local disassembly + caller inspection + cargo-summary correlation + link-count correlation"
0x00467eb0,104,placed_structure_route_link_attach_site_owner,map,thiscall,inferred,objdump + caller xrefs + chain-layout inspection,3,"Attaches one `0x006ada90` route-link record onto the owner chain of one placed structure. The helper first detaches the current record through `0x00467df0`, stages the caller-supplied placed-structure id into route-link field `+0x0a`, links the record into the placed-structure-owned chain at `[site+0x272]` through route-link field `+0x04`, and then re-enters `0x00467c30` to recompute the route-link flag byte at `+0x12` against neighboring site pairs. When that flag byte keeps bit `0x2` set, the helper also projects one class-indexed signed contribution through `0x0040fa50` and accumulates it into the placed structure through `0x0042b310`. Current grounded caller is the route-link allocator path at `0x00468067`, which makes this the clearest current owner bridge from one freshly allocated `0x006ada90` record into the site-linked chain later scanned by `placed_structure_query_candidate_directional_route_overlay_summary` at `0x0047e690` and `structure_candidate_query_route_style_or_local_availability_metric` at `0x0041e650`.","objdump + caller xrefs + chain-layout inspection + route-link-correlation"
0x00467df0,183,placed_structure_route_link_detach_current_owner_chain,map,thiscall,inferred,objdump + caller xrefs + chain-layout inspection,3,"Detaches one `0x006ada90` route-link record from whichever owner chain currently anchors it. The helper first checks route-link field `+0x08`; when nonzero it treats that field as one route-node-like owner id in collection `0x006cfcbc` and unlinks the record through owner field `+0x04` plus route-node link slot `+0x29`. Otherwise it falls back to the placed-structure owner path, using route-link field `+0x0a` as one site id in collection `0x0062b26c`, optionally applying the same class-indexed signed contribution rollback through `0x0040fa50` and `0x0042b310` when flag byte `+0x12` keeps bit `0x2` set, and then unlinking through `[site+0x272]`. Current grounded callers are the site-owner attach path at `0x00467eb0`, the route-node attach path at `0x00467f20`, and the route-link destructor path at `0x004680b0`, so this now looks like the shared detach helper beneath all owner-chain rewrites for the route-link family.","objdump + caller xrefs + chain-layout inspection + owner-slot correlation"
0x00467c30,443,placed_structure_route_link_recompute_endpoint_pair_state,map,thiscall,inferred,objdump + caller xrefs + endpoint-pair inspection,3,"Recomputes the route-link state byte at `+0x12` from the active site-endpoint pair and updates the linked site contribution when that state flips. The helper only runs on the site-owned branch where route-link field `+0x08` is zero; it resolves the two endpoint site ids from fields `+0x0a` and `+0x0e` through collection `0x0062b26c`, clears the prior bit-`0x2` state, then compares the two endpoint-side route-entry chains through `0x00455f60`, `0x0047de00`, `0x0040c990`, and `0x0047f2d0` until it finds a compatible shared peer. On the first match it restores bit `0x2` in the state byte. If the boolean substate derived from bit `0x1` changes across the recomputation, the helper applies one signed class-indexed contribution through candidate class byte `+0x10`, the class-weight table at `0x0062ba8c+0x8e`, and `0x0042b310` against the first endpoint owner. Current grounded callers are the site-owner attach path `0x00467eb0`, the route-link rebuild sweep around `0x004682e6`, and the route-link allocator path at `0x0046809b`, so this now looks like the endpoint-pair state reconciler beneath the route-link family rather than a generic chain walk.","objdump + caller xrefs + endpoint-pair inspection + shared-peer correlation"
0x00467f20,45,placed_structure_route_link_attach_route_node_owner,map,thiscall,inferred,objdump + caller xrefs + chain-layout inspection,3,"Attaches one `0x006ada90` route-link record onto the owner chain of one route-node-like record in collection `0x006cfcbc`. The helper first detaches the current record through `0x00467df0`, then stages the caller-supplied route-node id into route-link field `+0x08` and links the route-link through owner field `+0x04` plus route-node link slot `+0x29`. Current grounded caller is the route-node-side rewrite path at `0x004680e0`, which keeps this as the route-node owner companion to `placed_structure_route_link_attach_site_owner` rather than another site-chain helper.","objdump + caller xrefs + chain-layout inspection + route-node-owner correlation"
0x00467f50,352,placed_structure_route_link_allocate_site_pair_for_candidate_class,map,cdecl,inferred,objdump + caller xrefs + stack-layout inspection + class-counter correlation,3,"Allocates and seeds one new `0x006ada90` route-link record for a caller-supplied placed-structure pair and candidate class. The helper builds one `0x19`-byte local template whose current grounded creation-side writes seed route-link fields `+0x0c` and `+0x0e` from the two input site ids, class byte `+0x10` from the supplied candidate-class argument, and one masked initial state template from the class side table at `0x005f2adc[class]`. It then allocates the live record from the route-link collection, attaches it to the first site through `placed_structure_route_link_attach_site_owner` `0x00467eb0`, increments the grouped class counters at `[class_record+0x5a]` and `[class_record+0x5e]` through the candidate-class table at `0x0062ba8c+0x8e`, and finally re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`. Current direct creation-side caller is `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0`, while grounded internal calls land at `0x00468067` and `0x0046809b`; this is therefore the strongest current owner for creation-side site-pair seeding in the route-link family.","objdump + caller xrefs + stack-layout inspection + class-counter correlation + route-link-collection correlation"
0x004680b0,96,placed_structure_route_link_release_and_detach,map,thiscall,inferred,objdump + caller xrefs + class-counter correlation,3,"Releases one live `0x006ada90` route-link record's class-side counters and then detaches it from its current owner chain. The helper resolves the candidate-class record from route-link byte `+0x10` through `0x0062ba8c+0x8e`, subtracts the fixed creation-side increment from `[class_record+0x5a]`, then chooses one of the two trailing accumulator slots `[class_record+0x62]` or `[class_record+0x66]` by testing state byte `+0x12 & 0x1`. After that class-side rollback it tails into `placed_structure_route_link_detach_current_owner_chain` `0x00467df0`. Current grounded caller is the route-link collection sweep around `0x004681ae`, which keeps this as the clearest release-side companion to `placed_structure_route_link_allocate_site_pair_for_candidate_class` rather than another attach helper.","objdump + caller xrefs + class-counter correlation + detach-tail correlation"
0x00468110,39,placed_structure_route_link_collection_construct,map,thiscall,inferred,objdump + world-bringup correlation + collection-layout inspection,3,"Constructs the world-side route-link collection later published at `0x006ada90`. The helper seeds the collection vtable at `0x005ce130`, then initializes one indexed collection through `0x00518570` with grounded parameters `(record_size=0x19, initial_slots=0x64, growth=0x64, id_base=1)`. Current grounded caller is the world bring-up path at `0x004488a3`, where the resulting manager is stored into `0x006ada90` beside the placed-structure and candidate collections. This is the strongest current owner name for the record family later scanned by the route-style overlay and availability helpers.","objdump + world-bringup correlation + collection-layout inspection + manager-publication correlation"
0x00468140,18,placed_structure_route_link_collection_destroy,map,thiscall,inferred,objdump + world-shutdown correlation + collection-layout inspection,3,"Destroys the world-side route-link collection rooted at `0x006ada90`. The helper restores the same collection vtable at `0x005ce130`, releases the indexed-collection payload through `0x00518600`, and then tails into the common collection teardown at `0x00518bd0`. Current grounded callers are the global world-shutdown path at `0x0044931d` and the route-link collection sweep at `0x004681ae`, which keep this as the clear destructor companion to `placed_structure_route_link_collection_construct`.","objdump + world-shutdown correlation + collection-layout inspection + manager-publication correlation"
0x004681f0,100,placed_structure_route_link_collection_remove_links_touching_site_id,map,thiscall,inferred,objdump + caller xrefs + field-match inspection,3,"Collection-wide cleanup sweep over `0x006ada90` that removes every route-link record whose grounded site-reference triple matches one caller-supplied placed-structure id. The helper walks the live route-link collection and deletes any record whose `u16` fields at `+0x0a`, `+0x0c`, or `+0x0e` equal the requested id, reusing the collection erase vfunc for each match. Current grounded callers include the placed-structure teardown path at `0x0040e23b`, where the supplied id comes from `[site+0x2a4]`, so this now looks like the site-side cleanup companion for the route-link family rather than a generic collection filter.","objdump + caller xrefs + field-match inspection + site-cleanup correlation"
0x00468260,84,placed_structure_route_link_collection_remove_links_by_route_node_id,map,thiscall,inferred,objdump + caller xrefs + field-match inspection,3,"Collection-wide cleanup sweep over `0x006ada90` that removes every route-link record whose route-node owner field at `+0x08` matches one caller-supplied id. The helper walks the live route-link collection, compares each record's `u16` field `+0x08` against the requested route-node id, and erases matching records through the same collection vfunc used by the broader cleanup paths. Current grounded caller is the neighboring runtime teardown at `0x004acf03`, which keeps this as the route-node-side cleanup companion to `placed_structure_route_link_collection_remove_links_touching_site_id` rather than another site sweep.","objdump + caller xrefs + field-match inspection + route-node-cleanup correlation"
0x004682c0,58,placed_structure_route_link_collection_recompute_all_endpoint_pair_state,map,thiscall,inferred,objdump + caller inspection + collection-iteration inspection,3,"Collection-wide recompute sweep over the live `0x006ada90` route-link family. The helper iterates every live route-link id through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30` on each resolved record. This is the clean whole-collection state refresh companion to the per-record recompute helper rather than another allocator or cleanup path.","objdump + caller inspection + collection-iteration inspection + recompute-helper correlation"
0x00468300,235,placed_structure_route_link_rebuild_route_style_grid_counters_and_endpoint_state,map,thiscall,inferred,objdump + caller inspection + world-grid correlation + collection-iteration inspection,3,"Higher-level rebuild pass above the route-link family that resets the route-style world-grid counters and then recomputes live endpoint state across `0x006ada90`. The helper first reads three candidate-class ids from the structure-candidate side table at `0x0062ba8c+0x88/+0x8a/+0x8c`, walks the active world-grid tables rooted at `[0x0062c120+0x2129]`, and clears the aligned per-cell dword lanes at offset `+0x103` for those three classes. It then iterates every live route-link record in `0x006ada90`, clears state bit `0x2` in each record's flag byte at `+0x12`, and re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`. Current grounded callers include the recurring simulation-maintenance branch at `0x0040a575`, the world bring-up side near `0x00444b2f`, and one later world-side update path at `0x00481157`, which makes this the clearest current owner of the full-family route-style counter-and-state rebuild rather than just another collection walk.","objdump + caller inspection + world-grid correlation + collection-iteration inspection + route-style-class correlation"
0x0041e2b0,589,structure_candidate_rebuild_local_service_metrics,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Setup-side local-metrics rebuild for one live structure candidate after it has passed `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. The helper clears the metric bands at `[this+0x6a]`, `[+0x6e]`, `[+0x72]`, `[+0x76]`, and `[+0x7a]`, then samples repeated world-grid slices off the active world root at `0x0062c120` through `0x0042c960` and the per-cell tables rooted at `[world+0x2129]`. It accumulates one broad local magnitude at `[this+0x6a]`, folds two optional positive channels into `[this+0x6e]` and `[this+0x72]`, and finally normalizes and scales the trailing summary pair `[this+0x76]` and `[this+0x7a]` with fixed constants. Current grounded caller is `structure_candidate_collection_run_post_load_local_service_setup_phase` at `0x0041ea50`, so this still looks like a setup-time local service or demand scorer rather than the recurring owner of the whole cargo-economy lane, but it is now one clear downstream consumer of the same `[candidate+0x56]` live-availability gate.","objdump + caller xrefs + callsite inspection + world-grid correlation"
0x0042da90,129,scenario_event_prepare_runtime_record_text_bands_for_packed_state_save,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small pre-save sweep over one live runtime event record immediately beneath the `.smp` event-collection serializer `0x00433060`. The helper re-enters `0x0042d820` six times with save-side flag `1` over the fixed text-band families rooted at `[record+0x0e0]`, `[+0x401]`, `[+0x4ca]`, `[+0x593]`, `[+0x65c]`, and `[+0x725]`, using size `0x320` for the first band and `0xc8` for the remaining five. Current grounded caller is the first event-collection sweep inside `0x00433060`, so this is the safest current read for the text-band preparation pass that runs before the packed runtime-record stream is emitted rather than for a standalone serializer.","objdump + local disassembly + caller correlation + fixed-text-band correlation"
0x0042db20,1040,scenario_event_refresh_runtime_record_from_packed_state,scenario,thiscall,inferred,objdump + caller inspection + local disassembly + shell-event-window correlation,2,"Heavy per-event runtime materializer beneath the live event collection at `0x0062be18`. The helper reads one packed event definition from the caller-supplied state or stream object, conditionally clears and repopulates several fixed text bands on the destination event record at offsets such as `+0x0e0`, `+0x401`, `+0x4ca`, `+0x593`, `+0x65c`, and `+0x725`, then rebuilds two event-runtime row families from caller-supplied counts and packed row payloads. Current shell-side xrefs now tighten that split. The first family allocates `0x1e`-byte rows, fills scalar and byte fields from the packed source, conditionally extends the row on later-format branches, remaps bounded id ranges through the live structure-candidate collection `0x0062ba8c`, and links the resulting rows through one standalone event-side list anchor; the adjacent helper cluster `0x0042df30/0x0042df70/0x0042dfb0/0x0042dff0` is only consumed by `EventConditions.win`, so this first family now reads as the runtime condition-row list. The second family repeats the same materialization pattern with `0x28`-byte rows across four grouped slots on the destination event record, applying version-gated field extension and bounded remap logic against the locomotive collection `0x006ada84`, the live structure-candidate collection `0x0062ba8c`, and the global candidate pool `0x0062b268` before linking each rebuilt row into one of four grouped list anchors; the generic deep-copy helper `0x0042e050` now clones those same grouped lists during event duplication, so this second family still reads as the grouped event-effect row side rather than another condition list. Current grounded caller is the collection-wide wrapper `0x00433130`, so this is now the safest current read for one live event's runtime-record refresh from packed scenario-state data rather than a generic collection helper.","objdump + caller inspection + local disassembly + event-record materialization correlation + candidate-and-locomotive-remap correlation + shell-event-window correlation"
0x0042d700,59,scenario_event_query_standalone_condition_row_list_class_and_modifier_flags,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + local disassembly,2,"Aggregates the class and modifier bits implied by one live event's standalone `0x1e`-row condition list. The helper first short-circuits to literal `0x7f` when event byte `[event+0x82b]` is set, then otherwise walks the list rooted at `[event+0x00]`, OR-ing the static row-class byte from `0x005f3e04 + id*0x81` for ordinary nonnegative row ids and using the negative-id fallback branch only to preserve special marker value `0x7f`. Current grounded callers are the condition-window summary refreshes `0x004d9970` and the broader control refresh `0x004da0f0`, so this is the safest current read for the standalone condition-list class or modifier aggregate rather than a generic linked-list scan.","objdump + EventConditions.win refresh correlation + local disassembly + condition-row-class-table correlation"
0x0042d740,87,scenario_event_query_grouped_effect_row_list_type_flags,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + local disassembly,2,"Aggregates one grouped effect-row type bitfield for a live event. The caller supplies the grouped list ordinal on the stack, and the helper walks the selected grouped anchor at `[event + group*4 + 0x04]`, OR-ing one descriptor byte from `0x006103fd + opcode*0x6e` across the linked `0x28`-row family. One caller-controlled boolean also enables a narrower normalization path that remaps a small special opcode subset to shared bit `0x08` before the OR step. Current grounded callers are the conditions-window refresh family `0x004d9d10` and `0x004da0f0`, plus one world-side branch at `0x00431120`, so this is the safest current read for grouped effect-row type flags rather than a standalone condition helper.","objdump + EventConditions.win refresh correlation + local disassembly + grouped-effect-descriptor correlation"
0x0042df30,63,scenario_event_condition_row_list_has_class_bit0_or_flag7f9_fallback,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + static-bit-table inspection,2,"Tiny predicate over the standalone `0x1e`-row event-condition list rebuilt by `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20`. The helper walks the linked list rooted at the caller-supplied event record, tests each nonnegative row id against class-bit `0x01` in the static per-condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to event-record byte `[event+0x7f9]`. Current grounded callers are the `EventConditions.win` refresh path at `0x004da19a` and `0x004da23c`, so this now reads as the class-bit-0 condition-summary gate rather than a generic list scan.","objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation"
0x0042df70,63,scenario_event_condition_row_list_has_class_bit1_or_flag7fa_fallback,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + static-bit-table inspection,2,"Companion predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as `0x0042df30`, tests each nonnegative row id against class-bit `0x02` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to event-record byte `[event+0x7fa]`. Current grounded caller is the `EventConditions.win` refresh path at `0x004da1de`, so this now reads as the class-bit-1 condition-summary gate rather than another anonymous list helper.","objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation"
0x0042dfb0,62,scenario_event_condition_row_list_has_class_bit2_or_type63_fallback,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + static-bit-table inspection,2,"Companion predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as `0x0042df30`, tests each nonnegative row id against class-bit `0x04` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to the event-record dword check `[event+0x7f0] == 0x63`. Current grounded caller is the `EventConditions.win` refresh path at `0x004da2be`, so this now reads as the class-bit-2 condition-summary gate rather than another generic scan.","objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-type correlation"
0x0042dff0,82,scenario_event_condition_row_list_has_any_class_bit012_or_special_fallback,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + static-bit-table inspection,2,"Broad predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as the smaller `0x0042df30/0x0042df70/0x0042dfb0` family, tests each nonnegative row id against any of class bits `0x01|0x02|0x04` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to any of the three special event-record checks `[event+0x7f9]`, `[event+0x7fa]`, or `[event+0x7f0] == 0x63`. Current grounded caller is the early `EventConditions.win` refresh gate at `0x004da17d`, so this now reads as the broad condition-summary eligibility probe rather than a generic linked-list walk.","objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation"
0x0042e050,603,scenario_event_clone_runtime_record_deep_copy,scenario,cdecl,inferred,objdump + caller xrefs + local disassembly + shell-event-window correlation,2,"Deep-copy helper for one already-materialized live event runtime record. The helper copies the six fixed text bands at destination offsets `+0x0e0`, `+0x401`, `+0x4ca`, `+0x593`, `+0x65c`, and `+0x725`, mirrors the compact event metadata band at `+0x7ee..+0x80e`, then deep-copies the standalone `0x1e`-row linked list and the four grouped `0x28`-row linked lists from one live event-runtime record into the caller-supplied destination record. Current grounded caller is `shell_event_conditions_window_append_blank_or_clone_selected_event_via_name_modal` `0x004db8b0`, where it clones the currently selected live event into a newly created event record before selector refresh. This is therefore the safest current owner for deep-copy of an already-materialized event runtime record rather than another packed-state loader or an effects-only staging helper.","objdump + caller xrefs + local disassembly + shell-event-window correlation + deep-copy correlation"
0x0042c1b0,886,placed_structure_redistribute_local_service_pressure_from_neighbors,map,thiscall,inferred,objdump + caller xrefs + neighborhood sweep inspection,3,"Neighbor-aware local-service post-pass for one placed-structure or site record. The helper first builds a bounded set of nearby site references by scanning offset patterns from `0x00624b28` and `0x00624b48` against the world-grid tables rooted at `[0x0062c120+0x2129]`, keeping only neighbors whose state byte at `+0x0e6` is compatible with the current site and recording per-neighbor weights derived from the local word tables near `[site+0x00]` and `[site+0x0f3]`. It then walks the live candidate collection and, for each live non-remapped candidate, chooses the strongest positive neighbor deficit after scaling through the candidate-side weight at `[candidate+0x52]`; when a positive deficit remains it commits the redistribution through `0x0042bf80`. Current grounded caller is the composite local refresh `0x0042d580`, so this looks like the neighboring-site redistribution pass beneath the local service-score bundle rather than an independent outer loop.","objdump + caller xrefs + neighborhood sweep inspection + candidate-weight correlation"
0x0041eac0,794,structure_candidate_collection_refresh_cargo_economy_filter_flags,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + rdata strings,3,"Collection-wide refresh of one cargo-economy-sensitive candidate flag in the live structure collection at `0x0062ba8c`. The helper first walks the global candidate pool at `0x0062b268`, filters category-`2` entries through the paired availability bytes `[candidate+0xba]` and `[candidate+0xbb]` plus the recipe-runtime latch `[candidate+0x7ac]`, and builds one temporary per-cargo mask keyed by cargo names such as `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, `Diesel`, `Troops`, and `Passengers`; one special-case branch also uses structure labels such as `Barracks` and `Recycling Plant` while consulting the region collection at `0x0062bae0`. It then iterates the live structure collection itself, combines that temporary cargo mask with the candidate-local bytes `[entry+0x47]`, `[entry+0x48]`, and `[entry+0x49]`, the runtime cargo-economy latch at `[0x006cec74+0x25f]`, and the live copy of special-condition slot `31` `Use Wartime Cargos` at `[0x006cec78+0x4afb]`; when that slot is set the branch at `0x0041ed37` further tests the wartime cargo family `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, and `Diesel` before writing the resulting enabled-or-filtered state into `[entry+0x56]` and re-entering `0x0041e970` to rebuild the derived visible counts. Current grounded callers are the collection-side setup path around `0x0041f4cb` and the runtime toggle branch at `0x0046577c`, where the same `0x006cec74+0x25f` bit is flipped directly; that makes this the strongest current bridge from the editor's `Disable Cargo Economy` rule plus the `Use Wartime Cargos` scenario rule into live structure-candidate filtering rather than a purely editor-side helper.","objdump + caller xrefs + callsite inspection + rdata strings + special-condition correlation"
0x00421b60,180,world_region_collection_seed_default_regions,map,thiscall,inferred,objdump + strings + callsite inspection,4,"Seeds the default numbered region family on the manager collection at `0x0062bae0`. The helper pumps shell progress through `0x004834e0`, repeatedly creates collection entries through `0x00421660`, formats their labels from localized string id `2908` `Region %1` plus the `%02d` pattern at `0x005c9aec`, marks the created records live through `[entry+0x23e]`, and then finalizes the region set through `0x00421730` against the active world root at `0x0062c120`. Current grounded callsites are the post-load generation pipeline at `0x004384d0` and the broader world-build path around `0x004476ec`, so this now looks like region-set seeding rather than generic player or company setup.","objdump + RT3.lng strings + caller xrefs + callsite inspection"
0x00421ce0,55,world_region_collection_run_class0_secondary_overlay_stamp_pass_for_all_live_regions,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Small collection-wide region overlay pass. The helper walks every live region entry through `indexed_collection_get_nth_live_entry_id` `0x00518380` and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then re-enters `world_region_class0_stamp_local_secondary_overlay_and_scored_refinement_pass` `0x0041fb00` on each record. Current grounded caller is the late `.smp` restore tail inside `world_load_saved_runtime_state_bundle` `0x00446d40`, immediately after `world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids` `0x00421730` and the broader post-close world/tool refresh strip.","objdump + local disassembly + caller correlation + region-overlay-pass correlation"
0x00421c20,187,world_region_collection_run_building_population_pass,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Region-owned building-population dispatcher over the collection at `0x0062bae0`. For each region entry it forwards one caller-selected scale and mode flag into the lower worker at `0x004235c0`, pumps shell progress through `0x004834e0` between entries, and guards the sweep with the region-collection reentrancy counter at `[this+0x88]`. The same setup lane now shows one direct shell-state coupling too: constructor-time helpers in the same region family copy shell-state gate `[0x006cec74+0x174]` into local region-side state, and the post-load pipeline only reaches this dispatcher behind that same gate after posting localized id `320` `Setting Up Buildings...`. The per-region worker consults the region subcollection at `[region+0x37f]`, the global candidate pool at `0x0062b268`, the placed-instance registry at `0x0062b26c`, and one world-side notification or state owner at `0x0062b2fc`, which makes this look like a building spawn or allocation pass rather than a generic region refresh. Grounded callers include the post-load `Setting Up Buildings...` branch in world_run_post_load_generation_pipeline with arguments `(1.0, 1)` and a slower recurring simulation-side caller at `0x0040a804/0x0040a826` with scale `0.08333334` and mode `0`, which suggests the same lower subsystem also has a later maintenance cadence after initial setup.","objdump + caller xrefs + callsite inspection"
0x0042b2d0,52,route_entry_list_contains_key,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Boolean membership test over the compact six-byte route-entry list rooted at `[this+0xeb]/[this+0xef]`. The helper linearly scans the current rows and returns true when any leading `u16` key matches the caller-supplied id; otherwise it returns false. Current grounded callers include the linked-site support strip at `0x0040d27f`, the region or profile-side query family at `0x0041f6e7`, `0x0042007c`, `0x0042011a`, `0x0042020c`, `0x004202ba`, `0x004208b6`, and the later placed-structure branch at `0x004adecf`, so this is the safest current read for the shared contains-key helper beneath the same six-byte route-entry list family.","objdump + caller xrefs + local disassembly + six-byte-record correlation"
0x00422320,1320,world_region_normalize_cached_structure_balance_scalars,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Collection-wide region normalization pass over the live region manager `0x0062bae0`. The helper first early-outs in sandbox/editor-side mode through `[0x006cec7c+0x82]` and the active-mode latch `[0x006cec78+0x4aef]`, then runs one per-region prepass through `0x00420d40`, and finally performs two cohort sweeps split by region live byte `[region+0x23e]`. Across those sweeps it accumulates the cached scalar bands `[region+0x2b2/+0x2b6/+0x2ba/+0x2be/+0x2c2/+0x2c6]`, derives bounded normalization ratios, and writes the resulting cached growth-balance band back to `[region+0x2e2/+0x2e6/+0x2ea/+0x2ee]`. The player-facing meaning is tighter now from the editor growth report at `0x004d1d60`: `[region+0x2e2]` is the cached weighted-profit-margin scalar and `[region+0x2ee]` is the cached annual-density-adjust scalar later formatted as a percent, while `[region+0x2e6]` and `[region+0x2ea]` are the intermediate normalized-delta and clamped companion slots beneath that final annual-density adjust. The helper also uses world_region_count_linked_placed_structures_by_category `0x004228b0` as the direct category-count companion during the writeback sweep, and it applies one final live-value adjustment into `[region+0x25e]` when the shell latch `[0x006cec78+0x46c38]` is clear. Current grounded caller is the recurring simulation-maintenance branch at `0x0040a265` inside `simulation_service_periodic_boundary_work` `0x0040a590`, so this is now the safest current read for the region cached growth-balance normalization pass rather than a one-time setup helper.","objdump + local disassembly + caller inspection + recurring-maintenance correlation + editor-growth-report correlation"
0x004228b0,68,world_region_count_linked_placed_structures_by_category,map,thiscall,inferred,objdump + local disassembly,3,"Counts linked placed-structure records in the current region entry whose category byte matches one caller-supplied value. The helper walks the placed-instance chain rooted at `[region+0x383]` through the global registry `0x0062b26c`, resolves each live record's category byte through the vtable `+0x80` object view, and increments one simple match count without applying the heavier cap or availability filters used by `0x00422be0`. The current grounded local caller is the broader region-side worker around `0x00422320`, where this helper is used as the direct category-count companion to the later aggregate and placement passes rather than as a full demand-balancing gate.","objdump + local disassembly + local caller correlation"
0x00422850,91,world_region_count_class0_regions_passing_city_connection_peer_probe_variant,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Counts live class-0 regions in the current region collection that pass one specific `city_connection_bonus_exists_matching_peer_site` variant through `0x00420030`. The helper skips non-class-0 records, calls `0x00420030` with fixed boolean flags `(1,1,1)` plus one caller-supplied trailing dword, and increments a simple count only when that probe returns nonzero. Current grounded callers are the script or query dispatch at `0x0042f856` and the region-stats formatter at `0x004d2088`, so the safest current read is the narrow class-0 count wrapper over that peer-probe variant rather than a broader city-growth metric.","objdump + local disassembly + caller correlation + city-connection-probe correlation"
0x00422900,352,world_region_accumulate_structure_category_totals,map,thiscall,inferred,objdump + callsite inspection,3,"Aggregates the current structure-category totals for one region entry. The helper walks the placed-instance chain rooted at `[region+0x383]` through the global registry `0x0062b26c`, resolves each live record's category byte through the vtable `+0x80` object view, and returns both counts and accumulated weight-like totals across four categories via the caller-provided out-pointers. Current grounded caller is world_region_balance_structure_demand_and_place_candidates at `0x004235c0`, where the outputs feed the later demand-balancing logic for the region-owned building-population pass.","objdump + callsite inspection"
0x00422a70,355,world_region_validate_and_commit_candidate_placement,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Shared placement-validation and commit gate beneath the region candidate-placement family. The helper takes one region entry in `ECX`, one candidate or profile id on the stack, one candidate world-coordinate pair, one caller-controlled side flag, one direct-versus-staged commit flag, and one optional out-pointer for the created placed-structure id. It first clears the optional out-slot, conditionally snaps the candidate coordinate pair to integers under the preview gate `0x434050 -> 0x46d2b0`, then validates projected placement through `placed_structure_validate_projected_candidate_placement` `0x004197e0`. On the direct-commit lane it additionally resolves the candidate world cell through `0x0044a800` and requires that cell's region id to match `[region+0x23a]`. When placement is allowed and the shell-side latch `[0x006cec78+0x46c3c]` is clear, one branch emits the staged side path through `0x0046d260`; otherwise it commits directly through `placed_structure_collection_allocate_and_construct_entry` `0x004134d0` and stores the resulting placed-structure id in the caller's out-slot. Current grounded callers are `world_region_try_place_candidate_structure` `0x00422ee0` and the world-side randomized batch helper `world_try_place_random_structure_batch_from_compact_record` `0x00430270`, so this is best read as the shared region-side candidate-placement validator and commit gate rather than as one region-worker-private helper.","objdump + local disassembly + caller correlation + placement-validator correlation"
0x00422be0,768,world_region_count_placed_structures_for_category,map,thiscall,inferred,objdump + callsite inspection,3,"Counts already-placed structures in one requested category for the current region entry. It walks the placed-instance chain rooted at `[region+0x383]` through `0x0062b26c`, filters live records by the requested category byte, and applies several additional placement gates including one cap on `[record+0x276]`, one disable byte at `[record+0x390]`, and special handling for category `2`. Current grounded caller is world_region_balance_structure_demand_and_place_candidates at `0x004235c0`, where the result is subtracted from the region's computed category demand before more candidates are chosen.","objdump + callsite inspection"
0x00422ee0,884,world_region_try_place_candidate_structure,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Attempts one candidate-structure placement for the current region entry and requested category. It derives one region-ranking bucket from `[region+0x256]` and `[region+0x25e]`, uses the region count at `0x0062bae0` to index the weighting table at `0x005ee1e0`, chooses one trial budget of `10` or `15` depending on the setup latch at `[0x006cec78+0x46c3c]`, and then repeatedly evaluates candidates from the global site pool `0x0062b268`. The chooser matches candidate names and scores against region subcollection entries, rejects over-cap or already-satisfied sites through the placed-instance registry `0x0062b26c`, and when successful either dispatches one direct placement through `0x004134d0` or routes the selected site into the shell-facing side path through `0x004337c0`. Current grounded callers are the region building worker at `0x004235c0` and the separate world-side branch at `0x004d1871`, so this now looks like the core candidate-placement helper beneath the region-owned building-population family.","objdump + caller xrefs + callsite inspection"
0x004235c0,1887,world_region_balance_structure_demand_and_place_candidates,map,thiscall,inferred,objdump + callsite inspection,4,"Core per-region worker beneath world_region_collection_run_building_population_pass. It first checks the broader shell-state master flag at `[0x006cec74+0x68]` and diverts into a separate alternate path when that flag is nonzero. The same flag now aligns with the editor-map `.gmp` family in the shell file coordinators, so the ordinary demand-balancing and placement flow currently looks grounded for the non-editor world mode while the alternate branch likely belongs to the editor-map side. In that ordinary path it aggregates existing category counts and weights through world_region_accumulate_structure_category_totals at `0x00422900`, samples the current region subcollection size through `0x0041f6a0`, queries projected structure-count scalars through `world_region_query_projected_structure_count_scalar_by_category` `0x004234e0`, and then computes target demand for three structure categories by comparing those projected totals against live placed counts plus several randomized clamps. The three grounded category families are now narrower: category `0` uses the fixed fallback label `House` from `0x005c9114`; category `2` is the year-gated weighted region-profile family read through world_region_read_structure_profile_label_and_weight_by_index at `0x0041fac0` and bounded by world_region_count_structure_profiles_before_year_for_category at `0x0041f9b0`, which also feeds the localized `Industry Weightings` report in the region stats UI; and category `3` reaches world_region_pick_commercial_profile_label_by_region_rank at `0x00412ca0`, whose fallback token is `Commercial` but whose aligned region-stats label slot is localized as `City Support`. After subtracting already-placed coverage through world_region_count_placed_structures_for_category at `0x00422be0`, the worker tries placements through world_region_try_place_candidate_structure at `0x00422ee0` until demand is exhausted or the attempt budget runs out. This makes the worker a region structure-demand balancing and placement pass over houses, weighted region profiles, and the broader city-support branch rather than a generic setup loop.","objdump + callsite inspection + region stats disassembly + RT3.lng strings + rdata strings + file-flow correlation + projected-demand correlation"
0x004234e0,211,world_region_query_projected_structure_count_scalar_by_category,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Returns one projected structure-count scalar for the requested region and category family. The helper has two materially different branches. On the live-region branch `[region+0x23e] != 0`, it indexes base table `0x005ee1b0` by `(live_region_class, category)`, multiplies by the scenario-difficulty table `0x005f33e0` selected from world difficulty dword `[world+0x2d]`, scales by normalized region-density `[region+0x25e] / 0x005c85d8`, multiplies by the global pre-recipe scalar `[world+0x0bde]`, and then multiplies by cached building-count slot `[region+0x242]` before the final fixed scale at `0x005c8918`. On the fallback branch it instead rounds `[region+0x25e]` through `0x005a10d0`, derives one region bucket via `0x00421490`, combines tables `0x005ee138` and `0x005ee1b0`, applies the alternate scenario-difficulty table `0x005f33cc`, scales by the same normalized region-density and global pre-recipe scalar `[world+0x0bde]`, then applies fixed scale `0x005c8d68` without the `[region+0x242]` multiplier. Current grounded callers are the per-region placement worker `0x004236dc`, the map-editor city-count stats report `0x004d0420`, and the shell-side stats formatter around `0x004cc816`, where categories `2`, `3`, and `0` are aggregated into the projected starting industry and non-industry totals. This is therefore the shared projected region structure-count accessor rather than another placement mutator.","objdump + local disassembly + caller correlation + city-count-stats correlation + pre-recipe-scalar correlation + branch-split correlation"
0x00423d30,51,world_region_refresh_cached_category_totals_and_weight_slots,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Refreshes one small cached region summary band rooted at `[this+0x27a]`. The helper forwards three out-pointers `+0x27a/+0x27e/+0x282` plus one return slot `+0x286` into world_region_accumulate_structure_category_totals `0x00422900`, forcing the remaining category outputs and optional aggregate pointers to zero. Current grounded caller is the post-load seeding-burst tail around `0x00437bdc`, which sweeps the live region collection `0x0062bae0` after simulation_run_chunked_fast_forward_burst `0x00437b20`. This is therefore the narrow cached-category-summary refresher beneath that region-side setup and maintenance family rather than a company debt-table helper.","objdump + local disassembly + caller inspection + post-load caller correlation"
0x00423d70,176,company_repay_bond_slot_and_compact_debt_table,simulation,thiscall,inferred,objdump + caller inspection,4,"Repays and removes one indexed bond entry from the live company debt table. The helper validates the requested slot against the current bond count at `[this+0x5b]`, compacts the remaining 12-byte entries rooted at `[this+0x5f]`, and then recomputes the dependent finance accumulators through `0x0042a040` and `0x0042a080`. Current grounded shell caller is the repay-bond branch beneath `CompanyDetail.win`, which makes this the company-side debt-table mutator rather than a territory-access helper.","objdump + caller inspection + finance-field correlation"
0x00423ec0,33,company_adjust_available_track_laying_capacity_with_floor_zero,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,2,"Small saturating company-side counter adjuster over `[this+0x7680]`. When that field is not `-1`, the helper adds the caller-supplied delta, clamps the result at zero on underflow, and writes it back. The surrounding lifecycle is tighter now too: nearby company initialization around `0x004285c0` seeds `[this+0x7680]` to `50` when scenario byte `[0x006cec78+0x4aaf]` is enabled and to sentinel `-1` otherwise, while the companion getter `0x004240a0` returns either the live counter or fixed fallback `29999`. Current language-table correlation now gives that scenario byte a stronger player-facing read: it is the live gate behind RT3.lng `2576` `Company track laying is limited...` and event variable label `2358` `Company Track Pieces Buildable`. Current grounded caller is `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`, where company-bound endpoint synthesis passes either `-1` or `-2` through this helper before the new route-entry payload is committed. That makes this the strongest current match for available track-laying capacity consumption rather than a generic finance counter.","objdump + caller xrefs + callsite inspection + route-build-capacity correlation + capacity-lifecycle correlation + RT3.lng correlation"
0x004240a0,28,company_query_available_track_laying_capacity_or_unlimited,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,2,"Returns the current company's available track-laying capacity. When scenario byte `[0x006cec78+0x4aaf]` is enabled, the helper returns the live company counter at `[this+0x7680]`; otherwise it returns fixed fallback `29999`, which currently reads as an effectively-unlimited path. Current language-table correlation now ties that scenario byte to RT3.lng `2576` `Company track laying is limited...` and event variable label `2358` `Company Track Pieces Buildable`, so this helper is best read as the live getter beneath that scenario rule rather than only as an internal company counter accessor. Current grounded callers include `placed_structure_validate_projected_candidate_placement` `0x004197e0`, `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`, and `route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380`, where the returned value is used as the company-side track-laying-capacity gate for route synthesis and station-attachment placement.","objdump + caller xrefs + callsite inspection + track-laying-capacity correlation + RT3.lng correlation"
0x00424000,3,company_serialize_tagged_runtime_payload_noop,simulation,thiscall,inferred,objdump + local disassembly + company-save correlation,2,"Tiny current no-op callback beneath the company collection package-save strip. The helper simply returns zero and performs no per-company tagged payload write. Current grounded caller is `company_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` `0x00429b90`, so this is best read as the present save-side per-company payload stub rather than a standalone company mutation helper.","objdump + local disassembly + company-save correlation + callback-role correlation"
0x00424010,29,company_has_territory_access_rights,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns whether the current company has access rights in one requested territory id. The helper indexes the per-territory access byte at `[this + territory*0x38d + 0x1d9f]` and returns `1` when that byte is nonzero. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the territory-access purchase flow at `0x004c5fc9`.","objdump + caller inspection + territory-access table correlation"
0x00423e40,112,company_compute_weighted_average_bond_interest_rate,simulation,thiscall,inferred,objdump + caller xrefs + debt-record inspection,4,"Computes the company's current weighted average bond interest rate from the live debt table rooted at `[this+0x5f]`. The helper rejects inactive companies and companies with no live bond slots, then walks each 12-byte debt record, accumulates total principal from `[slot+0x00]`, accumulates principal-times-rate from `[slot+0x08]`, and returns the weighted quotient `sum(principal*rate) / sum(principal)`. Current grounded callers are the bond-quote wrapper at `0x00427540`, the CompanyDetail capital summary panel at `0x004c23a0`, and the city-connection bonus ladder at `0x00425320`, so this is the shared average coupon or interest-rate helper rather than a generic finance multiplier.","objdump + caller xrefs + debt-record inspection + finance-summary correlation + bond-quote correlation"
0x00423eb0,6,company_query_cached_share_price_scalar,simulation,thiscall,inferred,objdump + caller xrefs + per-share panel correlation,3,"Tiny cached-float accessor that returns the company field at `[this+0x0d7b]`. Current grounded shell callers are the CompanyDetail per-share panel at `0x004c2720` and later train-side consumer paths, where this cached scalar is used in the same lane as the `Share Price` readout. The write-side owner is now tighter too: `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` optionally snapshots its final float into the same field when the caller requests a cache refresh, so this remains the narrow cached share-price accessor rather than an arbitrary finance-field read.","objdump + caller xrefs + per-share panel correlation + cached-float-field correlation + stock-price-cache-write correlation"
0x00424030,22,company_set_territory_access_rights_byte,simulation,thiscall,inferred,objdump + caller inspection,4,"Stores one territory-access byte for the requested company and territory id. The helper writes the supplied byte value into the same per-territory access table rooted at `[this + territory*0x38d + 0x1d9f]`. Current grounded shell caller is the immediate commit path inside `shell_company_detail_buy_territory_access_rights_flow` at `0x004c5fc9`, where the purchase path writes value `1` after the access-rights dialog is accepted.","objdump + caller inspection + territory-access table correlation"
0x004241e0,23,company_sum_control_transfer_offer_policy_fields_raw,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the raw sum of two company-side floating fields at `[this+0x124f]` and `[this+0x12a7]`. Current grounded callers are the merger-offer builder around `0x004eb5a9` and adjacent control-transfer offer-side stat readers, where the returned value is paired with surrounding formatter setup for mode `0x0b` but is not itself passed an issue argument. This now looks like a narrow raw control-transfer offer policy total rather than a generic finance calculation.","objdump + caller inspection + merger-offer dialog correlation"
0x00424200,37,company_sum_control_transfer_offer_policy_fields_scaled_tenths,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the same `[this+0x124f] + [this+0x12a7]` company-side policy total as `company_sum_control_transfer_offer_policy_fields_raw`, but scaled by the `0.1` constant at `0x005c9b50`. Current grounded callers are the merger and chairmanship-takeover offer builders at `0x004eb588` and `0x0050c7cb`, where the scaled result is immediately paired with surrounding formatter setup for mode `0x0b`. The helper itself does not consume an issue id, so this now reads as the scaled control-transfer offer policy total rather than a broader vote-weight function.","objdump + caller inspection + takeover and merger dialog correlation"
0x004248d0,759,company_compute_cached_recent_per_share_performance_subscore,simulation,thiscall,inferred,objdump + caller inspection,3,"Builds one cached company-side per-share performance subscore from recent yearly stock-data history and current scenario difficulty. When the company is inactive via `[this+0x3f]` it returns the fixed negative fallback at `0x005c8598`; otherwise it reuses the cache in `[this+0x0cfb]` and `[this+0x0cff]` when the current year at `[0x006cec78+0x15]` matches. On a cold pass it first walks up to five recent years above founding year `[this+0x157]`, weighting yearly `Earnings Per Share` from slot `0x1f` and yearly `Revenue Per Share` from slot `0x1e` through `0x0042a5d0`; the current partial year uses weight `(5 * [world+0x0f]) - 5`, while the prior four full years use `48`, `36`, `24`, and `12`. That yields two normalized history lanes: `EPS * 10` into the first lane and `Revenue Per Share` into the second. It then runs a second trend pass over `Dividend Per Share` slot `0x20`, rewarding adjacent year pairs where the newer dividend does not fall below the previous year's value; that pairwise ladder uses weights `9`, `8`, `7`, and `6` from newest to oldest surviving comparison. The third lane is a dividend-strength score derived from that rewarded ratio, the previous-year dividend, and the constants `0.5`, `0.6`, `30`, and `230`, then floored to `1.13 * min(max(EPS lane, 1.0), revenue lane, current Book Value Per Share slot 0x1d)`. The fourth lane is current `Book Value Per Share` from slot `0x1d`. Negative lanes are clamped to zero. Base lane weights come from `0x005ee208` as `40/10/20/30`, and for company age under five years they are ramped through the four-dword rows at `0x005ee218`: `0/0/0/100`, `25/25/35/100`, `50/50/65/100`, `75/75/85/100`, and `100/100/100/100`. The strongest lane then gets weight `*1.25` while the weakest gets `*0.8`, and the resulting weighted blend ratio is stored as bounded intermediate `[this+0x0d19]` after multiplying by `((difficulty_table[[world+0x2d]] + 1.0) / 2.0)` and flooring at `0.5`. The final cached score recomputes that same base blend, multiplies it by the raw difficulty scalar table at `0x005f33b8` (`0.8/0.9/1.0/1.1/1.2/0.9/0.95/1.0`), applies post-bankruptcy smoothing for companies within ten years of `[this+0x163]` as `score * ((0.025 * years_since_bankruptcy) + 0.5)`, floors the result at `1.0`, and finally caches the float in `[this+0x0cff]` with the current year in `[this+0x0cfb]`. Current grounded caller is `company_compute_public_support_adjusted_share_price_scalar` at `0x00424fd0`, where this helper now reads as the recent per-share performance feeder rather than a generic governance-support history walker.","objdump + caller inspection + cache-field correlation + stock-data-family correlation + per-share-panel correlation + weight-ladder correlation + dividend-trend correlation + age-ramp-table correlation + difficulty-table correlation"
0x00425a90,194,company_declare_bankruptcy_and_halve_bond_debt,simulation,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the grounded company bankruptcy commit path. The helper walks the live bond table rooted at `[this+0x5f]`, halves each outstanding principal, recomputes finance metrics through `0x0042a040` and `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, reduces the company value field at `[this+0x47]`, and stamps the current year into `[this+0x163]` as the localized bankruptcy-cooldown anchor. Current grounded shell caller is `shell_company_detail_bankruptcy_flow` on the `CompanyDetail.win` path.","objdump + RT3.lng strings + caller inspection + finance-field correlation"
0x004261b0,74,company_count_unassigned_shares_after_active_chairman_holdings,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the current company share pool at `[this+0x47]` minus the positive holdings found in each active chairman profile record under `0x006ceb9c`. The helper uses the company collection index from `[this+0x00]` to read per-profile holdings from `[profile + company_index*4 + 0x15d]`, sums only positive entries, and subtracts that total from the company share count. Current grounded callers are the takeover and merger vote resolvers, which stage the result into `0x006d1a04` and `0x006d1104` before the lower public-vote support formulas run.","objdump + caller inspection + takeover and merger vote correlation"
0x00426260,607,company_compute_board_approved_dividend_rate_ceiling,simulation,thiscall,inferred,objdump + caller inspection,4,"Computes one nonnegative per-share dividend ceiling for the selected company. The helper starts from the current support or governance lane `0x2329/0x0d`, normalizes that value by the current outstanding-share band at `[this+0x47]`, then scans a bounded recent-year window relative to the founding year `[this+0x157]` and current scenario year `[0x006cec78+0x0d]`, taking minima from the shareholder-facing slots `0x2b` and `0x2c`. In the early-company path it also folds in `[this+0x57]` and the previous-year slot `0x1c`, applies several scale constants, and clamps the result at zero before returning the final per-share ceiling. Current grounded shell caller is `shell_company_detail_handle_change_dividend_rate_dialog_message` at `0x004c5140`, where this is the direct board-approval limit behind localized id `991` when the player tries to raise the dividend too far.","objdump + caller inspection + dividend-ceiling correlation"
0x004273c0,132,company_repurchase_public_shares_and_reduce_capital,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Repurchases one caller-supplied quantity of public shares and reduces company capital accordingly. The helper converts the share count into one cash-side total through the current support-adjusted share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` and fixed market-scale constants, posts the resulting negative amount into company stat slots `0x0c` and `0x0d` through `0x0042a080` and `0x0042a040`, and subtracts the same share count from the outstanding-share field `[this+0x47]`. Current grounded callers are the `CompanyDetail.win` stock-buyback flow at `0x004c46d0` and the annual finance-policy helper at `0x00401c50`, where it contributes the RT3.lng `2887` repurchase headline.","objdump + caller xrefs + callsite inspection + stock-buyback correlation + annual-finance correlation"
0x00427450,224,company_issue_public_shares_and_raise_capital,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Issues one caller-supplied quantity of public shares and increases company capital. When the optional pricing flag is clear, the helper derives one implied share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, the current company credit-rating score at `0x00425320`, and fixed underwriting constants; when the flag is set it reuses the caller-supplied scalar instead. It then posts the resulting proceeds into company stat slot `0x0c`, records the issued-share quantity in stat slot `0x0d`, snapshots the prior current-issue packed calendar tuple from `[this+0x16b/+0x16f]` into `[this+0x173/+0x177]`, writes the active world tuple from `[0x006cec78+0x0d/+0x11]` back into `[this+0x16b/+0x16f]` when taking the derived-pricing lane, and increases the outstanding-share field `[this+0x47]` by the issued quantity. Current grounded callers are the `CompanyDetail.win` stock-issue flow at `0x004c3f30` and the annual finance-policy helper at `0x00401c50`, where it contributes the debt-refinance-plus-borrowing and straight new-borrow capital side.","objdump + caller xrefs + callsite inspection + stock-issue correlation + annual-finance correlation + calendar-tuple-stamp correlation"
0x00427540,76,company_compute_bond_interest_rate_quote,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Computes one company-specific bond interest-rate quote from the requested term and current credit or rate state. When the company is active it combines the current company credit-rating score from `0x00425320`, the prime-rate helper `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580`, and one term-dependent adjustment from the caller-supplied year span, then returns the resulting float rate; otherwise it falls back to `1.0`. Current grounded caller is `company_issue_bond_and_record_terms` `0x004275c0`, where this helper supplies the quoted rate when the caller does not already provide one.","objdump + caller xrefs + callsite inspection + bond-rate correlation + credit-rating correlation + prime-rate correlation"
0x004275c0,255,company_issue_bond_and_record_terms,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Issues one new bond and appends its term record to the live company debt table. The helper first rejects companies already at the `0x14` bond-slot cap, computes or accepts one quoted interest rate through `company_compute_bond_interest_rate_quote` `0x00427540`, posts the bond proceeds into company stat slot `0x0c`, posts the principal into stat slot `0x12`, posts the coupon rate into stat slot `0x0d`, and then writes one new three-dword bond record into the next 12-byte entry rooted at `[this+0x5f]`: principal, maturity year, and quoted rate. It increments the bond count at `[this+0x5b]` and returns success. Current grounded callers are the `CompanyDetail.win` bond-issue flow at `0x004c3890` and the annual finance-policy helper at `0x00401c50`, where it supplies both straight new borrowing and refinance-plus-borrow follow-ons.","objdump + caller xrefs + callsite inspection + bond-issue correlation + annual-finance correlation"
0x00426890,68,company_find_collection_index_by_company_id,simulation,thiscall,inferred,objdump + caller inspection,4,"Finds one live company collection index by comparing the requested company id against the first dword of each entry in the company manager at `0x0062be10`. The helper returns the zero-based index on a match or `-1` when no live company record matches. Current grounded callers are the takeover and merger vote resolvers, which use that index before reading profile-side per-company holdings from `0x006ceb9c`.","objdump + caller inspection + company collection correlation"
0x004268e0,103,company_refresh_post_load_year_clamp_and_runtime_support_fields,simulation,thiscall,inferred,objdump + local disassembly + company-load correlation,3,"Per-company load-side follow-on beneath the live company collection bundle refresh. The helper clears runtime support dwords `[this+0x0d3a]` and `[this+0x0d3e]`, then clamps founding-year lane `[this+0x157]` into the active scenario-year band rooted at `[0x006cec78+0x05/+0x0d]`. Current grounded caller is `company_collection_load_tagged_header_counts_and_refresh_live_records_from_bundle` `0x00429af0`, so this is the safest current read for the post-load company year clamp and runtime support reset rather than a shell-side finance helper.","objdump + local disassembly + company-load correlation + field-reset correlation"
0x00426be0,53,company_can_purchase_territory_access_rights,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Returns whether the current company may purchase territory-access rights for one requested territory id. The helper first rejects territories where the company already has access through the byte table at `[this + territory*0x38d + 0x1d9f]`, then resolves the territory through `0x006cfc9c` and only returns `1` when the territory-side mode byte at `[territory+0x2d]` equals `1`. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the buy-rights flow at `0x004c5fc9`, where this is the direct gate between localized ids `947` and `948` plus the actionable `961` purchase prompt.","objdump + caller inspection + RT3.lng strings + territory-flag correlation"
0x00426d60,393,company_deactivate_and_clear_chairman_share_links,simulation,thiscall,inferred,objdump + caller inspection + collection-state correlation,4,"Runs the destructive selected-company clear path currently reached from `CompanyDetail.win`. The helper first rejects inactive companies through `[this+0x3f]`, then zeroes all active-chairman share holdings for this company across `0x006ceb9c`, clears the linked chairman backpointer `[company+0x3b]` and the profile-side owning-company field `[profile+0x1dd]`, clears the selected-company latch when the scenario currently points at this company, marks the company inactive by zeroing `[company+0x3f]`, and walks two live collections to drop or invalidate remaining references that still point back to this company. The tail then rebuilds one local name block from `[company+0x4]` and publishes the change through the scenario-state helper at `0x004360d0`. Current grounded shell caller is the `0x9493` section-0 control under `shell_company_detail_window_handle_message`, so current best meaning is a company deactivation or liquidation-style clear path rather than an ordinary governance vote helper.","objdump + caller inspection + collection-state correlation + CompanyDetail control correlation"
0x00426ef0,43,company_get_linked_chairman_profile_record,simulation,thiscall,inferred,objdump + caller inspection,4,"Resolves the linked chairman profile record for one company. The helper reads the linked chairman id from `[this+0x3b]`, validates it against the live profile collection at `0x006ceb9c`, and returns the resolved profile record through `0x00518140`; zero or invalid ids return null. Current grounded callers include the CompanyDetail section-0 overview formatter at `0x004e5cf0`, where this is the direct bridge from a selected company to the chairman profile used for ownership and governance text.","objdump + caller inspection + chairman-link correlation"
0x0042a0e0,77,company_query_highest_coupon_bond_slot_index,simulation,thiscall,inferred,objdump + caller inspection + debt-record layout correlation,3,"Returns the live bond-slot index with the highest coupon rate from the debt table rooted at `[this+0x5f]`. The helper walks the current bond count at `[this+0x5b]`, compares each slot's rate field at `[this+0x67 + slot*0xc]`, and returns the zero-based index of the strongest surviving slot or `-1` when no bond slots are live. Current grounded caller is the annual finance-policy helper at `0x00401c50`, where this picks the reference bond used by the build-`1.03+` stock-issue lane before it checks current cash against that slot's principal plus a small fixed buffer.","objdump + caller inspection + debt-record layout correlation + annual-finance correlation"
0x0042a040,55,company_add_delta_into_stat_series_and_current_slot,simulation,thiscall,inferred,objdump + caller xrefs + field-write correlation,3,"Adds one caller-supplied float delta into the company stat-family series lane selected by the requested slot id. The helper increments both the year-indexed series rooted at `[this+0x0d7f]` and the current aggregate lane rooted at `[this+0x1c47]`, but does not touch the broader cash-side shadow totals. Current grounded callers include bond repayment `0x00423d70`, bankruptcy `0x00425a90`, stock buyback `0x004273c0`, territory-access purchase `0x004c5fc9`, and several placement or world-service mutations, so this now reads as the shared company stat poster without the optional cash-side follow-on.","objdump + caller xrefs + field-write correlation + finance-mutator correlation"
0x0042a080,95,company_add_delta_into_stat_series_current_slot_and_optional_cash_totals,simulation,thiscall,inferred,objdump + caller xrefs + field-write correlation,3,"Adds one caller-supplied float delta into the selected company stat-family lane, exactly like `company_add_delta_into_stat_series_and_current_slot` `0x0042a040`, and optionally mirrors the same delta into the broader cash-side shadow totals when the third argument is nonzero. The shared stat writes still land in the year-indexed series rooted at `[this+0x0d7f]` and current aggregate lane `[this+0x1c47]`; the optional follow-on also increments the cash-pair totals at `[this+0x11f7]` and `[this+0x1caf]`. Current grounded callers include stock buyback `0x004273c0`, chairman-salary and dividend policy paths around `0x00427920`, linked world-service updates, and several company-side cash or capital mutators, so this is the stronger shared company stat poster when cash-side shadow totals must stay synchronized.","objdump + caller xrefs + field-write correlation + cash-pair correlation + finance-mutator correlation"
0x0042a2e0,645,company_read_control_transfer_metric_slot,simulation,thiscall,inferred,objdump + caller inspection,3,"Reads one derived company metric from the bounded slot family `0x13..0x2f` used by control-transfer, public-support, annual governance logic, report-history pages, and stock-data readouts. The dispatcher mixes direct company fields such as `[this+0x4b]`, `[this+0x53]`, `[this+0x323]`, `[this+0x327]`, `[this+0x333]`, `[this+0x33f]`, and the later counters near `[this+0x34b]` and `[this+0x14f]` with a few computed ratios and helper-backed terms. The first grounded slot `0x13` already resolves through `company_compute_public_support_adjusted_share_price_scalar` at `0x00424fd0`, which now reads as a broader investor-support and share-price lane rather than a vote-only term. Wider shell-side xrefs now tighten the stock-data subfamily too: slot `0x1c` is `Share Price`, slot `0x1d` is `Book Value Per Share`, slot `0x1e` is `Revenue Per Share`, slot `0x1f` is `Earnings Per Share`, slot `0x20` is `Dividend Per Share`, slot `0x21` now routes through `company_compute_five_year_weighted_shareholder_return` `0x004246b0` for `5 Year Weighted Return`, and the adjacent slot `0x23` is now best bounded as the hidden current or fallback shareholder-payout lane rooted at `[this+0x53]` that feeds that five-year return formula. The higher derived switch at `company_read_derived_financial_report_metric_slot` `0x00429c70` also now narrows the shared finance-family semantics reused beside this slot reader: `0x2b` is the net-profits-style derived lane, `0x2c` is the broader revenue aggregate, and raw slot `0x09` aligns with the Income Statement fuel-cost lane surfaced by tooltip `1309`; the adjacent special interest-help row uses a different metric id and `2815` rather than raw slot `0x09` itself. That keeps nearby annual finance, CompanyDetail, and ledger readouts consistent with shell labels such as `925` `Profits:`, `928` `Largest Shareholders`, `929` `Shares`, and `930` `Per Share Data`. This now looks like a generic company support-and-finance metric dispatcher rather than a merger-only issue reader.","objdump + caller inspection + metric-slot correlation + governance-string correlation + company-detail correlation + stock-data-label correlation + income-statement-row correlation + derived-report-metric correlation + share-price-scalar correlation + weighted-return correlation + shareholder-payout-lane correlation"
0x0042a5d0,131,company_read_year_or_control_transfer_metric_value,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,3,"Reads one company-side float from either a year-relative stat series or the local support-and-governance metric slot family. When the family argument is `0x2329` or one of the neighboring current-year offsets, the helper resolves one year-relative table entry from the series rooted at `[this+0x0d7f]`; when the request falls back to the bounded slot family it delegates to `company_read_control_transfer_metric_slot` at `0x0042a2e0`, and requests at `0x2b` or above then continue into `company_read_derived_financial_report_metric_slot` `0x00429c70`. The `0x2329` token is no longer treated as an issue id here: it is the stat-family selector paired with the localized company-stat label id `2329`, and current grounded callers use this wrapper beneath merger, takeover, bankruptcy, annual shareholder-revolt, creditor-liquidation, and other company-policy dialogs to fetch yearly or current support-side values. This makes the helper a generic company stat reader rather than an issue-specific vote formula.","objdump + caller inspection + RT3.lng strings + stat-family correlation + governance-string correlation + derived-report-metric correlation"
0x0042c690,311,placed_structure_rebuild_candidate_cargo_service_bitsets,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Rebuilds two per-cargo bitsets on one placed-structure or site record using the live structure-candidate collection at `0x0062ba8c`. The helper clears the bitsets rooted at `[this+0x0d8]` and `[this+0x0df]`, walks the linked placed-structure chain starting at `[this+0x0d6]` through `0x0062b26c`, selects only linked instances whose backing candidate resolves through vtable `+0x80` with category byte `2`, and then scans the live candidate collection for entries that pass `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. For each passing candidate it queries the direct and scaled supply-side cargo channels through the wrappers at `0x00412960` and `0x004129a0`; positive direct supply sets bits in `[this+0x0df]`, while positive scaled supply on candidates with runtime cargo state at `[candidate+0x78c]` sets bits in `[this+0x0d8]`. The cargo-id sweep is tighter now too: the inner loop starts at cargo id `1` and runs upward through the current live cargo count, so this steady-state bitset owner never intentionally queries cargo id `0`. Current grounded callers sit immediately above the sibling helper at `0x0042cdf0`, which makes this the strongest current steady-state consumer of the rebuilt editor cargo runtime tables rather than a pure setup path.","objdump + caller xrefs + callsite inspection + cargo-summary correlation + cargo-id-loop correlation"
0x0042c8f0,112,placed_structure_refresh_linked_candidate_flag4,map,thiscall,inferred,objdump + caller xrefs + linked-instance inspection,3,"Refreshes bit `0x4` in the placed-structure state byte at `[this+0x0e6]` from the currently linked placed-instance chain rooted at `[this+0x0d6]`. The helper walks linked instances through `0x0062b26c`, keeps only entries whose backing instance passes `0x0040c990 == 1`, resolves each surviving instance through vtable slot `+0x80`, and sets the local flag when any resolved candidate record has nonzero byte `[candidate+0xba]`; otherwise it clears that bit. Current grounded callers are the immediate wrapper `0x0042cdf0` plus the relink helpers at `0x0042c9a0` and `0x0042c9f0`, so this looks like the sibling state refresh that runs beside the cargo-service bitset rebuild with candidate byte `[candidate+0xba]` kept at the raw-flag level.","objdump + caller xrefs + linked-instance inspection + candidate-flag correlation"
0x0042cab0,117,placed_structure_accumulate_candidate_metric_or_emit_route_style_peer_link,map,thiscall,inferred,objdump + caller inspection + route-style remap inspection,3,"Small candidate-side projection helper used by the broader route-style rebuild lane. The helper starts by querying one integer local metric through `0x0042c960` for the caller-supplied candidate index, then resolves the matching structure-candidate record through `0x0062ba8c` and re-enters `0x0041e1f0` to stage one floating contribution. It next reads the candidate's route-style remap slot at `0x0062ba8c+0x9a`: when that slot is negative it adds the contribution directly into the local route-style grid lane at `[this+candidate*4+0x103]`; when the slot is nonnegative it instead re-enters `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0` with the remapped class id and the same floating contribution. Current grounded caller is the larger per-site route-style rebuild pass at `0x004101e0`, which makes this the clearest current branch where ordinary candidate metrics stay local but remapped route-style candidates become peer-link emission requests.","objdump + caller inspection + route-style remap inspection + peer-link emission correlation"
0x0042cb30,124,placed_structure_clamp_candidate_service_age_table,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Late clamp pass over the primary per-candidate word table rooted at `[this+0x00]`. When the site owns a nonzero route latch at `[this+0x0d4]` and `0x0042c880` signals the pass should run, the helper walks every live non-remapped candidate, queries one route-linked age or freshness value through `0x0042c110`, shifts that result into the local word-table scale, and replaces `[this+candidate*2]` with the smaller of the current value and the new clamp. Current grounded callers are the local bundle wrapper `0x0042d580` and the later world-grid sweep at `0x00450133`, so this now looks like the final recent-service clamp on the local candidate age table rather than another raw scoring helper.","objdump + caller xrefs + callsite inspection + route-age correlation"
0x0042cbb0,145,placed_structure_route_supports_candidate_local_service_mode,map,thiscall,inferred,objdump + caller xrefs + route-record inspection,3,"Boolean route-linked predicate for one candidate-local service branch. The helper walks the route or service record chain owned by the current site through `[this+0x0d4]` and collection `0x006cec20`, reads one candidate-indexed float lane at `[route+0x3e]`, and compares the route-side threshold at `[route+0x112]` against the current local word-table value for that candidate after scaling through `0x00437d20`. It returns `1` on the first matching route record and `0` otherwise. Current grounded caller is `placed_structure_rebuild_candidate_local_service_tables` at `0x0042ce00`, where this predicate selects one of the route-backed scoring transforms.","objdump + caller xrefs + route-record inspection + candidate-table correlation"
0x0042cc50,402,placed_structure_apply_route_linked_service_caps,map,thiscall,inferred,objdump + caller xrefs + route-record inspection,3,"Route-linked cap pass over the aligned local service tables. The helper walks the route or service record chain rooted at `[this+0x0d4]` through `0x006cec20`, then for each live non-remapped candidate that passes `structure_candidate_is_enabled_for_current_year` it compares the route-side candidate float at `[route+0x42]` against the current site float table at `[this+0x107]` and the current primary word-table value at `[this+0x00]`. When the route-linked ratio stays inside the live clamp window it writes a lower capped value back into the primary word table. Current grounded caller is the composite local refresh `0x0042d580`, so this now looks like the first route-backed cap pass that shapes the rebuilt local service tables before the later neighborhood redistribution and recent-service clamp run.","objdump + caller xrefs + route-record inspection + local-table correlation"
0x0042cdf0,16,placed_structure_refresh_candidate_service_state,map,thiscall,inferred,objdump + caller xrefs + wrapper inspection,4,"Tiny composite refresh for one placed-structure or site record. The helper first rebuilds the candidate cargo-service bitsets through `placed_structure_rebuild_candidate_cargo_service_bitsets` at `0x0042c690`, then tail-calls `placed_structure_refresh_linked_candidate_flag4` at `0x0042c8f0` to refresh the sibling state bit at `[this+0x0e6]`. Current grounded callers include the world-grid sweep at `0x00450003`, so this now looks like the common steady-state placed-structure service-state refresh immediately above the editor-driven cargo runtime tables.","objdump + caller xrefs + wrapper inspection"
0x0042ce00,1394,placed_structure_rebuild_candidate_local_service_tables,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Large per-site rebuild over the live candidate collection at `0x0062ba8c`. The helper walks every candidate with live runtime state at `[collection+0x16e]` and no remap entry at `[collection+0x9a]`, decays positive floats in the aligned per-candidate table rooted at `[this+0x107]`, and commits those float updates back through `0x0041e1b0`. It then combines that float table with two aligned per-candidate word tables rooted at `[this+0x02]` and `[this+0x6c]`, the direct-supply cargo bitset at `[this+0x0df]`, the site-side latch at `[this+0x0d4]`, and the branch predicate `0x0042cbb0` to choose among several normalized scoring transforms before writing the quantized result back into the destination word table. Current grounded callers now put this directly under the local wrapper at `0x0042d580`, so this looks like the first real site-side candidate service-score rebuild above the editor-driven cargo runtime lane rather than another candidate-only helper.","objdump + caller xrefs + callsite inspection + table-layout correlation"
0x0042d580,26,placed_structure_refresh_local_service_score_bundle,map,thiscall,inferred,objdump + caller xrefs + wrapper inspection,4,"Composite local-service refresh for one placed-structure or site record. The helper first runs `placed_structure_rebuild_candidate_local_service_tables` at `0x0042ce00`, then immediately chains into the neighboring local post-passes at `0x0042cc50`, `0x0042c1b0`, and `0x0042cb30` before returning. Current grounded caller is the world-grid sweep at `0x00450110`, which uses this as the stronger per-site local-service refresh after the lighter cargo-service-state pass at `0x00450003`.","objdump + caller xrefs + wrapper inspection"
0x00428a10,22,company_clear_selected_chairman_if_current_profile,simulation,thiscall,inferred,objdump + caller inspection,4,"Clears the linked chairman for the current company when the supplied profile id matches `[this+0x3b]`. On a match the helper zeroes the incoming profile id and tail-calls `0x00427c70`; otherwise it returns without changing company state. Current grounded shell caller is `shell_company_detail_resign_chairmanship_flow`, which uses this as the commit step behind the localized resignation confirmation.","objdump + caller inspection + chairman-link correlation"
0x00425320,607,company_compute_credit_rating_score,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,4,"Computes the bounded company credit-rating score reused by the debt-side shell and several adjacent company-policy gates. The helper returns a fixed floor when the company-active flag at `[this+0x3f]` is clear; otherwise it starts from a weighted four-year net-profits-minus-fuel ladder over slots `0x2b` and `0x09`, blends in the current debt total from stat-family `0x2329/0x12`, folds in the weighted average bond interest rate through `company_compute_weighted_average_bond_interest_rate` `0x00423e40`, conditionally adds the prime-rate baseline and raw issue-39 total through `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580`, then derives several debt- or liquidity-side ratios from derived stat slots `0x30` and `0x31` before applying company-age smoothing. The tail then adds the raw issue-38 total through `scenario_state_sum_issue_opinion_terms_raw` `0x00436710`, rounds the result, and uses that bounded score both for the CompanyDetail credit row and for bond-offer gating. Current grounded callers are the city-connection news owner `0x00406050`, the bond-interest quote wrapper `0x00427540`, the bond-side boolean gate `0x00427590`, the generic derived-metric reader at `0x0042a2e0` for the credit-rating-style slot, the CompanyDetail debt-credit-rate summary panel `0x004c23a0`, and the CompanyDetail bond-issue flow `0x004c3890`. The surrounding text anchors are explicit: shell localized id `952` is `Credit Rating:`, and localized id `974` says new bonds require a strong enough credit rating. This is therefore the safest current read for the debt-market or creditworthiness score, distinct from the issue-39 prime-rate lane and from the broader issue-37 equity-support lane.","objdump + caller xrefs + callsite inspection + RT3.lng strings + credit-rating correlation + bond-dialog correlation + prime-rate contrast + issue-38 correlation"
0x00424fd0,751,company_compute_public_support_adjusted_share_price_scalar,simulation,thiscall,inferred,objdump + caller inspection,3,"Computes one bounded investor-support and share-price scalar used by stock-capital policy, cached share-price readouts, and adjacent governance or control-transfer vote lanes. The helper starts from `company_compute_cached_recent_per_share_performance_subscore` at `0x004248d0`. If the older company-side support field `[this+0x57]` is still at least as strong as that fresh score and the company is within five years of founding year `[this+0x157]`, it interpolates the two through a capped startup-progress term derived from the current world calendar counter `[0x006cec78+0x15]`, the company stamp `[this+0x0d07]`, and the founding year, with the progress side capped at `50`; otherwise it keeps the fresh per-share score directly. The first caller argument is then normalized by current outstanding shares `[this+0x47]` and clamped into the narrow pressure band `[-0.2, 0.2]`. When the caller supplies nonzero control arguments, that pressure term can also refresh the mutable support field `[this+0x4f]` by blending the prior field with the staged delta. The later share-price body is tighter now too: it derives a share-count growth term from outstanding shares through the power helper `0x005a1b60` on `(shares / 20000)^0.33`, scales that by `1.4`, folds it back against current shares, and then runs a piecewise compression or clamp ladder over the resulting support scalar at thresholds `0.6`, `0.45`, `0.3`, `1.7`, `2.5`, `4.0`, and `6.0`. After that it multiplies by the scenario issue-opinion multiplier from `scenario_state_compute_issue_opinion_multiplier` `0x00436590` using issue id `0x37`, rounds through `0x005a10d0`, floors the rounded result at `0.0001`, and optionally snapshots it into the cached share-price field `[this+0x0d7b]` when the second control argument is nonzero. Current grounded callers include the cached share-price accessor `0x00423eb0`, the stock buyback and stock issue mutators `0x004273c0` and `0x00427450`, the bankruptcy recompute path `0x00425a90`, the merger vote resolver at `0x004ebd10`, the company-side takeover and policy family, and the annual creditor-pressure or shareholder-policy lane that surfaces localized ids `300..304`. The surrounding finance split is now tighter too: `company_compute_credit_rating_score` `0x00425320` feeds the explicit `Credit Rating` shell rows and bond-offer rejection flow, while `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580` feeds the explicit `Prime Rate` row and cash interest helpers. That leaves issue `0x37` as the broader equity-market or investor-confidence lane behind company or chairman performance. The strongest direct text anchors are still localized ids `300/301` `Shareholders revolt against poor management`, `1217` `Investors are somewhat pleased with the chairman's performance.`, and `3048/3049` `Investors are %1 your performance./the chairman's performance.`. A deeper follow-up now rules out three tempting label shortcuts: the nearby `0x460a90..0x460c53` and `0x473620..0x47366a` registration families are camera-view and related shell-command bindings, not finance issue owners; the editor-side `Stock Prices` label belongs to the separate float-tuning block `[state+0x0bde..0x0bf6]`, not the issue table behind `0x37`; and the extracted `CompanyDetail.win` shell resource from `rt3_2WIN.PK4` does not expose any separate plain-English investor or finance caption for this lane, which matches the owner-side read that section-0 is a dynamic text widget (`0x947f`) fed by `shell_format_company_governance_and_economy_status_panel` `0x004e5cf0` rather than a fixed label row.","objdump + caller inspection + support-field correlation + issue-id correlation + governance-string correlation + stock-buyback correlation + stock-issue correlation + share-price-cache correlation + per-share-performance correlation + pressure-band correlation + startup-interpolation correlation + power-helper correlation + credit-vs-prime-rate
0x00424580,82,company_compute_prime_rate_from_issue39_scenario_baseline,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small company-side rate helper that produces the current prime-rate-style baseline from scenario state plus issue `0x39`. It first reads one normalized scenario baseline through `0x00433740` on active scenario state `0x006cec78`, then adds the scaled raw issue-39 total from `scenario_state_sum_issue_opinion_terms_raw` at `0x00436710` using the current company id `[this+0x00]`, linked chairman id `[this+0x3b]`, and no territory argument. Current grounded callers now bound the player-facing meaning more tightly: the bond-interest quote wrapper at `0x00427540`, the negative and positive cash interest helpers at `0x00425880` and `0x004258c0`, and the CompanyDetail capital summary row labeled `954` `Prime Rate:` at `0x004c23a0`. This now reads as the shared prime-rate or market-rate helper rather than a generic company-support scalar.","objdump + caller xrefs + callsite inspection + issue-39 correlation + prime-rate correlation + bond-quote correlation"
0x004246b0,544,company_compute_five_year_weighted_shareholder_return,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,3,"Computes the stock-data lane surfaced as `5 Year Weighted Return`. Inactive companies fall back to the fixed scalar at `0x005c8598`; otherwise the helper walks up to five recent years above founding year `[this+0x157]`, samples yearly `Share Price` from slot `0x1c`, measures year-over-year price appreciation against the prior sample, blends that with the paired historical shareholder-payout lane from slot `0x23`, and weights recent years more heavily through the same scenario-side year weighting byte at `[0x006cec78+0x0f]`. Current evidence now bounds that paired lane more tightly: slot `0x23` falls back to direct company field `[this+0x53]` on the current-company path and is only consumed here, so the strongest current read is the historical dividend-per-share or shareholder-payout component paired with yearly price appreciation. The tail normalizes the accumulated weighted return by the accumulated weights and returns one bounded annualized-style float. Current grounded caller is `company_read_control_transfer_metric_slot` at `0x0042a2e0` for slot `0x21`, which matches the stock-data label `942` `5 Year Weighted Return:` and tooltip `936`.","objdump + caller inspection + RT3.lng strings + stock-data-label correlation + weighted-return correlation + shareholder-payout-lane correlation"
0x00425880,64,company_compute_negative_cash_balance_interest_rate,shell,thiscall,inferred,objdump + LoadScreen report correlation + localized string correlation,4,"Small company-side rate helper used only by the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper reads one control-transfer or yearly metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x22`, combines that with the prime-rate helper `company_compute_prime_rate_from_issue39_scenario_baseline` at `0x00424580`, normalizes the result through two fixed constants, and returns one bounded float formatted as the first `%1` insert in localized strings `2815` and `2816`. Current grounded meaning is the company's negative-cash borrowing interest rate, i.e. the rate the company currently pays on negative cash balances in the Income Statement and Balance Sheet help rows.","objdump + LoadScreen report correlation + localized string correlation + helper call inspection + prime-rate correlation"
0x004258c0,396,company_compute_positive_cash_balance_interest_rate,shell,thiscall,inferred,objdump + LoadScreen report correlation + localized string correlation,4,"Company-side rate helper paired with `company_compute_negative_cash_balance_interest_rate` beneath the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper starts from the same prime-rate helper at `0x00424580`, subtracts one baseline constant, then reads the company cash metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x0d`. It applies a piecewise threshold ladder over that cash or liquidity lane, clamps the result into several fixed bands, and returns the second `%2` insert for localized strings `2815` and `2816`. Current grounded meaning is the company's positive-cash deposit interest rate, i.e. the rate the company currently earns on positive cash balances in the Income Statement and Balance Sheet help rows.","objdump + LoadScreen report correlation + localized string correlation + helper call inspection + piecewise-threshold correlation + prime-rate correlation"
0x00429c70,976,company_read_derived_financial_report_metric_slot,simulation,thiscall,inferred,objdump + caller inspection + shell-label correlation,3,"Reads one derived company metric from the higher report-style slot family rooted at `0x2b`. The jump-table body now has one safe finance-side core: slot `0x2c` sums raw slots `0x01..0x04` into the broader revenue aggregate, slot `0x2d` combines the neighboring expense-side derived lanes, and slot `0x2b` then combines `0x2c` and `0x2d` into the net-profits-style lane reused by shell labels `1212` `Profits`, `925` `Profits:`, and the annual finance policy. The same helper also owns several later derived ratios and aggregates, including one asset-side pair around `0x30/0x31` and the per-unit revenue lanes that divide the revenue aggregate `0x2c` by count or distance slots such as `0x24`, `0x16`, and `0x17`. Current grounded callers arrive indirectly through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0`, so this is the shared derived financial-report metric reader beneath CompanyDetail, LoadScreen, and annual finance rather than a shell-only formatter helper.","objdump + caller inspection + shell-label correlation + derived-metric correlation + income-statement correlation"
0x00429950,42,company_collection_construct,simulation,thiscall,inferred,objdump + world-load correlation + local disassembly,3,"World-load constructor for the live company collection later rooted at `0x0062be10`. The helper seeds the indexed-collection base through `0x00517ce0/0x00518570` with grounded parameters `(record_size=0x7684, initial_slots=5, growth=5, id_base=1)`, installs vtable `0x005c9bf8`, and returns `this`. Current grounded caller is the world-load allocation strip inside `0x00438c70`, where the resulting collection is stored into global `0x0062be10`.","objdump + world-load correlation + local disassembly + constructor-parameter reconstruction"
0x00429980,11,company_collection_release_entries_and_collection_storage,simulation,thiscall,inferred,objdump + world-shutdown correlation + local disassembly,2,"Release-side companion to `company_collection_construct` `0x00429950`. The helper reinstalls vtable `0x005c9bf8` and then tails into the common collection teardown `0x00518bd0`. Current grounded caller is the ordered world-root shutdown strip inside `0x00434300`, which releases global `0x0062be10` with the other typed runtime collections.","objdump + world-shutdown correlation + local disassembly + companion correlation"
0x00429990,86,company_collection_get_nth_active_company_id,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the company id of one requested active-company ordinal within the live company collection rooted at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, tests the active company-state flag at `[entry+0x3f]`, decrements the caller-supplied ordinal only for active entries, and returns the first company id whose active ordinal matches zero. Current grounded callers use it as the forward mapping between active-company page indices and concrete company ids in shell-side roster, detail, and picker flows.","objdump + caller inspection + active-company roster correlation"
0x004299f0,84,company_collection_count_active_companies_before_company_id,simulation,thiscall,inferred,objdump + caller inspection,4,"Counts how many active companies precede one requested company id in the live company collection at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, stops when the entry id matches the requested company id, and increments the return counter only for active entries whose state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the inverse mapping for shell-side company paging and company-relative selector paths before converting back through `company_collection_get_nth_active_company_id` at `0x00429990`.","objdump + caller inspection + active-company roster correlation"
0x00429a50,62,company_collection_count_active_companies,simulation,thiscall,inferred,objdump + caller inspection,4,"Counts active companies in the live company collection rooted at `0x0062be10`. The helper walks collection slots through `0x00518380`, resolves each record through `0x00518140`, and increments the total only when the active-state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the active-company roster size for shell-side company browsing and neighboring selector math.","objdump + caller inspection + active-company roster correlation"
0x00429af0,118,company_collection_load_tagged_header_counts_and_refresh_live_records_from_bundle,simulation,thiscall,inferred,objdump + world-load correlation + local disassembly + tag correlation,3,"Bundle-load owner for the live company collection `0x0062be10`. The helper reads tagged sections `0x61a9/0x61aa/0x61ab` through repeated `0x00531360` calls, refreshes the indexed-collection header through `0x00518680`, and then walks every live company entry dispatching each record through `0x004268e0` with the active bundle handle before closing the final tag. Current grounded caller is the world-entry bring-up family, where this helper refreshes the live company records from the tagged bundle after collection construction.","objdump + world-load correlation + local disassembly + tag correlation + per-entry-load correlation"
0x00429b90,92,company_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle,simulation,thiscall,inferred,objdump + package-save correlation + local disassembly + tag correlation,3,"Package-save sibling for the live company collection `0x0062be10`. The helper opens tagged sections `0x61a9/0x61aa/0x61ab` through repeated `0x00531340` calls, serializes the indexed-collection header through `0x00517d90`, and then walks every live company entry dispatching each record through the current no-op payload callback `0x00424000` before closing the final tag. Current grounded caller is the package-save path that persists the live runtime collections beside the other world roots.","objdump + package-save correlation + local disassembly + tag correlation + per-entry-save correlation"
0x00430270,225,world_try_place_random_structure_batch_from_compact_record,map,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Shared world-side retry loop that tries to place multiple structures from one compact spawn record. The caller supplies one small record whose fields now read most safely as a structure or profile token at `+0x00`, requested placement count at `+0x11`, center coordinates at `+0x12/+0x14`, and placement radius or extent at `+0x16`. The helper translates the token through the static table at `0x0061039c` into the live structure-profile collection `0x0062b268`, increments the region-manager reentrancy counter at `[0x0062bae0+0x88]`, and then runs up to `200` randomized attempts while placements remain. Each attempt samples a candidate coordinate inside the requested radius, rejects points outside the live world bounds at `[0x0062c120+0x2155/+0x2159]`, resolves the owning region through `0x0044a800` and `0x0062bae0`, adapts the candidate through `0x00412880`, and finally re-enters `world_region_validate_and_commit_candidate_placement` `0x00422a70`. Successful placements decrement the remaining batch count and reset the local retry counter. Current grounded caller is the world-side dispatch branch at `0x00431b43`, where only compact record classes in the `0x1f7..0x265` table range enter this batch placer. This is therefore the strongest current read for the world-side randomized structure-batch placement loop rather than a region-worker-private helper.","objdump + local disassembly + caller correlation + placement-batch correlation"
0x00430b50,624,scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Builds one runtime-effect record in the live scenario event collection from a compact source record plus the caller's currently resolved targets. The helper first allocates a new runtime-effect entry through `scenario_event_collection_allocate_runtime_effect_record_from_compact_payload` `0x00432ea0`, then seeds several per-record control bytes and target selectors in the new object, including mode byte `[record+0x7ef]`, optional gating bytes `[record+0x7f4/+0x7f9/+0x7fa]`, a primary selector at `[record+0x7f0]`, and optional comparison ids at `[record+0x82c/+0x830]`. Current grounded callers are the compact runtime-effect dispatcher `0x00431b20`, where fallback branches synthesize follow-on runtime effects from one compact linked record, and the shell-side branch at `0x004d60fd`, where the same builder is reached with a caller-owned output slot. This is therefore the current safest read for the runtime-effect follow-on record builder rather than a generic collection insert wrapper.","objdump + local disassembly + caller correlation + runtime-effect-builder correlation"
0x00430d70,990,scenario_event_serialize_runtime_record_into_packed_state,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Per-record save-side companion to `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20` beneath the `.smp` event-collection serializer `0x00433060`. The helper first re-enters `0x0042d820` six times with clear-side flag `0` over the same fixed text bands rooted at `[record+0x0e0]`, `[+0x401]`, `[+0x4ca]`, `[+0x593]`, `[+0x65c]`, and `[+0x725]`, then counts the standalone linked runtime-condition row chain at `[record+0x00]` and the four grouped runtime-effect row chains rooted at `[record+0x04/+0x08/+0x0c/+0x10]`. It writes per-family version marker `0x526f`, serializes each `0x1e` condition row with its scalar and byte fields plus the optional resolved candidate-name side string for bounded candidate-id ranges, emits grouped-row marker `0x4eb8` plus the four per-slot counts, and then serializes each `0x28` grouped row with the same version-gated field extension seen on restore, including the optional linked locomotive-name side string for bounded locomotive-id ranges before the later grouped remap and write-side branches continue. Current grounded caller is `scenario_event_collection_serialize_runtime_records_into_packed_state` `0x00433060`, so this is the safest current read for one live event's packed-state serializer rather than a broader collection walk.","objdump + local disassembly + caller correlation + event-record-save correlation + condition-row-and-effect-row correlation"
0x00431b20,399,world_apply_compact_runtime_effect_record_to_resolved_targets,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Dispatches one linked compact runtime-effect record against the caller-resolved target context. The record token at `[*record+0x00]` is translated through the static table at `0x0061039c`; when the translated class lies in the `0x1f7..0x265` range the helper immediately re-enters `world_try_place_random_structure_batch_from_compact_record` `0x00430270`. Otherwise it jumps through the local class table at `0x004320b4/0x004320fc` into a mixed effect family that now includes: shell-state modifier branches over `0x006cec78`, signed scalar adjustments on resolved company/profile/territory targets through the `0x004d6611/0x004d6617` numeric readers, territory-access writes through `company_set_territory_access_rights_byte` `0x00424030`, selected-profile updates through `0x00434890/0x004348c0`, and several collection-side erase or follow-on branches. Current grounded caller is the outer loop at `0x00432317`, which walks linked compact records via `[record+0x24]` and supplies optional resolved company, chairman-profile, and adjacent owner context before each dispatch. This is therefore the current safest read for the wider compact runtime-effect dispatcher above the separate world-side structure-batch placement branch rather than as a placement-only helper.","objdump + local disassembly + caller correlation + effect-dispatch correlation"
0x004323a0,842,scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Per-record service pass over one live runtime-effect record in the scenario event collection. The helper first enforces several activation gates over the record's local control bytes and shell-side preview state, including one one-shot latch at `[this+0x81f]`, mode byte `[this+0x7ef]`, optional preview-policy byte `[this+0x7f4]`, and shell-side state at `0x006cec78/0x006cec74`. Once active it formats the optional status line through shell news helper `0x004554e0`, derives a target-availability bitmask through `0x0042d700`, resolves optional company/chairman/territory target pools, and then walks the linked compact effect chain rooted at `[this+0x00]`. Each linked record is dispatched through `world_apply_compact_runtime_effect_record_to_resolved_targets` `0x00431b20`, while fallback branches synthesize follow-on runtime-effect records through `scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets` `0x00430b50`. When any effect fires it may refresh company share-price caches through `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, and records with nonzero `[this+0x7f5]` set the one-shot latch `[this+0x81f]`. Current grounded caller is the collection-wide service loop `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40`. This is therefore the current safest read for the runtime-effect record service and linked-effect dispatcher rather than a low-level target iterator.","objdump + local disassembly + caller correlation + runtime-effect-service correlation"
0x00433060,198,scenario_event_collection_serialize_runtime_records_into_packed_state,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide save-side companion to `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130` for the live event collection at `0x0062be18`. The helper opens chunk `0x4e99`, writes fixed version dword `0x3e9`, walks every live event record in the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and first re-enters `scenario_event_prepare_runtime_record_text_bands_for_packed_state_save` `0x0042da90` on each record. It then uses `0x00517d90` to emit the collection-side packed metadata, opens chunk `0x4e9a`, walks the same live records again through the same indexed-collection helpers, and re-enters `scenario_event_serialize_runtime_record_into_packed_state` `0x00430d70` on each one before closing with chunk `0x4e9b`. Current grounded caller is the `.smp` serializer `world_runtime_serialize_smp_bundle` `0x00446240`, so this is the safest current read for the event-side packed-state save owner rather than an anonymous collection walk.","objdump + local disassembly + caller correlation + event-collection-save correlation"
0x00433130,169,scenario_event_collection_refresh_runtime_records_from_packed_state,scenario,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Collection-wide runtime materialization pass over the live event collection at `0x0062be18`. The helper opens chunk `0x4e99`, reads one fixed header dword from the caller-supplied state or stream object, re-enters the collection-side metadata refresh at `0x00518680`, then opens chunk `0x4e9a`, walks every live event record in the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and re-enters `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20` on each resolved record before closing chunk `0x4e9b`. When the sweep completes it clears the collection-side reentrancy or dirty latch at `[this+0x88]`. Current grounded callers are the `Setting up Players and Companies...` `319` lane inside `world_entry_transition_and_runtime_bringup` `0x00443a50` and one neighboring world-build path at `0x00448020`, so this now reads as the event-side runtime refresh pass beneath post-load world setup rather than an anonymous collection walk.","objdump + caller xrefs + local disassembly + event-collection correlation + post-load-pipeline correlation + chunk-family correlation"
0x004336d0,95,world_runtime_reset_startup_dispatch_state_bands,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small runtime-object zero-init helper immediately above `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`. The helper clears a bounded startup-owned state band on the caller object, including `[+0x4cae]`, `[+0x4cb2]`, `[+0x46a80..+0x46aa0]`, `[+0x66b2]`, `[+0x66b6]`, `[+0x46c34]`, and `[+0x66ae]`, then returns the same pointer. Current grounded callers are the mode-`4` `LoadScreen.win` lane inside `shell_transition_mode` at `0x004830b6` and the multiplayer preview launch lane at `0x0046b8c9`, both of which then publish the returned object into `0x006cec78` and immediately call `0x00438890`. This is therefore the safest current read for the pre-dispatch runtime reset helper rather than another world-release path.","objdump + caller xrefs + local disassembly + pre-dispatch-state correlation"
0x00433730,1,world_runtime_release_followon_noop_placeholder,map,cdecl,inferred,objdump + local disassembly + caller correlation,1,"Single-instruction `ret` placeholder immediately beside `world_runtime_reset_startup_dispatch_state_bands` `0x004336d0`. Current grounded caller is the old-active-mode teardown branch inside `shell_transition_mode` `0x00482ec0`, where it contributes no observable release work between `world_runtime_release_global_services` `0x00434300` and the common free path `0x0053b080`. This is therefore the safest current read for a no-op followon placeholder rather than a meaningful runtime teardown owner.","objdump + local disassembly + caller correlation"
0x00432ea0,103,scenario_event_collection_allocate_runtime_effect_record_from_compact_payload,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Allocates and initializes one live runtime-effect record in the scenario event collection at `0x0062be18` from a compact payload source. The helper allocates one temporary `0x88f` payload object, inserts a new collection entry through the generic collection allocator path, resolves the inserted live entry, and then initializes that entry from the caller-supplied compact payload through `0x0042d670` before freeing the temporary object. Current grounded callers are `scenario_runtime_effect_record_build_followon_effect_from_compact_record_and_targets` `0x00430b50` and the shell-side branch at `0x004db9f1`, where the returned live entry id is stored back into the caller object. This is therefore the current safest read for the scenario event collection's runtime-effect allocator rather than a generic collection clone helper.","objdump + local disassembly + caller correlation + runtime-effect-allocation correlation"
0x00432f40,267,scenario_event_collection_service_runtime_effect_records_for_trigger_kind,scenario,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide service loop over the live scenario event collection at `0x0062be18` for one caller-selected trigger kind byte. The helper first rejects fast-forward and editor-map gates through `0x006cec78+0x46c38`, `[0x006cec7c+0x82]`, and `[0x006cec74+0x68]` unless the trigger kind is `9`, then walks every live runtime-effect record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. Each resolved record is serviced through `scenario_runtime_effect_record_service_and_dispatch_linked_compact_effects` `0x004323a0` with the selected trigger kind and optional text sink. When any record fires, the helper refreshes every active company's cached share price through `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`; when the collection dirty latch at `[this+0x88]` is raised it clears that latch and immediately reruns the whole pass with trigger kind `0x0a`. The caller split is now tighter too: recurring simulation maintenance drives kinds `1`, `0`, `3`, and `2` through `0x0040a276`, `0x0040a55f`, `0x0040a6cb`, and `0x0040a7a3`, while the neighboring route-style follow-on at `0x0040a91f` drives kinds `5` and `4` through `0x0040a930` and `0x0040a9ac`; world or startup-side company creation branches at `0x00407682`, `0x0047d293`, `0x0047d42b`, and `0x0047d6de` drive kind `7`; the kind-`6` branch is now tighter too, covering the placed-structure post-create tail at `0x0040f69e`, the build-version-gated company-startup or roster-refresh tail at `0x00428406`, and the route-entry post-change sweep at `0x004a3eae`; the kind-`8` world-entry one-shot gate now sits inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, where it fires after the post-load company or route setup passes and then clears shell-profile latch `[0x006cec7c+0x97]`; and the `LoadScreen.win` briefing page at `0x004e520b` drives kind `9`. This is therefore the current safest read for the scenario event collection's collection-wide runtime-effect service loop rather than a generic text-query helper.","objdump + local disassembly + caller correlation + collection-service correlation + trigger-kind callsite decode"
0x00433bd0,546,world_refresh_selected_year_bucket_scalar_band,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared selected-year companion beneath `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`. The helper reads packed year word `[this+0x0d]`, walks the 21-entry threshold ladder rooted at `0x005f3980`, and chooses either the first bucket baseline at `0x005f3984`, the terminal bucket scalar at `0x005f3a24`, or one interpolated scalar between the paired `(year,value)` table entries at `0x005f3978/0x005f3980`. It then rebuilds the dependent selected-year float band in two layers. First it seeds the direct bucket trio `[this+0x65/+0x69/+0x6d]` from three fixed multipliers of that chosen scalar. It next derives three normalized complement lanes `[this+0x71/+0x75/+0x79]` from that trio after the build-version-sensitive clamp through `0x00482e00(0x006cec74)`, and three additional scaled companion lanes `[this+0x7d/+0x81/+0x85]` from the same direct trio. Current grounded callers are the year-step path in `simulation_service_periodic_boundary_work` around `0x0040a123`, the post-fast-forward setup tail around `0x00437168`, and the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared year-bucket scalar rebuild helper rather than a world-entry-only follow-on.","objdump + local disassembly + caller inspection + threshold-ladder correlation + year-bucket-table correlation + world-entry correlation + direct-trio correlation + complement-lane correlation"
0x00433f02,28,scenario_state_roll_pending_float_0x4caa_into_accumulator_0x4ca6,map,thiscall,inferred,objdump + local disassembly + field xrefs,3,"Tiny scenario-state accumulator rollup over the late world-state float pair `[this+0x4ca6]` and `[this+0x4caa]`. The helper adds the pending lane `[this+0x4caa]` into accumulator `[this+0x4ca6]`, clears `[this+0x4caa]` back to zero, and returns. Current field evidence grounds the relationship too: the periodic support-side branch at `0x0041144f` accumulates live deltas into `[0x006cec78+0x4caa]`, while the shell-side query family at `0x0042f89b/0x0042f8bb` reads both the pending lane alone and the accumulated sum. Current grounded caller is the late world-side scalar rollup strip around `0x00433ec0`.","objdump + local disassembly + field xrefs + accumulator-rollup correlation"
0x00434050,11,shell_has_auxiliary_preview_owner,shell,cdecl,inferred,objdump + caller inspection + side-owner correlation,4,"Tiny presence probe over the auxiliary preview or side owner rooted at `0x006cd8d8`. The helper returns `1` when that owner pointer is nonnull and `0` otherwise. Current grounded callers include the `.gmt` save-side branch in `shell_map_file_world_bundle_coordinator` `0x00445de0`, the shell-state frame service pass `0x00482160`, the `BuildingDetail.win` subject-sync and tutorial gate lane around `0x004b9e10` and `0x004bb9e0`, and adjacent train-side branches that round route scalars or finalize auxiliary route buffers only when this side owner is live.","objdump + caller inspection + side-owner correlation + caller xrefs"
0x00434080,80,scenario_state_query_cached_available_locomotive_rating_clamped_for_shell,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small read-side helper over cached scenario-state float `[this+0x4cbe]`. The helper returns that cached available-locomotive rating in `st(0)` when it stays under the local threshold, and otherwise falls back to one fixed shell-side float constant before returning. Current grounded caller is the shell-side formatter band around `0x004b11c5`, where this cached value is optionally rounded to an integer and then compared against display thresholds `40/50/70/85/100`. This is therefore the safest current read for the query-side companion of the later locomotive-rating refresh rather than a broader world-state getter.","objdump + caller inspection + local disassembly + shell-threshold correlation + display-bucket correlation"
0x00434130,196,scenario_state_refresh_year_gap_scalar_from_current_year_minus_1850_into_0x4ca2,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small year-derived float refresh over active scenario state `0x006cec78`. The helper subtracts literal base year `1850` from current year word `[this+0x0d]`, converts that year gap into one normalized float through fixed constants rooted at `0x005c9680`, `0x005c8770`, `0x005c9ef8`, and `0x005c8d80`, stores the first result into `[this+0x4ca2]`, then immediately reclamps the same field into the closed `1/3..1.0` range by flooring sub-threshold values to literal `0.333333...` and capping larger values at `1.0`. Current grounded callers are the periodic year-step branch at `0x0040a310`, the scenario-state reset or rebuild owner at `0x00436d10`, and the two world-entry load lanes at `0x00443edd` and `0x00444070`, so this is the safest current read for a shared year-gap-derived scenario float refresh rather than a presentation-only helper.","objdump + caller xrefs + local disassembly + year-gap correlation + clamp correction + two-stage-store correlation"
0x00434300,881,world_runtime_release_global_services,map,cdecl,inferred,objdump + local disassembly + caller correlation,4,"Primary old-world teardown owner for the live runtime object at `0x006cec78`. The helper first increments one local reentrancy band at `[this+0x4c93]`, then destroys and frees the two indexed world collections at `[this+0x66b2]` and `[this+0x66b6]` through `0x00518bd0` plus `0x0053b080`, clears global roots `0x0062b244`, `0x006cfcbc`, `0x0062be10`, `0x006ceb9c`, and `0x0062c120` through their typed release siblings `0x0040b720`, `0x004b23b0`, `0x00429980`, `0x00477770`, and `0x00449500`, and then tears down the map-content service roots `0x0062ba8c`, `0x006ada84`, `0x0062ba88`, `0x0062b2fc`, `0x0062b268`, `0x006cea4c`, and `0x006acd34` through `0x0041e8d0`, `0x004619b0`, `0x0041d7a0`, `0x00419680`, `0x00412a90`, `0x00473da0`, and `0x00455350` before freeing each backing object and nulling the global slot. After that typed global strip it releases the eight shell-helper handles at `[this+0x46a80..+0x46aa0]` plus the variable-length owner band rooted at `[this+0x46aa4]` through repeated `0x0053c000`, drains the linked chains at `[this+0x66a6]` and `[this+0x66aa]` through `0x0053afd0`, clears `[this+0x66ae]`, optionally re-enters `0x00516ba0` when shell gate `0x006d3b4c` is live, and finally decrements `[this+0x4c93]` before returning. Current grounded callers are the heavier world-entry branch `0x00443a50`, the sibling `.smp` world-state branch `0x00446d40`, and the old-active-mode teardown branch in `shell_transition_mode` `0x00482ec0`.","objdump + local disassembly + caller correlation + typed-global-release-order correlation"
0x00434d40,100,placed_structure_collection_seed_candidate_subtype2_runtime_latch,map,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Shared post-setup sweep over the live placed-structure collection at `0x0062b26c`. The helper walks every live placed structure through the indexed-collection accessors, resolves each linked candidate or structure descriptor through vtable slot `+0x80`, and when the resolved record's subtype byte `[candidate+0x32]` equals `2` it writes `1` to runtime dword `[candidate+0x7b0]`. Local field evidence is now tight enough to keep the name structural: the same dword is zeroed during candidate runtime materialization around `0x00412112`, read as a one-shot guard in the world-side placement branch around `0x00423c43`, and also written there after the guarded follow-on fires. Current grounded callers are the post-fast-forward setup tail at `0x00437bf9` and the late `0x197` checkpoint inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared subtype-`2` candidate-runtime latch seeder rather than a one-off world-entry patch.","objdump + local disassembly + caller correlation + candidate-runtime-latch correlation"
0x004354a0,355,world_publish_shell_controller_progress_scalar_from_year_thresholds_or_selector_overrides,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Shared shell-facing scalar publisher beneath selected-year changes, shell-state selector updates, and the late world-entry reactivation band. The helper always resolves the current shell presentation object through controller `0x006d4024 -> [controller+0x18]` and writes one clamped `0..255` integer into `[object+0x15]` through `0x00523d60`. Its source split is now bounded enough to name conservatively: when tutorial flag `0x006d3b4c` is live it forces `0`; otherwise it first honors the temporary shell-state selector pair `[0x006cec74+0x1df/+0x1e3]`, then the persisted selector pair `[0x006cec74+0x23b/+0x23f]` when sandbox bit `[0x006cec7c+0x82]` is set, and only when no selector override is active does it derive one interpolated scalar from the current year `[this+0x15]` against the ensured threshold band `[this+0x51/+0x55/+0x59/+0x5d/+0x61]` plus the base value at `[this+0x3a]`, re-entering `scenario_state_ensure_derived_year_threshold_band` `0x00435603` before the year-band path needs it. Current grounded callers are the simulation year-advance path at `0x0040ab39`, the shell-state setter at `0x00482878`, the startup-side branch at `0x005173d3`, and the late `0x197` checkpoint inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the shared shell-controller progress-scalar publisher rather than a world-entry-only helper.","objdump + local disassembly + caller correlation + shell-controller correlation + year-threshold-band correlation"
0x004358d0,489,region_collection_service_pending_connection_bonus_notifications_and_optional_company_credit,map,cdecl,inferred,objdump + local disassembly + caller inspection,3,"World-side service pass over the live region collection at `0x0062bae0` for the transient city-connection bonus amount stored at `[region+0x276]`. The helper walks every live region, ignores entries whose pending amount is zero, and reuses `city_connection_bonus_exists_matching_peer_site` `0x00420030` with two flag variants plus `city_connection_bonus_select_first_matching_peer_site` `0x00420280` to find one matching peer site and its linked company through `placed_structure_query_linked_company_id` `0x0047efe0`. When a matching peer company exists and the first `0x420030` probe returned nonzero, it formats one localized notice using the region name at `[region+0x356]`, world scalar `[region+0x23a]`, and the current pending amount, publishes that notice through `0x004554e0`, posts the pending amount into company stat slot `4` through `company_add_delta_into_stat_series_current_slot_and_optional_cash_totals` `0x0042a080`, then clears `[region+0x276]` and stamps completion latch `[region+0x302] = 1`. When the peer-company branch is unavailable and byte `[region+0x316]` is still clear, it instead publishes one alternate localized notice built from the same pending amount and region-side world scalar, then sets that byte so the alternate notice only fires once while the pending amount remains live. Current grounded caller is the linked-site refresh tail inside `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0`, where the helper runs beside `0x00420650` as the city-connection bonus sidecar service rather than as a generic region sweep.","objdump + local disassembly + caller inspection + city-connection correlation + company-credit correlation"
0x00435b50,1764,world_service_year_threshold_news_and_structure_milestone_notifications,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"World-side year-threshold and structure-milestone news owner beneath periodic simulation and startup bring-up. The helper reads the current packed year at `[0x006cec78+0x0d]`, suppresses itself when scenario gate `[0x006cec78+0x46c38]` is live or when cached prior-year field `[0x006cec78+0x05]` already matches, and then services several threshold families. Fixed threshold years `0x749/0x767/0x780/0x7a6` (`1865/1895/1920/1958`) publish paired localized ids `0x157..0x15e` through `0x005193f0` and append the resulting fixed records into collection `0x006cea4c` through `0x00473f80`. Years `0x73a/0x76c/0x79e` build three formatted numeric fragments through `0x0051b700`, splice them into localized id `0x15f`, and publish the finished notice through `0x004337c0`. The later milestone branch resolves specific candidate stems through `0x00412af0`, counts matching live placed structures through `0x004138f0`, and for year `0x755` also combines those counts with localized text fragments `0x161..0x165` before queueing one news record through `0x004337c0`; the single-stem branches at `0x7a4/0x789/0x794` instead publish localized ids `0x166/0x167/0x168` directly when at least one matching live structure exists. Current grounded caller is the periodic boundary work branch at `0x0040a6f7`, so this is the safest current read for the shared year-threshold and structure-milestone news owner rather than a generic date-change helper.","objdump + local disassembly + caller correlation + year-threshold correlation + structure-milestone correlation + news-record correlation"
0x0043ad50,227,world_view_query_city_label_alpha_byte_from_normalized_xy_and_view_scalars,shell,thiscall,inferred,objdump + local disassembly + caller xrefs,3,"Small bounded-byte helper beneath the city-site label formatters at `0x004207d0` and `0x004613d0`. The caller supplies rounded normalized `(x,y)` values, while the helper samples the current world-view state at `0x0062be68`: it first tests the view scalar at `[this+0x14]` against a three-band threshold ladder, returning `0` on the lowest band, `0xff` on the saturated band, and otherwise deriving one provisional byte through scaled subtraction and integer rounding. It then folds in the auxiliary view scalars at `[this+0x1c]` and `[this+0x24]` through the shared x87 rounding helper `0x005a10d0` and finishes by returning one bounded byte-like priority or alpha value in `EAX`. Current grounded callers use any nonzero result to arm a highlighted city-label style and only splice the returned byte into the top color lane when it stays below `0xff`, so the safest current read is a world-view-dependent city-label alpha-byte query rather than a generic camera scalar helper.","objdump + local disassembly + caller xrefs + city-label correlation"
0x00434ea0,124,scenario_state_query_named_candidate_availability_record_value,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Read-side lookup over the scenario-side named candidate-availability collection at `[this+0x66b2]`. The helper normalizes the first byte of the caller-supplied candidate name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches full names through `0x005a57cf` after a first-byte fast reject on `[entry+0x00]`. When a matching record is found it returns the dword at `[entry+0x1e]`; otherwise it returns zero. The insert sibling `0x00434f20` shows the exact record shape now too: each collection entry is a zero-initialized `0x22`-byte blob with a fixed zero-terminated name slot at `[entry+0x00..+0x1d]` and one trailing availability dword at `[entry+0x1e]`. Current grounded callers are the runtime refresh pass `0x00412c10`, the editor-side detail and summary formatters at `0x004cc209`, `0x004cdfa3`, `0x004d14b8`, and `0x004d1684`, and the same startup-side candidate filter family that later writes `[candidate+0x7ac]`. This is therefore the current safest read for the candidate-side lookup sibling of the named availability helpers rather than a generic string-table query.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + candidate-filter refresh correlation + record-layout correlation"
0x00434f20,272,scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Upserts one named candidate-availability record into the scenario-side collection at `[this+0x66b2]` and then refreshes dependent runtime candidate filters. The helper normalizes the first byte of the caller-supplied name buffer, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches candidate names through the shared string compare at `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the candidate-availability dword at `[entry+0x1e]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x22`-byte record, copies the supplied zero-terminated candidate name into `[entry+0x00..+0x1d]`, and seeds that same trailing dword. When the live candidate pool `0x0062b268` exists it then re-enters the neighboring runtime refresh at `0x00412c10`, where the returned value is stored into `[candidate+0x7ac]`. The write-side caller set is now tight enough to close the remaining semantic gap too: the grounded startup prepasses at `0x00437737` and `0x00436a70` and the editor-side `Industry (Overall)` handler `0x004cf430` all supply only boolean values, so `[entry+0x1e]` now reads safely as a real candidate-availability override bit rather than a wider mode enum.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + candidate-filter refresh correlation + record-layout correlation + callsite-argument correlation"
0x00435030,124,scenario_state_query_named_locomotive_availability_record_value,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Read-side lookup over the scenario-side named locomotive-availability collection at `[this+0x66b6]`. The helper normalizes the first byte of the caller-supplied locomotive name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches full names through `0x005a57cf` after a first-byte fast reject on `[entry+0x00]`. When a matching record is found it returns the dword at `[entry+0x3d]`; otherwise it returns zero. The insert sibling `0x004350b0` shows the exact record shape now too: each collection entry is a zero-initialized `0x41`-byte blob with a fixed zero-terminated locomotive-name slot at `[entry+0x00..+0x3c]` and one trailing availability dword at `[entry+0x3d]`. Current grounded callers are the shell-side `Locomotives` availability page constructor `map_editor_locomotive_availability_panel_construct` `0x004cd680`, the locomotive-side stats and summary branches at `0x004d0e5f` and `0x00461ed5`, and the neighboring startup or restore-side upsert family at `0x00438d6b` and `0x004478ea`. This is therefore the safest current read for the locomotive-side lookup sibling of the named availability helpers rather than a generic string-table query.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + locomotive-availability correlation + record-layout correlation"
0x004350b0,249,scenario_state_upsert_named_locomotive_availability_record_and_refresh_runtime_usage,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Upserts one named locomotive-availability record into the scenario-side collection at `[this+0x66b6]` and then refreshes dependent runtime locomotive usage state. The helper normalizes the first byte of the caller-supplied locomotive name, walks the live collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and matches existing names through `0x005a57cf` after the same first-byte fast reject on `[entry+0x00]`. When a matching record already exists it rewrites the locomotive-availability dword at `[entry+0x3d]`; otherwise it allocates a new collection entry through the collection vtable, zero-initializes one fixed `0x41`-byte record, copies the supplied zero-terminated locomotive name into `[entry+0x00..+0x3c]`, and seeds that same trailing dword. When the live locomotive pool `0x006ada84` exists it then re-enters `0x00461e00`, where the queried value is later stored into `[loco+0x7b]`. The write-side caller set is now tight enough to close the remaining semantic gap here too: the grounded startup or restore-side seeding lanes at `0x00438d6b`, `0x004478ea`, and `0x00461eab` and the shell-side `Locomotives` availability handler family at `0x004cf178`, `0x004cf1fe`, `0x004cf2f9`, and `0x004cf3fc` all supply only boolean values, so `[entry+0x3d]` now reads safely as a real locomotive-availability override bit rather than a broader policy enum.","objdump + caller xrefs + local disassembly + scenario-state collection correlation + locomotive-runtime-refresh correlation + record-layout correlation + callsite-argument correlation"
0x004351c0,1099,scenario_state_rebuild_derived_year_threshold_band,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Broader rebuild owner for the compact scenario-side year-threshold band rooted at `[this+0x3a/+0x51/+0x55/+0x59/+0x5d/+0x61]`. The helper first samples one shell presentation scalar through `0x006d4024 -> [controller+0x18] -> [object+0x15]`, chooses one of three range profiles from that scalar (`<0x28`, `<0x46`, or later), and seeds base lane `[this+0x61]` to `0xff`, `0xc8`, or `0xe6` together with one paired year-span scalar derived from the fixed `0x5a0` multiplier. It then re-enters `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` on the current year `[this+0x15]`, queries three companion shell integers through `0x00527cc0`, folds those shell-side values into one normalized offset, and writes the rebuilt threshold quartet into `[this+0x51]`, `[this+0x55]`, `[this+0x59]`, and `[this+0x5d]` through the shared x87 rounding helper `0x005a10d0`. The same owner also contains the shell-facing follow-on hidden by the tiny ensure wrapper `0x00435603`: when the caller stack flag is nonzero, or when the current shell progress scalar falls outside the rebuilt band, it computes one interpolated or clamped `0..255` presentation value from current year `[this+0x15]`, base byte `[this+0x3a]`, floor `[this+0x61]`, and the rebuilt threshold quartet, then republishes that value into the current shell presentation object through `0x00523d60`. Current grounded callers are the ensure wrapper `0x00435603`, the shell command `0x004412e0`, the shell-state setter path around `0x00482878`, the compact runtime-effect side branch at `0x00431e03`, and the world-entry late rehydrate tail inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the actual year-threshold rebuild owner beneath selected-year restore and shell progress refresh rather than another anonymous math body.","objdump + local disassembly + caller correlation + year-threshold-band correlation + shell-progress-followon correlation"
0x00436a70,128,scenario_state_preseed_named_candidate_availability_overrides_from_editor_map_placed_structures,map,thiscall,inferred,objdump + local disassembly + package-save correlation + caller correlation,3,"Small editor-map prepass over the live placed-structure collection `0x0062b26c`, reached directly from the early package-save prelude `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0` before the later direct named-availability collection save. The helper walks every live placed-structure through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, keeps only records accepted by the subtype-family predicate `0x0040c990`, resolves each accepted record's linked candidate/runtime owner through virtual slot `+0x80`, filters that owner to subtype byte `[obj+0x32] == 2` with both availability bytes `[obj+0xba]` and `[obj+0xbb]` clear, and then forwards the owner name at `[obj+0x04]` plus boolean `1` into `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20`. Current grounded caller is the editor-map package branch at `0x00444f30`, which makes this the strongest current read for the save-side preseed pass that materializes candidate-availability override records from qualifying placed structures before the direct collection serializer `0x00517d90` persists `[world+0x66b2]` rather than a generic placement scan.","objdump + local disassembly + package-save correlation + caller correlation + placed-structure collection correlation + named-availability correlation"
0x00436c70,37,scenario_state_check_special_tutorial2_signature_gate,map,cdecl,inferred,objdump + local disassembly + string inspection + caller correlation,2,"Small special-case gate immediately above the broader scenario reset owner `0x00436d10`. The helper returns true only when the caller selector equals `0x10`, the current world root at `0x0062c120` reports map dimensions `0x180 x 0x1c0`, the live city collection `0x0062bae0` reports exactly `0x41` entries, the first live city name at `[entry+0x356]` matches `Italy - North`, the current shell-side file or scenario root at `0x0062be18` passes `0x4331e0 == 0x16`, and its row `7` subtype byte `[row+0x7ef]` equals `6`. The nearby string table points at `Tutorial_2.gmp`, so the safest current read is one hard-coded tutorial-signature predicate rather than a generic map-size or city-count checker.","objdump + local disassembly + string inspection + caller correlation + special-case-signature correlation"
0x00436af0,384,scenario_state_refresh_cached_available_locomotive_rating_from_year_baseline_and_live_availability_gates,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared scenario-side refresh over cached float `[this+0x4cbe]` after selected-year or locomotive-availability changes. The helper seeds one year-dependent baseline from the current scenario year at `[0x006cec78+0x0d]` with explicit tiers `110.0` through year `2000`, `200.0` after `2000`, and `300.0` after `2010`, then, when the live locomotive pool `0x006ada84` exists, walks every live locomotive record, resolves the linked era through `[loco+0x72]`, filters each locomotive through the locomotive-era policy gate `0x0041d550` plus the named-availability lane rooted at `[loco+0x7b]`, and keeps the strongest surviving locomotive-side rating scalar from `[loco+0x20]`. The winning rating is forced to at least `1.0`, normalized through the fixed `100.0 / 220.0` scale pair at `0x005c9f40/0x005c85d8`, then floored to `50.0` and capped at `100.0` before storage into `[this+0x4cbe]`, where the shell-side read helper later buckets it against display thresholds `40/50/70/85/100`. Current grounded callers are the periodic year-step path around `0x0040a317`, the post-fast-forward setup tail at `0x004371ad`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and the tail of `locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00`, so this is the safest current read for the cached available-locomotive rating refresh rather than a world-entry-only helper.","objdump + local disassembly + caller inspection + locomotive-availability correlation + selected-year correlation + cached-scalar correlation + display-bucket correlation + year-baseline correlation + normalization-tail correlation"
0x004367c0,92,world_set_outcome_mode_and_copy_cheat_win_or_loss_status_text,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + RT3.lng strings,3,"Small world-side outcome-status helper. The caller-supplied mode dword is stored into `[this+0x4a73]`, world flag `[this+0x4d]` is cleared, and the current selected-year snapshot byte `[this+0x15]` is copied into `[this+0x4c88]`. The helper then copies one fixed localized string into status buffer `[this+0x4b47]`: id `2923` `You lose.` when the incoming mode equals `1`, otherwise id `2924` `You win, cheater...`. Current grounded callers are the cheat-modal owner `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` `0x00437d70` and the scenario follow-on command branch around `0x004648e1`, so this is the safest current read for the cheat-owned outcome-mode setter rather than a generic prompt publisher.","llvm-objdump + local disassembly + caller correlation + RT3.lng strings + outcome-buffer correlation"
0x00436d10,522,scenario_state_reset_defaults_seed_named_availability_collections_and_rebuild_runtime_bridges,map,thiscall,inferred,objdump + caller xrefs + local disassembly,4,"Broader scenario-state reset or initialization owner over active world state `0x006cec78`. The helper first zeroes one contiguous late-state slab from `[this+0x4cc2]` for `0x9b` dwords plus one trailing byte, then separately clears the much larger late setup-preview/runtime slab rooted at `[this+0x66be]` and immediately reseeds its leading validity byte `[this+0x66be] = 1`. It seeds the same editor-owned scenario start-year trio later refreshed by `map_editor_scenario_metadata_panel_refresh_controls` `0x004ca790` and clamped by `map_editor_scenario_metadata_panel_handle_message` `0x004cb4a0`: minimum `[this+0x66ca] = 0x726` (`1830`), default `[this+0x66d2] = 0x74e` (`1870`), and maximum `[this+0x66ce] = 0x7d0` (`2000`). It also seeds the four neighboring startup dwords `[this+0x6a68/+0x6a6c/+0x6a70/+0x6a74] = 1`, seeds the sixteen 9-byte chairman-slot rows rooted at `[this+0x69d8]` with default tuning `0x186a0`, and explicitly sets the first slot's distinguished occupied-seat byte `[this+0x69db] = 1`, matching the later chairman-slot readers `0x00437220`, `0x004377a0`, and `0x004ca1c0` that treat `[slot+0x03]` as the special occupied-seat marker. The helper clears several now-grounded latch families explicitly: `[this+0x19/+0x21/+0x25/+0x29/+0x31/+0x3d/+0x41/+0x45/+0x49/+0x4d]`, queue or fast-forward latches `[this+0x46c38/+0x46c3c/+0x66a2/+0x66a6/+0x66aa]`, outcome and cheat bands `[this+0x4a73/+0x4a77/+0x4a7b]`, the scenario-rule table `[this+0x4a7f..+0x4b3f]` plus trailing scalar `[this+0x4b43]`, the outcome text root `[this+0x4b47]`, the byte-policy and cached-scalar cluster `[this+0x4c74/+0x4c78/+0x4c7c/+0x4c88/+0x4c8c..+0x4c99/+0x4c9a/+0x4c9e/+0x4ca6/+0x4caa/+0x4cae/+0x4cb2/+0x4cb6/+0x4cba]`, and the trailing float strip `[this+0xbce..+0xbf6]` before reseeding the same six-dword economic-tuning band later serialized at `0x00446240`, restored at `0x00446d40`, and edited through `map_editor_economic_cost_slider_dispatch` `0x004ca980`: `+0xbde/+0xbe2 = 1.0f`, `+0xbe6/+0xbea/+0xbee/+0xbf2 = 0x3c75c28f`, and `+0xbf6 = 0x3ba3d70a`. It then zero-fills the twelve scenario recipe books at `[this+0x0fe7]` and only seeds their per-book name lane through the fixed format string `# %1` at `0x005c9f78`, using generated ordinal strings `1..12` via `0x0051b700` and `0x00518de0`; current local disassembly does not show it preloading any default line modes, amounts, or cargo-token strings into the later `+0x3ed/+0x3f1` recipe payload. It also destroys and recreates the two named-availability collections at `[this+0x66b2]` and `[this+0x66b6]` with fixed record sizes `0x22` and `0x41`. The selected-year rebuild tail is explicit now too: when live profile `0x006cec7c` reports campaign/setup byte `[profile+0xc5] != 0` and sandbox byte `[profile+0x82] == 0`, the helper copies profile year word `[profile+0x77]` into scenario default year `[this+0x66d2]`; it then seeds `[this+0x05/+0x09]` from that chosen year through `calendar_pack_year_and_component_bytes_to_packed_tuple_dwords` `0x0051d3f0` with Jan-1-style constants, conditionally decrements the selected year before `calendar_pack_unpacked_components_to_absolute_counter` `0x0051d390` based on shell mode `[0x006cec74+0x68/+0x178]` and tutorial gate `[0x006cec78+0x4af7]`, stores the resulting absolute counter into `[this+0x15]`, clamps `[this+0x1d]` from current year `[this+0x19]`, and only then re-enters `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, and `scenario_state_ensure_derived_year_threshold_band` `0x00435603`. After that selected-year/calendar chain it re-enters `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630`, `structure_candidate_collection_refresh_filter_and_year_visible_counts` `0x0041e970`, `structure_candidate_collection_rebuild_cargo_membership_and_scaled_rate_tables_for
0x0043cb00,295,world_view_step_heading_quadrant,shell,thiscall,inferred,objdump + caller xrefs,3,Applies one discrete heading-step command to the live world-view owner at 0x0062be68. The helper quantizes the current heading-like field [this+0x10] into one of four wrapped sectors derives the neighboring sector selected by the signed caller step and writes the resulting snapped heading back before rebuilding the dependent view state through 0x0043a750 0x0052d640 and 0x0043bde0. Current grounded callers are the paired shell UI command branches at 0x004de83d and 0x004de857 so this looks like the discrete rotate-view command family rather than free camera drag.,objdump + caller xrefs + callsite inspection
0x0043cc30,437,world_view_step_zoom_bucket,shell,thiscall,inferred,objdump + caller xrefs,3,Applies one discrete zoom or view-height bucket step to the live world-view owner at 0x0062be68. It derives a seven-entry threshold table under 0x005ee4dc and 0x0062be4c compares the current view-height field [this+0x18] against those thresholds chooses the neighboring bucket selected by the signed caller step clamps the result into the supported range and then rebuilds the dependent view state through 0x0043c610 0x00439820 and 0x0043bde0. Current grounded callers are the signed shell UI command pair at 0x004de871 and 0x004de88b and the keyboard-owned smoothing branch inside world_view_service_shell_input_pan_and_hover at 0x0043dca4.,objdump + caller xrefs + callsite inspection
0x0043d050,111,world_view_set_focus_position_xyz,shell,thiscall,inferred,objdump + caller xrefs,4,Stores one new world-view focus position into the owner at 0x0062be68 by updating [this+0x04] [this+0x08] and [this+0x0c] as the requested X Y and Z coordinates then rebuilding the dependent view state through 0x0043cec0 0x0043a750 0x0052d640 0x00439820 and 0x0043b0e0. The helper also clamps the view-height or distance field at [this+0x18] before recomputing the derived pitch-like field at [this+0x14]. Current grounded callers are the screen-delta wrapper at 0x0043d0c0 the relative pan helper at 0x0043d130 and two larger world-view service branches at 0x0043ee76 and 0x0043f32d.,objdump + caller xrefs
0x0043af60,205,world_view_should_drive_primary_pan_channel,shell,thiscall,inferred,objdump,3,Returns whether the world-view owner should drive its primary pan channel on this pass. The predicate first honors the latched override at [this+0xa2] then checks several shell-view gates through 0x00543e00 0x00543e20 and 0x00543e40 on the active controller node plus one optional guard under 0x006d1a8c and the world-mode flag at [0x006cec74+0x120]. When the controller view is active it also treats packed shell input bits 0x3 in 0x006d4018+0xa8c as one enabling condition; `shell_input_apply_window_key_transition` grounds those bits as the left and right Shift modifiers from scan codes 0x2a and 0x36 which ties held Shift state back into the same world-view pan family. Current grounded callers sit in the larger recurring world-view input service at 0x0043db00 and the smaller motion helper at 0x0043e610.,objdump + callsite inspection
0x0043b030,173,world_view_should_drive_secondary_pan_channel,shell,thiscall,inferred,objdump,3,Returns whether the world-view owner should drive its secondary pan channel on this pass. Like the neighboring primary predicate it combines shell controller view gates through 0x00543e00 0x00543e20 and 0x00543e40 optional suppression under 0x006d1a8c and one world-mode check at [0x006cec74+0x120]; when the active controller view is present it also treats packed shell input bits 0x3 in 0x006d4018+0xa8c as an enabling condition. Those bits are now grounded as the left and right Shift modifiers from scan codes 0x2a and 0x36 rather than an opaque gameplay-only flag source. Current grounded callers sit in the larger recurring world-view input service at 0x0043db00 and in the smaller motion helpers at 0x0043e610 and 0x0043f4f0.,objdump + callsite inspection
0x0043b2c0,133,world_view_store_camera_view_slot_snapshot,shell,thiscall,inferred,objdump + caller inspection + world-view correlation,4,"Stores one live camera-view snapshot into a fixed slot family rooted inside the world-view owner at `0x0062be68`. The helper expands the caller slot selector into one `0x30`-byte record, sets slot-valid dword `[slot+0x10e]`, copies the current scenario-side focus-kind pair from `[0x006cec78+0x45/+0x49]` into `[slot+0x112/+0x116]`, and then mirrors the live world-view focus and camera fields `[view+0x04/+0x08/+0x0c/+0x18/+0x10/+0x14/+0x1c/+0x20/+0x24]` into `[slot+0x11a..+0x13a]`. Current grounded caller is the shell-side assignment owner `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`, which uses this helper for the ten-slot `Assign Camera View` family. This is therefore the safest current read for the fixed camera-view snapshot writer rather than a generic view-state copier.","objdump + caller inspection + world-view correlation + slot-layout correlation"
0x0043ca20,223,world_view_restore_camera_view_slot_snapshot_if_populated,shell,thiscall,inferred,objdump + caller inspection + world-view correlation,4,"Restores one previously saved camera-view snapshot from the fixed slot family inside the live world-view owner at `0x0062be68`. The helper expands the caller slot selector into the same `0x30`-byte record used by `world_view_store_camera_view_slot_snapshot` `0x0043b2c0`, rejects immediately when slot-valid dword `[slot+0x10e]` is zero, re-enters `0x004349f0` to clear or normalize scenario-side focus state, restores the saved focus and camera fields back into `[view+0x04/+0x08/+0x0c/+0x18/+0x10/+0x14/+0x1c/+0x20/+0x24]`, clamps the restored heading through `0x005a1390`, optionally replays the saved focus-kind pair `[slot+0x112/+0x116]` through `shell_world_focus_selected_subject_kind_and_id` `0x00437a90`, and finally rebuilds the dependent view state through `0x0043db00` and `0x0043bde0` before returning `1`. Empty slots return `0` without side effects. Current grounded caller is the shell-side selection owner `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`, which uses this helper for the ten-slot `Select Camera View` family. This is therefore the safest current read for the fixed camera-view snapshot restore helper rather than a generic world-view reset.","objdump + caller inspection + world-view correlation + slot-layout correlation + focus-replay correlation"
0x0043d0c0,111,world_view_apply_screen_delta_to_focus_position,shell,thiscall,inferred,objdump + caller xrefs,4,Converts one screen-relative drag delta into a new world-view focus position and forwards it through world_view_set_focus_position_xyz. When the auxiliary object at [this+0x6e] is live it samples a derived center or height term through 0x00534490 and scales both incoming deltas by the world-view projection constant at 0x005c8700 before calling the lower focus-position setter. The current grounded caller is the cursor-drag helper at 0x00478d31 inside the larger input loop at 0x00478cb0.,objdump + caller xrefs
0x0043d130,292,world_view_pan_relative_offset_in_camera_plane,shell,thiscall,inferred,objdump + caller xrefs,4,Applies one local X/Z pan offset to the world-view owner at 0x0062be68 in the current camera plane and forwards the result through world_view_set_focus_position_xyz. The helper derives a scale from the active view-height field [this+0x18] rotates the incoming offset by the current heading-like field [this+0x10] through sine and cosine calls at 0x005a13e4 and 0x005a1494 adds the rotated result onto the current world focus position in [this+0x04] and [this+0x0c] preserves the current Y term in [this+0x08] and then calls the lower focus-position setter. Current grounded callers are the GameUppermost hotspot path at 0x004e094b and the keyboard-owned service branch inside world_view_service_keyboard_turn_and_pan_bindings at 0x0043dae4 which together indicate a shared world-view pan action rather than a separate gameplay command dispatcher.,objdump + caller xrefs
0x0043d740,937,world_view_service_keyboard_turn_pan_and_zoom_bindings,shell,thiscall,inferred,objdump + callsite inspection,4,"Keyboard-driven world-view interaction helper beneath world_view_service_shell_input_pan_and_hover. It samples elapsed wall-clock time through 0x0051d890 against the previous timestamp at 0x0062be74 clamps the per-pass delta into the 0x08 through 0xc8 range and polls four configurable binding-pair families through the shell input table at 0x006d4018 via 0x0054e7d0. The first two pair families at [this+0x0a6] through [this+0x0b2] and [this+0x0b6] through [this+0x0c2] now ground as the default `Camera Forward` or `Camera Backward` pair and `Camera Left` or `Camera Right` pair. The third family at [this+0x0c6] through [this+0x0d2] produces a signed zoom-step or view-height delta that is returned through the caller-owned out-parameter for later smoothing and grounds as the default `Camera Zoom In` or `Camera Zoom Out` pair, while the fourth family at [this+0x0d6] through [this+0x0e2] applies continuous heading turns through 0x0043c810 and grounds as the default `Camera Rotate Left` or `Camera Rotate Right` pair. When the pan families are active the helper reaches world_view_pan_relative_offset_in_camera_plane at 0x0043d130 after checking the active world-view state. Current grounded caller is world_view_service_shell_input_pan_and_hover at 0x0043db00.",objdump + callsite inspection + caller xrefs + registration xrefs + RT3.lng
0x0045ea90,365,shell_input_binding_format_display_label_from_registry_entry,shell,cdecl,inferred,objdump + local disassembly + registry correlation,4,"Formats one user-facing binding label directly from a live registry entry. The helper clears the destination buffer, rejects entries whose primary binding code `[entry+0x0c]` is `0xff`, prepends up to three localized prefix fragments from ids `0xdef`, `0xdf0`, and `0xdf1` according to bits `0x4`, `0x2`, and `0x1` in mode field `[entry+0x94]`, then scans the static binding-descriptor table rooted at `0x005f0a34` for the current action id `[entry+0x0c]`. When the descriptor-side localized caption id at `[row+0x04]` exists and `0x0051c900` accepts it, the helper appends that localized caption through `0x005193f0`; otherwise it appends the fallback literal stem at `[row+0x08]`. Current grounded caller is `shell_input_binding_registry_format_display_label_by_action_stem` `0x0045f3d0`, which uses this helper beneath the camera-view modal family and the hotkey report path. This is therefore the safest current read for the lower binding-label formatter rather than a generic string helper.","objdump + local disassembly + registry correlation + descriptor-table correlation + localized-prefix correlation"
0x0045ec00,108,shell_input_binding_split_plus_prefixed_label_into_primary_and_modifier_fragments,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Splits one compound binding label into a primary token plus one optional modifier fragment. The helper copies the caller source string into the primary destination unchanged when the string either begins with `+`, does not contain the localized token from id `0xdf2`, or contains no later `+` delimiter. Otherwise it trims the source at the first `+`, copies the suffix after that delimiter into the primary destination, and copies the preserved prefix fragment into the secondary destination buffer. Current grounded caller is the hotkey import worker `0x0045f420`, where it prepares one imported binding label for action lookup and modifier parsing before the rebucket helper `0x0045ef00`. This is therefore the safest current read for the localized plus-split helper rather than a generic string tokenizer.","objdump + caller inspection + local disassembly + hotkey-import correlation"
0x0045ec70,88,shell_input_binding_descriptor_query_action_id_by_localized_label,shell,cdecl,inferred,objdump + local disassembly + descriptor-table correlation,4,"Resolves one action id from the binding-descriptor table rooted at `0x005f0a34` by matching a user-facing label. The helper rejects empty input with `0xff`, then walks the descriptor rows and compares the caller text against either the localized caption at `[row+0x04]` when `0x0051c900` accepts that id or the fallback literal stem at `[row+0x08]` otherwise. On success it returns the descriptor action id at `[row+0x00]`; failure returns `-1`. Current grounded caller is the hotkey import worker `0x0045f420`, which uses this helper after `shell_input_binding_split_plus_prefixed_label_into_primary_and_modifier_fragments` `0x0045ec00` to recover the target action id for one imported binding row.","objdump + local disassembly + descriptor-table correlation + localized-caption correlation + hotkey-import correlation"
0x0045e940,216,placed_structure_build_attached_emitter_variant_list_by_owner_stem,map,cdecl,inferred,objdump + local disassembly + literal inspection + caller inspection,2,"Builds a repeated attached-emitter list for one owner stem on top of the global emitter table. The helper rejects literal `Stadium` immediately, clears caller flag bit `0x10` when the owner stem matches `ParticleCar`, then iterates `effect_emitter_table_select_next_existing_formatted_3dp_variant` `0x00474860` first with reset mode `1` and then resume mode `0`. For each accepted formatted variant it creates one attached sprite emitter through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, optionally ORs flag `0x10000` when startup latch `[0x006cec78+0x46c3c]` is live, ORs emitter flag `0x02` for literal `Nuclear`, appends the created emitter into the caller output array when that array is present, and terminates the list with a trailing null when at least one output slot was available. Current grounded callers are the heavier placed-structure transient builders around `0x0045b828` and `0x0045e23e`, so this is best read as the owner-stem-driven attached-emitter variant-list builder rather than a one-off specialization stub.","objdump + local disassembly + literal inspection + caller inspection + formatted-variant correlation + transient-family correlation"
0x0045ea20,61,shell_emit_indexed_audio_feedback_nudge_if_live,shell,cdecl,inferred,objdump + caller correlation + local disassembly,4,"Small indexed audio-feedback helper used by shell command paths and tutorial guidance. When selector `ECX` is in the bounded range `2..0x40` and the two audio override gates at `0x00ccba14` and the service-side `0x00531e10` checks remain clear, the helper looks up one pair of table-driven dwords from `0x005f0828/0x005f082c`, forwards them together with the caller scalar and three zero trailing arguments into the shell audio service at `0x006d402c` through `0x00531e10`, and otherwise returns without side effects. Current grounded callers include the pause-toggle shell command `0x00440880` with selector `0x2c` and the tutorial-step advance path `0x00516be0`, which makes this the reusable indexed feedback-nudge owner rather than a one-off pause-only stub.","objdump + caller correlation + local disassembly + audio-service correlation"
0x0045ecd0,155,shell_input_binding_parse_modifier_fragment_to_compact_mode_code,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Parses one binding-label modifier fragment into a small compact mode code. The helper normalizes the caller text through `0x005a2abe`, probes it for one localized header token from `0xdf3` and the follow-on localized fragments `0xdf4` and `0xdf5`, and then returns one of four compact codes: default `1` when the header token is absent, `4` when only the middle fragment is absent, `2` when the trailing fragment is absent, and `0` for the fully matched final branch. Current grounded caller is the hotkey import worker `0x0045f420`, which uses this compact code immediately before `shell_input_binding_expand_compact_mode_code_to_registry_mask` `0x0045ed70` and the rebucket helper `0x0045ef00`. This is therefore the safest current read for the localized modifier-fragment parser rather than a stronger semantic mode-name decoder.","objdump + local disassembly + caller inspection + hotkey-import correlation"
0x0045ed70,26,shell_input_binding_expand_compact_mode_code_to_registry_mask,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Tiny compact-mode projector for the input-binding family. The helper expands the caller compact code in `ECX` into the registry-facing mode mask over bits `0x1`, `0x2`, and `0x4` using the low two bits plus one high nibble bit, then returns that mask in `EAX`. Current grounded caller is the hotkey import path at `0x00500205`, where it immediately feeds the result into `shell_input_binding_registry_rebucket_entry_by_stem_to_action_id_and_mode_mask` `0x0045ef00`.","objdump + local disassembly + caller inspection + hotkey-import correlation"
0x0045ed90,69,shell_input_binding_descriptor_query_bucket_key_for_action_id_when_mode_mask_is_singular,shell,cdecl,inferred,objdump + local disassembly + descriptor-table correlation,4,"Descriptor-side bucket-key query for the shell input-binding registry. The helper scans the static descriptor table rooted at `0x005f0a34` for the caller action id in `ECX`, counts the number of set bits in the caller mode mask in `EDX`, and only when that bit count is `0` or `1` returns the descriptor-side bucket key at `[row-0x04]` / `[row+0x30]`; multi-bit masks return `0`. Current grounded callers are `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`, the hotkey message path at `0x005001e1`, and the rebucket helper `0x0045ef00`, which all use this helper as the singular-mode bucket discriminator above the live registry buckets. This is therefore the safest current read for the descriptor-side bucket-key query rather than a generic action-table scan.","objdump + local disassembly + descriptor-table correlation + mode-mask correlation + bucket-key correlation"
0x0045f370,95,shell_input_binding_registry_lookup_primary_code_and_mode_bits_by_action_id,shell,cdecl,inferred,objdump + caller inspection + registry correlation,4,"Lookup helper over the shell input-binding registry rooted at `0x006acd78..0x006ad960`. The helper scans each linked per-bucket list for a record whose action id at `[entry+0xa0]` matches the caller key in `ECX`; on success it writes the entry's primary binding code `[entry+0x0c]` through the first out-parameter and packs three mode bits from `[entry+0x94]` into a small output mask through the second out-parameter before returning `1`. Failure returns `0`. Current grounded caller is `world_view_seed_keyboard_binding_slot_pairs` `0x00439e40`, where this helper resolves the default `Camera Forward/Backward/Left/Right/Zoom/Rotate` action ids before the resulting codes are normalized into the world-view slot-pair band. This is therefore the safest current read for the action-binding query helper rather than a generic shell hash-table scan.","objdump + caller inspection + registry correlation + output-mask correlation"
0x0045ede0,88,shell_input_binding_registry_resolve_entry_by_action_stem,shell,cdecl,inferred,objdump + local disassembly + registry correlation,4,"Resolves one shell input-binding registry entry by stem text. The helper copies the caller string into a local `0x80`-byte buffer, normalizes it through `0x0053d810`, hashes or canonicalizes that normalized stem, and then scans the linked registry buckets rooted at `0x006acd78..0x006ad960` for an entry whose cached normalized token at `[entry+0x90]` matches the derived value. On success it returns the live registry entry pointer; otherwise it returns null. Current grounded callers are `shell_input_binding_registry_format_display_label_by_action_stem` `0x0045f3d0` and `shell_input_binding_registry_query_primary_code_by_action_stem` `0x0045f400`, which use this helper as the shared action-stem lookup beneath the camera-view modal family. This is therefore the safest current read for the stem-to-binding-entry resolver rather than a generic string hash helper.","objdump + local disassembly + registry correlation + normalized-stem correlation"
0x0045ef00,568,shell_input_binding_registry_rebucket_entry_by_stem_to_action_id_and_mode_mask,shell,cdecl,inferred,objdump + local disassembly + caller inspection + registry correlation,4,"Rehomes one existing binding entry into a different action bucket and mode-mask family while preserving its current binding data. The helper first resolves the target descriptor bucket through `shell_input_binding_descriptor_query_bucket_key_for_action_id_when_mode_mask_is_singular` `0x0045ed90` unless the requested action id is `0xff`, then resolves the source live entry by stem through `shell_input_binding_registry_resolve_entry_by_action_stem` `0x0045ede0`, allocates one fresh record from the pool owner at `0x006acd6c`, copies the source entry payload into that fresh record, overwrites the new action id `[entry+0x0c]` and mode mask `[entry+0x94]`, unlinks the old record from its current per-bucket list, optionally moves the old record into the detached `0xff` side list rooted at `0x006ad96c..0x006ad974`, and finally links the new record into the requested target bucket at `0x006acd78..0x006ad960`. Failure at either the descriptor-bucket or source-entry step returns `0`; success returns `1`. Current grounded caller is the hotkey message path at `0x0050020f`, where this helper commits one imported or reassigned binding row after the local label split and modifier decode. This is therefore the safest current read for the binding-entry rebucket helper rather than a generic pool copier.","objdump + local disassembly + caller inspection + registry correlation + pool-allocation correlation + detached-list correlation"
0x0045f250,278,shell_input_binding_report_iterate_next_entry_in_sorted_priority_order,shell,cdecl,inferred,objdump + caller inspection + local disassembly + registry correlation,4,"Iterates the next live binding entry in one temporary sorted report order. On first use when sentinel `0x005f0fe0 == 1`, the helper allocates a small queue owner at `0x006acd74`, initializes it through `0x0053d740`, walks every live registry bucket at `0x006acd78..0x006ad960`, and pushes each entry into that queue with priority `0x7ffffffe - [entry+0x9c]`. Each call then pops one entry through `0x0053d540`; when one record is available it formats the user-facing label into scratch `0x006ad980` through `shell_input_binding_format_display_label_from_registry_entry` `0x0045ea90`, copies the action stem from `[entry+0x10]` into `0x006ada00`, mirrors the binding code and companion field into `0x006ad978` and `0x006ad97c`, and returns `0x006ad978`. When the queue is exhausted it destroys the temporary owner, resets `0x006acd74` to null, restores sentinel `0x005f0fe0` to `1`, and returns `0`. Current grounded callers are the hotkey-report writer `0x0045f550` and the hotkeys-window refresh path at `0x004fed16/0x004fedb2`, which makes this the current sorted binding-report iterator rather than a generic priority-queue wrapper.","objdump + caller inspection + local disassembly + registry correlation + temporary-queue correlation + report-scratch correlation"
0x0045f3d0,33,shell_input_binding_registry_format_display_label_by_action_stem,shell,cdecl,inferred,objdump + caller inspection + registry correlation,3,"Small display-label helper above `shell_input_binding_registry_resolve_entry_by_action_stem` `0x0045ede0`. The helper resolves the caller action stem into one registry entry, then forwards the destination buffer plus that entry into `0x0045ea90` to format the user-facing label string. Success returns `1`; unresolved stems return `0`. Current grounded callers are the camera-view command owners `0x004408f0` and `0x004409c0`, where it formats the optional current focus labels embedded in the assignment and unassigned-view modals.","objdump + caller inspection + registry correlation + modal-text correlation"
0x0045f400,18,shell_input_binding_registry_query_primary_code_by_action_stem,shell,cdecl,inferred,objdump + local disassembly + registry correlation,3,"Tiny primary-code accessor above `shell_input_binding_registry_resolve_entry_by_action_stem` `0x0045ede0`. The helper resolves the caller action stem into one registry entry and, on success, returns that entry's primary binding code from `[entry+0x0c]`; unresolved stems return `0`. Current local evidence only grounds the raw field access, not a stronger player-facing meaning beyond the shared binding-registry lane.","objdump + local disassembly + registry correlation + field-access correlation"
0x0045f420,296,shell_input_import_hotkeys_file_and_rebucket_registry_entries_from_compound_labels,shell,thiscall,inferred,objdump + local disassembly + caller correlation + import-file correlation,4,"Imports one saved hotkeys file and rehomes matching live binding entries into the requested action or mode buckets. The helper first loads one parsed text resource through the small loader pair `0x00557320 -> 0x00557630`, retrying with the secondary `(0x28,0x29)` selector pair when the primary `(0x21,0x7e)` load fails. On the success path it walks the resulting nested record lists at `[root] -> [group+0x108] -> [entry+0x104]`, splits each imported `foo+bar` label through `shell_input_binding_split_plus_prefixed_label_into_primary_and_modifier_fragments` `0x0045ec00`, normalizes both fragments through `0x00557280/0x005572e0`, resolves the target action id from the descriptor table through `shell_input_binding_descriptor_query_action_id_by_localized_label` `0x0045ec70`, decodes the modifier fragment through `shell_input_binding_parse_modifier_fragment_to_compact_mode_code` `0x0045ecd0`, and finally commits the rebucket through `shell_input_binding_registry_rebucket_entry_by_stem_to_action_id_and_mode_mask` `0x0045ef00` using the preserved stem at `[entry+0x04]`. A fully successful import returns `1`; early parse or load failures return the loader status unchanged. Current grounded caller is the registry constructor `0x00461120`, which tail-jumps here with the fixed path `hotkeys\\hotkeys.txt` when the caller requests saved-hotkey import. This is therefore the safest current read for the hotkeys-file import worker rather than a generic text-resource walker.","objdump + local disassembly + caller correlation + import-file correlation + nested-record-walk correlation + rebucket correlation"
0x0045f550,382,shell_input_write_hotkeys_report_file,shell,cdecl,inferred,objdump + caller inspection + local disassembly + literal correlation,4,"Writes the current hotkey report to the fixed output path `hotkeys\\hotkeys.txt`. The helper opens that file through mode string `wt`, writes the fixed report header `!Hotkeys~\\n`, appends the localized heading strip from ids `0xdf6` through `0xdfc`, then iterates the current binding set through `shell_input_binding_report_iterate_next_entry_in_sorted_priority_order` `0x0045f250`. For each returned record it copies the action stem at `[entry+0x08]` into a local `0x20`-byte padded column, falls back to the localized empty-label string `0x0b3e` when the stem is empty, and formats each output line through the fixed template `%s = %s\\n`; rows whose leading dword is zero instead use the alternate template `%s = %s\\n` with the shifted value pointer at `[entry+0x08]`. Current grounded callers are the shell command path at `0x00461082` and the hotkeys-window message path at `0x00500153/0x0050021d`, which makes this the current shared hotkey-report writer rather than a generic file dump helper.","objdump + caller inspection + local disassembly + literal correlation + report-iterator correlation + hotkeys-path correlation"
0x0045f6d0,334,shell_input_register_action_binding_with_mode_specific_defaults,shell,cdecl,inferred,objdump + caller inspection + registry correlation,4,"Shared registration helper over the shell input-binding registry rooted at `0x006acd78..0x006ad960`. The helper first selects one mode-specific `(binding_code, companion_value)` pair from the caller's four fallback pairs according to shell mode dword `0x006d3c84`; when the selected binding code is not `0xff`, it re-enters `0x0045ed90` to resolve or create the target registry bucket, optionally updates an existing entry for the same companion discriminator `[entry+0x94]` through `0x0045f8a0`, or allocates and links a fresh entry from the pool owner at `0x006acd6c` and the monotonic id source `0x006acd68`. The new or updated record stores the action id, mode flags, callback pointer, localized label string, and the selected default pair before it is linked back into the per-action bucket family. Current grounded callers include the camera-view command registration block at `0x00460903..0x00460cac` and the world-view keyboard registration block at `0x00460720..0x004608e7`, which makes this the current shared action-binding registration helper rather than a camera-specific leaf.","objdump + caller inspection + registry correlation + allocation-pool correlation + mode-specific-default correlation"
0x0045f8a0,315,shell_input_binding_registry_replace_existing_entry_by_action_bucket_and_mode_mask,shell,cdecl,inferred,objdump + local disassembly + caller inspection + registry correlation,4,"Updates one existing binding entry for a specific action bucket plus mode-mask discriminator. The helper first scans the requested live bucket at `0x006acd78..0x006ad960` for an entry whose stored mode mask `[entry+0x94]` matches the caller value in `EDX`; when found it copies the full record to a local stack frame, unlinks and releases the live record from both its bucket and the pool owner at `0x006acd6c`, then re-enters `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0` with the preserved callback pointer, localized label pointer, default-pair payload, and the copied companion values while forcing the binding-code selector to `0xff`. Current grounded caller is the registration helper `0x0045f6d0`, which uses this path when a same-bucket same-mode entry already exists for the target action. This is therefore the safest current read for the existing-entry replacement helper rather than a generic free-and-realloc wrapper.","objdump + local disassembly + caller inspection + registry correlation + preserved-payload correlation"
0x0045f9e0,598,shell_input_seed_default_binding_registry_entries_from_static_table,shell,cdecl,inferred,objdump + local disassembly + static-table inspection,4,"Seeds the shell input-binding registry from the static default table rooted at `0x005ecadc`. The helper walks `0x71` eight-byte rows, localizes each row label id at `+0x04`, decodes the packed row policy word at `+0x06` into the mode-specific default tuple expected by `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`, and installs each resulting binding into the live registry. After the fixed table pass it appends a smaller manual post-table strip for adjacent shell commands such as the wrappers at `0x00441a00`, `0x00441940`, `0x00441980`, `0x00482b00`, `0x004408b0`, `0x00441ac0`, `0x004408d0`, and `0x00441af0`, using localized ids `0x0d4a` through the neighboring `0x0d53` band. Current grounded caller is the registry initializer `0x00461120`, which runs this helper after rebuilding the pool and queue roots. This is therefore the safest current read for the default binding seeder rather than a generic command-registration batch.","objdump + local disassembly + static-table inspection + post-table registration-strip correlation"
0x00460fe0,52,shell_input_register_localized_binding_command_id_0xdb5_to_action_0x6b,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db5`, then installs one default binding row with action id `0x6b`, callback `0x00441cb0`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits immediately beside the paired `0x0db6` half-step registration. The row is therefore carried at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation"
0x00461000,52,shell_input_register_localized_binding_command_id_0xdb6_to_action_0x6d,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db6`, then installs one default binding row with action id `0x6d`, callback `0x00441d20`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The row is therefore carried at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation"
0x00461040,40,shell_input_register_localized_binding_command_id_0xdb7_to_action_0x6a,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db7`, then installs one default binding row with action id `0x6a`, callback `0x004413e0`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The row is therefore carried at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation"
0x00461070,170,shell_input_binding_registry_destroy_all_roots_and_reset_globals,shell,cdecl,inferred,objdump + local disassembly + global-field correlation,4,"Destroys the live shell input-binding registry and clears all of its global roots. The helper first re-enters `shell_input_write_hotkeys_report_file` `0x0045f550` when the main pool owner at `0x006acd6c` is present, then releases the main pool owner `0x006acd6c`, the companion owner at `0x006acd70`, zeroes every bucket head/tail/count triple across `0x006acd78..0x006ad974`, and finally releases the temporary report queue owner at `0x006acd74` if it is still live. Current grounded caller is the setup helper `0x00461120`, which uses this as the hard reset before rebuilding the registry state. This is therefore the safest current read for the binding-registry teardown and global reset owner rather than a one-off file export command.","objdump + local disassembly + global-field correlation + teardown correlation + hotkey-report correlation"
0x00461120,171,shell_input_binding_registry_initialize_roots_seed_defaults_and_optionally_import_hotkeys_file,shell,thiscall,inferred,objdump + local disassembly + caller correlation,4,"Constructs the live shell input-binding registry, seeds the default action set, and optionally imports the saved hotkeys file. The helper first hard-resets the old registry through `shell_input_binding_registry_destroy_all_roots_and_reset_globals` `0x00461070`, zeros the monotonic id source `0x006acd68`, allocates and clears the primary pool owner at `0x006acd6c`, allocates the two companion owners at `0x006acd70` and `0x006acd74`, seeds the default bindings through `shell_input_seed_default_binding_registry_entries_from_static_table` `0x0045f9e0`, and when the caller flag in `ECX` equals `1` immediately tail-jumps into the hotkey import worker `0x0045f420` using the fixed path literal `hotkeys\\hotkeys.txt`. This is therefore the safest current read for the binding-registry constructor and optional hotkey-import owner rather than a generic allocator batch.","objdump + local disassembly + caller correlation + pool-allocation correlation + default-seed correlation + hotkey-import correlation"
0x00439e40,557,world_view_seed_keyboard_binding_slot_pairs,shell,thiscall,inferred,objdump + callsite inspection,4,"Initializes the eight world-view keyboard binding slot pairs rooted at [this+0x0a6] through [this+0x0e2]. The helper zeroes the paired 4-byte fields then queries the global action-binding registry through 0x0045f370 using eight distinct stub roots at 0x0043d2a0 through 0x0043d310. The registration block at 0x00460769 through 0x004608e7 plus `Data/Language/RT3.lng` show those eight roots are seeded as four labeled directional pairs: `Camera Forward` id 0x0d8a on Up, `Camera Backward` id 0x0d8b on Down, `Camera Left` id 0x0d8c on Left, `Camera Right` id 0x0d8d on Right, `Camera Zoom In` id 0x0d8e on Up, `Camera Zoom Out` id 0x0d8f on Down, `Camera Rotate Left` id 0x0d90 on Left, and `Camera Rotate Right` id 0x0d91 on Right. The first bank feeds the pan pairs later consumed at [this+0x0a6] through [this+0x0c2], while the second bank feeds the zoom-step and heading-turn pairs later consumed at [this+0x0c6] through [this+0x0e2]. After the registry lookups the helper normalizes several legacy companion values across all eight pairs by remapping 0x2 to 0x10 0x20 to 0x12 and 0x4 to 0x11 before storing the results back. This now looks like the live world-view setup path above world_view_service_keyboard_turn_pan_and_zoom_bindings at 0x0043d740 rather than a separate config-side binding store.",objdump + callsite inspection + callee inspection + registration xrefs + RT3.lng
0x0043db00,1968,world_view_service_shell_input_pan_and_hover,shell,thiscall,inferred,objdump + callsite inspection,4,Recurring world-view service that fuses shell input state into the live world-view owner at 0x0062be68. It begins by delegating keyboard-bound turn pan and zoom work to world_view_service_keyboard_turn_pan_and_zoom_bindings at 0x0043d740 then samples controller and view state through 0x00543c50 and 0x00543ba0 caches successive shell input coordinates from 0x006d4018 offsets 0xa94 and 0xa98 derives smoothed cursor or hover deltas against [this+0x2f6] [this+0x2fa] and [this+0x2fe] updates one world-under-cursor cache through 0x00448ac0 and 0x00448bd0 and refreshes the GameUppermost overlay through 0x004e0730 when the pan state changes. The helper repeatedly consults world_view_should_drive_primary_pan_channel at 0x0043af60 and world_view_should_drive_secondary_pan_channel at 0x0043b030 drives one of the lower motion branches at 0x0043e610 0x0043f4f0 or 0x0043e2c0 and smooths the keyboard zoom-step channel through the shared accumulator at 0x0062be78 before issuing discrete view-height bucket steps through world_view_step_zoom_bucket at 0x0043cc30. Current grounded callers include the recurring world-frame path at 0x00439730 and two setup or transition loops at 0x00516859 and 0x00516921. This now looks like the shared shell-input coordinator above keyboard turn pan zoom cursor drag and hotspot world-view motion rather than a mouse-only helper.,objdump + callsite inspection + caller xrefs
0x00420030,578,city_connection_bonus_exists_matching_peer_site,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Reusable placed-structure scan beneath the city-connection bonus note family. The helper walks the live placed-structure collection at `0x006cec20`, first requiring each candidate peer to match one site-class token from the caller's local six-byte class table through `0x0042b2d0`, then applying four bounded caller-controlled filters before returning success on the first matching peer. Current filter roles are tighter now: the first stack flag enables the station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the linked-instance class-byte test through `0x0047de00 -> 0x0040c990 == 1`; the third stack flag enables the deeper route or peer-reachability sweep through `0x0047f310` and `0x0048e3c0`; and the fourth stack dword is an optional owning-company id that is matched through `placed_structure_query_linked_company_id` at `0x0047efe0`. Current grounded callers include the adjacent city bonus or status formatter around `0x004207d0`, where the helper's boolean combinations choose localized ids `3868` through `3873`, plus wider world-side sweeps at `0x00404d66`, `0x004221ea`, `0x00422264`, `0x00435930`, and `0x00435944`. This now looks like the common city-connection peer probe rather than a generic anonymous scan.","objdump + caller xrefs + callsite inspection + city-bonus note correlation + filter-role decoding"
0x00420280,204,city_connection_bonus_select_first_matching_peer_site,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Companion selector beside `city_connection_bonus_exists_matching_peer_site`. The helper walks the live placed-structure collection at `0x006cec20`, requires each candidate peer to match one site-class token from the caller's six-byte class table through `0x0042b2d0`, and then applies two caller-controlled filters before returning the first matching placed-structure id from the collection instead of a boolean. The first stack flag enables the same station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the stricter linked-instance class-byte requirement through `0x0047de00 -> 0x0040c990 == 1`; when either flag is zero the corresponding predicate becomes permissive. Current grounded callers are the city bonus or status formatter at `0x004207d0`, which uses the selected peer to recover linked-company context after the boolean note checks, and the earlier world-side branch at `0x004046f5`, which passes both flags as `1` before sampling the selected peer's derived coordinates through `0x0047df30` and `0x0047df50`. This now reads as the first-match peer selector paired with the broader existence probe rather than as a second generic scan.","objdump + caller xrefs + callsite inspection + filter-role decoding + peer-selector correlation"
0x004207d0,1053,city_site_format_connection_bonus_status_label,map,thiscall,inferred,objdump + local disassembly + RT3.lng strings + caller inspection,4,"Adjacent city-site label formatter above the city-connection peer helpers at `0x00420030` and `0x00420280`. The boundary is tighter now. When preview-global `0x0062be84` is armed the helper returns `0` immediately; when city-side subtype dword `[this+0x23e]` is nonzero it does not run its own status logic at all and instead forwards all five caller parameters into the shared fallback formatter thunk `0x00455860 -> 0x00530820`. On the main branch it rounds the current normalized city coordinates through `0x00455810/0x00455800`, samples one world-view-dependent alpha byte through `world_view_query_city_label_alpha_byte_from_normalized_xy_and_view_scalars` `0x0043ad50`, and then tries to resolve one active linked world object through the live selection path at `0x006d1720` or the scenario fallback at `[0x006cec78+0x66a2]`. When that object passes vtable slot `+0x70`, linked-peer resolution `0x0040d1f0`, station-or-transit gate `0x0047fd50`, and the city-class membership test `0x0042b2d0`, the formatter writes one highlighted color with fixed alpha `0xff` and arms its local connected-style flag. Otherwise it uses the sampled byte from `0x0043ad50` as the top color lane only when that value is nonzero and below `0xff`. The helper always formats the base city label from `[this+0x356]`, optionally appends the numeric pending amount in `[this+0x276]`, and when the connected-style flag is armed appends localized id `207` `(Connected)`. If `[this+0x276]` is nonzero it then chooses one of the city-connection bonus note strings `3868` through `3873` by calling `city_connection_bonus_exists_matching_peer_site` `0x00420030` with three grounded filter combinations: the first branch is the connected-station special case keyed by `0x0040c990`, the second is the active-company-only pass using `scenario_state_get_selected_chairman_company_record` `0x004337a0`, and the third is the broader any-company pass. After those note checks it still re-enters `city_connection_bonus_select_first_matching_peer_site` `0x00420280` to recover one representative matching peer site and linked company context for the follow-on company-oriented text lane. The tail also splits cleanly now: when `0x0041fff0` fails it returns style code `1`; otherwise it derives one label-priority scalar from either `[this+0x25e]` or the piecewise-scaled `[this+0x312]` path, clamps that scalar to `0x95`, resolves one color-table entry through `0x0053de00`, stores it through the caller's style pointer, and returns style code `3`. This is therefore the grounded world-label or hover-summary formatter for city connection-bonus state, not a station-detail overlay body.","objdump + local disassembly + RT3.lng strings + caller inspection + connected-style-path correlation + peer-selector correlation + style-code split correlation"
0x0043f610,13,world_clear_station_detail_candidate_service_preview_pair_globals,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Tiny shared reset for the two preview globals at `0x005ee4fc` and `0x005ee500`. The helper writes `-1` into both lanes and returns. Current grounded callers are the shell-side preview clear and teardown paths in `StationDetail.win` at `0x00504a90` and `0x00505bf0`, where those globals hold the active `(station id, candidate id)` pair used by the world-side overlay scanner `0x0043f640`. This is the safest current read for the direct candidate-service preview-pair reset helper.","objdump + caller inspection + local disassembly + preview-pair correlation"
0x0043f620,20,world_store_station_detail_candidate_service_preview_pair_globals,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Tiny shared setter for the same preview globals at `0x005ee4fc` and `0x005ee500`. The helper stores its two caller dwords into those lanes unchanged and returns. Current grounded caller is `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, where the pair is the active `(station id, candidate id)` selection later consumed by `world_render_station_candidate_service_map_overlay` `0x0043f640`. This is the safest current read for the direct candidate-service preview-pair setter.","objdump + caller inspection + local disassembly + preview-pair correlation"
0x0043f640,3797,world_render_station_candidate_service_map_overlay,render,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Renders the world-side map overlay behind the active `StationDetail.win` candidate-service preview. The helper reads the currently previewed `(station id, candidate id)` pair from `0x005ee4fc` and `0x005ee500`, rejects early when shell preview mode or cargo-economy gates are inactive, re-enters `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`, and then scans the placed-structure collection at `0x006cec20` through either the direct local-service path or the heavier route-side helper at `0x0047e690`. The candidate byte at `[candidate+0x46]` now looks like the key legend split: when it is nonzero the overlay formats the directional route rows `3874` `Coming To %1` and `3875` `Going From %1`; when it is zero the same two legend lanes instead format `3876` `Current Supply @ < %1` and `3877` `Current Demand @ > %1`. Empty directional lanes collapse to `3878` `--None--`, and the title lane falls back to literal `All` when no specific candidate label is active. The neighboring connection-state notes `3872` `Already Connected by Another Company` and `3873` `Not Connected` no longer look like direct overlay-body emits; current grounded disassembly keeps them in the adjacent city bonus or status formatter `city_site_format_connection_bonus_status_label` at `0x004207d0`, which reuses `city_connection_bonus_exists_matching_peer_site` at `0x00420030` plus `placed_structure_query_linked_company_id` at `0x0047efe0` before choosing those strings. `3879` `Out of Sync` is also outside this function body and belongs to the multiplayer preview dataset path at `0x0046b780`. This now looks like the first grounded world-side owner above the shell preview pair armed by `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` rather than a generic hidden scanner.","objdump + RT3.lng strings + caller inspection + preview-overlay correlation + legend-branch correlation + adjacent-formatter boundary check"
0x00439140,1086,simulation_frame_accumulate_and_step_world,simulation,cdecl,inferred,objdump + analysis-context,4,"Frame-owned simulation cadence after world bring-up and still directly called from shell_service_pump_iteration at 0x00483f70 rather than a separately grounded outer gameplay loop. The routine samples elapsed time through 0x0051d890 mixes shell and mode scalars into a simulation quantum keeps leftover fractional time in [this+0x4c80] and when enough time has accumulated repeatedly calls simulation_advance_to_target_calendar_point at 0x0040ab50 using the current step quantum from 0x005f2b38. Around those simulation steps it refreshes shell-facing presentation helpers under 0x006d4024 and 0x006d0818 updates multiple world collections and transport or scenario side structures and services the recurring GameMessage.win branch through `game_message_window_service_if_present` `0x004e0720` before later follow-up work. The shell-owned cadence evidence is tighter here now too: one direct frame-side branch at `0x0043970f` opens or focuses `LoadScreen.win` through `shell_open_or_focus_load_screen_page` `0x004e4ee0`, and the post-step shell-window ladder then services several sibling shell windows by presence-probe plus dirty-latch pairs instead of any detached gameplay-only owner. Current grounded members of that ladder now include the shared custom modal through `shell_has_live_custom_modal_dialog` `0x004c8680` plus `shell_mark_custom_modal_dialog_dirty` `0x004c8670`, the file-options dialog through `shell_has_file_options_dialog` `0x004dc7d0` plus `shell_mark_file_options_dialog_dirty` `0x004dc7e0`, `LoadScreen.win` through `shell_has_live_load_screen_window` `0x004e1f50` plus `shell_mark_load_screen_window_dirty` `0x004e1f60`, `SettingsWindow.win` through `shell_has_settings_window` `0x004fe120` plus `shell_mark_settings_window_dirty` `0x004fe130`, `Overview.win` through `shell_has_live_overview_window` `0x004f2e80` plus `shell_mark_overview_window_dirty` `0x004f2e90`, `BuildingDetail.win` through `shell_has_live_building_detail_window` `0x004b9d70` plus `shell_mark_building_detail_window_dirty` `0x004b9d80`, and now `Trainbuy.win` through `shell_has_live_trainbuy_window` `0x0050f740` plus `shell_mark_trainbuy_window_dirty` `0x0050f750`. One deeper world-mode sidecar inside the same frame path now looks grounded too: after delegating to world_view_service_shell_input_pan_and_hover at 0x0043db00 the frame compares the active controller-view pointer at [0x006d4024+0x18]+0x366e against the latched world object at [this+0x66a2], releases the previous object through vtable slot +0x64, and when the new object passes its own availability test at slot +0x1c plus shell-detail control gate 0x07d6 on 0x006d0818 it latches the new object and calls slot +0x60. That makes the frame owner the first grounded non-camera world-input coordinator for hover or focus-target transitions beneath the shell-fed camera stack, even though click or command semantics are still unresolved. This is the strongest grounded owner so far for the recurring gameplay simulation cadence that follows world_entry_transition_and_runtime_bringup.","objdump + analysis-context + caller xrefs + callsite inspection + frame-disassembly correlation"
0x00433a40,82,shell_can_open_company_list_or_detail_panel_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,4,"Shared availability gate above the shell-side company-list and selected-company-detail lanes. The helper reads scenario toggle `[0x006cec78+0x4aef]`; when that dword is nonzero it raises the shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0` and returns `0`, otherwise it returns `1`. Current grounded callers are the direct shell command branches `0x004405b3` and `0x0044062c`, plus the broader shell-strip and page-side handlers `0x004de2e3` and `0x004de3ae`, all of which open company-list or selected-company-detail panels only on success. This is therefore the safest current read for the company list/detail availability gate rather than a generic scenario-action blocker.","objdump + caller inspection + shell-detail correlation + modal-path correlation"
0x00433aa0,95,shell_can_open_stockbuy_window_or_warn,shell,thiscall,inferred,objdump + caller inspection + stockbuy correlation,4,"Shared availability gate above the shell-side `StockBuy.win` family. The helper first rejects scenario states where toggle `[0x006cec78+0x4aa7]` is nonzero, surfacing the same shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0`. When the scenario toggle allows the action, it still requires a nonzero selected-company id at `[scenario+0x21]`; if no company is currently selected it raises the sibling shell modal rooted at localized id `335` and returns `0`. Only the success path returns `1` to the callers at `0x00440673` and `0x004de50f`, both of which immediately open detail-panel mode `0x0c` that later refreshes through the `StockBuy.win` family. This is therefore the safest current read for the stock-buy availability gate rather than a generic company-selection check.","objdump + caller inspection + stockbuy correlation + modal-path correlation"
0x00433b00,117,shell_can_open_trainbuy_window_or_warn,shell,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Shared availability gate above the shell-side `Trainbuy.win` family. The helper first rejects scenario states where the train-buy action is globally disabled through `[0x006cec78+0x4aa3]`, surfacing localized id `334` `That action is not allowed in this scenario.` through the shared shell modal path when blocked. It then checks whether the active company or world object state supplied by the caller allows train purchase; if no company is active it raises id `337` `You can't buy a train without starting a company first!`, and if no track has been placed it raises id `338` `You can't buy a locomotive until some track has been placed!`. Only the success path returns nonzero to the callers at `0x004406d3` and `0x004de7d9`, both of which immediately enter `shell_open_or_focus_trainbuy_window` at `0x00512c50`.","objdump + caller inspection + RT3.lng strings + train-buy gate correlation"
0x00434db0,91,shell_can_open_detail_panel_mode_0x0b_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,3,"Shared availability gate above one still-unresolved shell detail-panel mode `0x0b`. The helper first re-enters `shell_can_open_company_list_or_detail_panel_or_warn` `0x00433a40`; only when that broader company-family gate succeeds does it consult the additional scenario toggle `[0x006cec78+0x4a7f]`. When that second toggle is nonzero it raises the shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0` and returns `0`; otherwise it returns `1`. Current grounded callers are the direct shell command branch `0x00440543` and the page-side launcher `0x004de4a0`, both of which immediately open detail-panel mode `0x0b` on success. This is therefore the current bounded read for the mode-`0x0b` availability gate.","objdump + caller inspection + shell-detail correlation + modal-path correlation"
0x00434e20,128,shell_can_open_detail_panel_mode_0x06_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,3,"Shared availability gate above one still-unresolved shell detail-panel mode `0x06`. The helper first checks the three scenario toggles `[0x006cec78+0x4ab3]`, `[+0x4ab7]`, and `[+0x4abf]`; only when all three are nonzero does it raise the shared shell modal rooted at localized id `334` and return `0`. Otherwise it checks editor-map mode `[0x006cec74+0x68]`; outside editor mode it also requires a nonzero selected-company id at `[scenario+0x21]`, raising the sibling shell modal rooted at localized id `336` when that company selection is absent. Only the success path returns `1` to the callers at `0x004406a3` and `0x004de280`, both of which immediately open detail-panel mode `0x06`. This is therefore the current bounded read for the mode-`0x06` availability gate.","objdump + caller inspection + shell-detail correlation + modal-path correlation + editor-mode gating correlation"
0x00433b80,69,scenario_state_run_optional_collection_refresh_hooks_when_mutation_depth_zero,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Runs a small dispatcher of optional collection-side refresh hooks, but only when global mutation depth `0x0062be40` has fallen back to zero. On the active path it conditionally refreshes four live collection families through shell-state-controlled gates: the placed-structure collection at `0x006cec20` through `0x00481430`, the sibling placed-structure helper family at `0x0062b26c` through `0x00413860`, the train-side collection at `0x006cfcbc` through `0x004b2a90`, and the route-entry collection at `0x006cfca8` through `0x004931e0`. Current grounded callers include the periodic maintenance branch at `0x0040a914`, the placed-structure finalize path at `0x0040f6b4` after it decrements `0x0062be40`, and several shell or editor mutation branches around `0x0049d3a8` and `0x00508f97/0x0050900a`. This is therefore the safest current read for the zero-depth optional collection-refresh dispatcher rather than a single collection owner.","objdump + local disassembly + caller correlation + zero-depth-dispatch correlation + collection-refresh correlation"
0x00433da0,367,shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay,shell,cdecl,inferred,objdump + caller inspection + overlay-control correlation,3,"Shared owner beneath the paired shell commands `0x00441260` and `0x004412a0` for the mode-`0x19` overlay family. The helper takes one caller-supplied presenter-state boolean and one variant selector, restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across the detail-panel control band `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and then forwards the same variant into world helper `0x0043a0a0`. Current grounded callers are the two registered shell commands that derive the presenter-state boolean from `[0x006d4024+0x114216] == 1` and pass variant `0` or `1`, which makes this the safest current read for the shared mode-`0x19` variant-open and overlay-refresh owner rather than another anonymous control restyler.","objdump + caller inspection + overlay-control correlation + mode-0x19 correlation + detail-panel transition correlation"
0x00439820,91,world_view_sample_local_clearance_ring_clamp_eye_height_and_optionally_republish_triplet,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared world-view helper beneath the local controller strip. The function samples five nearby heights through `0x00534490` at the current eye X/Z pair `[this+0x1c/+0x24]` and four axis-offset probes, keeps the highest sampled clearance, rounds and expands that limit through `0x0052d0c0` plus fixed scalar margins, and then compares the result against current eye height `[this+0x20]`. When the smoothed or clamped target exceeds the current eye height it republishes the eye triplet through `0x0052d1e0`; when local smoothing latch `[this+0x60]` is live it also uses gain `[this+0x34e]` and cached scalar `[this+0x34a]` before that republish. Current grounded callers are the shell-input controller path `0x0043a1d4`, the camera-restore and step buckets at `0x0043c967`, `0x0043cdd4`, `0x0043d0a6`, and the neighboring motion branches `0x0043e4d5` and `0x0043f427`, so this is the safest current read for the local clearance-ring clamp and republish helper rather than a generic terrain-height query.","objdump + caller inspection + local disassembly + world-view correlation + local-clearance correlation + eye-triplet correlation"
0x0043a0a0,76,world_view_set_mode_0x19_variant_latch_seed_controller_blend_and_mark_dirty,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small world-view owner reached directly from the mode-`0x19` shell strip. The helper stores the inverse of its caller-supplied variant selector into presenter dword `[0x006d4024+0x114216]`, seeds four controller scalars through `0x0052d140` on the live world-view root `0x0062be68`, calls that same object's vtable slot `+0x00`, and then sets dirty byte `[world_view+0x65] = 1`. The seeded scalar quadruple is either `(1.0, 1.0, 0.0, 0.0)` or `(0.7, 1.0, 0.0, 0.0)` depending on the selected mode-`0x19` variant. Current grounded caller is `shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay` `0x00433da0`, so this is the safest current read for the world-view-side variant latch plus controller-blend seed owner rather than a generic shell flag setter.","objdump + caller inspection + local disassembly + world-view correlation + mode-0x19 correlation + controller-band correlation"
0x0043a1a0,61,world_view_store_two_scaled_controller_inputs_and_mark_projection_dirty,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small world-view helper over the same local controller strip. The helper scales its two caller floats by `100.0`, forwards them together with current controller dword `[this+0x0c]` into `0x0052d180`, forces controller scalar `[this+0x34e] = 1.0`, and then re-enters `0x00439820` to refresh the dependent view-projection state. Current grounded caller is `shell_world_view_apply_one_normalized_input_pair_from_shell_frame` `0x00516837`, which makes this the safest current read for the two-input controller setter plus projection-dirty publish rather than a higher-level camera mode owner.","objdump + caller inspection + local disassembly + world-view correlation + controller-input correlation + projection-refresh correlation"
0x0043a1e0,890,world_view_service_controller_transient_offsets_and_selection_handle,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader world-view-side service owner above the same controller strip. When activation dword `[this+0x38e]` is nonzero, the helper derives time-varying transient offsets into `[this+0x3a6/+0x3aa/+0x3ae]` from the current timer fields `[+0x392/+0x396]` and several fixed scalar thresholds, updates or clears one selection-like handle at `[this+0x3b2]` through `0x00531790` and `0x005317b0`, and can drop the activation dword plus all three offsets back to zero when the transient expires. On the live path it also republishes the accumulated offset-adjusted controller position through `0x0052d180` and restores controller gain `[this+0x34e] = 1.0`. Current grounded callers are the recurring simulation-frame path `0x0043916c`, the selection-side refresh strip at `0x0043bd1a`, and the neighboring motion branch at `0x0043e2a4`, so this is the safest current read for the controller transient-offset and selection-handle service owner rather than a static constructor or one-shot callback.","objdump + caller inspection + local disassembly + world-view correlation + transient-offset correlation + selection-handle correlation"
0x0043a560,64,world_view_release_controller_selection_handle_and_reset_embedded_controller_base,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Teardown-side sibling for the same world-view controller family. The helper temporarily restores one local vtable root at `[this]`, releases selection-like handle `[this+0x3b2]` through `0x005317b0(0)` when it is still live, clears the matching presenter-side owner slot through `0x0052d3e0`, and then tail-jumps into the embedded controller-base reset at `0x0052d570`. This is the safest current read for the controller-family release and base-reset helper rather than a generic shell singleton destructor.","objdump + local disassembly + caller inspection + world-view correlation + controller-reset correlation + selection-handle correlation"
0x0043a5a0,421,world_view_construct_reset_controller_state_and_seed_keyboard_bindings,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Broader world-view constructor or reset owner above the same controller strip. The helper first resets the embedded controller base through `0x0052d5a0`, clears a large local scalar and handle band rooted at `[this+0x8a..+0x38e]`, seeds a few fixed defaults such as `[this+0x38a] = -999.0f` and `[this+0x34e] = 1.0f`, and then tail-jumps into `world_view_seed_keyboard_binding_slot_pairs` `0x00439e40`. The resulting boundary is strong enough to treat this as the real world-view reset and keyboard-binding seed owner rather than a small camera-only helper.","objdump + local disassembly + caller inspection + world-view correlation + reset-owner correlation + keyboard-binding correlation"
0x0043ac30,235,world_view_load_camera_snapshot_release_pending_helper_and_reseed_blend_scalars,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Load-side world-view owner above the embedded controller snapshot loader. The helper first releases any pending helper handle from `[this+0x3b2]` through `0x005317b0`, clears presenter owner slot through `0x0052d3e0`, and resets the local controller strip through `0x0043a5a0`. It then loads one stored camera-view snapshot from the caller stream through `0x0052d750`, conditionally reads either `8` or `10` extra `0x30`-byte rows into `[this+0x10e]` according to startup-side scalar `[0x006cec78+0x46c34]`, consumes one trailing `0x14`-byte block, reseeds the four controller blend scalars through `0x0052d140(0, 0, 1.0, 0.7)`, calls vtable slot `+0x10`, and finally normalizes the heading lane `[this+0x10]`. Current evidence is strongest for a camera-snapshot load owner with one optional extra-row band rather than a generic stream-reader wrapper.","objdump + caller inspection + local disassembly + world-view correlation + stream-load correlation + controller-base correlation"
0x0043bde0,2037,world_view_refresh_dependent_projection_visibility_and_presentation_scalars,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader dependent-refresh owner beneath the same world-view family. After re-entering `0x00439be0`, the helper derives one large band of projection, visibility, and presentation-side scalars from the current focus and eye triplets `[this+0x04..+0x24]`, current controller defaults `[+0x38/+0x3c/+0x40/+0x44/+0x4c]`, world-side mode gates, and several fixed threshold tables. Along that path it calls `0x0052cec0`, `0x00484af0`, `0x00533100`, `0x0043a940`, and repeated world-cell validity checks through `0x00534e50`, and can set dirty byte `[this+0x65]` when the resulting bounds or visibility envelopes move outside tolerated ranges. Current grounded callers are the camera-restore path `0x0043caee`, the heading and zoom-step paths `0x0043cb1d/0x0043cddb`, the shell-input controller service `0x00516842`, and several neighboring motion branches, so this is the safest current read for the world-view dependent projection and presentation refresh owner rather than a smaller math helper.","objdump + caller inspection + local disassembly + world-view correlation + projection-refresh correlation + presentation-scalar correlation"
0x0050f740,6,shell_has_live_trainbuy_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Tiny presence probe for the shell-side `Trainbuy.win` singleton rooted at `0x006d3ac8`. The helper returns the live-flag dword at `0x006d3ae4`, which is set during `shell_open_or_focus_trainbuy_window` at `0x00512c50` and cleared after that family tears the singleton down. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside the sibling overview, building-detail, load-screen, settings, custom-modal, and file-options probes.","objdump + caller inspection + strings correlation + singleton correlation"
0x0050f750,11,shell_mark_trainbuy_window_dirty,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Tiny dirty-latch setter paired with `shell_has_live_trainbuy_window`. The helper stores `1` into `0x006d3adc`, which current nearby call patterns treat as the `Trainbuy.win` refresh or service request latch once the live singleton family rooted at `0x006d3ac8` exists. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, and the same latch is consumed on the message-`0` service path inside the family handler at `0x00512202` through the `0x00512c09` branch.","objdump + caller inspection + nearby-family correlation + singleton correlation + service-path inspection"
0x0050f760,45,shell_trainbuy_window_query_selected_locomotive_id,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Returns the currently selected locomotive id or `0` when the shell-side `Trainbuy.win` family has no valid active selection. The helper first checks whether the live singleton at `0x006d3ac8` exists and whether control resource `0x2afe` exposes one nonnegative selected row through `0x0055fba0`; on success it returns that selected locomotive id. Current grounded callers include the route, upgrade-cost, and purchase-confirmation branches inside `shell_trainbuy_window_handle_message`, where this value is then resolved through the locomotive collection at `0x006ada84`.","objdump + caller inspection + strings correlation + selected-row correlation"
0x0050f790,241,shell_trainbuy_window_compute_selected_upgrade_total_and_count,shell,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Computes the current selected-train upgrade summary beneath the shell-side `Trainbuy.win` family. The helper counts all flagged train entries in the `0x2000`-byte selection array rooted at `0x006d1aa8`, resolves the currently selected locomotive choice through `shell_trainbuy_window_query_selected_locomotive_id` at `0x0050f760`, and then multiplies the resulting selected-train count by the per-train upgrade cost from `0x004619c0` after converting the current and target locomotive ids through `0x004337b0` and `0x004337a0`. It writes the total upgrade cost through the first out-parameter and the number of selected trains through the second. Current grounded callers are the summary formatter at `0x0050f890` and the purchase-or-upgrade confirmation path inside `shell_trainbuy_window_handle_message`.","objdump + caller inspection + RT3.lng strings + selection-array correlation + upgrade-cost correlation"
0x0050f890,368,shell_trainbuy_window_render_selected_train_upgrade_summary,shell,cdecl,inferred,objdump + caller inspection + RT3.lng strings,4,"Formats the selected-train upgrade summary text in the shell-side `Trainbuy.win` family. After resolving the currently selected locomotive id through `shell_trainbuy_window_query_selected_locomotive_id` at `0x0050f760`, the helper calls `shell_trainbuy_window_compute_selected_upgrade_total_and_count` at `0x0050f790` and then builds the player-facing status string from localized ids `1338` `No trains currently selected to upgrade.`, `1339` `Total Cost to Upgrade the %1 Selected Trains to %2 is %3.`, and `1340` `Total Cost to Upgrade the 1 Selected Train to %1 is %2.`. It publishes the resulting heap-backed text through the callback-driven shell control path rooted at control resource `0x275c`. Current grounded callers are the family refresh path at `0x00511500` and the row-selection branch at `0x00512ac7`.","objdump + caller inspection + RT3.lng strings + upgrade-summary correlation"
0x0050fc00,1003,shell_trainbuy_window_render_selected_train_route_and_state_panel,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Renders the richer selected-train detail panel beneath the shell-side `Trainbuy.win` family. The helper resolves the currently selected train and its linked locomotive definition, formats one header block through the shared shell text path at `0x005519f0`, and then builds the lower route or cargo state block through `0x0053de00`, `0x0041d540`, and `0x00552560`. When the runtime latch at `[0x006cec74+0x180]` is set it also appends up to three localized fragments through ids `1341..1343`, gated by bytes `[train+0x30..0x32]`, before laying the final text out. Current grounded callers are the per-row hover or selection refresh paths beneath `Trainbuy.win`; the evidence is strong enough to carry it as the selected-train route-and-state renderer, with the three optional localized fragments kept at that bounded caption level.","objdump + caller inspection + nearby-family correlation + selected-train correlation"
0x00511500,2941,shell_trainbuy_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Constructs the shell-side `Trainbuy.win` singleton later published at `0x006d3ac8`. The constructor binds the window resource through `0x0053fa50`, caches three shell runtime handles in `0x006d3abc..0x006d3ac4`, seeds the live singleton pointer at `0x006d3ac8`, builds one filtered locomotive-choice list under `0x006d3ae8`, and then wires the family controls and callbacks through `0x00540120`. Current grounded control ownership is broad enough to treat this as the full `Trainbuy.win` family rather than a small helper: it binds the main action and selection controls under resources `0x2afa..0x2aff`, the selected-train summary path through `shell_trainbuy_window_render_selected_train_upgrade_summary` at `0x0050f890`, the per-row hover helpers at `0x0050fa00` and `0x0050fc00`, the selected-row refresh helper at `0x00511170`, and the selection-paging helper at `0x00512080`. Current grounded caller is `shell_open_or_focus_trainbuy_window` at `0x00512c50`.","objdump + caller inspection + strings correlation + control-wiring inspection + singleton correlation"
0x00512080,372,shell_trainbuy_window_refresh_controls,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Refreshes the visible control state for the shell-side `Trainbuy.win` family. The helper consumes and clears the temporary refresh gate at `0x006d3ae1`, clamps the current selected locomotive-row index from control resource `0x2aff` against the live filtered choice list length at `0x006d3aec`, rewrites the list-selection state across control `0x88`, updates the current mode-strip and list-state controls rooted at `0x00622b28`, and then tail-calls the selected-row detail refresher at `0x00511170`. Current grounded callers are the family constructor at `0x00511500`, the action path after row or mode changes inside `shell_trainbuy_window_handle_message`, and the initial open path in `shell_open_or_focus_trainbuy_window` at `0x00512dd5`.","objdump + caller inspection + strings correlation + list-state correlation"
0x00512c50,615,shell_open_or_focus_trainbuy_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation + RT3.lng strings,4,"Shared opener for the shell-side `Trainbuy.win` singleton rooted at `0x006d3ac8`. The helper first rejects duplicate opens through the live flag at `0x006d3ae4`, seeds the family globals `0x006d3ad0..0x006d3ad8`, `0x006d3acc`, `0x006d3aa8`, `0x006d1aa0`, `0x006d1aa4`, `0x006d3af0`, `0x006d3af4`, `0x00622b24`, and the filtered locomotive-choice list at `0x006d3ae8`, allocates an `0x80`-byte shell window object, constructs it through `shell_trainbuy_window_construct` at `0x00511500`, refreshes it through `shell_trainbuy_window_refresh_controls` at `0x00512080`, and publishes it to the shell runtime at `0x006d401c`. Current grounded callers are the direct train-buy shell command branches at `0x004406ee` and `0x004de7f4` after `shell_can_open_trainbuy_window_or_warn` at `0x00433b00`, plus the sibling train-side action family around `0x00514c97` and `0x00514d7e`. The current family semantics are broader than a bare locomotive picker: nearby message and summary paths show that the same window also stages selected-train upgrade state and train-route editing affordances, but the strongest resource-name anchor remains `Trainbuy.win`.","objdump + caller inspection + strings correlation + RT3.lng strings + singleton correlation + control-family correlation"
0x00512f80,193,shell_trainbuy_window_refresh_selection_side_toggle,shell,thiscall,inferred,objdump + caller inspection + control-flow inspection,4,"Refreshes the small side-toggle strip beneath `Trainbuy.win` and stores the chosen side in `0x006d3b28`. The helper converts the caller-supplied boolean into two opposing style states on controls `0x6593` and `0x6594`, rewrites one small layout block through `0x0053fe90`, and keeps the current side latched for the surrounding message paths that call it with `0` and `1` at `0x00514fed` and `0x00514fd8`. Current grounded caller is the neighboring train-side window family rooted at `0x006d3b20`, which reuses the same selected-train context and is carried conservatively at that neighboring family root.","objdump + caller inspection + control-flow inspection + side-toggle correlation"
0x005130f0,62,shell_trainbuy_window_query_selected_train_record,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Returns the currently selected train record or `0` when the active shell detail controller at `0x006d0818` does not hold one valid train id in `[this+0x90]`. The helper validates that selected id against the train collection at `0x006cfcbc` and then resolves the live record through `0x00518140`. Current grounded callers include the neighboring train-side shell window family around `0x005146d6`, `0x00514ce2`, and `0x00515176`, which repeatedly reuse the same selected-train pointer for route, upgrade, and warning flows.","objdump + caller inspection + nearby-family correlation + selected-train correlation"
0x00513130,51,shell_trainbuy_window_query_selected_train_id,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Returns the currently selected train id from the active shell detail controller at `0x006d0818` when that id is positive and still present in the train collection at `0x006cfcbc`; otherwise returns `-1`. Current grounded callers are the same neighboring train-side shell families that package selected-train requests for local and multiplayer follow-on work.","objdump + caller inspection + nearby-family correlation + selected-train-id correlation"
0x00513170,44,shell_trainbuy_window_has_valid_selected_train,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Boolean validity probe above `shell_trainbuy_window_query_selected_train_id`. The helper returns `1` only when the active shell detail controller at `0x006d0818` currently holds one positive train id in `[this+0x90]` and that id is still live in the train collection at `0x006cfcbc`. Current grounded callers include the train-side command family around `0x00514c66`, `0x00514cb5`, `0x00514d9c`, and `0x0051515c`, where it gates nearly every selected-train verb before deeper ownership or route checks run.","objdump + caller inspection + nearby-family correlation + selected-train-id correlation"
0x005131a0,125,shell_trainbuy_window_selected_train_belongs_to_selected_company,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Boolean ownership probe for the currently selected train. After resolving the selected train record through the same `0x006d0818` plus `0x006cfcbc` path as `shell_trainbuy_window_query_selected_train_record`, the helper compares that record's linked company id at `[train+0x51]` against the current scenario-selected company from `0x004337a0`. It returns `1` only when they match. Current grounded callers include the neighboring train-side command family, where failure falls into the explicit warning path at `0x00513220`.","objdump + caller inspection + nearby-family correlation + company-match correlation"
0x00513220,351,shell_trainbuy_window_warn_selected_train_not_owned_by_current_company,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Shared warning modal raised when a selected train does not belong to the current scenario-selected company. The helper resolves one player-facing label through `0x004a8bd0` when a live selected train exists, falls back to the static string block at `0x005c87a8` otherwise, formats localized id `0x250`, and then opens the standard callback-driven shell modal through `shell_open_custom_modal_dialog_with_callbacks` at `0x004c98a0`. Current grounded caller is the ownership-failure branch immediately after `shell_trainbuy_window_selected_train_belongs_to_selected_company` at `0x00514a35`.","objdump + caller inspection + nearby-family correlation + modal correlation"
0x00513720,168,shell_trainbuy_window_refresh_selection_column_empty_state_labels,shell,thiscall,inferred,objdump + caller inspection + control-flow inspection,4,"Refreshes the paired empty-state labels and styles on controls `0x65a1` and `0x65a2`. The helper inspects the currently active side resource `0x65a3/0x65a4`, checks whether its list selection at `[resource+0x1d6]` is negative, and then switches the two visible placeholder strings between localized ids `0x25b..0x25e` while also rewriting both controls' styles through `0x00540120`. Current grounded callers are the neighboring train-side shell window family constructor at `0x005145f3` and the row-selection action lane at `0x005148f3`.","objdump + caller inspection + control-flow inspection + placeholder-label correlation"
0x00514110,67,shell_train_detail_window_refresh_selected_train_name_label,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Small dynamic-label refresher beneath the shell-side `TrainDetail.win` family rooted at `0x006d3b20`. After validating the currently selected train id from the shell detail controller at `0x006d0818`, the helper resolves control `0x659d` inside the live `TrainDetail.win` singleton and forwards the caller-supplied subject string through `0x004bffc0`. Current grounded caller is the family constructor at `0x00514420`, which binds this helper as the dynamic-text callback for control `0x659d`.","objdump + caller inspection + strings correlation + callback binding"
0x00514160,704,shell_train_detail_window_refresh_controls,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Refreshes the visible control state for the shell-side `TrainDetail.win` family rooted at `0x006d3b20`. The helper rewrites the two top selection bands `0x65a3` and `0x65a4` from the current side latch at `0x006d3b24`, rebuilds the selected train's nested row state from the current train record resolved through the shell detail controller at `0x006d0818`, installs the per-row callbacks and renderers for the metric rows `0x65b6`, `0x65b9`, `0x65bc`, and `0x65bf`, updates the placeholder and summary text controls `0x659a`, `0x659b`, and `0x659d`, and then refreshes the current row selection plus the paired empty-state labels through `0x004bf320` and `shell_trainbuy_window_refresh_selection_column_empty_state_labels` at `0x00513720`. Current grounded callers are the family constructor at `0x00514420`, the opener at `0x00514620`, and several action paths inside the family message dispatcher at `0x00514690`.","objdump + caller inspection + strings correlation + callback binding + row-state correlation"
0x00514420,512,shell_train_detail_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Constructs the shell-side `TrainDetail.win` singleton later published at `0x006d3b20`. The constructor seeds the local vtable at `0x005d1990`, caches three shell runtime handles in `0x006d3b14..0x006d3b1c`, binds the `TrainDetail.win` resource directly through `0x0053fa50` using the embedded string at `0x005d19c0`, and then wires the family controls and callbacks through `0x00540120`. Current grounded bindings are broad enough to treat this as the full `TrainDetail.win` family: it installs row-click callbacks on `0x65a3` and `0x65a4`, metric renderers on `0x65ab` and `0x65ac`, the selected-train callback on `0x659c`, the dynamic-name label callback on `0x659d`, seeds the side-toggle state through `shell_trainbuy_window_refresh_selection_side_toggle` at `0x00512f80`, and then refreshes the full window through `shell_train_detail_window_refresh_controls` at `0x00514160`. Current grounded callers are the shell detail-panel transition manager at `0x004ddda1` and the direct opener at `0x00514620`.","objdump + caller inspection + strings correlation + callback binding + singleton correlation"
0x00514620,110,shell_open_or_focus_train_detail_window,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Shared opener or focus path for the shell-side `TrainDetail.win` singleton. When the caller supplies one valid train id present in the train collection at `0x006cfcbc`, the helper can seed the selected train subject through `0x004a7390`; when a live `TrainDetail.win` singleton already exists at `0x006d3b20` and the current shell runtime subject matches the incoming one, it simply refreshes that window and pings the shell runtime. Current grounded direct caller is the surrounding shell command path at `0x0046cbda`, and the existing constructor edge at `0x004ddda1` confirms that this opener sits above the same `TrainDetail.win` family rather than the neighboring `Trainbuy.win` singleton.","objdump + caller inspection + strings correlation + singleton correlation"
0x00514690,1920,shell_train_detail_window_handle_message,shell,thiscall,inferred,objdump + caller inspection + control-flow inspection + RT3.lng strings,4,"Primary message dispatcher for the shell-side `TrainDetail.win` family rooted at `0x006d3b20`. The handler processes shell messages `0`, `0xca`, `0xcb`, and the recurring service message `0x3e9`; routes the top-level side-toggle, list-selection, and metric-row controls through a dispatch table over resources `0x659c..0x6947`; repeatedly reuses the currently selected train via the helper family at `0x005130f0..0x00513220`; and fans out into several now-bounded train verbs. Current explicit branches include one selected-train engine-replacement or trainbuy handoff lane that checks scenario gate `[0x006cec78+0x4a97]`, raises localized ids `593` `That action is not allowed in this scenario.` and `594` `You can not replace the engine while the train is broken-down.` on failure, and otherwise re-enters `shell_open_or_focus_trainbuy_window` at `0x00512c50` or the neighboring local follow-on path at `0x00436820`; one selected-train retirement lane that checks `[0x006cec78+0x4a9b]`, rejects blocked states through ids `595` and `597`, confirms through id `596`, and then either tears the train down locally through the train collection plus `shell_detail_panel_transition_manager` mode `2` or packages multiplayer opcode `0x37`; plus one tighter route-edit lane over the shared `0x33`-stride route-entry family, where removal re-enters `train_route_list_remove_entry_and_compact` at `0x004b3000` and staged insertion re-enters `train_route_list_insert_staged_entry_at_index` at `0x004b3160`, then validates the resulting route through `train_route_list_validate_reachability_and_station_pair` at `0x004b2c10` and commits the follow-on train state through `train_set_route_operating_mode_and_scalar` at `0x004ab980`, with multiplayer opcode mirrors `0x3d`, `0x3f`, and `0x41`. It also consumes the family refresh path through `shell_train_detail_window_refresh_controls` at `0x00514160`. Current evidence is broad enough to treat this as the full `TrainDetail.win` message owner even though several deeper per-action verbs remain semantically open.","objdump + caller inspection + control-flow inspection + dispatch-table inspection + selected-train helper correlation + RT3.lng strings"
0x00515780,48,shell_train_list_window_clear_lower_action_range_unless_event_targets_active_top_list_control,shell,thiscall,inferred,objdump + local disassembly + callback correlation,3,"Tiny callback beneath the shell-side `TrainList.win` family. The helper consults the current top-side latch `0x006d3b30`, treats control `0x32c9` as active when that latch is clear or `0x32ca` as active when it is set, and only when the incoming control is outside that active top list does it clear or restyle the lower action range `0x332c..0x36b0` through `0x0053fe00(0)`. This is the current narrow callback that keeps the lower train-action band from being cleared while the active top list is still the event target.","objdump + local disassembly + callback correlation + top-side-latch correlation"
0x005157c0,21,shell_train_list_window_destruct_and_clear_singleton,shell,thiscall,inferred,objdump + strings correlation + singleton correlation,3,"Destructor wrapper for the shell-side `TrainList.win` family rooted at `0x006d3b34`. The helper restores the local vtable to `0x005d19d0`, clears the live singleton pointer `0x006d3b34`, and then tail-calls the shared shell base destructor `0x0053f7d0`. This is the current grounded teardown edge for the same `TrainList.win` family later constructed at `0x00515f50`.","objdump + strings correlation + singleton correlation + local disassembly"
0x005157e0,6,shell_train_list_window_query_current_top_side_latch,shell,cdecl,inferred,objdump + local disassembly + global-state correlation,2,"Tiny getter for the shared `TrainList.win` top-side latch at `0x006d3b30`. The helper simply returns that dword unchanged. Current grounded callers include the shared lower-row refresh owner `0x004bf320`, where the latch selects which top list side is currently active.","objdump + local disassembly + global-state correlation + caller correlation"
0x005157f0,41,shell_train_list_window_render_top_list_train_row_summary,shell,cdecl,inferred,objdump + local disassembly + callee correlation,3,"Top-list row renderer callback beneath the shell-side `TrainList.win` family. The helper resolves the incoming train id through the live train collection `0x006cfcbc` and then forwards the resolved train record plus the caller-supplied four float or scalar arguments into `0x004bd4a0` with `dl = 0`. Current evidence is strongest for the structural read: this is the shared top-list train-row summary renderer used by `TrainList.win`, not a direct action owner.","objdump + local disassembly + callee correlation + train-collection correlation"
0x00515820,136,shell_train_list_window_focus_selected_train_row_and_optionally_center_or_refresh,shell,fastcall,inferred,objdump + local disassembly + caller correlation,3,"Selection-focus callback beneath the shell-side `TrainList.win` family. The helper validates the incoming train id through `0x00517d40`, republishes that id into the shell detail controller `0x006d0818` through `0x004dd8a0`, resolves the train record, and then fans out by live input bits `[0x006d4018+0xa8c]`: when either low pan bit is set it validates the linked route object through `0x004a77b0` and recenters the world through `0x00437a90(1, 1, route_obj+0x34a)`; when bit `0x04` is set it re-enters the train-side action gate `0x004acb90` and, if the live `TrainList.win` singleton exists, reruns `shell_train_list_window_refresh_controls` `0x005158f0(-1)`. This is therefore the focus-and-follow callback for selected top-list train rows rather than a generic collection probe.","objdump + local disassembly + caller correlation + shell-detail correlation + selected-train-follow correlation"
0x005158b0,53,shell_train_list_window_refresh_lower_action_rows_for_inactive_top_list_side,shell,thiscall,inferred,objdump + local disassembly + callee correlation,3,"Small lower-row refresh callback beneath the shell-side `TrainList.win` family. The helper uses the same top-side latch `0x006d3b30` and active-control split `0x32c9/0x32ca` as `0x00515780`; when the event does not target the active top list it computes the relative row ordinal against the source control's base word `[control+0x1e2]` and forwards that delta into the broader lower action-row refresh owner `0x004bf320`. Current evidence is strongest for the structural read: this is the inactive-side lower-action refresh callback bound under `TrainList.win`, not a standalone action dispatcher.","objdump + local disassembly + callee correlation + top-side-latch correlation + control-base-word correlation"
0x005158f0,1120,shell_train_list_window_refresh_controls,shell,thiscall,inferred,objdump + strings correlation + control-flow inspection + caller correlation,4,"Refreshes the visible control state for the shell-side `TrainList.win` family rooted at `0x006d3b34`. The helper clears and rebuilds the two top list controls `0x32c9/0x32ca`, walks the full train collection `0x006cfcbc`, filters rows to the current company through `0x004337a0`, formats each surviving train name through `0x005193f0` and `0x00518de0`, and publishes mirrored entries into both list controls through `0x00540120`. It then installs the row renderers and callbacks on `0x32c9/0x32ca`, refreshes the shared selected-row latch `[this+0x78]`, updates the empty-state labels `0x32cf/0x32d0`, republishes the optional secondary selection from `0x00622b2c`, and when the world-side selected support-entry id at `[world+0x4cb6]` still resolves to one live train owned by the current company it reselects that same train in both list controls. Current grounded callers are the family constructor `0x00515f50`, the family message dispatcher `0x00515c60`, the sibling focus helper `0x00515820`, and the broader shell follow-on sweep `0x00436170`. This is therefore the real `TrainList.win` refresh owner rather than a generic company-list helper.","objdump + strings correlation + control-flow inspection + caller correlation + singleton correlation + selected-train-mirror correlation"
0x00515c60,752,shell_train_list_window_handle_message,shell,thiscall,inferred,objdump + strings correlation + control-flow inspection + caller correlation,4,"Primary message dispatcher for the shell-side `TrainList.win` family rooted at `0x006d3b34`. The handler processes shell messages `0`, `0xca`, `0xcb`, `0xce`, and the recurring refresh message `0x3e9`. Message `0` services the timed secondary-selection refresh through `0x0053f830` and updates `0x00622b2c`. Message `0xca` routes either the lower train-action row block `0x332c..0x36b0` through `0x004bf9d0` or direct top-list row clicks on controls `0x32c9/0x32ca`: those top-list clicks resolve the chosen train from `0x006cfcbc`, validate its linked route object through `0x004a77b0`, mirror the train-side support-entry id `[train+0x25]` into `[world+0x4cb6]`, republish the world focus through `0x00433900`, and transition the active detail panel through `0x004ddbd0(2, train_id)`. Message `0xcb` toggles the current top-side latch `0x006d3b30`, rewrites the paired list-action controls `0x32cb/0x32cc`, repopulates the lower action range `0x332c..0x36b0`, and clears the opposite top selection. Message `0xce` mirrors externally supplied top-list row payloads directly into `[world+0x4cb6]`. Message `0x3e9` simply re-enters `shell_train_list_window_refresh_controls` `0x005158f0`. This is the current grounded message owner for the full `TrainList.win` family.","objdump + strings correlation + control-flow inspection + caller correlation + detail-panel-transition correlation + selected-train-mirror correlation"
0x00515f50,181,shell_train_list_window_construct,shell,thiscall,inferred,objdump + strings correlation + control-wiring inspection + singleton correlation,4,"Constructs the shell-side `TrainList.win` singleton later published at `0x006d3b34`. The constructor binds the `TrainList.win` resource directly through `0x0053fa50` using the embedded string at `0x005d19dc`, seeds the local vtable at `0x005d19d0`, stores the live singleton pointer `0x006d3b34`, initializes the shared top-row selection latch at `[this+0x78] = -1`, wires the two top list controls `0x32c9/0x32ca`, the top-side toggle controls `0x32cb/0x32cc`, and the row-selection callbacks through `0x00540120`, and then tail-calls `shell_train_list_window_refresh_controls` `0x005158f0(-1)`. Current evidence is strong enough to treat this as the full `TrainList.win` constructor rather than another unnamed train-side shell family.","objdump + strings correlation + control-wiring inspection + singleton correlation + local disassembly"
0x004a01a0,789,route_entry_collection_try_build_path_between_optional_endpoint_entries,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy route-entry collection method over the global route store at `0x006cfca8`. The helper accepts up to two optional endpoint-entry pointers or ids, two endpoint coordinate pairs, a route-policy or mode byte, and optional output slots for the chosen endpoint-entry ids. It first resolves any supplied route-entry ids through `0x00518140` and projects them back to compact coordinate pairs through `0x0048a170`, rejects early when either endpoint lands on an invalid world tile through `0x00449980`, and computes one span scalar through `0x004952f0`. When the leading endpoint entry is absent it can synthesize one fresh route entry from the supplied coordinates and policy arguments through `0x00493cf0`; after that it resolves the chosen entry, copies four `3*dword` route-shape or bounding blocks from that entry into the collection-owned builder-state area at `[this+0x139]..[this+0x167]` through `0x005394b0`, stores the chosen endpoint coordinates at `[this+0x11d]` and `[this+0x121]`, latches one active-builder flag at `[this+0x118]`, and stages one linked entry field from `[entry+0x202]` into `[this+0x125]`. On one newly synthesized-entry path and policy bytes `1/2` it also touches the auxiliary route-entry family at `0x006cfcb4` through `0x004a42b0`, `0x00494f00`, and `0x004a4340`. Current caller evidence now narrows one more policy case: both the later world-side caller at `0x00480cd0` and the linked-site refresh helper `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0` enter this helper with both optional endpoint-entry ids unset and literal policy byte `2`, so the strongest current read for that byte is a full linked-site route-anchor rebuild between optional endpoint entries rather than the narrower direct endpoint-anchor creation or replacement lane carried by literal byte `1` in `0x00493cf0`. The helper then resets the collection's transient path-search state through `0x00495480`, re-enters the deeper route-search core at `0x0049d380`, optionally writes the chosen endpoint-entry ids back through the caller-supplied output pointers on success, and finally tears down the transient search state through `0x00495540` and `0x0049ad90`. Current grounded callers are the early route-search lane inside `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`, two neighboring retry branches at `0x004030d0` and `0x00403330`, a paired startup-connection branch at `0x00403ac0`, that later world-side caller at `0x00480cd0`, and the linked-site refresh helper at `0x00480bb0`. This now looks like the shared route-entry search or synthesis owner above the deeper path-search core rather than a generic route-store mutator.","objdump + caller xrefs + callsite inspection + route-entry search correlation + builder-state correlation + partial-mode-byte correlation + linked-site refresh correlation + linked-site policy-byte split correlation"
0x004a3db0,272,route_entry_collection_service_recent_entry_state_promotions_and_followon_refreshes,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Collection-wide post-change sweep over the global route-entry store at `0x006cfca8`. The helper first snapshots collection field `[this+0x90]` into `[this+0x94]`, then, when shell-state gate `[0x006cec74+0x94]` is set, walks every live route entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. The current changed-entry lane is now bounded: for entries newer than collection threshold `[this+0x102]` via `[entry+0x240]` and still carrying state byte `[entry+0x216] == 1`, it promotes that state through `0x0048b830(entry, 2)` and then releases any queued side list at `[entry+0x244]` through `0x00489f40`. After that sweep it drains the collection-owned linked list at `[this+0x98]`, resets `[this+0x88] = -1`, and, when shell runtime `0x006d401c` is live while collection latch `[this+0xed]` is clear, posts shell status id `0xbb` through `0x00538e00`. When any entry was promoted it also re-enters `0x004358d0` on the active mode object at `0x006cec78`, triggers `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with kind `6`, and then tails into `placed_structure_route_link_collection_recompute_all_endpoint_pair_state` `0x004682c0` on `0x006ada90`. Current grounded callers include the city-connection route-builder tail at `0x00404564`, the linked-site route-anchor refresh tail at `0x00480d1c`, and TrackLay-side follow-ons at `0x0050d7ed` and `0x0050db24`, so this is now the safest current read for the route-entry collection's recent-entry state-promotion and follow-on refresh sweep rather than a generic collection walk.","objdump + caller inspection + local disassembly + route-entry collection correlation + state-promotion correlation + runtime-effect trigger-kind correlation + route-link followon correlation"
0x00489f80,11,route_entry_assign_aux_tracker_group_id,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,3,"Tiny route-entry helper that writes the caller-supplied auxiliary tracker id into route-entry field `+0x212`. Current grounded callers include the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0`, the route-search core `0x0049d380`, the broader regrouping pass `0x004a45f0`, and neighboring tracker-update branches at `0x004996e0`, `0x004a4380`, `0x004a4ce0`, and `0x004a4ff0`. This now looks like the direct route-entry aux-tracker group-id assignment helper rather than a generic field store.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
0x00493cf0,456,route_entry_collection_create_endpoint_entry_from_coords_and_policy,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Creates one fresh route-entry endpoint record from caller-supplied coordinates and a small policy tuple. The helper rejects when either coordinate pair falls outside the live world bounds in `0x0062c120`, optionally validates the supplied company id through `0x0062be10` and `company_query_available_track_laying_capacity_or_unlimited` `0x004240a0`, allocates a new route-entry-like record from the current collection through `0x00518900` with type `0x257`, applies one company-side setup branch through `company_adjust_available_track_laying_capacity_with_floor_zero` `0x00423ec0` when the company id is nonzero, and then commits the detailed endpoint payload through `0x00490ac0`. It can also re-enter `0x00491e60` when the created record or the owning collection keeps one follow-on latch set, and if the collection field `[this+0x88]` is still unset it seeds that field from the created record's word at `+0x240`. Current mode-byte evidence is still partial but tighter now. Literal policy byte `1` is the strongest current match for direct linked-site endpoint-anchor creation or replacement, because the linked-site constructor and its nearby repair branches at `0x00480463`, `0x00480a77`, and `0x00480b69` all pass that byte before rebinding one chosen anchor through `0x0048abc0`. The TrackLay-side callers at `0x0050df1e` and `0x0050eec6` are tighter now too: they derive the passed policy byte from the shared TrackLay mode `0x00622b0c` through `route_entry_collection_map_track_lay_mode_to_endpoint_policy_byte` `0x004955b0`, which currently gives the strongest read `policy 1 = single-track endpoint synthesis` and `policy 4 = double-track endpoint synthesis`. Bytes `1/2` are also the ones later reused by `0x004a01a0` to enable the auxiliary tracker lane, while the company-side charge split is no longer vague: when a company id is present, ordinary company-bound synthesis passes `-1` into `0x00423ec0`, while byte `4` instead passes `-2`, so the current strongest read is that policy byte `4` consumes a larger company-side available-track-laying-capacity unit rather than skipping the company setup branch outright. The older builder-state path at `0x0046f2d1` still passes a dynamic byte from `[esi+0x05]`. The function returns the newly created route-entry id or `-1` on failure. Current grounded callers include `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0`, those neighboring route-building branches, and the TrackLay-side callers at `0x0050df1e` and `0x0050eec6`, so this now looks like the shared endpoint-entry synthesis helper rather than a generic collection allocator.","objdump + caller xrefs + callsite inspection + route-entry creation correlation + partial-mode-byte correlation + caller-pattern correlation + route-build-capacity correlation + linked-site policy-byte split correlation + TrackLay mode correlation"
0x00494e40,61,aux_route_entry_tracker_reset,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Zeroes or reinitializes one small auxiliary route-entry tracker record. The helper seeds the two endpoint-entry ids at `+0x04` and `+0x08` to `-1`, clears the small refcount at `+0x10`, clears the cached route-key and class-signature words at `+0x18` and `+0x1e`, resets the boolean latch at `+0x1c` to `0`, and clears the trailing payload band through `+0x42`. Current grounded callers are the tracker allocator paths at `0x004a42b0` and several neighboring `0x006cfcb4` setup sites, so this is the clearest current initializer for the auxiliary route-entry tracker family.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
0x00494e90,15,aux_route_entry_tracker_seed_owner_entry_id,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Seeds one auxiliary route-entry tracker with its owner or primary route-entry id. The helper writes the caller-supplied id into tracker field `+0x00` and clears the small accumulator fields at `+0x42` and `+0x46`. Current grounded callers are the tracker allocator paths at `0x004a42b0`, which use it immediately after allocating one `0x006cfcb4` record keyed by a route-entry id.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
0x00494eb0,15,aux_route_entry_tracker_adjust_refcount,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Adds the caller-supplied delta into the small refcount field at tracker offset `+0x10` and returns the updated total. Current grounded callers are the collection-side tracker updater `0x004a4340`, where a zero result triggers the tracker's destruction path.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
0x00494ed0,26,aux_route_entry_tracker_contains_endpoint_entry_id,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Small membership probe over one auxiliary route-entry tracker. The helper returns `1` when the caller-supplied route-entry id matches either tracker endpoint slot `+0x04` or `+0x08`, and `0` otherwise. Current grounded callers include several tracker-regroup and repair branches around `0x00490d62`, `0x0049a9ed`, `0x0049f162`, and `0x004a4ce0`, where it acts as the cheap endpoint-membership test beneath adjacent-chain transfer and duplicate-split logic.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
0x00494ef0,1,aux_route_entry_tracker_serialize_noop_per_entry_payload_stub,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Current per-entry save callback used by the auxiliary route-entry tracker collection tagged save owner `0x004a4240`. The body is a single `ret 4`, so this lane presently persists only the collection-side metadata and live ids emitted by the collection wrapper, not any additional per-entry payload. This is the safest current read for the tracker save stub rather than overclaiming hidden serialization state.","objdump + local disassembly + caller correlation + tracker-save correlation"
0x00494f00,176,aux_route_entry_tracker_merge_or_bind_endpoint_entry,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Binds one route-entry id into the two-endpoint auxiliary tracker record. The helper resolves the supplied route-entry through `0x006cfca8`, derives one route-key-like value through `0x0048aa70`, reads the route-entry signature fields at `+0x22e` and byte `+0x44`, and then either seeds both endpoint slots `+0x04/+0x08` on the first bind or merges the new entry into one side when the signature, route-key, and boolean class latch match the tracker's existing state. On failure it returns `0`; on success it returns `1`. Current grounded callers are the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring `0x006cfcb4` tracker update branches around `0x0049f1ce`, `0x0049f38d`, `0x0049f90b`, `0x004a4685`, `0x004a4830`, `0x004a4982`, `0x004a5175`, and `0x004a5189`. This now looks like the tracker-side endpoint bind or merge helper rather than a generic route-entry accessor.","objdump + caller xrefs + callsite inspection + tracker-family correlation"
0x00494fb0,97,aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Refreshes the small boolean class latch at tracker offset `+0x1c` and notifies the owning route-entry group when that latch changes. When the route-store latch `[0x006cfca8+0xf1]` is clear, the helper resolves the current endpoint-entry ids from `+0x04` and `+0x08`, recomputes whether the bound endpoint pair carries the nonzero route-entry byte `+0x44` on both sides, writes the resulting boolean back into `+0x1c`, compares it against the previous latch value, and on change calls `0x004a6360` on the auxiliary tracker collection `0x006cfcb4` with the owner entry id at `+0x00`. Current grounded callers are the neighboring route-state branch at `0x004915e0` and the compatible endpoint-slot rewrite helper `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0`. This now looks like the tracker-side boolean class-latch refresh plus owner-notify path rather than a generic predicate helper.","objdump + caller xrefs + callsite inspection + tracker-family correlation + owner-notify correlation"
0x00495020,188,aux_route_entry_tracker_refresh_cached_match_fields_and_maybe_split_duplicate_pair,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + field-layout inspection,3,"Refreshes one auxiliary tracker's cached match metadata and clears its trailing relationship payload band. Under two scenario-threshold branches keyed by `[0x006cec78+0x46c34]`, the helper seeds or refreshes tracker cache fields from the currently bound endpoint pair: it derives one route-key-like value through `0x0048aa30`, reuses one endpoint signature word from route-entry field `+0x22e`, and falls back to constant `1` when no endpoint slot is available on the active branch. After that it zeroes the trailing payload band at `+0x24..+0x46`. When both endpoint slots `+0x04` and `+0x08` still point to the same route-entry id and the tracker refcount `+0x10` is greater than `1`, it tail-calls the deeper split or reseed path at `0x004a51a0` with the owner route-entry id at `+0x00`. Current grounded caller is the broader tracker-side branch at `0x004a41b0`. The current objdump shape keeps the exact `+0x18/+0x1e` destination split slightly irregular on the second threshold path, so this row stays conservative about the final field assignment while still grounding the helper as cached-match refresh plus duplicate-pair split prep.","objdump + caller xrefs + callsite inspection + field-layout inspection + tracker-family correlation"
0x004950f0,128,aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Rewrites one matching endpoint slot in an auxiliary tracker after compatibility checks. The helper validates the replacement route-entry id, derives its route-key-like value through `0x0048aa70`, requires that value plus the route-entry signature word `+0x22e` to match the tracker's cached comparison fields, and then only replaces endpoint slot `+0x04` or `+0x08` when the caller-supplied old endpoint id currently occupies that slot. After any replacement it re-enters `aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner` `0x00494fb0` so the boolean class latch at `+0x1c` stays in sync. It returns `1` when a slot was replaced and `0` otherwise. Current grounded callers include the route-search core `0x0049d380`, the broader regrouping pass `0x004a45f0`, the neighboring route-state helpers at `0x00490bf0` and `0x004996e0`, and the tracker-side link-rewrite family at `0x004a4ce0`. This now looks like the compatibility-checked endpoint-slot rewrite helper beneath the auxiliary tracker family rather than a generic record mutator.","objdump + caller xrefs + callsite inspection + tracker-family correlation + endpoint-slot rewrite correlation"
0x004955b0,43,route_entry_collection_map_track_lay_mode_to_endpoint_policy_byte,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Small mapper from the live TrackLay primary mode into one of the endpoint-synthesis policy bytes consumed by `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`. The helper returns `1` immediately when the caller-supplied mode dword is `1`; otherwise it inspects two route-store state fields at `[this+0x1e1]` and `[this+0x1fd]` before either keeping that same `1` fallback or returning `4`. Current grounded callers are the TrackLay-side branches at `0x0050df00` and `0x0050eea8`, where the input mode comes directly from the shared TrackLay state at `0x00622b0c` already bounded as `Lay single track.` `0x1`, `Lay double track.` `0x4`, and `Bulldoze` `0x40`. That makes the strongest current read `policy 1 = single-track endpoint synthesis` and `policy 4 = double-track endpoint synthesis`, with one route-store-state-dependent fallback still preventing a fully closed user-facing name.","objdump + caller xrefs + callsite inspection + TrackLay mode correlation + partial-policy-byte correlation"
0x004952f0,208,math_compute_quadrant_adjusted_heading_angle_from_xy_pair,map,cdecl,inferred,objdump + caller xrefs + arithmetic inspection,4,"Computes one quadrant-adjusted heading angle from two float XY point pairs. The helper handles the vertical-line degeneracy explicitly by returning `pi/2` or `3*pi/2`, otherwise computes one arctangent ratio through the CRT helper at `0x005a1270` and then adds either `pi` or `2*pi` when the caller's delta pair lands in the corresponding quadrant. The result is a normalized heading-like angle in the `0 .. 2*pi` range. Current grounded callers include the route-entry search family at `0x004a01a0`, `0x0049d380`, and `0x0049c900`, plus several neighboring route and world-side geometry branches.","objdump + caller xrefs + arithmetic inspection + constant correlation"
0x004953c0,95,math_normalize_subtracted_angle_delta_and_report_wrap,map,thiscall,inferred,objdump + caller xrefs + arithmetic inspection,4,"Subtracts one angle from another and normalizes the resulting delta back into the principal `[-pi, pi]` range. When the optional pointer in `ECX` is nonnull the helper clears it to `0`, then sets it to `1` only when the delta had to be wrapped by adding or subtracting `2*pi`. Current grounded callers include the route-entry search family at `0x0049d380` and `0x0049c900`, several route-node or waypoint geometry branches, and neighboring world-side angle tests. This now grounds `0x004953c0` as a reusable wrapped-angle-delta helper rather than another anonymous quality check.","objdump + caller xrefs + arithmetic inspection + constant correlation"
0x0049d380,1134,route_entry_collection_search_path_between_entry_or_coord_endpoints,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy internal route-search core beneath the route-entry synthesis family. The helper accepts a leading route-entry id, one company id, two endpoint coordinate pairs, a route-policy tuple, one optional external target entry id, and several scratch or output buffers. It begins by validating the company id through `0x0062be10` and `company_query_available_track_laying_capacity_or_unlimited` `0x004240a0` when present, then packages the current search context into the collection-owned builder state, including one current-search latch at `[this+0x1d5]` and one distance-like scalar at `[this+0x1d1]`. From there it runs three bounded internal stages. First, it enters the deeper candidate path sweep at `0x0049bd40`; this can return a direct matching route-entry id or leave the search unresolved. Second, when that first stage does not settle the search, it rehydrates the returned route entry through `0x0048a170`, evaluates point-to-point distance, span, and angle-like quality terms through `math_measure_float_xy_pair_distance` `0x0051db80`, `0x004952f0`, `0x004953c0`, and `0x005a152e`, and only accepts the result when those quality gates pass. Third, when the quality gates or initial sweep fail, it can fall back to route-entry extension helpers `0x00494cb0` and `0x0049c900`, plus route-state propagation through `0x0048e600`, while rewriting several collection-side path blocks rooted at `[this+0x169]`, `[this+0x175]`, `[this+0x181]`, `[this+0x18d]`, `[this+0x199]`, `[this+0x1a5]`, `[this+0x1b1]`, and `[this+0x1bd]`. The function returns one resolved route-entry id or `-1`, and current direct callers are only internal route-entry family wrappers at `0x004a0470`, `0x004a0870`, `0x004a0b2a`, and `0x004a0cef`. In current evidence this is the search core that the higher wrapper `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` hands off to after endpoint reuse or synthesis, rather than a user-facing route mutator by itself.","objdump + caller xrefs + callsite inspection + path-search correlation + builder-state correlation + distance-helper correlation + track-laying-capacity correlation"
0x0049bd40,982,route_entry_collection_run_initial_candidate_path_sweep,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Runs the first candidate route sweep beneath `route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380`. The helper clears any prior temporary path list through `0x0049ad90`, seeds two caller-owned status dwords, resolves the starting route-entry id through the collection, rejects one trivial or degenerate local-delta case, and then seeds an initial extension attempt through `0x00494cb0`. From there it builds one temporary candidate chain in `[this+0x1cd]`, derives route quality terms from point-to-point distance through `math_measure_float_xy_pair_distance` `0x0051db80`, re-enters the route-node search against the auxiliary tracker collection `0x006cfcb4` through `0x004a6630`, and on a passing result publishes one follow-on route-entry id through the caller-supplied output slot. Current evidence now narrows the internal quality policy too: when the route-state gate at `[this+0xe9]` stays clear the helper selects a larger quality multiplier of `1.8` on route-policy byte `4` or field `[0x006cec78+0x4c74]`, and otherwise uses `1.4`; the same branch also folds in one signed angle-bias term `+/-0.181000038854627` before the later acceptance checks. That field is still the same player-facing TrackLay preference slot grounded elsewhere as `Auto-Show Grade During Track Lay`, but on this route-search lane it now reads more concretely as a temporary search-quality override: the shared city-connection builder `0x00402cb0` and the broader company periodic pass `0x004019e0` both mirror electric-locomotive context into it specifically to force this same larger initial-sweep multiplier branch. Current grounded direct caller is the search core `0x0049d380`, where this helper is the first stage before the later quality-gate and extension fallbacks. This now looks like the initial candidate path sweep rather than a generic collection iterator.","objdump + caller xrefs + callsite inspection + candidate-sweep correlation + tracker-family correlation + quality-threshold constant correlation + distance-helper correlation + temporary-override correlation"
0x0049c900,829,route_entry_collection_try_extend_search_frontier_toward_target_coords,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Tries to extend the current route-search frontier toward one target coordinate pair. The helper starts from two endpoint coordinate pairs plus one caller-owned result slot, initializes that result slot to `-1`, computes span and angle-like quality terms through `0x004952f0`, `0x005a152e`, and the same constant families used by the search core, and then repeatedly advances the search sample window until one candidate route extension passes the quality thresholds. Current evidence now narrows those thresholds too: this helper reuses the same signed angle-bias family `+/-0.181000038854627` seen in the initial candidate sweep before deciding whether to probe a covering entry. On successful passes it re-enters `route_entry_collection_try_find_route_entry_covering_point_window` `0x00494cb0`, verifies the returned entry through `0x0048ba40`, `0x004953c0`, and neighboring state bytes, and publishes the accepted route-entry id through the caller-owned result pointer. On failure it leaves that pointer at `-1`. Current grounded direct callers are the search core `0x0049d380` and the neighboring route wrapper at `0x004a0740`, which together make this the clearest current extension or frontier-advance helper beneath the route-entry search family rather than a free-standing world query.","objdump + caller xrefs + callsite inspection + frontier-extension correlation + quality-threshold constant correlation"
0x00494cb0,398,route_entry_collection_try_find_route_entry_covering_point_window,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Searches the current route-entry collection for one entry whose sampled span covers the caller's point window. The helper rejects immediately when the supplied window radius is nonpositive, quantizes the caller's center coordinates into world-grid bounds, iterates the resulting rectangular tile window inside `0x0062c120`, and repeatedly re-enters `0x004921a0` on each candidate tile or route bucket until it finds one acceptable route-entry id. Current grounded callers include the station-attachment validation lane at `0x00403d30`, the placement validator at `0x00417ba1` and `0x0041a2c9`, the world-side route mutation lane at `0x00480d88`, the initial candidate sweep `0x0049bd40`, the search core `0x0049d724`, and several neighboring route-search branches. This now looks like the shared route-entry point-window coverage query beneath both placement-side track attachment and the heavier route-entry search family rather than a generic tile scan.","objdump + caller xrefs + callsite inspection + world-grid correlation + route-window correlation"
0x004a42b0,79,aux_route_entry_tracker_collection_allocate_entry,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Allocates one new tracker record in the auxiliary route-entry collection at `0x006cfcb4` and seeds it for one owner route-entry id. The helper resets a small local tracker template through `aux_route_entry_tracker_reset` `0x00494e40`, allocates one live record from the collection through `0x00518900`, resolves that record, seeds its owner entry id through `aux_route_entry_tracker_seed_owner_entry_id` `0x00494e90`, and returns the new tracker id. Current grounded callers include `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring route-state branches at `0x0049e174`, `0x0049e3d8`, `0x0049e427`, `0x0049e45c`, `0x0049f1b0`, `0x0049f3b5`, `0x0049f91a`, `0x004a466d`, `0x004a4814`, `0x004a4966`, and `0x004a5054`, so this is now the clearest current allocator for the auxiliary route-entry tracker family.","objdump + caller xrefs + callsite inspection + tracker-family correlation"
0x004a4340,55,aux_route_entry_tracker_collection_adjust_refcount_or_destroy,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Looks up one tracker record in the auxiliary route-entry collection at `0x006cfcb4`, adjusts its small refcount through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`, and destroys the record through the collection vtable when the resulting count reaches zero. Current grounded callers include the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring route-state branches at `0x00490da5`, `0x0049a9b8`, `0x0049abca`, `0x0049f178`, `0x0049f1a2`, `0x0049f1e0`, `0x0049f37e`, `0x0049f3a7`, `0x004a4f9c`, `0x004a4fb0`, and `0x004a5161`. This now looks like the shared refcount or destroy path for the auxiliary route-entry tracker family rather than another anonymous collection helper.","objdump + caller xrefs + callsite inspection + tracker-family correlation"
0x004a4380,619,aux_route_entry_tracker_collection_try_split_route_entry_chain_into_fresh_group,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Broader prepass beneath the auxiliary route-entry tracker regrouping family at `0x006cfcb4`. Starting from one existing tracker id, the helper snapshots the source tracker's cached match tuple at `+0x18/+0x1c/+0x1e` plus its endpoint slots `+0x04/+0x08`, walks the adjacent route-entry chain through the `+0x206/+0x20a/+0x20e` family, and watches for a subchain whose route-key-like value from `0x0048aa70`, signature word `+0x22e`, or boolean class byte `+0x44` no longer matches the source tracker. When that mismatch survives the surrounding guards, it allocates one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, seeds or binds the moved entries through `aux_route_entry_tracker_seed_owner_entry_id` `0x00494e90` and `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, reassigns the traversed route entries through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, and rebalances the two trackers' counts through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`. Current grounded direct caller is `aux_route_entry_tracker_collection_refresh_route_entry_group_membership` `0x004a45f0`, where this helper runs as the early split prepass keyed by the current route entry's tracker id. This now looks like the chain-splitting helper that carves a mismatching adjacent subchain into one fresh tracker group rather than a generic collection walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + regrouping prepass correlation"
0x004a45f0,1420,aux_route_entry_tracker_collection_refresh_route_entry_group_membership,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy regrouping pass over the auxiliary route-entry tracker collection at `0x006cfcb4`. The helper starts from one route-entry record, rejects the trivial case where both adjacent route-entry fields `[entry+0x206]` and `[entry+0x20a]` are unset, optionally runs `aux_route_entry_tracker_collection_try_split_route_entry_chain_into_fresh_group` `0x004a4380` keyed by the route entry's current tracker id in `[entry+0x212]`, and then refreshes ownership around that id. On the simpler branch it can allocate one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, bind one or more route-entry ids into it through `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, assign the resulting tracker id back into route-entry field `+0x212` through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, and rebalance tracker refcounts through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`. The current endpoint-bind semantics are tighter now too: the bind helper groups entries only when their route-key-like value from `0x0048aa70`, route-entry signature word `+0x22e`, and boolean class latch derived from byte `+0x44` all agree. On the larger branch this pass walks adjacent route-entry links through the `+0x206/+0x20a/+0x20e` family, can re-enter `aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups` `0x004a4ce0` to migrate compatible neighboring subchains between tracker groups, uses `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0` to rewrite compatible endpoint slots, and can re-enter the nearby cached-match refresh path `0x00495020` before dropping empty tracker records through the collection vtable. Current grounded caller is `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0`, where this pass runs immediately after literal-policy-`2` route-anchor rebuild and bind. This now looks like the auxiliary tracker regrouping pass beneath the broader linked-site route-anchor rebuild lane rather than a generic collection sweep.","objdump + caller xrefs + callsite inspection + tracker-family correlation + linked-site refresh correlation + endpoint-match-tuple correlation + chain-transfer correlation"
0x004a4c00,224,aux_route_entry_tracker_route_entry_pair_pass_adjacent_chain_transfer_gate,map,thiscall,inferred,objdump + callsite inspection + field-layout inspection,3,"Compatibility gate used before adjacent tracker-chain transfers. Given two route-entry records, the helper validates both current tracker ids in the auxiliary tracker collection at `0x006cfcb4`, resolves the two tracker records, and then requires a matching cached comparison tuple across both trackers: byte `+0x1d` must be nonzero on both sides, dwords `+0x18` and `+0x1e` must match, and boolean latch byte `+0x1c` must match. It also requires both candidate route entries to keep their special side fields at `+0x20e` and `+0x222` unset at `-1`. Only when all of those checks pass does it return `1`; otherwise it returns `0`. Current grounded direct caller is `aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links` `0x004a6360`, where this gate sits directly above the adjacent-chain transfer helper `0x004a4ce0`. This now looks like the reusable adjacent-chain transfer compatibility gate rather than a generic pairwise predicate.","objdump + callsite inspection + field-layout inspection + tracker-family correlation + transfer-gate correlation"
0x004a4ce0,777,aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Reusable cross-group migration helper beneath the auxiliary route-entry tracker collection at `0x006cfcb4`. Given two tracker ids plus one cached match tuple, the helper first verifies that collection-busy latches are clear, validates the destination tracker's cached fields at `+0x18/+0x1c/+0x1d/+0x1e`, then walks one adjacent route-entry chain through the `+0x206/+0x20a/+0x20e` family while using `aux_route_entry_tracker_contains_endpoint_entry_id` `0x00494ed0` to avoid trampling the destination tracker's existing endpoint entries. Compatible traversed entries are reassigned into the destination group through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, source and destination tracker populations are rebalanced through `aux_route_entry_tracker_collection_adjust_refcount_or_destroy` `0x004a4340` and the raw `+0x14` count field, and the destination endpoint slots can be rewritten through `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0` before any emptied source tracker is destroyed. Current grounded callers include the owner-refresh family at `0x004a6360` plus neighboring route-state branches at `0x0049ac78`, `0x0049ff6e`, and `0x004a645a..0x004a65a3`. This now looks like the adjacent-chain transfer helper between compatible tracker groups rather than a generic collection mutator.","objdump + caller xrefs + callsite inspection + tracker-family correlation + adjacent-chain transfer correlation"
0x004a4ff0,454,aux_route_entry_tracker_collection_reseed_group_from_route_entry_component,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Repair or reseed helper over the auxiliary route-entry tracker collection at `0x006cfcb4`. Starting from one route-entry id whose current tracker membership is missing or invalid, the helper allocates one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, assigns that tracker id into the starting entry through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, walks the connected route-entry component through `0x0048e140` and `0x0048e160`, and migrates each adjacent member that still carries the stale tracker id into the new group while counting the moved entries. It then updates the involved tracker populations, binds the new component's endpoint entries back into the fresh tracker through two calls to `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, and returns. Current grounded callers include the route-state repair branch at `0x0048b896` and the broader tracker traversal pass at `0x004a6244`. This now looks like the component-level tracker-group reseed helper used when a route-entry component has lost valid tracker ownership rather than a generic regrouping walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + reseed correlation"
0x004a5fc0,928,aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Collection-wide traversal refresh for the auxiliary route-entry tracker family at `0x006cfcb4`. The helper clears the collection dirty latch at `[this+0x8c]`, allocates one temporary queue array at `[this+0x94]`, resets every live tracker's traversal label field at `+0x0c` to `-1`, and then repeatedly walks connected tracker groups until every live record has one stable component label. While traversing, it destroys dead tracker records whose active count has fallen nonpositive, follows adjacent route-entry links outward from each tracker endpoint through the `+0x206/+0x20a/+0x20e` route-entry family, and when one neighboring route entry carries an invalid tracker id it repairs that side immediately through `aux_route_entry_tracker_collection_reseed_group_from_route_entry_component` `0x004a4ff0` before continuing the walk. The refreshed component labels are stored back into tracker field `+0x0c`, and neighboring collection-side queries reuse them after the dirty latch has been cleared. Current grounded callers are the adjacent tracker-query helper at `0x004a6320` and neighboring owner-refresh branches that first test `[this+0x8c]` before trusting cached component labels. This now looks like the collection-wide connected-component refresh and invalid-group reseed pass rather than a generic sweep.","objdump + caller xrefs + callsite inspection + tracker-family correlation + traversal-label correlation + reseed correlation"
0x004a6360,592,aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Owner-side adjacent-group refresh beneath the auxiliary route-entry tracker family at `0x006cfcb4`. Starting from one owner route-entry id, the helper validates the current tracker, requires its tracker-side enable byte `+0x1d` to be nonzero, resolves the two bound endpoint entries from tracker slots `+0x04` and `+0x08`, and first requires those endpoint entries to agree on the boolean class state derived from route-entry byte `+0x44`. It then inspects adjacent route-entry links hanging off both endpoint sides through the `+0x206/+0x20a` family and, whenever a neighboring route entry belongs to a different tracker group, runs `aux_route_entry_tracker_route_entry_pair_pass_adjacent_chain_transfer_gate` `0x004a4c00` before re-entering `aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups` `0x004a4ce0` to migrate that compatible adjacent chain into the owner's tracker group. Current grounded caller is `aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner` `0x00494fb0`, which invokes this helper only when the tracker's boolean class latch at `+0x1c` changes. This now looks like the owner-adjacent compatible-group refresh path triggered by latch changes rather than a generic tracker walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + owner-refresh correlation + compatibility-gate correlation"
0x004a62c0,79,aux_route_entry_tracker_query_tracker_component_labels_match,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Small dirty-aware equality test over tracker component labels in the auxiliary route-entry tracker collection at `0x006cfcb4`. Given two tracker ids, the helper first refreshes stale labels through `aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups` `0x004a5fc0` when collection dirty latch `[this+0x8c]` is set, resolves both tracker records, and returns `1` only when both ids are live and tracker field `+0x0c` matches across the pair. Invalid tracker ids return `0`. Current grounded callers include the alternate recursive pair-metric branch at `0x004a5900`, where this helper gates same-component recursion before adjacent-neighbor expansion.","objdump + caller xrefs + callsite inspection + tracker-family correlation + component-label equality correlation"
0x004a6320,64,aux_route_entry_tracker_collection_query_component_label_by_tracker_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Dirty-aware query helper over the auxiliary route-entry tracker collection at `0x006cfcb4`. The helper first checks collection dirty latch `[this+0x8c]` and re-enters `aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups` `0x004a5fc0` when the cached component labels are stale. It then validates the caller-supplied tracker id through the collection, resolves the live tracker record, and returns the connected-component label stored in tracker field `+0x0c`; invalid tracker ids return `-1`. Current grounded callers are the heavier pair-selection family around `0x004a6630`, where this helper is the reusable query side of the component-label sweep rather than another traversal owner.","objdump + caller xrefs + callsite inspection + tracker-family correlation + component-label query correlation"
0x004a65b0,128,aux_route_entry_tracker_dispatch_route_entry_pair_metric_query,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Build-compatibility-switched lower metric query beneath the auxiliary route-entry tracker pair-selection family. The helper forwards one fixed route-entry pair, one companion output pair, and the surrounding score or scratch arguments into one of two heavier internal algorithms: it dispatches to `0x004a5280` when the shared build-version query at `runtime_query_hundredths_scaled_build_version` `0x00482e00(0x006cec74)` reports at least `0x67`, and otherwise dispatches to `0x004a5900`. The recovered cutovers now line up with executable build values `0x67/0x68/0x69/0x6a == 1.03/1.04/1.05/1.06`, and the version source itself can come from either the local `RT3.EXE` version resource or the multiplayer session-side companion path at `0x0046a4b0`, so this branch now reads most safely as a pre-`1.03` versus `1.03+` route-metric compatibility dispatcher rather than any gameplay time or era gate. Current grounded caller is the broader chooser at `0x004a6630`, which can invoke this helper repeatedly across multiple endpoint combinations, keep the smallest non-`-1` returned score, and publish the chosen route-entry pair through out pointers. Current evidence is therefore tight enough to treat this as the reusable route-entry-pair metric dispatcher beneath that chooser, while the deeper user-facing meaning of the returned metric still lives mostly in the linked-transit and route-validation consumers rather than inside this switch itself.","objdump + caller xrefs + callsite inspection + tracker-family correlation + pair-metric correlation + version-gate correlation + multiplayer-session-version correlation"
0x004a5280,1664,aux_route_entry_tracker_query_route_entry_pair_metric_via_weighted_recursive_search,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavier weighted search branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates tracker membership, can require endpoint-capable entry type byte `[entry+0x216] == 2` when the caller's looser gate is clear, and on top-level entry initializes one global prune threshold at `0x006cfcb0` plus one per-tracker best-cost cache at `0x006cfcac`. It then evaluates up to four candidate continuations: one direct paired-side route entry plus adjacent links `+0x206`, `+0x20a`, and `+0x20e`. For each surviving candidate it resolves route-entry coordinates through `0x0048a170`, computes one float heuristic through `0x0051dbb0`, orders the candidates by that heuristic, accumulates integer step and mismatch penalties, and recursively re-enters itself while pruning against the current best threshold and the per-tracker cache. On success it writes the best integer metric back through one out pointer, the paired companion metric through another, and returns one chosen downstream route-entry id; top-level calls free the temporary cache block before returning. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the weighted recursive route-entry-pair metric search rather than a generic tracker walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + weighted-search correlation + heuristic-ordering correlation + recursive-search correlation"
0x004a5900,1728,aux_route_entry_tracker_query_route_entry_pair_metric_via_recursive_neighbor_walk,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Alternate recursive neighbor-walk metric branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates top-level endpoint eligibility in the same broad way as `0x004a5280`, initializes the same global prune threshold and per-tracker cache on top-level entry, and then recursively explores neighboring route entries through the `+0x206`, `+0x20a`, and `+0x20e` link family. The search stays within compatible tracker-component context through `aux_route_entry_tracker_query_tracker_component_labels_match` `0x004a62c0`, applies optional boolean-class and company gates through tracker latch byte `+0x1c` and `0x00424010`, and accumulates one integer route-step count plus one mismatch penalty count, adding extra cost when route-entry signature word `+0x22e` differs from the caller-supplied filter. The best surviving branch writes the minimal metric and companion penalty back through out pointers, and top-level calls free the temporary per-tracker cache block before returning one chosen downstream route-entry id or one adjacent fallback entry when no recursive hit survives. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the simpler recursive neighbor-walk metric query beneath the weighted branch rather than a generic collection scan.","objdump + caller xrefs + callsite inspection + tracker-family correlation + recursive-neighbor-walk correlation + component-label correlation"
0x004a6630,892,aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavier chooser above the auxiliary route-entry tracker pair-metric dispatcher. Given two route-entry ids plus several out slots and optional gates, the helper validates both route entries and their tracker ids, rejects one caller-requested boolean-class mismatch when the source route-entry byte `+0x44` stays clear, and then has two bounded modes. When both entries pass `0x0048b870`, it directly re-enters `aux_route_entry_tracker_dispatch_route_entry_pair_metric_query` `0x004a65b0` for that fixed pair. Otherwise it resolves the current tracker endpoint slots `+0x04/+0x08` for both sides, derives up to four endpoint-pair combinations from those two tracker groups, and invokes `0x004a65b0` on each surviving combination while keeping the smallest non-`-1` returned metric. The winning route-entry id and companion peer id are written back through out pointers, and current grounded callers reuse the chooser beneath the initial candidate route sweep `0x0049bd40`, the company linked-transit peer-cache builder `0x004093d0`, and the train route validator `0x004b2c10`. This now looks like the best route-entry-pair metric chooser with tracker-endpoint fallbacks rather than a generic sweep.","objdump + caller xrefs + callsite inspection + tracker-family correlation + endpoint-fallback correlation + pair-chooser correlation"
0x004a77b0,24,train_resolve_linked_route_object_or_null,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Tiny train-side resolver over linked route-object id `[train+0x41]`. The helper treats `-1` as empty, otherwise resolves that id through collection `0x0062ba84` via `0x00518140` and returns the live linked route object pointer. Current grounded callers are broad and consistent: the whistle command `0x00441870`, the multiplayer train-apply and callback families at `0x0046d780`, `0x0046e250`, and `0x00470bb0`, the train list renderers around `0x004e7670`, and many neighboring simulation-side train helpers. This is therefore the safest current read for the shared train-to-linked-route-object resolver rather than a metrics-owner-only helper.","objdump + local disassembly + caller inspection + linked-route-object correlation + train-family correlation"
0x004a77d0,51,train_query_linked_route_object_metric_pair_or_default_10f,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small train-side wrapper above the linked route-object metric helper `0x0041add0`. When linked route-object id `[train+0x41]` is live, the helper resolves that route object through collection `0x0062ba84` and tail-calls `0x0041add0` with the original two out-float pointers. When the train has no linked route object, it instead writes `10.0f` to both caller out-float slots and returns. Current evidence is strongest for a generic two-float linked-route metric pair rather than a narrower semantic name, but the default path and ownership boundary are now explicit.","objdump + local disassembly + caller inspection + linked-route-object correlation + two-float-out-parameter correlation"
0x004a7810,183,train_refresh_linked_route_object_steam_emitter_enable_flags,simulation,thiscall,inferred,objdump + local disassembly + caller inspection + effect-family correlation,3,"Iterates the linked route-object row band rooted at `[route+0x316]` / count `[route+0x31a]` after resolving the train's linked route object through `[train+0x41]`. For each `0xc0`-stride row it probes the optional emitter definition at `[row+0x60]`, uses `effect_name_matches_literal_steam` `0x004749a0` to separate the literal `steam` family, and then either clears row byte `[row+0x1d8]`, resets scalar `[row+0xcc]` to `1.0f`, and re-enters `0x00554920`, or sets `[row+0x1d8] = 1` on the non-steam or missing-emitter branch. This is the safest current read for the linked-route-object steam-emitter enable-state refresh rather than a broader train visual owner.","objdump + local disassembly + caller inspection + effect-family correlation + linked-route-object correlation + row-band correlation"
0x004a9460,65,train_current_route_context_uses_strict_reachability_mode,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small boolean gate keyed off the train's current linked route object at `[this+0x41]`. The helper resolves that route object through `0x0062ba84`, follows its class or profile reference through `0x0041adb0`, uses the resulting id at `[profile+0x126]` to query the small class table rooted at `0x006ada84`, and returns `1` only when the final type field at `[entry+0x10]` equals `2`. Current grounded callers include the local and multiplayer route-entry insertion success paths at `0x00515430` and `0x004718fe`, where a true result triggers the stricter second `train_route_list_validate_reachability_and_station_pair` pass before mode `0x13` is selected, and several neighboring simulation branches such as `0x004ad5e2` and `0x004b1ec5` that use the same gate before re-entering the stronger route-state path. Current evidence is therefore tight enough to treat this as a shared current-route-context gate for the stricter reachability or operating-mode family even though the player-facing meaning of class type `2` remains open.","objdump + caller xrefs + callsite inspection + route-context correlation"
0x004a94b0,381,train_finalize_aux_route_entry_buffer_preserving_subflags,simulation,thiscall,inferred,objdump + caller xrefs + route-entry inspection,3,"One train-side cleanup or finalize helper over the auxiliary route-entry wrapper at `[this+0x1c6]`. When that wrapper is present, the helper walks the embedded `0x33`-stride route-entry list rooted at `[aux+0x0c]`, rewrites one bounded payload band back into the selected entries, and explicitly preserves route-entry flag bits `0x40`, `0x20`, and `0x10` in byte `+0x28` across the rewrite. It then frees the auxiliary wrapper through `0x005a1145` and clears `[this+0x1c6]`. Current grounded caller is the larger train-side route-state branch at `0x004b0cf0`, where this helper sits behind the scenario-state gate at `0x00434050` and ahead of the later current-route-entry resolution path. Current evidence is therefore strong enough to treat this as an auxiliary route-entry buffer finalize step that preserves the lower route-entry subflags even though the exact player-facing meaning of those bits remains open.","objdump + caller xrefs + route-entry inspection + auxiliary-buffer correlation"
0x004ac460,210,train_query_deterioration_scalar_with_disable_bypass,simulation,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + train-deterioration correlation,3,"Small train-side scalar query in the same deterioration family as the later crash or breakdown owner. When special-condition slot `33` `[0x006cec78+0x4b03]` is set, the helper returns the fixed fallback float at `0x005c8598` immediately. Otherwise it resolves the train's linked route-object family through `[train+0x41] -> 0x0062ba84 -> 0x41adb0 -> [entry+0x126] -> 0x006ada84`, derives one year-relative delta from current year `[0x006cec78+0x0d] - [train+0xd4]`, folds that delta through two fixed multipliers, and then quantizes the train-local float `[train+0xb8]` through `0x005a10d0` before continuing into the remaining scalar tail. Current loader-side prose already depends on this slot-`33` fast path as the smaller sibling beside the broader failure owner `0x004af8a0`, so this is the safest current read for the train deterioration scalar query with special-condition bypass rather than a generic route-object metric.","llvm-objdump + local disassembly + caller correlation + train-deterioration correlation + special-condition correlation"
0x004ad7a0,595,train_trigger_crash_state_effects_and_optional_owner_notifications,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng strings,3,"Broader train-side crash owner reached both from the cheat-code selector branch in `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` `0x00437d70` and from the direct shell command strip around `0x00441810`, where localized id `365` warns `There is no train available to crash!` when no candidate train survives. The helper first enforces the usual crash-side global gates: it rejects when shell byte `[0x006cec78+0x4c8e]` is already set, when world or shell latches under `0x006cec74` block the action, or when the train already carries a nonzero operating mode at `[train+0xe8]`. On the active path it resolves the current linked route object through `[train+0x41]`, marks route field `[route+0x33e]`, enables the shared three-selector and selector-`5` train-visual effect families through `train_visual_toggle_three_selector_effect_slots_and_reseed_shared_anchors` `0x0045cc90(1)` and its selector-`5` sibling `0x0045d1e0(1)`, clears several transient train fields `[+0x55/+0x59/+0x5d/+0x1a7]`, and then walks the linked route-object chain to drive byte `[train+0xf4]` plus the paired visual refresh lane through `0x0052fb70`, `0x0045c8d0`, and `0x004a8100`. It finishes by writing crash mode `0x11` into `[train+0xe8]`, seeding scalar `[train+0xec] = 0x46924000`, rebuilding the local event payload through `0x004a9360`, and, when the crashing train belongs to the currently selected company, publishing both a shell-side notice through `0x004554e0` and the follow-on company update through `0x00423fd0`. Current neighboring caller `0x004af9e8` also treats this body as the crash-side branch opposite `0x004ada00`, so the safest current read is the shared train crash-state, effect, and owner-notification owner rather than a generic operating-mode setter.","objdump + caller xrefs + local disassembly + RT3.lng strings + train-visual correlation + crash-command correlation + route-state correlation"
0x004ada00,543,train_trigger_breakdown_state_effects_and_optional_owner_notifications,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng strings,3,"Breakdown-state sibling of `train_trigger_crash_state_effects_and_optional_owner_notifications` `0x004ad7a0`. The helper is reached from the direct shell command strip around `0x004418a0`, where localized id `366` warns `There is no train available to break down!`, and from the neighboring train-state branch at `0x004af9f7`. It enforces the same crash-side global gates and the same `[train+0xe8] == 0` requirement, but on the active path it marks route field `[route+0x342]`, enables the selector-`5` and selector-`2` train-visual effect families through `0x0045cf40(1)` and `0x0045d1e0(2)`, clears the same transient train fields `[+0x55/+0x59/+0x5d/+0x1a7]`, and drives the same linked route-object byte `[train+0xf4]` plus refresh lane through `0x0052fb70`, `0x0045c8d0`, and `0x004a8100`. It then writes breakdown mode `0x12` into `[train+0xe8]`, seeds the same scalar `[train+0xec] = 0x46924000`, rebuilds the local event payload through `0x004a9360`, and, when the affected train belongs to the currently selected company, publishes the shell-side notice through `0x004554e0` and the paired company follow-on through `0x00423fe0`. Current neighboring caller `0x004af9f7` uses this body as the direct opposite branch of `0x004ad7a0`, so the safest current read is the shared train breakdown-state, effect, and owner-notification owner rather than another generic operating-mode setter.","objdump + caller xrefs + local disassembly + RT3.lng strings + breakdown-command correlation + train-visual correlation + route-state correlation"
0x004af8a0,354,train_service_try_trigger_crash_or_breakdown_from_year_and_load_thresholds,simulation,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + train-deterioration correlation,3,"Broader train-side deterioration owner above `train_trigger_crash_state_effects_and_optional_owner_notifications` `0x004ad7a0` and `train_trigger_breakdown_state_effects_and_optional_owner_notifications` `0x004ada00`. The helper first consults special-condition slot `33` `[0x006cec78+0x4b03]`; when that slot is set it returns immediately without building any threshold. Otherwise it derives one year-scaled base threshold from the current scenario year `[0x006cec78+0x0d]`, one live collection count from `0x006cfcbc`, and several fixed multipliers, quantizes that threshold through `0x005a10d0`, applies a second year-relative adjustment from `[train+0xd4]`, and then compares the result against one random bounded scalar from `0x00518be0`. Slot `32` `[0x006cec78+0x4aff]` is the narrower gate in the same owner: when it is set, or when `0x00434050` reports the auxiliary-preview side path, the helper forces the milder breakdown branch. Otherwise the random-threshold comparison selects crash via `0x004ad7a0` on the low path and breakdown via `0x004ada00` on the high path. Current save/load prose already depends on this slot-`32/33` split when describing restored special-condition semantics, so this is the safest current read for the train deterioration owner rather than an unnamed failure branch family.","llvm-objdump + local disassembly + caller correlation + train-deterioration correlation + special-condition correlation"
0x004ab980,760,train_set_route_operating_mode_and_scalar,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Shared train-side mode setter beneath route editing and adjacent operating-state transitions. The helper clears several transient route-state fields at `[this+0x55]`, `[this+0x59]`, `[this+0x5d]`, and `[this+0x1a7]`, optionally rounds the caller-supplied scalar argument to an integer when the scenario-state gate at `0x00434050` is active, dispatches over mode ids `0..0x13`, and in several branches toggles the train byte at `[this+0xf4]` across the linked route-object chain rooted at `[this+0x41]` before notifying follow-on state refresh helpers `0x004a8100` or `0x004a81b0`. Every successful path writes the chosen mode id to `[this+0xe8]` and the final scalar to `[this+0xec]`. Current grounded callers include the local and multiplayer route-entry insertion success path at `0x004718a0` and `0x00515450`, which select mode `0x13` after the stricter post-insertion validation succeeds and mode `0x0a` after the looser fallback path. Current evidence is therefore tight enough to treat this as the shared train route operating-mode and scalar setter even though the player-facing names of the individual mode ids remain open.","objdump + caller xrefs + callsite inspection + mode-write correlation + route-edit correlation"
0x004b2b80,29,train_route_list_count_live_site_reference_entries,simulation,thiscall,inferred,objdump + caller xrefs + route-entry inspection,4,"Counts the subset of entries in the same train-owned `0x33`-stride route-entry list whose flag byte at `+0x28` is nonnegative. Current grounded callsites make that sign-bit split meaningful: sign bit clear entries are the live placed-structure-backed family, while sign bit set entries use the direct route-node payload side instead. Current callers include the shell-side formatter branches at `0x004be50c` and `0x004be53c`, plus the train purchase or readiness path at `0x005126c2`, where the count must reach at least `2` before the deeper route validation lane is allowed to continue. Current evidence is therefore tight enough to treat this as the shared count of live site-reference route entries rather than a generic row counter.","objdump + caller xrefs + route-entry inspection + callsite inspection"
0x004b2c10,656,train_route_list_validate_reachability_and_station_pair,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,4,"Shared route validator above the train route-entry insertion and edit family. The helper walks the same train-owned `0x33`-stride route-entry list and splits on route-entry flag byte `+0x28`: sign bit clear entries resolve live placed-structure ids from field `+0x29` through the placed-structure collection at `0x006cec20` before mapping those structures into the route-node collection at `0x006cfca8`, while sign bit set entries take one direct route-node payload from field `+0x2b`. It then re-enters `0x004a6630` for each successive route step and one optional caller-supplied external target. While scanning, it also tracks up to two distinct station-like placed-structure ids through `0x0047fd50`; the final result fails when any placed structure or route node cannot be resolved, when any `0x004a6630` sweep leaves the output marker at `-1`, or when the scan never accumulates both ends of that station pair. Current grounded callers include the local and multiplayer insertion paths at `0x004718a0` and `0x00515450`, where failure leads to localized route warnings `3089` `At least one station on the route is not connected to the others.`, `3090` `This train cannot reach the station you've selected.`, and `3091` `This train cannot reach the track waypoint you've selected.`. Current evidence is therefore tight enough to treat this as the shared route reachability and terminal-station-pair validator rather than a generic list scan.","objdump + caller xrefs + callsite inspection + RT3.lng strings + placed-structure correlation + route-warning correlation + route-entry flag split"
0x004b2f00,250,train_route_list_select_entry_and_refresh_linked_site_state,simulation,thiscall,inferred,objdump + caller xrefs + state-layout inspection,4,"Shared selector helper for one train-owned route-entry list whose records are `0x33` bytes wide. The helper clamps the requested selected index against the current count at `[this+0x4]`, stores the new selection in `[this+0x8]`, and only when route-entry flag byte `+0x28` has its sign bit clear does it extract the previous and new placed-structure ids from field `+0x29` and forward that old/new site pair into `0x004819b0`; sign bit set entries skip that placed-structure extraction path. It then refreshes the linked train-side state through `0x004abca0`, `0x004ad260`, and `0x004b2ea0`. When the caller requests it, it also marks the owning train record's byte `[train+0x1b9]`. Current grounded callers include the local `TrainDetail.win` route-entry branch at `0x00514a96`, the multiplayer-side route-entry handlers at `0x00471730` and `0x004097f9`, and the removal helper `train_route_list_remove_entry_and_compact` at `0x004b3000`. The same route family is now also tied to localized reachability warnings `3089..3091`, so this reads as a train route-stop or waypoint selection helper rather than a generic row selector.","objdump + caller xrefs + state-layout inspection + placed-structure-id correlation + route-warning correlation + route-entry flag split"
0x004b3000,341,train_route_list_remove_entry_and_compact,simulation,thiscall,inferred,objdump + caller xrefs + state-layout inspection,4,"Removes one entry from the same `0x33`-stride train-owned route list and compacts the remaining records. The helper validates the caller-supplied index against current count `[this+0x4]`, repairs the selected index `[this+0x8]`, re-enters `train_route_list_select_entry_and_refresh_linked_site_state` at `0x004b2f00` when the removed row was the selected one, allocates a shorter replacement buffer, copies the prefix and suffix segments around the removed row, decrements the list count, frees the old buffer, and then refreshes the linked train-side state through `0x004abca0`, `0x004ad260`, and `0x004b2ea0`. Current grounded callers include the local `TrainDetail.win` route-entry removal branch at `0x00515211` and the multiplayer-side handler at `0x00471823`.","objdump + caller xrefs + state-layout inspection + compacting-buffer correlation + route-list correlation"
0x004b3160,530,train_route_list_insert_staged_entry_at_index,simulation,thiscall,inferred,objdump + caller xrefs + state-layout inspection + RT3.lng strings,4,"Inserts one staged `0x33`-byte route-entry record into the same train-owned route list at one caller-selected index. Before insertion the helper seeds parts of the staged record from the prior terminal route entry and preserves the currently grounded lower route-entry subflags `0x40`, `0x20`, and `0x10` in field `+0x28`. That same flag byte also carries the top-level entry split: sign bit clear entries use one live placed-structure id in field `+0x29`, while sign bit set entries use one direct route-node payload in field `+0x2b`. Only the live site-reference branch can re-enter the narrower tutorial gate `tutorial_validate_train_route_station_indicator_step` at `0x00516d00`, and only when the staged placed-structure id is station-or-transit-like and the shell tutorial family rooted at `0x006d3b4c` is active. The helper then allocates a `(count+1)` replacement buffer, copies the prefix rows, writes the staged record at the requested insertion index, copies the suffix rows, frees the old buffer, bumps the count, repairs the selected index, and refreshes the linked train-side state. Current grounded callers include the local `TrainDetail.win` insertion or staging branch at `0x00515417`, the multiplayer-side handlers at `0x004718e5` and `0x004097eb`, and the nearby validation path that surfaces localized reachability warnings `3090` `This train cannot reach the station you've selected.` and `3091` `This train cannot reach the track waypoint you've selected.`. Current evidence is therefore tight enough to treat this as the route-stop or waypoint insertion helper above that validation family rather than as a generic record copier.","objdump + caller xrefs + state-layout inspection + RT3.lng strings + insertion-buffer correlation + route-warning correlation + route-entry flag split + subflag preservation"
0x00516be0,284,tutorial_advance_step_and_refresh_expected_control_ids,shell,cdecl,inferred,objdump + caller xrefs + local disassembly + tutorial-table inspection,4,"Advances one active shell tutorial step and refreshes the small expected-control cache under `0x00622b34..0x00622b3c`. The helper first returns immediately when the tutorial-active flag at `0x006d3b4c` is zero; otherwise it increments the current tutorial step index at `0x006d3b50`, consults the `0x40`-byte descriptor table rooted at `0x00622b48`, and skips several currently grounded step codes when their extra world or shell-state predicates fail. After choosing the next live step it copies the previous expected control id from `0x00622b34` into `0x00622b38`, then loads the new expected control id and one current alternate-accepted control id from descriptor offsets `+0x34` and `+0x38` into `0x00622b34` and `0x00622b3c`. Current shell-command correlation is now tight enough to support that narrower reading: the generic shell control path around `0x004de199` and `0x004de724` compares incoming control ids directly against `0x00622b3c` and suppresses the tutorial-only `3587` rejection when they match, which makes `0x00622b3c` look like a current companion control id rather than a page or mode selector. The helper also rate-limits one small shell-side nudge through `0x0045ea20` while the tutorial runs. Current grounded callers are the generic shell control path at `0x00540cca` and the train-route tutorial validator at `0x00516d93`, which makes this the current best owner for the tutorial step-advance and expected-control cache instead of leaving `0x00622b34/38/3c` as anonymous globals.","objdump + caller xrefs + local disassembly + tutorial-table inspection + control-cache correlation + shell-command correlation"
0x00516d00,143,tutorial_validate_train_route_station_indicator_step,shell,thiscall,inferred,objdump + caller xrefs + callsite inspection + nearby-state inspection + RT3.lng strings,4,"Small shell-side tutorial gate used before one live station-or-transit site id is committed into the train route-entry list. The helper only matters while the tutorial state family rooted at `0x006d3b4c` is active: it consults the current tutorial step index at `0x006d3b50`, reads that step's code from the `0x40`-byte tutorial descriptor table rooted at `0x00622b48`, and accepts only the currently grounded step codes `0x172` and `0x17c`, which align with localized tutorial prompts `3777` `Click on the yellow station indicator for Milan.` and `3778` `Now click on the station indicator for Turin`. For accepted steps it stages the caller-supplied site id into `0x006d3b5c` and, in the second step, advances the surrounding tutorial state through `0x00516be0` only when the incoming site differs from the currently staged one. For incompatible tutorial steps it opens one callback-driven shell modal through `0x004c98a0` and returns `0`, which causes `train_route_list_insert_staged_entry_at_index` at `0x004b3160` to abort before the record is inserted. Current evidence is therefore tight enough to treat this as the tutorial-side train-route station-indicator validator rather than a general `TrainDetail.win` row-kind gate.","objdump + caller xrefs + callsite inspection + nearby-state inspection + RT3.lng strings + modal correlation"
0x00517ce0,9,indexed_collection_base_init_vtable_5d1aa0,simulation,thiscall,inferred,objdump + local disassembly + constructor correlation,3,"Tiny common base initializer for the shared indexed-collection family. The helper only installs base vtable `0x005d1aa0` at `[this+0x00]` and returns the same pointer, leaving the actual collection-shape metadata to the later constructor helper `0x00518570`. Current grounded callers are the world-load constructors across support, candidate, era, train, profile, and region families, where this is the common first step before each concrete collection installs its own vtable and layout tuple.","objdump + local disassembly + constructor correlation + collection-base correlation"
0x00517cf0,3,indexed_collection_slot_count,simulation,thiscall,inferred,objdump + caller inspection + collection-layout inspection,4,"Tiny shared accessor that returns the current slot-count field `[this+0x18]` from the common indexed-collection layout. Current grounded callers use it as the upper bound for zero-based slot walks before resolving one nth live entry id through `indexed_collection_get_nth_live_entry_id` `0x00518380`.","objdump + caller inspection + collection-layout inspection + slot-walk correlation"
0x00517d40,66,indexed_collection_entry_id_is_live,simulation,thiscall,inferred,objdump + caller inspection + collection-bitset inspection,4,"Shared indexed-collection presence test over the common collection layout that uses `[this+0x14]` as the upper id bound and `[this+0x34]` as the tombstone or disabled-bitset. The helper rejects nonpositive or out-of-range ids and otherwise returns `1` only when the bit for the requested id is clear, i.e. when the entry is currently live. Current grounded callers include `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0`, where it guards ordinary candidate ids before `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and neighboring collection walkers that treat the same ids as positive live-record selectors rather than zero-based dense ordinals.","objdump + caller inspection + collection-bitset inspection + callsite correlation"
0x00517d90,506,indexed_collection_serialize_header_and_live_entry_payload_band,simulation,thiscall,inferred,objdump + local disassembly + collection-layout inspection + caller correlation,4,"Shared indexed-collection save helper over the common collection layout. The serializer first writes the fixed scalar header dwords `[this+0x04/+0x08/+0x0c/+0x10/+0x14/+0x18/+0x1c]`, then four repeated auxiliary-band descriptors rooted at `[this+0x20..+0x2c]` with their paired dwords at `[this+0x48..+0x54]` and `[this+0x58..+0x64]`; when one auxiliary band is active after the first slot it also writes the corresponding `count*0x0c` payload table from `[band+0x18]`. It then writes the live/tombstone bitset from `[this+0x34]` as `ceil(([this+0x14]+8)/8)` bytes and walks every positive live entry id, skipping tombstoned rows through the same bitset. For direct collections with nonzero `[this+0x04]` it writes one fixed-stride record from `[this+0x30] + [this+0x08]*id`, optionally clamping to the caller-supplied byte limit and zero-filling the remainder of the stride. For indirect collections with zero `[this+0x04]` it instead writes one `u16` payload length plus the pointed variable-size payload for each live id. Current grounded callers are the tagged save owners across support, region, train, company, route-entry tracker, neighboring world families, and the early non-`.smp` package-save prelude on the two named-availability collections `[world+0x66b2]` and `[world+0x66b6]`, so this is the shared collection-header-and-live-entry serializer even for those named-availability saves rather than a helper limited to the larger tagged collection families.","objdump + local disassembly + collection-layout inspection + caller correlation + direct-vs-indirect payload correlation + save-helper correlation + named-availability caller correction"
0x00517f90,163,indexed_collection_grow_payload_bitset_and_auxiliary_link_bands_for_additional_ids,simulation,thiscall,inferred,objdump + local disassembly + constructor/load/add-entry correlation + collection-layout inspection,4,"Shared indexed-collection growth helper used by the constructor, load helper, and add-entry path. The helper expands the live-id bound from old `[this+0x14]` to the new requested total, reallocates the direct-or-indirect payload slab at `[this+0x30]` to `stride=[this+0x08] * new_bound` while copying old contents forward, reallocates the tombstone bitset at `[this+0x34]` to `ceil((new_bound+8)/8)` bytes while preserving old bytes and filling the newly added range with `0xff` so fresh ids start tombstoned, and then grows the three auxiliary link tables rooted at `[this+0x3c/+0x40/+0x44]` to the corresponding `id*3*4` byte bands while zero-filling each extension. It writes the new live-id bound back to `[this+0x14]` and resets the small cache band `[this+0x68..+0x74]` to `-0x10`. Current grounded callers are constructor helper `0x00518570`, load helper `0x00518680`, and the add-entry path `0x00518b90`, where this is the common grow-payload-bitset-and-aux-band owner rather than one family-specific allocator.","objdump + local disassembly + constructor/load/add-entry correlation + collection-layout inspection + reallocation correlation"
0x00518140,89,indexed_collection_resolve_live_entry_by_id,simulation,thiscall,inferred,objdump + caller inspection + collection-layout inspection,4,"Shared indexed-collection record resolver over the same common collection layout. The helper rejects nonpositive, out-of-range, or tombstoned ids through the `[this+0x14]` bound and `[this+0x34]` bitset, then returns one live record pointer from the payload rooted at `[this+0x30]`. When collection flag dword `[this+0x04]` is nonzero it treats that payload as a flat `stride=[this+0x08]` record array and returns `base + stride*id`; otherwise it treats the payload as an array of record pointers stored in `stride=[this+0x08]` slots and returns the pointer loaded from `base + stride*id`. Current grounded callers include the company, profile, train, and structure-candidate families, where it is the common bridge from one positive collection id to one concrete live record pointer.","objdump + caller inspection + collection-layout inspection + direct-vs-indirect payload correlation"
0x00518380,364,indexed_collection_get_nth_live_entry_id,simulation,thiscall,inferred,objdump + caller inspection + collection-layout inspection,4,"Shared nth-live-entry selector over the same indexed-collection layout. With traversal mode `0` it walks slot ids in forward order, skipping tombstoned ids through the bitset at `[this+0x34]`, and returns the positive entry id whose zero-based live ordinal matches the caller-supplied index; recent results are memoized in the small cache bands rooted at `[this+0x68]` and `[this+0x78]`. With nonzero traversal mode it reuses the auxiliary link banks rooted at `[this+0x38]`, `[this+0x48]`, and `[this+0x58]` to step through one alternate live-order chain before returning the resulting id. Current grounded callers across company, profile, structure-candidate, and placed-structure families mostly use traversal mode `0`, where this is the shared bridge from one zero-based live ordinal to one positive collection entry id.","objdump + caller inspection + collection-layout inspection + cache-band inspection + alternate-chain correlation"
0x00518570,138,indexed_collection_construct_seed_record_layout_slot_bounds_and_aux_band_tuple,simulation,thiscall,inferred,objdump + local disassembly + constructor correlation + collection-layout inspection,4,"Shared indexed-collection constructor helper above the base init at `0x00517ce0`. The helper stores the caller-supplied fixed-record flag at `[this+0x04]`, the primary slot stride or record size at `[this+0x08]` (forcing that field to `6` when the incoming flag is zero), the growth tuple at `[this+0x0c/+0x10]`, clears live-count `[this+0x14]`, slot-count `[this+0x18]`, allocator root `[this+0x1c]`, payload root `[this+0x30]`, and tombstone bitset `[this+0x34]`, seeds the four auxiliary-band roots `[this+0x20..+0x2c]` and their paired descriptor dwords `[this+0x48..+0x64]` from the last three caller-supplied arguments plus zeroed defaults, forces `[this+0x20] = 1`, seeds the small live-id cache bands `[this+0x68..+0x74]` to `-0x10`, and then re-enters `0x00517f90` to allocate the initial slot, bitset, and payload backing for the requested starting capacity in `[this+0x0c]`. Current grounded callers are the concrete collection constructors across support, candidate, era, region, profile, train, and multiplayer fixed-record families, where the tuple literals now explain why some file-side save headers look collection-shaped even when a given runtime save path later bypasses the shared serializer family.","objdump + local disassembly + constructor correlation + collection-layout inspection + allocation-followon correlation"
0x00518680,625,indexed_collection_refresh_header_auxiliary_bands_and_live_entry_payloads_from_stream,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + collection-layout inspection,4,"Shared indexed-collection load helper paired with serializer `0x00517d90`. The helper first invokes collection vtable slot `+0x00`, then reads the fixed scalar header dwords back into `[this+0x04/+0x08/+0x0c/+0x10]`, one temporary live-id bound later copied into `[this+0x14]`, current slot-count `[this+0x18]`, allocator root `[this+0x1c]`, the four auxiliary-band roots `[this+0x20..+0x2c]`, and their paired descriptor dwords `[this+0x48..+0x64]`. When the incoming live-id bound exceeds current `[this+0x14]` it re-enters `0x00517f90` to grow the payload and tombstone backing first. It then reloads the tombstone bitset at `[this+0x34]` and walks every positive id below `[this+0x14]`, zero-filling tombstoned rows while rehydrating live payloads either as direct fixed-stride records in `[this+0x30]` when `[this+0x04]` is nonzero or as indirect `u16`-length-plus-pointer payload rows when `[this+0x04]` is zero. The same loop also replays the nonzero auxiliary-band rows through `0x00518260` and refreshes the small live-id cache band `[this+0x68..+0x74]` back to `-0x10`. Current grounded callers are the tagged and packed-state load owners across support, company, train, route-entry, placed-structure, region, event, and city-database families, where this is the shared collection-header-and-live-entry refresh helper rather than one family-specific loader.","objdump + local disassembly + caller correlation + collection-layout inspection + direct-vs-indirect payload correlation + load-helper correlation"
0x0051c920,223,localization_lookup_display_label_by_stem_or_fallback,shell,thiscall,inferred,objdump + caller inspection + language-table correlation + static-table inspection,4,"Shared shell-side label helper that turns one ASCII stem string into one player-facing display label. The helper case-folds the first letter, scans the static `(stem, string-id)` table rooted at `0x006243c8`, compares candidate stems case-insensitively, and returns the localized text for the first matching string id through `0x005193f0` when that localized entry is nonempty. The current table correlation already grounds entries such as `Alcohol`, `Aluminum Mill`, `Automobiles`, `Bauxite`, and `Big Boy` against RT3.lng ids `3202..3220`. When no table entry matches, the helper falls back to localized id `3866` `Could not find a translation table entry for '%1'`. Current grounded callers include `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0`, where it sits directly above candidate field `[record+0x04]`, and several neighboring list and detail renderers that need one display label from the same stem family.","objdump + caller inspection + language-table correlation + static-table inspection + RT3.lng correlation"
0x0051d390,37,calendar_pack_unpacked_components_to_absolute_counter,support,fastcall,inferred,objdump + local arithmetic correlation + restore-path correlation,3,"Tiny calendar helper that converts one unpacked component set into the same mixed-radix absolute counter family later stored at `[world+0x15]`. It combines the fastcall component pair in `ECX/EDX` plus three stack-supplied scalar subfields as one `12 x 28 x 3 x 60` progression and returns the resulting absolute counter. Current grounded load or restore-side caller correlation comes from the selected-year rehydrate path in `world_load_saved_runtime_state_bundle` `0x00446d40`, where the helper is used after the mode-sensitive year adjustment to rebuild the final absolute counter from the staged calendar components before `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` republishes the derived tuple fields.","objdump + local arithmetic correlation + restore-path correlation + mixed-radix decode"
0x0051d3c0,44,calendar_point_pack_tuple_to_absolute_counter,support,fastcall,inferred,objdump + caller inspection + local arithmetic correlation,3,"Tiny packed-calendar helper that converts one local tuple rooted at the caller pointer in `ECX` into the same absolute calendar counter family later stored at `[world+0x15]`. It reads one year word plus four packed calendar subfields from `[tuple+0x00/+0x02/+0x04/+0x05/+0x06]`, combines them as one mixed-radix `12 x 28 x 3 x 60` progression, and returns the resulting scalar for direct subtraction against `[0x006cec78+0x15]`. That is now the strongest current read for the world-side calendar model: a packed year-plus-subfield point converted into one absolute counter rather than a plain year or month stamp. Current grounded finance caller is the stock-issue cooldown gate inside `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`, where it converts the current issue tuple at `[company+0x16b/+0x16f]` before comparing that scalar against the active world counter.","objdump + caller inspection + local arithmetic correlation + finance-cooldown correlation + world-calendar-counter correlation + mixed-radix decode"
0x0051d3f0,103,calendar_pack_year_and_component_bytes_to_packed_tuple_dwords,support,cdecl,inferred,objdump + local arithmetic correlation + restore-path correlation,3,"Packs one explicit year-plus-component set into the broader world-calendar tuple format. The helper writes the caller-supplied year word and input bytes into the tuple root on the stack, derives the companion mixed-radix byte fields used by `calendar_point_pack_tuple_to_absolute_counter` `0x0051d3c0`, and returns the resulting packed tuple dwords in `EAX:EDX`. Current grounded load or restore-side caller correlation comes from `world_load_saved_runtime_state_bundle` `0x00446d40` and the shared scenario reset owner `0x00436d10`, where the raw selected-year lane `[profile+0x77]` is first expanded through this helper with Jan-1-style constants before later adjustment and republish through `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`.","objdump + local arithmetic correlation + restore-path correlation + packed-tuple correlation"
0x0051d460,131,calendar_point_unpack_absolute_counter_to_tuple,support,fastcall,inferred,objdump + caller inspection + local arithmetic correlation,3,"Inverse packed-calendar helper for the absolute counter family rooted at `[world+0x15]`. It accepts one absolute calendar counter in `ECX`, decomposes it back into the same mixed-radix year-plus-subfield tuple, and returns the reconstructed pair of dwords in `EAX:EDX` for storage into fields such as `[world+0x0d]` and `[world+0x11]`. Current local arithmetic now bounds the inverse against the same `12 x 28 x 3 x 60` model as `0x0051d3c0`, which keeps this tuple in the world-side calendar-point family rather than as an unrelated packed timestamp. Current grounded callers are `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, which refreshes `[world+0x0d/+0x11]` from the selected absolute counter at `[world+0x15]`, plus the target-resolution wrappers `0x0051d550` and `0x0051d5f0` used by `simulation_advance_to_target_calendar_point` `0x0040ab50`.","objdump + caller inspection + local arithmetic correlation + world-calendar-tuple correlation + target-resolution correlation + mixed-radix decode"
0x004f2e80,14,shell_has_live_overview_window,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Tiny presence probe for the shell-side `Overview.win` singleton rooted at `0x006d12bc`. The helper returns `1` when that live overview object pointer is nonnull and `0` otherwise. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside other shell-window probes, and the overview family itself around `0x004f3a10`, which uses the same singleton to suppress duplicate opens.","objdump + caller inspection + nearby-family correlation + singleton correlation"
0x004f2e90,11,shell_mark_overview_window_dirty,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Tiny dirty-latch setter paired with `shell_has_live_overview_window`. The helper stores `1` into `0x006d12cc`, which current nearby call patterns treat as the `Overview.win` refresh or service request latch once the live overview singleton at `0x006d12bc` exists. Current grounded caller is the same post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + caller inspection + nearby-family correlation + singleton correlation"
0x004f38a0,67,shell_overview_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Constructs the shell-side `Overview.win` object later published at `0x006d12bc`. The constructor seeds the local vtable at `0x005d1368`, binds the shell window resource through `0x0053fa50`, clears the selected subject field at `[this+0x7c]`, and installs the shared control callback `0x004f3880` on control `0x88bf`. Current grounded caller is `shell_open_or_focus_overview_window` at `0x004f3a10`, and current string-table correlation leaves `Overview.win` as the strongest owner name for this singleton family.","objdump + caller inspection + strings correlation + singleton correlation"
0x004f38f0,562,shell_overview_window_handle_message,shell,thiscall,inferred,objdump + caller inspection + control-flow inspection,4,"Primary message dispatcher for the shell-side `Overview.win` family rooted at `0x006d12bc`. The handler processes the usual shell message ids `0`, `0xca`, and `0xcb`; uses the current subject object at `[this+0x78]`; opens follow-on detail lanes through `0x004f2ea0`; and raises simple shell modals through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` when the requested drill-down path is currently invalid. It also consumes the family dirty latch at `0x006d12cc` on the recurring service path. Current grounded caller is the shell runtime after construction through `shell_open_or_focus_overview_window`.","objdump + caller inspection + control-flow inspection + dirty-latch correlation"
0x004f3a10,272,shell_open_or_focus_overview_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Shared opener for the shell-side `Overview.win` singleton. When a valid overview subject exists under the live world-side owner at `0x006cea4c` and no current overview window is open, the helper allocates an `0x80`-byte shell object, constructs it through `shell_overview_window_construct` at `0x004f38a0`, publishes it through the shell runtime at `0x006d401c`, and stages the selected subject pointer into the live singleton at `0x006d12bc` before routing it into the family message path at `0x004f2ea0`. When an overview window already exists it leaves the current singleton in place. Current grounded callers include the world-side action branches at `0x004396ae` and `0x004414c6`, both of which pass one subject object resolved from `0x006cea4c` before opening the overview path.","objdump + caller inspection + strings correlation + singleton correlation + publish-path inspection"
0x004b99c0,88,structure_candidate_collection_get_nth_active_candidate_id,map,cdecl,inferred,objdump + caller inspection + collection iteration,4,"Returns the zero-based nth active candidate id from the structure-candidate collection at `0x0062ba8c`. The helper iterates the collection through `0x517cf0` and `0x518380`, skips candidates whose active byte in the returned record is clear, decrements the caller-supplied ordinal only across the surviving entries, and finally returns the matching candidate id or `0` when the requested active slot does not exist. Current grounded callers are the shell-side building-detail branches at `0x004ba01f`, `0x004bbcfd`, and `0x004bbd56`, where ordinals `page-3` are translated back into live candidate ids before the selected-building service and capability rows are refreshed.","objdump + caller inspection + collection iteration + active-candidate correlation"
0x004b9a20,833,shell_building_detail_refresh_flagged_service_capability_rows,shell,thiscall,inferred,objdump + caller inspection + control-range inspection,3,"Shared `BuildingDetail.win` refresh helper for the flagged service or capability row bands driven from the currently selected building subject at `0x006cfe04`. The helper repeatedly restyles controls in the `0x7d07..0x7d1c` range through `0x540120`, using route-entry flag byte `+0x28` from the selected building subject as the decision source. Current local control correlation now bounds that mask family more tightly than a generic bit consumer: `0x7d07/0x7d08` split the zero-versus-nonzero `0x30` mask, `0x7d11/0x7d12` split the bit-`0x20`-only case, `0x7d13/0x7d14` split the exclusive-or `0x20^0x10` case, `0x7d17/0x7d1a` track bit `0x20`, `0x7d18/0x7d1b` track bit-`0x10`-only, and `0x7d19/0x7d1c` track the combined `0x30` case. The important boundary is now explicit too: these rows are style-only indicator controls in current disassembly, not text-publishing lanes with a missing caption lookup. The later repeated row family rooted at `0x7f58..0x801f` also consults bit `0x40` together with the currently selected candidate or service id in subject field `+0x24`, but current evidence now narrows that lane too: it is a selected-ordinal highlight band rather than a generic restyle loop. The special express-side triplet at `0x7f58..0x7f5a` is the fixed table-driven branch; after that the helper falls through into the ordinary active-candidate/service rows. When the selected id is below `0x384`, the helper translates it through `structure_candidate_collection_get_nth_active_candidate_id` at `0x004b99c0` and highlights ordinal `3 + active-candidate-rank` for the current subject id; otherwise it treats `0x384..` as the parallel express-side family directly. Current grounded callers include the broader building-detail refresh path at `0x004bae97`, the constructor-adjacent refreshes at `0x004bbcf3` and `0x004bbd0d`, and neighboring handler branches at `0x004bb8e3`, `0x004bbe5c`, and `0x004bc039`. Current evidence is therefore strong enough to treat this as the shared shell-side consumer of route-entry subflags `0x10`, `0x20`, and `0x40`, with the player-facing text side already grounded separately on the `0x7f58..0x7f5a` express triplet and the `Dining Car`/`Caboose` rows.","objdump + caller inspection + control-range inspection + route-entry flag correlation + active-candidate correlation + control-family triplet correlation + row-mask partition correlation + selected-ordinal highlight correlation + style-only-boundary correlation"
0x004ba3d0,2380,shell_building_detail_refresh_subject_cargo_and_service_rows,shell,thiscall,inferred,objdump + caller inspection + strings correlation,3,"Large `BuildingDetail.win` refresh helper for the selected subject row families centered on controls `0x7d06`, `0x7d96..`, `0x7d0e`, and the adjacent `0x7d6a/0x7d6b` and `0x7d9d` visual lanes. The helper walks the selected building subject at `0x006cfe04`, iterates the per-subject id list rooted at `[subject+0x01]`, validates ordinary ids through the structure-candidate collection at `0x0062ba8c` with `indexed_collection_entry_id_is_live` `0x00517d40`, resolves them into concrete live candidate records through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and then uses candidate field `[record+0x04]` as the shared stem for both the ordinary row asset path `%s.imb` and the neighboring display-label lookup through `localization_lookup_display_label_by_stem_or_fallback` `0x0051c920`. Only when that ordinary candidate branch fails does it fall back to the fixed express-side special ids `0x384..0x386`. Current table correlation now bounds that fixed branch more sharply: `0x00621df8` seeds the short-label controls `0x7dc8..0x7dca` with localized ids `494..496` `Any Cargo`, `Any Freight`, and `Any Express`, while `0x00621e10` seeds the adjacent asset-name controls `0x7e90..0x7e92` with `AnyCargo`, `AnyFreight`, and `PassMail` before `%1.imb` formatting. The helper also uses `Cargo.imb`, `Caboose.imb`, and the adjacent asset string `Dining.imb` while rebuilding the visible row payloads; current RT3.lng alignment now ties the longer descriptive popup/help side to `497/498` for freight/express and the two special service rows to localized labels `911` `Dining Car` and `912` `Caboose`. One resource-side boundary is tighter now too: the extracted `BuildingDetail.win` blob currently exposes only a sparse embedded text table with the help line `0xbb8`, the asset-name string `0xbb9`, and one standalone caption entry `0xbba` `Cargo`, which is the strongest current resource-side anchor for the row header around `0x7d06` and simultaneously reinforces that the deeper ordinary rows are being labeled from live candidate-record stems rather than from a larger hidden caption table. Current subflag correlation is tighter too: the extra visual lanes `0x7d6a`, `0x7d6b`, and `0x7d9d` are driven from the same selected-subject flag byte at `+0x28`, with `0x7d9d` on the bit-`0x20` branch using `Caboose.imb` and the sibling bit-`0x10` special lane using `Dining.imb`. The helper then re-enters both `shell_building_detail_refresh_subject_pair_value_rows` at `0x004bad20` and the flagged-row helper `shell_building_detail_refresh_flagged_service_capability_rows` at `0x004b9a20`. Current grounded callers include the main building-detail refresh at `0x004baedd`, constructor-adjacent and handler-side refreshes at `0x004bb8dc`, `0x004bbc89`, `0x004bbd6a`, and `0x004bc02b`. Current evidence is therefore strong enough to treat this as the selected-building cargo or service row owner even though several ordinary candidate-row captions remain unrecovered.","objdump + caller inspection + strings correlation + control-range inspection + candidate-id correlation + collection-helper correlation + stem-label correlation + subflag-row correlation + asset-string block correlation + RT3.lng correlation + table-entry correlation + win-resource extraction"
0x004ba270,311,shell_building_detail_handle_subject_value_row_band_action,shell,cdecl,inferred,objdump + callsite inspection + local disassembly,3,"Small `BuildingDetail.win` row-band action callback over the control-id family `0x7d07..0x7d14`. The helper switches on the clicked control id minus `0x7d07`, updates the selected building subject rooted at `0x006cfe04`, and treats subject bytes `+0x21`, `+0x22`, and `+0x23` as one current selection plus one bounded low/high pair. On change it increments the family dirty latch at `0x006cfe0c`, writes the refreshed current or bound value back through the shared shell control helper on code `0x66`, and when the side list helper at `0x006cfe08` is active it re-enters the neighboring follow-up refresh path at `0x004b9ec0`. Current direct installation site is the `0x7d0e` widget branch inside `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004bacc9`, which keeps this bounded as the live action owner for the paired value rows rather than another passive formatter.","objdump + callsite inspection + local disassembly + selected-subject field correlation"
0x004bad20,461,shell_building_detail_refresh_subject_pair_value_rows,shell,thiscall,inferred,objdump + caller inspection + control-range inspection,3,"Shared `BuildingDetail.win` helper for the mutually exclusive subject-value row pairs around controls `0x7d05..0x7d14`. The helper first styles the leading pair `0x7d05/0x7d06`, then chooses between the value-row pairs `0x7d07/0x7d08`, `0x7d11/0x7d12`, and `0x7d13/0x7d14` from the selected building subject at `0x006cfe04`, using the same flag byte at `+0x28` that drives the neighboring cargo or service rows. On the nonzero selector branch it instead refreshes the current-selection status around `0x7d0d/0x7d0e` from the subject count byte and the subject field at `+0x21`, then tails back into `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004ba3d0`. Current payload values for the mutually exclusive pairs come from subject fields `+0x22` and `+0x23`, and current grounded caller correlation keeps this bounded as one shared pair-value row owner rather than a separate top-level widget family.","objdump + caller inspection + control-range inspection + subject-field correlation + flag-branch correlation"
0x004b9d70,14,shell_has_live_building_detail_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Tiny presence probe for the shell-side `BuildingDetail.win` singleton rooted at `0x006cfe00`. The helper returns `1` when that live detail object pointer is nonnull and `0` otherwise. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside the sibling overview, load-screen, settings, custom-modal, and file-options probes.","objdump + caller inspection + strings correlation + singleton correlation"
0x004b9d80,11,shell_mark_building_detail_window_dirty,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Tiny dirty-latch setter paired with `shell_has_live_building_detail_window`. The helper stores `1` into `0x006cfe10`, which current nearby call patterns treat as the `BuildingDetail.win` refresh or service request latch once the live singleton at `0x006cfe00` exists. Current grounded caller is the same post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + caller inspection + nearby-family correlation + singleton correlation"
0x004b9e10,166,shell_building_detail_submit_aux_owner_subject_sync_request,shell,cdecl,inferred,objdump + caller inspection + state-block inspection,3,"Small side-owner sync helper for `BuildingDetail.win`. When the auxiliary owner at `0x006cd8d8` is present and the local dirty counter `0x006cfe0c` is nonzero, the helper allocates a `0x3f`-byte request block, stamps a small header through `0x005216c0` and `0x00513130`, stores one mirrored-subject mode bit in request word `+0x08`, stores the current building-detail ordinal from `0x00621df4`, then copies the full staged building subject record from `0x006cfe04` into the request body before queueing it through `0x00469d30` on the owner-local request list at `[0x006cd8d8+0x8f48]`. Current direct callers are the `0x7d01` and `0x7d09/0x7d0a` branches inside `shell_building_detail_window_handle_message` `0x004bb9e0`, and both now clearly source that mode bit from the side-list mirror latch at `[0x006cfe08+0x0c]`, which keeps this bounded as an auxiliary-owner subject-sync path that preserves local mirror-state rather than a generic widget refresh. The helper also currently suppresses submission when the neighboring live-flag dword at `0x006d3ae4` is nonzero.","objdump + caller inspection + state-block inspection + side-owner queue correlation + mirror-latch correlation"
0x004b9ec0,272,shell_building_detail_propagate_selected_subject_state_into_side_list,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Shared follow-up helper for `BuildingDetail.win` when the sibling side-list owner at `0x006cfe08` is active and its mirror latch at `+0x0c` is nonzero. The helper walks every indexed side-list subject through `0x004b2b60`, copies the currently selected subject state from `0x006cfe04` into each sibling record, mirrors the current service or capability id at `[subject+0x24]`, and propagates the mutable subflag family in byte `+0x28` with bits `0x40`, `0x20`, and `0x10` preserved from the active subject. It also copies the current-selection fields `+0x21/+0x22/+0x23` and the live id list rooted at `+0x01`, which is why the paired value-row action helper at `0x004ba270` and several handler-side selector branches re-enter this path after mutating the active subject. Current grounded callers are `shell_building_detail_handle_subject_value_row_band_action` at `0x004ba270` and the handler-side refresh branches at `0x004bbc9d`, `0x004bbd81`, and `0x004bbe55`.","objdump + caller inspection + local disassembly + selected-subject field correlation + side-list iteration correlation + mirror-latch correlation"
0x004b9fd0,672,shell_building_detail_present_flagged_service_capability_popup,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Popup callback installed on the larger `BuildingDetail.win` flagged-row band. The helper takes one clicked control id in the `0x7f58..0x801f` family, resolves either one fixed express-side descriptor from table `0x00621e04` for the first three rows or one active candidate/service id from the selected subject at `0x006cfe04+0x24`, and then formats an explanatory shell popup before returning through `0x538c70`. Current table correlation now closes that first triplet more cleanly: `0x00621e04` supplies localized ids `494`, `497`, and `498`, so the fixed popup/help branch is specifically `Any Cargo`, `Any Freight\\n(Freight is everything but Passengers, Mail, and Troops)`, and `Any Express\\n(Express is Passengers, Mail, and Troops)` for controls `0x7f58..0x7f5a`. Current language-table correlation also tightens the ordinary popup split: one single-line availability popup uses localized id `3922` `%1\\nLoads available at %2: %3`, while the ordinary candidate branch uses localized id `2981` `%1\\nLoads available at %2: %3 Current Price: %4` and can append localized id `2982` `Price at next station, %1: %2 (%3%4)`. On that ordinary branch it resolves the current candidate through `structure_candidate_collection_get_nth_active_candidate_id` at `0x004b99c0`, compares the selected site against the current subject site at `+0x29`, queries local service metrics through `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`, and conditionally computes the nearby-site delta line before presenting the final text. Current direct installation sites are the callback-registration branches at `0x004bb43f` and `0x004bb8a6`, which keeps this bounded as the live explanatory popup owner for the `0x7f58..0x801f` selector rows rather than another passive formatter.","objdump + caller inspection + local disassembly + callback-registration correlation + popup-path correlation + candidate-metric correlation + RT3.lng correlation + table-entry correlation"
0x004bb9e0,2183,shell_building_detail_window_handle_message,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Primary message dispatcher for the shell-side `BuildingDetail.win` family rooted at `0x006cfe00`. The handler switches over shell messages `0`, `0xca`, and `0xcb`; updates the staged building subject in `0x006cfe04` and its list helper at `0x006cfe08`; refreshes the visible control ranges `0x7d..0x8051`; and consumes the dirty latch at `0x006cfe10` on the recurring service path. Its action cases are now tighter than a generic navigation bucket. The `0x7d01` branch is no longer just an isolated oddball either: extracted `BuildingDetail.win` text now makes `Set the initial cargo amount for 'Disable Cargo Economy' scenarios.` the strongest current caption candidate for that control, the message path can mirror that action through `shell_building_detail_submit_aux_owner_subject_sync_request` `0x004b9e10` when `shell_has_auxiliary_preview_owner` `0x00434050` reports the side owner live, and one later rejection path now clearly raises localized id `3587` `This option is only available by following the tutorial.` behind the active tutorial flag at `0x006d3b4c` plus the cached previous expected-control id at `0x00622b38`. The `0x7d02/0x7d03` pair flips selected-subject bit `0x40` and re-enters `shell_building_detail_refresh_subject_pair_value_rows` `0x004bad20`, which makes that pair the real top-level mode switch between the bounded pair-value branch and the current-selection/status branch around `0x7d0d/0x7d0e`. The `0x7d09/0x7d0a` pair steps neighboring building subjects through `0x004b2b60`, skipping disallowed subjects on the local iteration path, and the same branch can also mirror the new selected subject through `0x004b9e10` when that auxiliary owner is present. The `0x7d0f/0x7d10` pair flips selected-subject bits `0x20` and `0x10`, i.e. the same special-service subflags later rendered as `Caboose` and `Dining Car`, and then re-clamps the paired value widgets through the same shared refresh path. The `0x7f58..0x801f` selector band changes the current service or capability id at `[subject+0x24]` before re-entering `shell_building_detail_refresh_flagged_service_capability_rows` `0x004b9a20`; current refresh-side correlation now shows that band as one selected-ordinal picker over three fixed express rows plus the ordinary active-candidate rows rather than an undifferentiated list. The `0x8020..0x8051` action band is now tighter too: it is primarily a per-row removal family over the selected subject's live id list rooted at `+0x01`, zeroing one indexed entry, compacting the remaining dword ids, decrementing count byte `+0x00`, clamping the current-selection byte `+0x21`, and then refreshing the visible row bands. Two special row indices inside that same band re-route into the adjacent `0x7d0f/0x7d10` subflag-clearing path instead of ordinary list compaction when the current `0x20/0x10` service-bit state requires it. The handler can also open simple shell modals through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` when one building-side action is disallowed. Current grounded callers are the shell runtime after construction and the explicit dirty-latch service path.","objdump + caller inspection + strings correlation + control-range inspection + dirty-latch correlation + selected-subject mutation correlation + RT3.lng correlation + selected-ordinal correlation + remove-entry compaction correlation + auxiliary-owner sync correlation + tutorial-rejection correlation + expected-control-cache correlation"
0x004baef0,2793,shell_building_detail_window_refresh_controls,shell,thiscall,inferred,objdump + caller inspection + control-range inspection,4,"Primary refresh path for the shell-side `BuildingDetail.win` family. The helper rebuilds the top-level control bands under `0x7d02..0x8051`, including the paired mode switch `0x7d02/0x7d03` from subject flag `0x40`, the smaller special-service toggles `0x7d0f/0x7d10` from subject bits `0x20` and `0x10`, the current-selection status widget around `0x7d0d/0x7d0e`, the selected-building cargo or service rows through `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004ba3d0`, the paired subject-value rows through `shell_building_detail_refresh_subject_pair_value_rows` at `0x004bad20`, and the flagged service or capability rows through `shell_building_detail_refresh_flagged_service_capability_rows` at `0x004b9a20`. Current control-building correlation now makes the leading special-row bands explicit too: the short-label triplet `0x7dc8..0x7dca`, its adjacent asset/icon triplet `0x7e90..0x7e92`, and the popup/selectable triplet `0x7f58..0x7f5a` are the fixed express-side branch before the broader ordinary candidate rows. Current branch structure is tighter too: when subject bit `0x40` is set the refresh ends on the selected-subject cargo/service family rooted at `0x004ba3d0`, while the clear branch instead ends on the flagged capability-selector family rooted at `0x004b9a20`. It also hides or shows the larger control ranges `0x7dc8..0x7f57`, `0x7f58..0x801f`, and `0x8020..0x8051` through the shared shell control toggles at `0x53fe00`. Current grounded callers are the main constructor-side and focus refreshes at `0x004bbace`, `0x004bc0cc`, and `0x004bc0de`, and the message dispatcher at `0x004bb9e0`.","objdump + caller inspection + control-range inspection + subject-flag correlation + helper-family correlation + branch-end correlation + control-family triplet correlation"
0x004bc0a0,71,shell_building_detail_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Constructs the shell-side `BuildingDetail.win` object later published at `0x006cfe00`. The constructor seeds the local vtable at `0x005d05e0`, binds the window resource through `0x0053fa50`, and immediately refreshes the visible subject and control bands through `0x004baef0`. Current grounded caller is `shell_open_or_focus_building_detail_window` at `0x004bc100`, and current string-table correlation leaves `BuildingDetail.win` as the strongest owner name for this singleton family.","objdump + caller inspection + strings correlation + singleton correlation"
0x004bc100,203,shell_open_or_focus_building_detail_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Shared opener for the shell-side `BuildingDetail.win` singleton. The caller supplies the building-detail list helper in `ECX`, one current building subject in `EDX`, and one selected ordinal on the stack. The helper seeds the shared family globals at `0x006cfe04`, `0x006cfe08`, and `0x00621df4`, validates that the supplied building subject resolves to one live world object through the placed-structure collection at `0x006cec20`, allocates a `0x78`-byte shell object when no detail window is live, constructs it through `shell_building_detail_window_construct` at `0x004bc0a0`, publishes it through the shell runtime at `0x006d401c`, and tears it back down on return while clearing `0x006cfe00`. Current grounded callers include the world-side branch around `0x004bbace`, which updates the current building subject before opening this detail family. Current string-table correlation leaves `BuildingDetail.win` as the strongest owner name for this singleton family.","objdump + caller inspection + strings correlation + publish-path inspection + singleton correlation"
0x004bcdd0,352,shell_change_trees_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `ChangeTrees.win` tool window. The constructor installs vtable `0x005d06bc`, binds `ChangeTrees.win` through `0x0053fa50`, seeds the current ordinal and paired scalar lanes from globals `0x00621ec0..0x00621ec8`, formats the visible scalar caption through `0x0051f070` and `0x00527de0`, copies one localized six-row label table from `0x005ef3ec`, stores the live singleton at `0x006cfe18`, and then refreshes the visible selection band through `0x004bccd0`. Current grounded caller is the detail-panel manager branch at `0x004ddf32`, which keeps this on the shell tool-window side rather than the larger company- or station-detail lanes.","objdump + strings + detail-manager correlation + control-table correlation + singleton correlation"
0x004bcc20,50,shell_change_trees_window_select_scalar_and_refresh_caption,shell,thiscall,inferred,objdump + message-owner inspection + caption-table correlation,4,"Small `ChangeTrees.win` setter for the scalar selection lane. The helper stores the requested scalar ordinal in `[this+0x78]`, looks up one float caption value through table `0x00621ecc`, converts that value into shell text through `0x0051f070` and `0x00527de0` on presenter `0x006d4024`, and returns without touching the broader row bands. Current grounded caller is the message owner `0x004bcf30`, where controls `0x1389..0x138f` forward through this helper before the wider control refresh runs.","objdump + message-owner inspection + caption-table correlation + shell-presenter correlation"
0x004bcc60,80,shell_change_trees_window_select_four_state_mode_and_publish_group_event,shell,thiscall,inferred,objdump + message-owner inspection + shell-presenter correlation,4,"Small `ChangeTrees.win` mode selector beneath the broader control refresh. The helper stores the requested `0..3` value in `[this+0x84]` and then publishes one grouped selector event through `0x0053f000` on presenter `0x00ccbb20`: mode `0` maps to event `0x16`, mode `1` maps to `0x07`, mode `2` maps to `0x01`, and mode `3` currently falls through without publishing an event. Current grounded callers are the constructor `0x004bcdd0` and the message owner `0x004bcf30`, which keeps this as a shell-side mode-group selector rather than a world brush mutation path.","objdump + message-owner inspection + shell-presenter correlation + constructor correlation"
0x004bccd0,250,shell_change_trees_window_refresh_control_bands,shell,thiscall,inferred,objdump + constructor correlation + message-owner inspection,4,"Refreshes the visible row bands for the shell-side `ChangeTrees.win` family. The helper walks five grouped control strips and republishes them through `0x00540120` with the standard selected-vs-unselected style split `0x87/0x65`: the scalar strip `0x1389..0x138f` from `[this+0x78]`, the sibling strip `0x13ed..0x13f3` from `[this+0x80]`, the third strip `0x1451..0x1457` from `[this+0x7c]`, the four-state strip `0x14b5..0x14b8` from `[this+0x84]`, and the larger localized row band `0x139c..0x13b7` from `[this+0x8c]`. Current grounded callers are the constructor `0x004bcdd0` and the message owner `0x004bcf30`, which makes this the current owner-side refresh pass for `ChangeTrees.win` rather than one generic tree-paint helper.","objdump + constructor correlation + message-owner inspection + control-band correlation"
0x004bcf30,924,shell_change_trees_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary message dispatcher for the shell-side `ChangeTrees.win` tool window. Under message `0xc8`, controls `0x1389..0x138f` update the scalar lane through `shell_change_trees_window_select_scalar_and_refresh_caption` `0x004bcc20`, controls `0x13ed..0x13f3` update `[this+0x80]` and global `0x00621ec4`, controls `0x1451..0x1457` update the paired row lane through `0x004bcc60` and global `0x006cfe1c`, and controls `0x139c..0x13b7` update the larger localized row-band selection in `[this+0x8c]` and `0x006cfe20`; each of those branches re-enters `shell_change_trees_window_refresh_control_bands` `0x004bccd0`. Control `0x07d6` owns the shared world-surface latch `[this+0x88]`: it arms the latch after the standard hit-test gate `0x00448ac0`, snapshots anchor coords in `[this+0x90/+0x94]`, and then enters the broader brush-distance/math branch rooted at `0x004bd083`. Current grounded owner correlation is the constructor `0x004bcdd0` and the live shell message flow, which keeps this on the `ChangeTrees.win` tool-window side of the shared world-surface family rather than a generic terrain-detail page.","objdump + constructor correlation + caller inspection + world-surface latch correlation + control-band correlation"
0x004bc210,67,shell_world_surface_brush_set_selected_ordinal_and_refresh_scalar_caption,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small setter beneath the shell world-surface brush family. The helper stores the caller-selected ordinal into `[this+0x78]`, resolves the corresponding dword from table `0x00621e24`, converts that value into a float caption through `0x0051f070` and `0x00527de0` under shell owner `0x006d4024`, and returns. Current grounded caller is the `0x0fa0..0x0fa7` ordinal-strip branch inside `shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf` `0x004bc350`, so this is the safest current read for the selected-ordinal setter plus scalar-caption refresh rather than a generic text helper.","objdump + caller inspection + local disassembly + ordinal-strip correlation + scalar-caption correlation"
0x004bc260,43,shell_world_surface_brush_query_cached_world_coords_and_selected_scalar,shell,thiscall,inferred,objdump + local disassembly + field correlation,2,"Tiny cached-parameter getter beneath the same shell world-surface brush family. The helper copies cached world coordinates `[this+0x80]` and `[this+0x84]` into the two caller out-pointers and returns the current selected scalar from table `0x00621e24[ordinal]`, where the ordinal is stored at `[this+0x78]`, through the third out-pointer. Current local field correlation keeps this bounded as the brush-family cached-parameter query rather than a generic subject getter.","objdump + local disassembly + field correlation + ordinal-table correlation"
0x004bc290,192,shell_world_surface_brush_refresh_ordinal_and_mode_button_rows,shell,thiscall,inferred,objdump + caller inspection + control-family correlation,3,"Shared control refresh helper for the shell world-surface brush family. The first loop restyles the ordinal strip `0x0fa1..0x0fa7` through `0x00540120`, highlighting the current selected ordinal at `[this+0x78]`. The second loop restyles the mode strip `0x0faa..0x0faf` by mapping the current mode dword `[0x006d0818+0x8c]` from `0x0e..0x13` into local indices `0..5` and highlighting the matching button through the same shell control helper. Current grounded callers are the ordinal-strip branch at `0x004bc3fc` and the mode-change path beneath `shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf` `0x004bc350`, so this is the safest current read for the ordinal and mode button-row refresh owner rather than a generic widget restyler.","objdump + caller inspection + control-family correlation + ordinal-mode-strip correlation"
0x004bc350,1496,shell_world_surface_brush_handle_message_for_control_0x07d6_and_mode_family_0x0fa0_0x0faf,shell,thiscall,inferred,objdump + local disassembly + control-family correlation,3,"Shell-side message owner for one world-surface brush family whose current grounded controls are the shared main-world surface `0x07d6`, the ordinal strip `0x0fa0..0x0fa7`, and the mode buttons `0x0faa..0x0faf`. The `0x07d6` branch first resolves world coordinates through `0x00448ac0`, latches drag-active byte `[this+0x7c]`, stores the accepted world coordinate pair into `[this+0x80/+0x84]`, and caches the incoming scalar at `[this+0x88]`. When that latch is active, the helper dispatches the current mode dword `[0x006d0818+0x8c]` across six grounded edit branches: mode `0x0e` and `0x13` re-enter `world_raise_companion_float_grid_local_peak_in_rect_with_optional_class_3_5_bias` `0x0044da70`; mode `0x0f` re-enters `world_relax_companion_float_grid_cross_average_in_rect_with_raster_bit0_gate` `0x0044d4e0`; modes `0x10` and `0x11` re-enter `world_raise_companion_float_grid_toward_center_sample_in_rect` `0x0044d880`; and mode `0x12` toggles the secondary-raster low nibble through `world_secondary_raster_xor_cell_byte2_low_nibble_mask` `0x00448e20` before re-entering `placed_structure_collection_refresh_local_runtime_side_state_in_rect_from_cell_bucket_map` `0x00419110`. The same owner also routes the ordinal strip `0x0fa0..0x0fa7` through `0x004bc210/0x004bc290` and updates the shared brush ordinal at `0x00621e20`, while the mode buttons `0x0faa..0x0faf` dispatch `0x004ddbd0` with mode ids `0x0e..0x13`. Current evidence is sufficient to carry this as a shell world-surface brush and mode dispatcher.","objdump + local disassembly + control-family correlation + world-surface correlation + brush-mode correlation"
0x004384d0,570,world_run_post_load_generation_pipeline,map,cdecl,inferred,objdump + strings + caller xrefs,4,"Large post-load world-generation pipeline reached after world entry and shell-side file-load success paths. It increments the world-root generation counter at `[0x0062c120+0x2205]`, mirrors the leading editor economic-tuning scalar from `[world+0x0be2]` back into runtime multiplier lane `[world+0x0bde]`, and on the caller-selected setup path first runs the preliminary candidate-availability prepass `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437737(0)`. The visible phase order is now grounded directly from the function body instead of only from scattered callers: id `318` `Computing Transportation and Pricing...` is posted first and remains active while the pipeline runs `world_compute_transport_and_pricing_grid` `0x0044fb70`, the early candidate-local service pass `structure_candidate_collection_run_post_load_local_service_setup_phase` `0x0041ea50(1)`, and, only on the setup path, the conditional region pair `world_region_collection_seed_default_regions` `0x00421b60` plus `world_region_border_overlay_rebuild` `0x004882e0`; if shell-state gate `[0x006cec74+0x174]` is set while master editor-mode latch `[0x006cec74+0x68]` is still clear, id `320` `Setting Up Buildings...` posts next, marks one-shot latch `[world+0x46c3c] = 1`, runs `world_region_collection_run_building_population_pass` `0x00421c20(1.0, 1)`, and then clears that latch again; if `[0x006cec74+0x178] > 0` under the same editor-mode clear gate, id `321` `Seeding Economy...` then drives `simulation_run_chunked_fast_forward_burst` `0x00437b20`; only after those setup-side gates does the pipeline post id `319` `Setting up Players and Companies...`; and id `322` `Calculating Heights...` finally tails into `0x0044d410`. That `319` lane is no longer just gate plumbing: when startup latch `0x006cd8d8` is clear it stamps `[0x006cec7c+0x79] = 1`, ensures `[world+0x6a6c] >= 1`, forces chairman-seat byte `[world+0x69db] = 1`, and then runs the chairman-profile pair `world_seed_default_chairman_profile_slots` `0x004377a0` plus `world_build_chairman_profile_slot_records` `0x00437220`; current neighboring setup flow also exposes one conditional company-side helper at `0x0047d440` under sandbox or non-editor shell-state conditions. The later interior ordering of the same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` through `0x00493be0`, the pipeline refreshes the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, then re-enters `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, runs a flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0`, and only after that re-enters the route-entry post-pass `0x00491c20` before continuing into later persona, route-style, region, and world-manager setup families. Current evidence is tighter on the remaining gates too: `[0x006cec74+0x68]` now aligns with the editor-map `.gmp` mode in the shell file coordinators and acts as the broader master editor-mode flag that suppresses both later world-generation branches and diverts region-side calculations into alternate paths. The body fans into the live world root at `0x0062c120`, manager collections `0x0062ba8c`, `0x0062bae0`, `0x006cfca8`, `0x006cfcb4`, and `0x006cfc9c`. Current grounded callers are the world-entry side around `0x004390ea` and the shell file-load side around `0x004dccfc`.","objdump + RT3.lng strings + caller xrefs + callsite inspection + file-flow correlation + post-load-stage-order correlation + pre-recipe-scalar mirror correlation + economic-tuning-band correlation + direct-body gate correlation"
0x00437737,105,world_preseed_named_candidate_availability_records_from_live_pool,map,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Preliminary post-load candidate-availability prepass reached only from `world_run_post_load_generation_pipeline` `0x004384d0` when the caller requests the fuller setup path. The real function entry starts at `0x00437737`, where it first checks the shared stage counter at `0x00620e94` against threshold `0x26ad` and returns immediately once that earlier startup window has passed. Otherwise it walks the live candidate pool at `0x0062b268` in reverse order, derives one boolean override bit, and upserts each surviving candidate stem into the scenario-side named availability table through `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20` on `0x006cec78`. That override bit is now tighter than the older structural read: any nonzero availability word at `[candidate+0xba/+0xbb]` forces the upsert with bit `0`, while zero-word candidates derive the bit from the subtype parity check on `[candidate+0x32]` via the local `2 xor subtype` path; those zero-word subtype cases are skipped only when the copied stage-counter argument is nonzero. Current evidence is therefore strongest for an early scenario-side named candidate-availability seeding pass that mirrors live candidate subtype or availability state into `[world+0x66b2]` before the visible progress phases begin, rather than another visible progress phase.","objdump + local disassembly + caller correlation + candidate-pool correlation + override-bit-derivation correlation + entry-boundary correction"
0x00438890,644,shell_active_mode_run_profile_startup_and_load_dispatch,map,thiscall,inferred,objdump + caller xrefs + debugger comparison,4,"Large active-mode startup and profile-dispatch owner rooted at the live mode object in `0x006cec78`. At entry it clears local state at `[this+0x00]` and `[this+0x4c80]`, immediately re-enters the shared scenario-state reset-and-rebuild owner `0x00436d10`, posts several shell progress or status updates through `0x5193f0/0x540120`, mirrors one shell-managed string table off `0x006d4020+0x429b0` into local dword slots `[this+0x46a80..+0x46aa4]`, and allocates the common startup-side runtime pools before the selector jump at all: the cargo collection `0x0062ba8c`, structure-candidate pool `0x0062b268`, auxiliary candidate collection `0x0062b2fc`, support owner `0x0062ba88`, locomotive pool `0x006ada84`, optional world root `0x0062c120`, city-label and manager families `0x006cfcbc`, `0x0062be10`, `0x006ceb9c`, `0x006cea4c`, and `0x006acd34`, plus the setup helper at `0x0062b244`. That common pre-branch stage is tighter now too: after allocating the locomotive pool it reverse-walks the live locomotives through `0x00461c80` and pre-seeds named locomotive-availability rows in scenario state through `world_preseed_named_locomotive_availability_records_from_live_pool` `0x004350b0` before the later progress lane continues. Only after that common allocation pass does it switch over the runtime-profile selector at `[0x006cec7c+0x01]`, which is now clearly a separate seven-way startup selector rather than the shell mode id itself. The jump table has four grounded branch bodies: selector values `1` and `7` share the tutorial map lane at `0x00438f67`, which writes `[0x006cec74+0x6c]=2` and calls shell_map_file_entry_coordinator `0x00445ac0` with `Tutorial_2.gmp` or `Tutorial_1.gmp`; selector `2` is a world-root initialization lane at `0x00438a66..0x00438c00` that first refreshes one support-family type-`7` record from setup path buffer `0x006d1370` through `global_banked_type7_record_refresh_from_openable_path_basename_and_stem` `0x0053d130`, strips the basename extension into a local label buffer, briefly drops the nested mouse-cursor selection hold through `0x0053f310`, builds three progress-text payloads, re-enters the hold through `0x0053f2f0`, and only then allocates `0x0062c120` when absent, runs `0x0044faf0`, and forces the selector to `3`; selector `4` is the setup-side world reset or regeneration lane at `0x00439038`, which tears down and reallocates `0x0062c120` from setup globals `0x006d14cc/0x006d14d0`, then runs `0x00535100` and `0x0040b830`; and selector values `3`, `5`, and `6` collapse into the same profile-seeded file-load lane at `0x004390b0..0x004390ea`. The write side is tighter now too: `Campaign.win` writes selector `6` at `0x004b8a2f`; `Multiplayer.win` writes selector `3` on one pending-status branch at `0x004f041e`; and the larger `Setup.win` dispatcher around `0x005033d0..0x00503b7b` writes selectors `2`, `3`, `4`, and `5` on several validated launch branches, including the setup-size path through `0x0050394c`, the generation branch at `0x00503a12`, and the profile-file validation branch at `0x00503a74/0x00503a7d`. The shared file-load lane is therefore no longer anonymous: selector `6` is the grounded campaign-side variant and selectors `3/5` are grounded setup or multiplayer variants, while selector `6` is also the only variant that first writes `[0x006cec74+0x6c]=1` before all three values call shell_map_file_entry_coordinator `0x00445ac0` with `([0x006cec7c]+0x11, 4, &out_success)`, re-enter shell service `0x004834e0`, conditionally run world_run_post_load_generation_pipeline `0x004384d0` when `out_success != 0`, drain the counter object at `0x00ccbb20` through `0x0053f310`, and service `0x004834e0` again. The caller split above that branch is tighter now too: `0x004830ca` is the shell startup or `LoadScreen.win` lane and calls this owner as `(1, 0)` after publishing `0x006cec78`, while `0x00443b57` world entry and `0x00446d7f` saved-runtime restore both enter with `(
0x00435603,10,scenario_state_ensure_derived_year_threshold_band,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Tiny guard wrapper over one derived scenario-state year-threshold band rooted at `[this+0x3a/+0x51/+0x55/+0x59/+0x5d/+0x61]`. When the small mode or threshold byte at `[this+0x3a]` is already `>= 2` the helper returns immediately; otherwise it falls back into the heavier rebuild body at `0x004351c0`, which refreshes those companion thresholds from the current year and shell-controller-side values before continuing. Current grounded callers are the post-fast-forward selected-year tail at `0x00437170`, the later staged-profile rehydrate band inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, the compact runtime-effect side branch at `0x00431e03`, and the shell-command lane at `0x004661c0/0x004661e9`, so this is the safest current read for the small year-threshold ensure wrapper rather than a generic boolean probe.","objdump + local disassembly + caller correlation + year-threshold-band correlation"
0x00435630,648,scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables,map,thiscall,inferred,objdump + caller xrefs + state-layout inspection,4,"Rebuilds the runtime port-or-warehouse cargo-line tables from the scenario-side recipe-book state rooted at `[this+0x0fe7]`. The helper first biases into the recipe-book runtime band at `[this+0x13d4]`, then iterates all `12` recipe-book blocks in `0x4e1`-byte steps. For each book it clamps the shared production-cap float that precedes the first line up to a fixed minimum `4.0`, counts active nonzero-mode lines across the fixed five repeated `0x30`-byte line records, writes that count into the paired runtime lane at `[book_runtime-0x3b0]`, and then imports those same five lines into one parallel runtime array of `0xbc`-byte descriptors rooted at `[book_runtime-0x3ac]`. Every runtime slot is first zeroed, seeded with fixed year-window defaults `0x0708..0x270f`, and then filled only when the source line mode is nonzero. The importer treats every line slot symmetrically rather than special-casing any row index: each slot reads one mode dword, one annual amount, and two cargo-token strings, resolves both token lanes through `cargo_collection_find_entry_id_by_exact_name` `0x0041e9f0` over the live cargo collection at `0x0062ba8c`, and builds the direct primary-cargo half for modes `1/3` plus the one-row subordinate half for modes `2/3`. Current mode polarity is grounded rather than provisional: the source token at `line+0x08` is the primary or supplied-cargo field because it feeds the direct branch used by `Supply Only` and the primary half of `Production Demand->Supply`, while the source token at `line+0x1c` is the subordinate or demanded-cargo field because it feeds the one-row branch used by `Demand Only` and the subordinate half of `Production Demand->Supply`. The importer-side string behavior is tighter now too: empty token strings in either lane are replaced in-place with the first live cargo name from `0x0062ba8c` before the same exact-name matcher runs, while mode `3` repeatedly compares the two token lanes through `0x005a57cf` and keeps reseeding the primary lane from that first live cargo name until the primary and subordinate strings diverge. The return-value side is tighter in the same way: the exact matcher returns one live cargo entry id or `0`, and the importer writes that result directly into runtime descriptor lanes `[desc+0x1c]` and `[desc+0x44]` without any post-match failure guard. The amount semantics are tighter in the same way: `line+0x04` is normalized to at least `1.0` for every nonzero-mode line, copied into `[desc+0x04]` only for modes `1/3`, copied into `[desc+0x48]` for mode `2`, and replaced with literal `1.0` in `[desc+0x48]` for mode `3`. After all twelve books are imported, the helper explicitly re-enters `structure_candidate_collection_rebuild_runtime_records_from_scenario_state` `0x00412d70` when the live candidate collection `0x0062b268` exists, so this row is the real scenario-to-runtime bridge between the editor-owned recipe books and the candidate-side `0xbc` descriptor arrays plus their later cargo summary tables. Current grounded callers include the scenario-state initializer at `0x00436ee0`, world-load or map-entry side branches at `0x00443ebc`, `0x00444ac1`, and `0x00448126`, plus the live editor page constructor at `0x004cf935`.","objdump + caller xrefs + state-layout inspection + cargo-collection correlation + mode-table correlation + constructor correlation + exact-matcher correlation + runtime-bridge correlation + mode3-divergence correlation + return-value correction"
0x00437b20,218,simulation_run_chunked_fast_forward_burst,simulation,thiscall,inferred,objdump,3,"Shell-mediated burst advance helper above simulation_advance_to_target_calendar_point. It marks a local fast-forward latch at `[this+0x46c38]`, derives one loop count from shell-state `[0x006cec74+0x178]`, and then overrides that count to literal `0x150` whenever special-condition slot `30` `[0x006cec78+0x4af7]` is nonzero before repeatedly advancing the world toward fixed target `0x05a0` through simulation_advance_to_target_calendar_point while pumping the shell-side service helper at `0x004834e0` between chunks. After the burst it clears the latch, sweeps the world collection at `0x0062bae0`, and tails into the neighboring cleanup path at `0x00434d40`. The current grounded owner is world_run_post_load_generation_pipeline at `0x004384d0`, where the helper sits behind shell-state gate `[0x006cec74+0x178]` under the localized `Seeding Economy...` phase after the earlier transportation-pricing and building-setup work has already run. This keeps the helper on the map or scenario setup side rather than the ordinary player-facing speed-control path.","objdump + caller context + RT3.lng strings + phase ordering + special-condition override correlation"
0x00434680,435,world_set_game_speed_mode,simulation,thiscall,inferred,objdump + strings,3,"Primary game-speed setter for the live world object. It clamps the requested mode against the normal `0..5` range or the wider `0..9` range when shell-state gate `[0x006cec74+0x2c8]` is active, stores the current mode at `[this+0x19]`, preserves the nonzero resume mode at `[this+0x1d]`, updates the shell detail control `0x74` when `0x006d0818` is live, and can format the localized status line `Game Speed: %1` using speed labels `Paused` through `Very Fast` and the hidden `Ultra Fast 6..9` strings. When the caller requests propagation and the multiplayer preview path is active it also routes the new speed through the multiplayer-side handoff around `0x00407870`, which matches the localized restriction `Only the host may change the game speed.`","objdump + RT3.lng strings + multiplayer handoff"
0x00434850,19,world_adjust_game_speed_mode_delta,simulation,thiscall,inferred,objdump,3,"Small relative front end over world_set_game_speed_mode. It adds the signed caller delta to the current mode at `[this+0x19]` and then re-enters world_set_game_speed_mode with both notification and propagation flags enabled.","objdump + callee inspection"
0x004338c0,12,shell_mode_gate_is_active,shell,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Tiny boolean wrapper over the shell-side gate at `0x006d07b4`. The helper simply forwards `0x004d4150`, normalizes the result to `0/1`, and returns. Current grounded callers use it as a coarse mode gate before trusting several scenario-side and runtime-object fields, including the flag-byte readers at `0x0041f910`, `0x00461500`, and `0x00474430`, plus broader world or shell-side branches such as `0x004197e0`, `0x00440e4d`, and `0x0044ccdc`. The row is therefore kept at the structural active-shell-mode-gate level around `0x006d07b4`.","objdump + local disassembly + caller correlation + gate reuse correlation"
0x00433790,8,scenario_state_set_selected_chairman_company_id,map,thiscall,inferred,objdump + global-state inspection + caller correlation,4,"Tiny raw setter over the shell-side scenario state object at `0x006cec78`. The helper stores the caller-supplied company id directly into `[this+0x21]` and returns. Current grounded callers are the company and chairman reassignment flows at `0x00426dd4`, `0x00427d06`, `0x00427d93`, and the startup-company seeding or rotation paths around `0x0047d282`, `0x0047d409`, and `0x0047d609`, where it keeps the raw selected-company summary in sync with later chairman or ownership changes. This is therefore the direct id-level companion to the higher record accessor `scenario_state_get_selected_chairman_company_record` `0x00434870` rather than a broader state mutator.","objdump + global-state inspection + caller correlation + selected-company-summary correlation"
0x004337a0,4,scenario_state_get_selected_chairman_company_id,map,thiscall,inferred,objdump + global-state inspection + caller correlation,4,"Tiny raw getter over the shell-side scenario state object at `0x006cec78`. The helper returns company id field `[this+0x21]` directly without resolving it through the live company collection. Current grounded callers include the linked-site status formatter `0x0040e4e0`, the company or chairman reassignment families around `0x00426dd4`, `0x004427aac`, and `0x0047d462`, the startup-company seeding branches around `0x0047d4ed`, and many shell-side overview or ledger renderers that compare the current row against the scenario-selected company before choosing text or style. This is therefore the raw selected-company-id accessor beneath the higher record resolver `scenario_state_get_selected_chairman_company_record` `0x00434870`.","objdump + global-state inspection + caller correlation + selected-company-summary correlation"
0x004337b0,4,scenario_state_get_selected_chairman_profile_id,map,thiscall,inferred,objdump + global-state inspection + caller correlation,4,"Tiny raw getter over the shell-side scenario state object at `0x006cec78`. The helper returns chairman profile id field `[this+0x25]` directly without resolving it through the global persona collection. Current grounded callers include the company-detail and load-screen style selectors, chairman rotation or reassignment branches around `0x00427cf4`, `0x00427d80`, `0x004295ef`, and `0x0047d3f9`, and many shell-side renderers that compare the current row's linked chairman against the scenario-selected chairman before choosing visible styling. This is therefore the raw selected-chairman-profile-id accessor beneath the higher record resolver `scenario_state_get_selected_chairman_profile_record` `0x004348c0`.","objdump + global-state inspection + caller correlation + selected-chairman-summary correlation"
0x00433900,160,shell_world_view_center_on_object_with_mode_specific_zoom_policy,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Mode-aware world-view centering helper above the live world-view owner at `0x0062be68`. The helper takes one object pointer plus one small mode argument. Except for the early mode-`2` no-op path, it first refreshes shell control `0x7922`, derives one `(distance,height)` preset from the target object's virtual classification through slots `+0x70`, `+0x6c`, and `+0x28`, optionally overrides that preset for mode `1`, and then re-enters `world_view_center_on_runtime_object` `0x0043c9a0` with the chosen preset and object pointer. Current grounded callers include the shell station and company list modifier paths, several detail-panel and window-side center actions, the tutorial or event-follow branches around `0x00435b2d` and `0x0044c75e`, and broader shell-side center helpers around `0x00505e0c`, `0x005060f7`, and `0x0051486b`. This is therefore the shared shell-facing center-on-object helper with one caller-selected zoom-policy mode rather than a station-only centering path.","objdump + caller xrefs + local disassembly + world-view-center correlation"
0x004339b0,144,scenario_state_set_investor_confidence_issue_lane_and_refresh_company_support_scalars,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Clamps one small scenario-side issue lane and refreshes the company-side support scalar family derived from it. The helper clamps the incoming value to `0..4`, stores the result in `[this+0x2d]`, derives one companion float in `[this+0x29]` through the fixed affine mapping at `0x005c85b8/0x005c8658`, and then walks the live company collection at `0x0062be10`, re-entering `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` on every live company to refresh the dependent support-side cache. Current grounded callers include the compact runtime-effect dispatcher branch at `0x00431db2`, the local setup or reset lane at `0x00436e05`, and the neighboring scenario-side text or collection refresh branch at `0x00434d23`, which keeps this helper bounded as the shared setter for the investor-confidence-style issue lane beneath equity-support and share-price logic rather than a generic scalar write.","objdump + local disassembly + caller correlation + company-support-refresh correlation"
0x00433850,109,scenario_state_refresh_active_chairman_profiles_with_reentrancy_guard,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Re-entrant-safe refresh dispatcher over the active chairman-profile family. The helper uses globals `0x0062be20` and `0x0062be1c` as a guard plus rerun latch: when no refresh is in progress it raises the guard, clears the rerun latch, walks the global persona collection at `0x006ceb9c` through `profile_collection_count_active_chairman_records` `0x00477820` and `profile_collection_get_nth_active_chairman_record` `0x00477860`, and re-enters `0x004771e0` on each active chairman record before dropping the guard. If any nested path re-raises the rerun latch, the outer loop repeats until the latch stays clear. Current grounded callers include the periodic service branch at `0x0040a7ae`, the chairman cash or tuning adjustment paths at `0x00476541` and `0x004771ca`, and several neighboring company-side mutation branches, so this is the safest current read for the shared active-chairman refresh pass rather than a one-off persona walker.","objdump + local disassembly + caller correlation + active-chairman refresh correlation + reentrancy-guard correlation"
0x00437220,279,world_build_chairman_profile_slot_records,map,thiscall,inferred,objdump + strings + caller xrefs + local disassembly,4,"Post-load chairman-profile materialization pass reached under banner id `319` `Setting up Players and Companies...`. The helper first rebuilds one local `0x29`-byte occupancy mask on the stack through `0x0047bc80`, using two `0x48`-byte staging records rooted at `[this+0x69db]` to mark already-consumed persona ordinals. It then optionally waits on the multiplayer preview owner at `0x006cd8d8`, showing localized progress `0x0e1e/0x0e1f` while that owner finishes, before walking the 16 selector bytes at `[0x006cec7c+0x87]` together with the per-slot staging table rooted at `[this+0x69d8]`. Current slot-field semantics are tighter now: `[slot+0x00]` is the staged chairman profile id, `[slot+0x01]` is the Optional-versus-Mandatory byte with nonzero=`Optional` and zero=`Mandatory`, `[slot+0x02]` is the ordinary seat-enable byte that combines with the separate per-slot gate at `[this+0x0bc3+slot*9]` to surface `Human`, `Computer`, and `Human or Computer`, `[slot+0x03]` is the special occupied-seat byte, and `[slot+0x04]` is the numeric tuning field copied into the resolved profile. Selector `0` is the random-unused-persona path: it scans the global persona-state band at `[0x006cec78+0x6987]`, skips already-occupied ordinals from that local mask, honors the campaign-slot override byte `[slot-0x02]` when `[0x006cec7c+0xc5]` is live, and marks the chosen ordinal back into the same mask. Nonzero selectors map directly onto one persona index, with selectors below `0x64` using `selector-1` and selectors `0x64+` using the later-opponent range. Each resolved profile record is pulled from the global persona collection at `0x006ceb9c`, formatted through `0x0050a16f`, and then materialized through `world_seed_or_refresh_chairman_profile_record_from_static_persona_table` `0x00476140` using the static persona table at `0x005f2d28`, whose localized ids include `2730` `Unassigned`, the named-chairman range `2731+`, and the adjacent biography range `2495+`. Both this helper and the neighboring selector seeder treat either `[slot+0x02]` or `[slot+0x03]` as enough to keep a slot live, but current grounded writes only seed `[slot+0x03]` on slot zero and later move it solely by whole-record compaction. That keeps `[slot+0x03]` as the strongest current anchor for the distinguished primary-human-seat marker rather than a generic role byte. The helper stores per-profile numeric tuning from `[slot+0x04]` into `[profile+0x154]` and `[profile+0x158]`, can clear `[profile+0x293]` for inactive slots when the multiplayer preview owner is live, can mark `[profile+0x293] = 1` through `0x00434200` on the first resolved local-human seat during the preview side path, and finally writes the selected profile id to `[this+0x25]` plus the linked owner-company id from `[profile+0x1dd]` to `[this+0x21]`. Current grounded callers are the main post-load generation pipeline at `0x004384d0` and the saved-runtime tail inside `world_entry_transition_and_runtime_bringup` `0x00443a50`.","objdump + RT3.lng strings + caller xrefs + table inspection + shell editor cross-check + multiplayer-preview correlation + local disassembly"
0x004377a0,693,world_seed_default_chairman_profile_slots,map,thiscall,inferred,objdump + caller xrefs + strings + local disassembly,4,"Seeds the 16 scenario-side chairman selector bytes at `[0x006cec7c+0x87]` from the local chairman-slot table rooted at `[this+0x69d8]` before the later profile-record materialization pass runs. In editor-map mode the helper first compacts the 16 local 9-byte slot records so occupied slots bubble forward whenever a later slot has either the ordinary seat-enable byte `[slot+0x02]` or the special occupied-seat byte `[slot+0x03]` set and an earlier slot has neither; it then clears selectors for empty slots and assigns deterministic defaults for occupied ones, using selector `1` for the first occupied slot and selector `0x64+n` for later occupied slots. The same slot layout is now bounded more tightly by the editor window family around `0x004cc2d0`: `[slot+0x00]` is the staged chairman profile id, `[slot+0x01]` is the Optional-versus-Mandatory flag with nonzero=`Optional` and zero=`Mandatory`, `[slot+0x02]` is the ordinary seat-enable byte, `[slot+0x03]` is the special occupied-seat byte, and `[slot+0x04]` is the numeric tuning field. Current grounded writes seed `[slot+0x03]` on slot zero and the compaction pass moves it only by swapping whole 9-byte records, which matches the selector policy: one distinguished first slot gets selector `1`, and the remaining occupied slots get the `0x64+n` opponent range. After the selector seeding pass it walks the selector array, allocates one fresh persona-record id from the global collection at `0x006ceb9c`, resolves the chosen static persona index from the selector byte, and materializes the final per-profile record through `world_seed_or_refresh_chairman_profile_record_from_static_persona_table` `0x00476140` instead of only formatting a temporary name row. It then copies the numeric tuning field from `[slot+0x04]` into `[profile+0x154]` and `[profile+0x158]`, seeds the scenario-state summary pair from the first persona entry so `[this+0x25]` becomes the selected profile id while `[this+0x21]` becomes the linked owner-company id through `[profile+0x1dd]`, and can still tail into `0x0047d440` when no multiplayer preview owner is active and the surrounding shell gates allow the later company-side helper. Current grounded caller is the neighboring world bring-up path around `0x00438692`, where this helper runs after the setup-side burst branch and immediately before the localized `Calculating Heights...` progress update.","objdump + caller xrefs + RT3.lng strings + slot-table inspection + shell editor cross-check + local disassembly + persona-record-allocation correlation"
0x00434870,23,scenario_state_get_selected_chairman_company_record,map,thiscall,inferred,objdump + global-state inspection,4,"Returns the currently selected company record for the shell-side scenario state object at `0x006cec78`. The helper reads `[this+0x21]` as a company id and resolves that id through the live company collection at `0x0062be10`; zero or negative ids return null. This is the clearest direct accessor yet for the summary field written by the post-load chairman-profile lane.","objdump + global-state inspection + caller correlation"
0x00434890,35,scenario_state_set_selected_chairman_profile,map,thiscall,inferred,objdump + global-state inspection,4,"Sets the currently selected chairman profile on the shell-side scenario state object at `0x006cec78`. The helper stores the incoming persona id into `[this+0x25]`, resolves that persona through the global profile collection at `0x006ceb9c`, and then copies the linked owner-company id from `[profile+0x1dd]` into `[this+0x21]`. This grounds the summary pair used by the post-load chairman-profile setup lane: `[state+0x25]` is the selected chairman profile id and `[state+0x21]` is the corresponding owning company id.","objdump + global-state inspection + caller correlation"
0x004348c0,23,scenario_state_get_selected_chairman_profile_record,map,thiscall,inferred,objdump + global-state inspection,4,"Returns the currently selected chairman profile record for the shell-side scenario state object at `0x006cec78`. The helper reads `[this+0x25]` as a profile id and resolves it through the global persona collection at `0x006ceb9c`; zero or negative ids return null. This pairs directly with scenario_state_set_selected_chairman_profile at `0x00434890`.","objdump + global-state inspection + caller correlation"
0x004337c0,128,scenario_state_append_runtime_effect_or_queue_record,map,thiscall,inferred,objdump + local disassembly + caller correlation,4,"Allocates one zeroed `0x20`-byte node through `0x005a125d`, copies one caller-supplied string or payload seed into `[node+0x04..]` through `0x0051d820`, stores six further caller dwords into the fixed field band `[node+0x08]`, `[node+0x0c]`, `[node+0x10]`, `[node+0x14]`, `[node+0x18]`, and `[node+0x1c]`, and appends the finished node to the singly linked list rooted at `[this+0x66a6]`. Current grounded callers include `world_region_collection_pick_periodic_candidate_region_and_queue_scaled_event_record` `0x00422100`, which appends payload seed `0x005c87a8`, literal kind `7`, zero promotion-latch dword `[node+0x0c]`, one chosen class-0 region id at `[node+0x10]`, one scaled amount at `[node+0x14]`, and sentinel tails `-1/-1` in `[node+0x18/+0x1c]`, plus the shell-facing side path inside `world_region_try_place_candidate_structure` `0x00422ee0`, several startup-company branches around `0x0047d282/0x0047d409/0x0047d609`, and the broader runtime-effect service family. The exact gameplay label of this linked `0x20`-byte record family is still broader than one subsystem, so the safest current name stays structural around appending one runtime-effect or queue record node beneath scenario state.","objdump + local disassembly + caller correlation + queue-node-list correlation + node-layout correlation + periodic-region-bonus correlation"
0x00436590,372,scenario_state_compute_issue_opinion_multiplier,simulation,thiscall,inferred,objdump + caller inspection,4,"Computes one bounded opinion multiplier for a caller-selected issue slot on the active scenario or shell state rooted at `0x006cec78`. The helper starts from the base issue term at `[this + issue*4 + 0x8a]`, clamps that raw value to a floor of `-99`, normalizes it into a multiplier around `1.0`, and then optionally folds in up to three issue-specific override tables: a company-side term from `[company + issue*4 + 0x35b]`, a chairman-profile term from `[profile + issue*4 + 0x2ab]`, and a territory-side term from `[territory + issue*4 + 0x3b5]`. When the profile argument is omitted but a valid company is supplied, it implicitly reuses that company's linked chairman id from `[company+0x3b]`. The final multiplier is clamped to a small positive floor near `0.01` before return. Current grounded callers include the broader support-adjusted share-price helper at `0x00424fd0`, the merger vote resolver at `0x004ebd10` with issue id `0x3a`, and several other company-policy and shell-side opinion branches. The merger-side `0x3a` use now lines up directly with `RT3.lng` id `726`, which says public merger votes depend on their attitude toward the management of the two companies, so this issue slot is now best read as the merger-management-attitude multiplier.","objdump + caller inspection + issue-table correlation + merger-text correlation"
0x004768c0,53,chairman_profile_owns_all_company_shares,simulation,thiscall,inferred,objdump + caller inspection,4,"Boolean ownership predicate over one chairman profile and company id. The helper resolves the requested company through the live company collection at `0x0062be10`, reads the company's full outstanding-share count from `[company+0x47]`, and compares it against the current profile's holding slot for that same company at `[profile + company_id*4 + 0x15d]`. It returns `1` only when the profile holds the full outstanding-share band and `0` otherwise. Current grounded caller is the CompanyDetail section-0 overview formatter at `0x004e5cf0`, where this is the decision point between the wholly-owned text family `3046/3047` and the investor-attitude text family `3048/3049`.","objdump + caller inspection + ownership-predicate correlation"
0x00436710,163,scenario_state_sum_issue_opinion_terms_raw,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Raw additive companion to `scenario_state_compute_issue_opinion_multiplier` on the active scenario or shell state rooted at `0x006cec78`. The helper starts from the base issue term at `[this + issue*4 + 0x8a]`, then optionally adds the company override term at `[company + issue*4 + 0x35b]`, the chairman-profile override term at `[profile + issue*4 + 0x2ab]`, and the territory override term at `[territory + issue*4 + 0x3b5]` without normalizing or clamping the result into a multiplier. When the profile argument is omitted but a valid company is supplied, it implicitly reuses that company's linked chairman id from `[company+0x3b]`. Current grounded callers include the city-connection bonus lane through `company_compute_issue39_opinion_bias_scalar` at `0x00424580` and several neighboring policy or setup branches that treat the returned integer as one raw issue-opinion total rather than a finished probability or vote scalar.","objdump + caller xrefs + callsite inspection + issue-table correlation + raw-sum correlation"
0x00437a60,41,world_toggle_pause_or_restore_game_speed,simulation,thiscall,inferred,objdump + strings,3,"Pause or resume toggle over the world game-speed fields. When the current mode at `[this+0x19]` is above zero it re-enters world_set_game_speed_mode with target `0` to pause; otherwise it restores the saved nonzero resume mode from `[this+0x1d]`. This matches the player-facing speed-control family rooted in `Paused` through `Very Fast` and their tooltips in `RT3.lng` ids `1795..1800`.","objdump + RT3.lng strings"
0x00437d70,736,shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats,shell,thiscall,inferred,objdump + local disassembly + static-table decode + RT3.lng strings,4,"Broader shell-side cheat owner reached from the registered command wrapper `shell_command_dispatch_scenario_followon_0x437d70_if_active` `0x00441340`. After the usual single-profile gate through `0x004349a0`, the helper increments shell counter `[0x006d401c+0xc60]`, opens the callback-driven modal rooted at `RT3.lng` id `2922` `Do I detect a cheater in the house?\\n\\nEnter code (or <ESC> to cancel):` through `0x005193f0 -> 0x004c98a0`, and then scans the fixed 26-entry cheat table at `0x005ee2c8`. Current grounded case coverage is real: selector `0` dispatches winner or loss outcome modes through `0x004367c0` using labels `3618/3619/3620/3622`; selector `1` jumps out to `0x004d676c`, where it clears the selected-company stat bands rooted at `[company+0x0cfb]`, `[company+0x0d7f]`, and `[company+0x1c47]`; selector `2` posts one caller-supplied float delta into the selected company through `company_add_delta_into_stat_series_current_slot_and_optional_cash_totals` `0x0042a080`; selector `3` posts one signed integer delta into the selected chairman profile through `profile_entry_add_signed_integer_delta_into_qword_field_0x154` `0x00476050`; selector `4` resolves one locomotive record by primary or alias stem through `0x00461c00` and applies it to every train owned by the selected company through `0x004aefb0`; selector `5` walks the live territory collection and forces access-rights byte `1` through `company_set_territory_access_rights_byte` `0x00424030`; selector `6` toggles scenario byte `[state+0x4c8f]`; selector `7` runs the train-wide branch through `0x004ad7a0(1)`; and selectors `8/9/10` toggle scenario bytes `[state+0x4c8e/+0x4c8d/+0x4c8c]`. The same table also contains later labeled rows `3634` `Orca` and alias-only names `Katie..Seymour`, but their selector values lie above the visible jump-table bound `0x0a`, so current evidence only supports treating them as unreached or separately handled tail entries rather than active cases in this owner.","objdump + local disassembly + static-table decode + RT3.lng strings + cheat-table correlation + selected-company/profile mutation correlation"
0x00448aa0,28,world_sample_companion_float_grid_value_by_cell,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny float-raster sampler over the companion world grid rooted at `[this+0x1605]`. The helper uses width field `[this+0x15d9]`, flattens the caller-supplied cell coordinates with an extra `+1` row stride, reads one `float` from that raster, and returns it in `st(0)`. Current grounded callers include `world_compute_transport_and_pricing_grid` `0x0044fb70`, the flagged-cell sample collector `world_grid_count_flagged_cells_and_collect_float_samples` `0x00414fa0`, the projected-rectangle helper `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, and several neighboring shell or presentation branches, so this is the safest current read for the shared companion float-grid sampler rather than a transport-only helper.","objdump + caller inspection + field correlation + float-raster correlation"
0x00448af0,206,world_query_compact_grid_flag_bitset_membership_by_mode,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Boolean compact-bitset query over three neighboring world-grid flag banks. The helper uses dimensions `[this+0x215d/+0x2161]` to flatten the caller-supplied cell coordinates into one bit index, rejects out-of-bounds cells, and then checks one or more compact bitset banks depending on the caller mode argument: mode `0` checks both `[this+0x2139]` and `[this+0x213d]`, mode `1` checks `[this+0x213d]` only, mode `2` checks `[this+0x2139]` only, and mode `3` checks `[this+0x2141]` only. It returns `1` when any selected bank contains the bit and `0` otherwise. Current grounded callers include the post-load `319` cleanup lane inside `world_run_post_load_generation_pipeline` `0x004384d0`, the placement validator `placed_structure_validate_projected_candidate_placement` `0x004197e0`, the projected-runtime scratch builder `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0`, several neighboring world-scan or presentation branches around `0x004512b5..0x00451393`, and later world-side routes or scenario handlers, so this is the safest current read for the shared compact grid-flag-bitset membership query rather than one specific road- or route-only gate.","objdump + caller inspection + field correlation + compact-bitset correlation + post-load-cleanup correlation"
0x00448c20,132,world_secondary_raster_reclass_cell_to_low3bit_1_or_4_and_clear_primary_companion_plane,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small secondary-raster mutator over one world cell. After rejecting cells whose current secondary class already lies in subset `1/4` through `world_secondary_raster_query_cell_class_in_set_1_4` `0x00534e50`, the helper clears the primary companion byte plane at `[this+0x1655]` for that cell and rewrites the low 3 class bits of the packed secondary record at `[this+0x165d]` to `4` when the old class was `2`, or to `1` otherwise. It then notifies the shell-side world presentation through `0x00534270` with mode `6`. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and several shell-side map-editing or painting branches around `0x004f9c17` and `0x004fbcc9`, so this is the safest current read for the shared class-`1/4` demotion helper rather than a more player-facing terrain brush.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00448cb0,132,world_secondary_raster_reclass_cell_to_low3bit_3_or_5_and_clear_primary_companion_plane,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Sibling of world_secondary_raster_reclass_cell_to_low3bit_1_or_4_and_clear_primary_companion_plane for the `3/5` class family. After rejecting cells already in subset `3/5` through `world_secondary_raster_query_cell_class_in_set_3_5` `0x00534f00`, the helper clears the primary companion byte plane at `[this+0x1655]` for that cell and rewrites the low 3 class bits of the packed secondary record at `[this+0x165d]` to `5` when the old class was `2`, or to `3` otherwise. It then emits the same shell-presentation refresh through `0x00534270` with mode `6`. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and shell-side world-editing branches around `0x004f9c05` and `0x004fbce4`.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00448d40,78,world_secondary_raster_write_primary_companion_plane_byte_and_clear_low3bit_class_tag,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Writes one caller-supplied byte into the primary companion plane at `[this+0x1655]` for the selected world cell, then clears the low 3 class bits in the parallel packed secondary record at `[this+0x165d]`. The written byte comes from `0x00532a30` in the grounded callers, and the helper finishes by notifying the shell-side world presentation through the virtual owner at `0x0062be68`. Current grounded callers are shell-side painting and editing branches around `0x004f9c0e` and `0x004fbcfa`, so this is the safest current read for the shared primary-companion-byte write helper rather than a player-facing terrain label.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00448d90,43,world_secondary_raster_set_cell_byte2_bit0x10,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small write-side companion to world_secondary_raster_query_cell_byte2_bit0x10_set `0x00448f30`. The helper resolves one packed secondary cell record at `[this+0x165d]`, sets bit `0x10` in byte `2`, and then notifies the shell-side world presentation. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and one shell-side scan branch around `0x004fc45d`.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00448dc0,43,world_secondary_raster_clear_cell_byte2_bit0x10,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Clear-side companion to world_secondary_raster_set_cell_byte2_bit0x10. The helper resolves one packed secondary cell record at `[this+0x165d]`, clears bit `0x10` in byte `2`, and then notifies the shell-side world presentation. Current grounded caller is the shell-side scan branch around `0x004fc464`.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00448df0,33,world_secondary_raster_query_cell_byte2_low_nibble,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny nibble query over byte `2` of the packed secondary cell record rooted at `[this+0x165d]`. The helper flattens the caller-supplied coordinates, reads byte `2`, masks to the low nibble, and returns that `0..15` value. Current grounded callers are shell-side editing branches around `0x004faab3`, `0x004fabff`, `0x004faf9c`, `0x004fb007`, `0x004fb021`, and `0x004fca0e`, where the nibble is compared against small brush-state counts before the sibling write helper runs.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00448e20,47,world_secondary_raster_xor_cell_byte2_low_nibble_mask,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small low-nibble update helper over byte `2` of the packed secondary cell record rooted at `[this+0x165d]`. The helper XORs the caller-supplied low-nibble mask with the current low nibble and writes the merged result back without disturbing the upper nibble. Current grounded callers are shell-side editing branches around `0x004faba7` and `0x004fac18`.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00448e60,30,world_secondary_overlay_vector_x_byte_plane_set_cell_value,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small write helper for the signed X-component byte plane rooted at `[this+0x1661]`. It flattens one world-cell coordinate through width `[this+0x15dd]` and stores the caller byte directly. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and shell-side editing branches around `0x004faa59`. Later world-side rebuild logic in `0x00536710` treats this plane together with `[this+0x1665]` as a 2D signed vector field rather than a generic scratch buffer.","objdump + caller inspection + field correlation + vector-plane correlation"
0x00448e90,30,world_secondary_overlay_vector_y_byte_plane_set_cell_value,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Write-side sibling of world_secondary_overlay_vector_x_byte_plane_set_cell_value over the signed Y-component byte plane rooted at `[this+0x1665]`. The helper flattens one world-cell coordinate through width `[this+0x15dd]` and stores the caller byte directly. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and shell-side editing branches around `0x004faa6e`, while the later rebuild pass `0x00536710` consumes this plane together with `[this+0x1661]` as a paired local vector field.","objdump + caller inspection + field correlation + vector-plane correlation"
0x00448ec0,27,world_secondary_overlay_vector_x_byte_plane_query_cell_value,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny signed-byte accessor for the X-component overlay vector plane rooted at `[this+0x1661]`. Current grounded callers include neighboring world-side presentation or setup branches around `0x00446458` and shell-side editing branches around `0x004fa9cc`, so this is the safest current read for the X-component vector-plane cell query.","objdump + caller inspection + field correlation + vector-plane correlation"
0x00448ee0,27,world_secondary_overlay_vector_y_byte_plane_query_cell_value,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny signed-byte accessor for the Y-component overlay vector plane rooted at `[this+0x1665]`. Current grounded callers include neighboring world-side presentation or setup branches around `0x00446478` and shell-side editing branches around `0x004fa9e0`, so this is the safest current read for the Y-component vector-plane cell query rather than a generic companion-byte accessor.","objdump + caller inspection + field correlation + vector-plane correlation"
0x00448f00,40,world_secondary_raster_query_cell_low3bit_tag_nonzero,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny predicate over the secondary 3-byte raster rooted at `[this+0x165d]`. The helper flattens the caller-supplied cell coordinates through width `[this+0x15dd]`, reads the first byte of the 3-byte cell record, masks its low 3 bits, and returns `1` when that low-bit tag is nonzero and `0` otherwise. Current grounded callers consistently treat the zero case as the countable or eligible path: the region-border overlay count rebuild `0x004881b0`, the map-editor stats reports at `0x004d0472` and `0x004d1bd3`, and several neighboring world-side scans or scoring branches around `0x00403550`, `0x00450ffc`, and `0x00454599`.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00448f30,42,world_secondary_raster_query_cell_byte2_bit0x10_set,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small companion predicate over the same secondary 3-byte raster rooted at `[this+0x165d]`. The helper flattens the caller-supplied cell coordinates through width `[this+0x15dd]`, reads byte `2` of the 3-byte cell record, and returns `1` when bit `0x10` is set and `0` otherwise. Current grounded callers include neighboring world-side setup or presentation branches around `0x00446498` and `0x00451090`, plus one shell-side scan at `0x004fc43c`, so this is the safest current read for the shared secondary-raster bit-`0x10` predicate rather than a more player-facing terrain label.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x004490f0,18,world_query_sidecar_plane_cell_count,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny size helper for the sidecar byte-plane family hanging off the live world object. It returns `([this+0x15d9]+1)*([this+0x15d5]+1)`, which is the per-plane cell count used by the four-plane sidecar raster copies. Current grounded callers include the shell-side plane-copy branches around `0x004f5ad6..0x004f5cc7`, so this is the safest current read for the shared sidecar-plane cell-count query rather than a generic world-size helper.","objdump + caller inspection + field correlation + sidecar-plane correlation"
0x00448f60,114,world_load_four_sidecar_byte_planes_from_runtime_bundle,map,thiscall,inferred,objdump + caller inspection + bundle-tag correlation,4,"Loads four sidecar byte-plane buffers tied to the live world raster from one runtime bundle owner. The helper opens chunk family `0x9471..0x9472` through `0x00531360`, computes one plane size through `world_query_sidecar_plane_cell_count` `0x004490f0`, resolves four destination plane pointers through `world_query_sidecar_byte_plane_ptr_by_index` `0x00533b40` from `[this+0x1631 + index*4]`, and fills those four buffers through repeated `0x00531150` reads before closing the chunk family. Current grounded callers are the `.smp` restore path inside world_load_saved_runtime_state_bundle `0x00446d40` and the neighboring world-side bundle-load branch at `0x0044d350`, so this is the safest current read for the shared four-plane runtime-bundle load helper rather than a generic deserializer.","objdump + caller inspection + bundle-tag correlation + sidecar-plane correlation"
0x00448fe0,108,world_serialize_four_sidecar_byte_planes_into_runtime_bundle,map,thiscall,inferred,objdump + caller inspection + bundle-tag correlation,4,"Save-side sibling of world_load_four_sidecar_byte_planes_from_runtime_bundle. The helper opens chunk family `0x9471..0x9472` for output through `0x00531340`, computes the same one-plane size through `world_query_sidecar_plane_cell_count` `0x004490f0`, resolves four source plane pointers through `world_query_sidecar_byte_plane_ptr_by_index` `0x00533b40` from `[this+0x1631 + index*4]`, and writes those four buffers through repeated `0x00531030` calls before closing the chunk family. Current grounded callers are the `.smp` serializer inside world_runtime_serialize_smp_bundle `0x00446240` and the neighboring world-side bundle-save branch at `0x00449714`, so this is the safest current read for the shared four-plane runtime-bundle serializer rather than a generic writer.","objdump + caller inspection + bundle-tag correlation + sidecar-plane correlation"
0x00449520,636,world_serialize_runtime_grid_and_secondary_raster_tables_into_bundle,map,thiscall,inferred,objdump + caller inspection + local disassembly + bundle-tag correlation,4,"Save-side sibling of `world_load_runtime_grid_and_secondary_raster_tables_from_bundle` `0x0044cfb0`. The helper first opens chunk `0x2ee2`, delegates one fixed `0xc8`-byte world-grid header save through `world_serialize_fixed_grid_header_mask_planes_secondary_raster_and_overlay_chunks_into_bundle` `0x00553760`, posts progress notice `0x005caa50`, and then writes the core grid and stride scalars from `[this+0x2145/+0x2149/+0x214d/+0x2151/+0x2155/+0x2159/+0x215d/+0x2161/+0x2201]`. It follows with chunk family `0x2ef4/0x2ef5/0x2ef6` for the three main packed sidecar bands rooted at `[this+0x213d]`, `[this+0x2131]`, and `[this+0x2135]`, chunk family `0x2ee4/0x2ee5` for the extra bitplane and cell-word side rooted at `[this+0x2141]` and `[this+0x212d]`, re-enters `world_serialize_four_sidecar_byte_planes_into_runtime_bundle` `0x00448fe0`, and then walks every live world-grid cell from `[this+0x2129]` through `0x0042b4a0` before closing the `0x2ee5` phase. Current grounded caller is the early package-save owner `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`, so this is the safest current read for the early world-grid and secondary-raster bundle-save body rather than a generic header writer.","objdump + caller inspection + local disassembly + bundle-tag correlation + world-grid-array correlation + save-side sibling correlation"
0x0044afa0,439,world_query_local_companion_float_relief_score_at_cell_with_distance_and_mode_bias,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Composed local world-scalar query over the live world root. The helper first derives one distance-like term from the caller cell to global preview anchor fields `[0x0062be68+0x24/+0x1c]` through the precomputed radial helper `0x0051dc00`; distances above `0x32` contribute one clamped bias term. It then samples the companion float raster rooted at `[world+0x1605]` at the caller cell and across two 8-direction rings from the static offset tables `0x00624b28/0x00624b48`, keeps the highest rounded neighbor sample, and folds the local rise above the center sample into the running score. When preview scalar `[0x0062be68+0x20]` exceeds threshold `0x005ca190` it adds one further scaled bias, and when the neighboring shell-mode gate `0x0041fff0` passes it adds `0x32` more before returning the final score plus base offset `0x8c`. Current grounded callers are the shared rounded-coordinate wrapper `0x0041f6b0` and the sibling virtual wrapper `0x004614d0`.","objdump + caller xrefs + local disassembly + float-grid correlation + radial-distance-helper correlation"
0x00444dc5,11,world_query_global_stage_counter_reached_late_reactivation_threshold,map,cdecl,inferred,objdump + caller inspection + threshold correlation,3,"Tiny signed compare helper over the shared stage counter at `0x00620e94`. It returns the raw comparison against threshold `0x9901`, so current callers only test whether the counter is still below that later reactivation threshold. Grounded callers are the two late world-entry checkpoints at `0x00444044` and `0x00444a83` inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, where a negative result clears `[world+0x39]` before the broader reactivation sweep continues. Nearby evidence also shows the same global is seeded to `0x26ad` by `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`, copied into save-side payload state around `0x00441ec5`, and reused as the earlier preseed cutoff by `world_preseed_named_candidate_availability_records_from_live_pool` `0x00437737`, so the safest current read is a shared stage-threshold comparator rather than a one-off world-field helper.","objdump + caller inspection + threshold correlation + global-stage-counter correlation + late-reactivation-clear correlation"
0x0044c670,2544,world_service_secondary_grid_marked_cell_overlay_cache,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Recurring world-side service pass over the secondary raster rooted at `[this+0x2135]` after `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60` has cached min/max/count bounds into `[this+0x21c6..+0x21d6]`. The helper first requires shell-state gate `[0x006cec78+0x4af3]`, then consumes the cached bounds to normalize the marked-cell band and rewrite per-cell bits in the same secondary raster. Its later overlay side is tighter now too: after resolving scaled surface dimensions through `shell_world_presentation_query_scaled_surface_dimensions` `0x00534c50`, it walks one local 3-by-32 sample lattice through the static offset tables at `0x00624b28/0x00624b48`, keeps only secondary-raster classes `4..0x0d`, folds several interpolated samples through repeated `0x0051db80` evaluation into one strongest local score, writes packed overlay pixels into the staged surface buffer, and only then publishes that staged overlay through `shell_world_presentation_publish_staged_overlay_surfaces_and_release_buffer` `0x00534af0`. The lower helper cluster beneath that owner is now explicit too: `0x00533e70` refreshes the coarse overlay chunks in a rectangle, `0x00534160` ensures one coarse chunk and seeds local marks, and `0x00534e90` is the neighboring marked-bit predicate over the same 3-byte raster family. Current grounded callers are the recurring simulation-maintenance route-style branch at `0x0040a9f4` inside `simulation_service_periodic_boundary_work` `0x0040a590` and one startup-side world branch at `0x00448168`, so this is the safest current read for the shared secondary-grid marked-cell overlay-cache service rather than a one-shot startup helper or a fully player-facing panel renderer.","objdump + local disassembly + caller inspection + secondary-raster correlation + recurring-maintenance correlation + staged-overlay publish correlation"
0x00443a50,4979,world_entry_transition_and_runtime_bringup,map,cdecl,inferred,objdump + analysis-context,4,"First grounded gameplay-world entry coordinator reached from `shell_map_file_entry_coordinator` `0x00445ac0`. The function boundary is now grounded as the full `0x00443a50..0x00444dc2` bringup span rather than just the early transition head. It stages the selected file path into `0x0062bee0`, dismisses the shell detail-panel controller at `0x006d0818`, drives `shell_transition_mode` through `0x00482ec0`, and resets the previous world bundle through `world_runtime_release_global_services` plus the neighboring startup-profile owner `0x00438890`. After the transition wait it explicitly re-enters the shared scenario-state reset-and-rebuild owner `0x00436d10`, builds temporary bundle payloads from `%1\\%2` and `%1.tmp`, allocates or serializes world-entry records through `0x00530c80`, `0x00531150`, and `0x00531360`, allocates the new world root at `0x0062c120` from the staged filename through `0x0044e910`, notifies the shell owner at `0x0062be68`, and then continues through the larger post-load generation pipeline instead of returning immediately. The collection-side tagged load strip inside that bringup is now explicit too: before the later runtime rehydrate tail it loads the main route-entry collection `0x006cfca8` through `0x00493be0`, the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, refreshes placed-structure local runtime records through `0x004133b0`, rebuilds one flagged secondary-raster cleanup band through `0x00448af0/0x00533fe0`, reloads the world-manager side family at `0x006ceb9c` through `0x00477780`, reloads the geographic-label database at `0x006ada80` through `geographic_label_database_refresh_records_from_tagged_bundle` `0x00461580`, reloads the city-database entry collection at `0x006cea50` through `city_database_entry_collection_refresh_records_from_tagged_bundle` `0x00474540`, reloads the live region collection at `0x0062bae0` through `world_region_collection_refresh_records_from_tagged_bundle` `0x00421510`, refreshes the neighboring manager at `0x006cfc9c` through `0x00487c20`, reloads the support family at `0x0062b244` through `0x0040b5d0`, and reloads event runtime records through `scenario_event_collection_refresh_runtime_records_from_packed_state` `0x00433130`. The recipe-runtime lane is now split more tightly than before too: one early restore-side call at `0x00443ebc` rebuilds the scenario-side port-or-warehouse cargo runtime tables immediately after restoring the named candidate-availability collection at `[world+0x66b2]`, and before the neighboring candidate-filter/count refreshes `0x00412c10/0x00412bd0` plus the year-derived follow-ons `0x00434130/0x00436af0`; a second late call at `0x00444ac1` reruns that same recipe rebuild only after the `0x197` checkpoint, shell-progress scalar publish `0x004354a0`, territory-side sweep `0x00487de0`, and before the final named-candidate availability preseed `0x00437737` plus the later candidate-filter refresh `0x00412c10`. The later load-side rehydrate band is tighter now too. Before the final world and shell reactivation it posts shell progress ids `0x32dc/0x3714/0x3715`, restores the late world-status block `[world+0x66be]` from `0x2ee0/0x2ee1`, reads one `0x108`-byte packed profile block through `0x00531150`, conditionally copies staged runtime-profile bytes from the loaded bundle back into `0x006cec7c` when latch `[profile+0x97]` is set, mirrors the grounded campaign-scenario bit `[profile+0xc5]` and sandbox bit `[profile+0x82]` into world bytes `[world+0x66de]` and `[world+0x66f2]`, restores the selected year or profile choice lane through `[profile+0x77]` into `[world+0x05/+0x09/+0x15]`, reruns `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, `world_refresh_selected_year_bucket_scalar_band` `0x00433bd0`, `scenario_state_ensure_derived_year_threshold_band` `0x00435603`, the shared stage-threshold compare `0x00444dc5`, the candidate visibility sweep `0x0041e970`, `structure_candidate_coll
0x00440530,46,shell_open_or_focus_detail_panel_mode_0x0b_if_allowed,shell,cdecl,inferred,objdump + caller inspection + shell-detail correlation,3,"Direct shell command branch that opens one still-unresolved shell detail-panel mode `0x0b`. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_detail_panel_mode_0x0b_or_warn` `0x00434db0`; on success it forwards `(-1, 0x0b)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Current grounded companion caller is the page-side launcher at `0x004de49a`, which uses the same gate and mode. This is therefore the current bounded read for the direct mode-`0x0b` opener.","objdump + caller inspection + shell-detail correlation + mode-transition correlation"
0x00440560,22,shell_open_or_focus_detail_panel_mode_0x01_if_present,shell,cdecl,inferred,objdump + local disassembly + shell-detail correlation,2,"Tiny direct shell command stub over the live detail-panel controller at `0x006d0818`. When that controller exists, the helper forwards `(-1, 1)` into `shell_detail_panel_transition_manager` `0x004ddbd0` and otherwise returns immediately. Current local evidence is only strong enough for the structural mode-`1` opener, not for a tighter family name.","objdump + local disassembly + shell-detail correlation"
0x00440580,22,shell_open_or_focus_detail_panel_mode_0x04_if_present,shell,cdecl,inferred,objdump + local disassembly + shell-detail correlation,2,"Tiny direct shell command stub over the live detail-panel controller at `0x006d0818`. When that controller exists, the helper forwards `(-1, 4)` into `shell_detail_panel_transition_manager` `0x004ddbd0` and otherwise returns immediately. Current local evidence is only strong enough for the structural mode-`4` opener, not for a tighter family name.","objdump + local disassembly + shell-detail correlation"
0x004405a0,46,shell_open_or_focus_company_list_panel_if_allowed,shell,cdecl,inferred,objdump + caller inspection + shell-detail correlation,4,"Direct shell command branch that opens the company-list panel through detail-panel mode `7`. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_company_list_or_detail_panel_or_warn` `0x00433a40`; on success it forwards `(-1, 7)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Current grounded companion caller is the page-side command strip at `0x004de2dd`, which uses the same gate and mode. This is therefore the safest current read for the direct company-list opener rather than a generic mode-toggle stub.","objdump + caller inspection + shell-detail correlation + mode-transition correlation"
0x004405d0,126,shell_open_or_focus_selected_company_detail_panel_with_start_company_fallback,shell,cdecl,inferred,objdump + caller inspection + company-detail correlation,4,"Direct shell command branch above the selected-company `CompanyDetail.win` lane. The helper first requires the live detail-panel controller at `0x006d0818`; if no selected-company id is available through `scenario_state_get_selected_chairman_company_id` `0x004337a0`, it raises localized id `368` through the shared shell modal path and, when the current chairman still passes `0x00476d10`, it offers the `Start New Company` dialog through `0x0047d080` before retrying the selected-company lookup. Once a selected-company id exists it re-enters `shell_can_open_company_list_or_detail_panel_or_warn` `0x00433a40` and then forwards `(selected_company_id, 8)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Current grounded companion caller is the load-screen side launcher strip at `0x004de3a8`, which shares the same gate, fallback dialog, and selected-company handoff. This is therefore the safest current read for the direct selected-company-detail opener with start-company fallback rather than a generic company-command branch.","objdump + caller inspection + company-detail correlation + start-company fallback correlation + mode-transition correlation"
0x00440660,46,shell_open_or_focus_stockbuy_window_for_selected_company_if_allowed,shell,cdecl,inferred,objdump + caller inspection + stockbuy correlation,4,"Direct shell command branch that opens the shell-side `StockBuy.win` family through detail-panel mode `0x0c`. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_stockbuy_window_or_warn` `0x00433aa0`; on success it forwards `(-1, 0x0c)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. The later same-mode refresh tail inside `0x004ddbd0` also special-cases mode `0x0c` through `0x00493150`, which keeps this on the `StockBuy.win` family rather than another company-side page. Current grounded companion caller is the page-side launcher at `0x004de50f`.","objdump + caller inspection + stockbuy correlation + mode-transition correlation + same-mode-refresh correlation"
0x00440690,46,shell_open_or_focus_detail_panel_mode_0x06_if_allowed,shell,cdecl,inferred,objdump + caller inspection + shell-detail correlation,3,"Direct shell command branch that opens one still-unresolved shell detail-panel mode `0x06`. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_detail_panel_mode_0x06_or_warn` `0x00434e20`; on success it forwards `(-1, 0x06)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Current grounded companion caller is the page-side launcher at `0x004de27a`, which uses the same gate and mode. This is therefore the current bounded read for the direct mode-`0x06` opener.","objdump + caller inspection + shell-detail correlation + mode-transition correlation"
0x004406c0,51,shell_open_or_focus_trainbuy_window_if_allowed,shell,cdecl,inferred,objdump + caller inspection + trainbuy correlation,4,"Direct shell command branch above the shell-side `Trainbuy.win` family. The helper first requires the live detail-panel controller at `0x006d0818` and active scenario root `0x006cec78`, then re-enters `shell_can_open_trainbuy_window_or_warn` `0x00433b00`; on success it calls `shell_open_or_focus_trainbuy_window` `0x00512c50` with the fixed singleton-open argument set used by the same family elsewhere. Current grounded companion caller is the page-side launcher at `0x004de7d9`, which shares the same gate and opener. This is therefore the safest current read for the direct train-buy opener rather than a generic shell command stub.","objdump + caller inspection + trainbuy correlation + singleton-open correlation"
0x00440700,22,shell_open_or_focus_load_screen_page_1_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `1` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table already grounds page `1` as the company-overview wrapper.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440720,22,shell_open_or_focus_load_screen_page_3_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `3` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `3` as the income-statement slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440740,22,shell_open_or_focus_load_screen_page_4_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `4` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `4` as the balance-sheet slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440760,22,shell_open_or_focus_load_screen_page_5_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `5` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `5` as the haulage-report slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440780,22,shell_open_or_focus_load_screen_page_6_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `6` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `6` as the stock-data slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x004407a0,22,shell_open_or_focus_load_screen_page_0x0a_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `0x0a` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `0x0a` as the train-list slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x004407c0,22,shell_open_or_focus_load_screen_page_0x0c_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `0x0c` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `0x0c` as the station-list slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x004407e0,22,shell_open_or_focus_load_screen_page_0x0f_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `0x0f` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `0x0f` as the industry-list slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440800,22,shell_open_or_focus_load_screen_page_0x0e_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `0x0e` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `0x0e` as the cargo-list slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440820,22,shell_open_or_focus_load_screen_page_2_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `2` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `2` as the company-list slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440840,22,shell_open_or_focus_load_screen_page_7_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `7` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `7` as the player-list slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440860,22,shell_open_or_focus_load_screen_page_9_if_scenario_active,shell,cdecl,inferred,objdump + local disassembly + load-screen correlation,3,"Tiny direct shell command stub above `shell_open_or_focus_load_screen_page` `0x004e4ee0`. When the active scenario root `0x006cec78` exists, the helper requests ledger page `9` and otherwise returns immediately. The later `LoadScreen.win` page descriptor table grounds page `9` as the game-status slice.","objdump + local disassembly + load-screen correlation + page-table correlation"
0x00440880,35,shell_toggle_pause_or_restore_game_speed_and_emit_feedback_nudge,shell,cdecl,inferred,objdump + caller inspection + game-speed correlation,2,"Tiny shell command stub over the active scenario root `0x006cec78`. When the scenario object exists, the helper first re-enters `world_toggle_pause_or_restore_game_speed` `0x00437a60` with caller flag `1`, then immediately re-enters the indexed shell feedback helper `0x0045ea20` with selector `0x2c` and scalar `0.5f`. Current local evidence is only strong enough for the pause-toggle plus feedback-nudge structure, not for a tighter player-facing label for the second helper.","objdump + caller inspection + game-speed correlation + feedback-helper correlation"
0x004408b0,21,shell_command_save_game_via_world_bundle_coordinator,shell,cdecl,inferred,objdump + caller inspection + bundle-coordinator correlation + registration correlation + RT3.lng correlation,2,"Tiny registered shell command stub above `shell_map_file_world_bundle_coordinator` `0x00445de0`. The helper is wired by the default binding seeder at `0x0045f9e0` under action id `0x76` and localized label id `0x0d4e`, whose RT3.lng caption is `Save game`. When the active scenario root `0x006cec78` exists, it forwards three zero stack arguments into that coordinator and otherwise returns immediately. Current evidence therefore closes both the registration-side and player-facing identity of the ordinary save-game wrapper.","objdump + caller inspection + bundle-coordinator correlation + registration correlation + RT3.lng correlation"
0x004408d0,21,shell_command_quick_save_via_world_bundle_coordinator,shell,cdecl,inferred,objdump + caller inspection + bundle-coordinator correlation + registration correlation + RT3.lng correlation,2,"Tiny registered shell command stub above `shell_map_file_world_bundle_coordinator` `0x00445de0`. The helper is wired by the default binding seeder at `0x0045f9e0` under action id `0x76` and localized label id `0x0d50`, whose RT3.lng caption is `Quick save`. When the active scenario root `0x006cec78` exists, it forwards stack flags `(0, 1, 0)` into that coordinator and otherwise returns immediately. Current evidence therefore closes both the registration-side and player-facing identity of the quick-save wrapper.","objdump + caller inspection + bundle-coordinator correlation + registration correlation + RT3.lng correlation"
0x004408f0,207,shell_assign_camera_view_slot_and_publish_confirmation,shell,cdecl,inferred,objdump + command-registration correlation + world-view correlation,4,"Direct shell command branch for the camera-view assignment family. The helper requires the live world-view owner at `0x0062be68`, stores one camera-view snapshot into the selected slot through `world_view_store_camera_view_slot_snapshot` `0x0043b2c0`, formats one slot label through `0x0051b700`, localizes ids `369` and `370` through `0x005193f0`, resolves one optional current focus label through `0x0045f3d0`, and finally publishes a two-line shell modal through the shared shell modal owner `0x004554e0`. Current direct wrappers `0x00440b00..0x00440b90` map the slot selector in `ECX` to camera views `1..9` and `0`, and the shell command-registration block at `0x0046092f..0x00460cab` ties those wrappers to the localized `Assign Camera View 1..9` and `Assign Camera View 0` command strip. This is therefore the safest current read for the shared camera-view assignment owner rather than a generic world-view modal helper.","objdump + command-registration correlation + world-view correlation + shell-modal correlation + slot-wrapper correlation"
0x004409c0,303,shell_select_camera_view_slot_or_publish_unassigned_warning,shell,cdecl,inferred,objdump + command-registration correlation + world-view correlation,4,"Direct shell command branch for the camera-view selection family. The helper first requires the live world-view owner at `0x0062be68`, then re-enters `world_view_restore_camera_view_slot_snapshot_if_populated` `0x0043ca20`. When the selected slot is populated the restore helper updates the live world-view immediately and this wrapper returns without opening a modal. When the slot is still unassigned, the wrapper formats one slot label through `0x0051b700`, localizes ids `371`, `372`, and `373` through `0x005193f0`, resolves up to two optional focus-label strings through repeated `0x0045f3d0` calls, and then publishes the resulting three-line warning through `0x004554e0`. Current direct wrappers `0x00440ba0..0x00440c30` map the slot selector in `ECX` to camera views `1..9` and `0`, and the shell command-registration block at `0x00460903..0x00460c7a` ties those wrappers to the localized `Select Camera View 1..9` and `Select Camera View 0` command strip. This is therefore the safest current read for the shared camera-view selection owner rather than a generic world-view restore path.","objdump + command-registration correlation + world-view correlation + shell-modal correlation + slot-wrapper correlation"
0x00440b00,12,shell_assign_camera_view_1,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `1` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x00460939` ties this wrapper to localized command id `3475`, the `Assign Camera View 1` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b10,12,shell_assign_camera_view_2,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `2` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x0046099c` ties this wrapper to localized command id `3477`, the `Assign Camera View 2` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b20,12,shell_assign_camera_view_3,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `3` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x004609fe` ties this wrapper to localized command id `3479`, the `Assign Camera View 3` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b30,12,shell_assign_camera_view_4,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `4` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x00460a60` ties this wrapper to localized command id `3481`, the `Assign Camera View 4` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b40,12,shell_assign_camera_view_5,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `5` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x00460ac2` ties this wrapper to localized command id `3483`, the `Assign Camera View 5` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b50,12,shell_assign_camera_view_6,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `6` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x00460b24` ties this wrapper to localized command id `3485`, the `Assign Camera View 6` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b60,12,shell_assign_camera_view_7,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `7` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x00460b86` ties this wrapper to localized command id `3487`, the `Assign Camera View 7` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b70,12,shell_assign_camera_view_8,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `8` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x00460be8` ties this wrapper to localized command id `3489`, the `Assign Camera View 8` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b80,12,shell_assign_camera_view_9,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `9` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x00460c4a` ties this wrapper to localized command id `3491`, the `Assign Camera View 9` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440b90,9,shell_assign_camera_view_0,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_assign_camera_view_slot_and_publish_confirmation` `0x004408f0`. It fixes slot selector `0` in `ECX` before tail-jumping into the shared assignment owner. The command-registration block at `0x00460cac` ties this wrapper to localized command id `3493`, the `Assign Camera View 0` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440ba0,12,shell_select_camera_view_1,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `1` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460909` ties this wrapper to localized command id `3474`, the `Select Camera View 1` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440bb0,12,shell_select_camera_view_2,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `2` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x0046096b` ties this wrapper to localized command id `3476`, the `Select Camera View 2` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440bc0,12,shell_select_camera_view_3,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `3` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x004609cd` ties this wrapper to localized command id `3478`, the `Select Camera View 3` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440bd0,12,shell_select_camera_view_4,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `4` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460a2f` ties this wrapper to localized command id `3480`, the `Select Camera View 4` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440be0,12,shell_select_camera_view_5,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `5` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460a91` ties this wrapper to localized command id `3482`, the `Select Camera View 5` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440bf0,12,shell_select_camera_view_6,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `6` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460af3` ties this wrapper to localized command id `3484`, the `Select Camera View 6` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440c00,12,shell_select_camera_view_7,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `7` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460b55` ties this wrapper to localized command id `3486`, the `Select Camera View 7` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440c10,12,shell_select_camera_view_8,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `8` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460bb7` ties this wrapper to localized command id `3488`, the `Select Camera View 8` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440c20,12,shell_select_camera_view_9,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `9` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460c19` ties this wrapper to localized command id `3490`, the `Select Camera View 9` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440c30,9,shell_select_camera_view_0,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `0` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460c7b` ties this wrapper to localized command id `3492`, the `Select Camera View 0` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440e00,274,shell_command_step_active_window_subject_forward_or_publish_contextual_notice,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,3,"Paired shell command owner for the forward-step action registered at `0x45ffae` with action id `0x22` and localized label id `0x0d65`. The helper first prefers live `StationDetail.win` singleton `0x006d16d8`, where it re-enters `shell_station_detail_cycle_to_next_station_preserving_owner_and_station_site_class` `0x00505e30`. Failing that it prefers the live building-detail singleton `0x006cfd04` and re-enters `0x004b6fc0`, then the live company-detail singleton `0x006cfe4c` when no custom modal is active through `shell_has_live_custom_modal_dialog` `0x004c8680`, where it re-enters `shell_company_detail_select_next_active_company` `0x004c3540`, and finally the sibling live singleton `0x006d3b20`, where it re-enters `0x00514880`. When no supported live window family is active but scenario state `0x006cec78` exists, it builds one contextual notice through localized ids `0x017a/0x017b`, validates the modal path through `0x0045f3d0`, and publishes that notice through `0x004554e0`. This is therefore the broad forward-step shell command above several live detail-window families rather than another StationDetail-only helper.","objdump + command-registration correlation + local disassembly + caller inspection + live-window-priority correlation"
0x00440f20,274,shell_command_step_active_window_subject_backward_or_publish_contextual_notice,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,3,"Backward-step sibling of `shell_command_step_active_window_subject_forward_or_publish_contextual_notice` `0x00440e00`, registered at `0x45ffdf` with action id `0x21` and localized label id `0x0d66`. The helper walks the same live window-family priority chain: `StationDetail.win` through `shell_station_detail_cycle_to_previous_station_preserving_owner_and_station_site_class` `0x00505e40`, then the building-detail singleton `0x006cfd04` through `0x004b6fd0`, then the company-detail singleton `0x006cfe4c` through `shell_company_detail_select_previous_active_company` `0x004c3550` when no custom modal is active, and finally the sibling singleton `0x006d3b20` through `0x00514890`. When none of those families is live but scenario state `0x006cec78` exists, it builds and conditionally publishes the paired contextual notice through localized ids `0x017c/0x017d`, `0x0045f3d0`, and `0x004554e0`. This is therefore the broad reverse-step shell command above several live detail-window families rather than another StationDetail-only helper.","objdump + command-registration correlation + local disassembly + caller inspection + live-window-priority correlation"
0x00441040,131,shell_open_or_focus_train_detail_for_current_or_first_owned_train,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,4,"Direct shell command branch registered at `0x45ff1b` with action id `0x54` and localized label id `0x0d62`. The helper first requires active scenario state `0x006cec78` and the live detail-panel controller `0x006d0818`, then reads the current train-subject id from `[detail+0x78]` and validates it against the live train collection `0x006cfcbc`. When that current subject is invalid it resolves the selected chairman company through `scenario_state_get_selected_chairman_company_record` `0x00434870`, counts that company's owned trains through `company_count_owned_trains` `0x004264c0`, and falls back to the first owned-train id through `0x00426520`. Once a valid train id survives it forwards `(train_id, 2)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. This is therefore the direct train-detail opener or refresher for the current subject with first-owned-train fallback, not a generic collection query.","objdump + command-registration correlation + local disassembly + caller inspection + train-detail correlation + first-owned-train fallback correlation"
0x004410d0,138,shell_open_or_focus_station_detail_for_current_or_first_owned_linked_station,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,4,"Direct shell command branch registered at `0x45ff7d` with action id `0x53` and localized label id `0x0d64`. The helper first requires active scenario state `0x006cec78` and the live detail-panel controller `0x006d0818`, then reads the current station-subject id from `[detail+0x80]` and validates it against the live placed-structure collection `0x006cec20`. When that current subject is invalid it resolves the selected chairman company through `scenario_state_get_selected_chairman_company_record` `0x00434870`, counts that company's owned linked stations through `company_count_linked_transit_sites` `0x00426590(0)`, and falls back to the first owned linked-station id through `0x00426620(1, 0)`. Once a valid station id survives it forwards `(station_id, 5)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. This is therefore the direct station-detail opener or refresher for the current subject with first-owned-station fallback, not a generic collection query.","objdump + command-registration correlation + local disassembly + caller inspection + station-detail correlation + first-owned-station fallback correlation"
0x00441160,50,shell_command_dispatch_live_world_followon_by_query_0x450150,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly,2,"Small registered shell command sibling beneath the same command table. The helper requires active scenario state `0x006cec78` plus the live world root `0x0062c120`, re-enters query helper `0x00450150`, and then dispatches one of two world-root follow-ons: `0x00453370` when that query returns zero, or `0x00453780` when it returns nonzero. The registration block at `0x460286` ties this body to localized label id `0x0d73` and command id `0x47`. The row is therefore kept at that concrete dispatch-shape and localized-command level.","objdump + command-registration correlation + local disassembly + world-root followon correlation"
0x004411a0,52,shell_command_dispatch_live_route_store_followon_by_query_0x4934a0_zero,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly,2,"Small registered shell command sibling over the live route-store root `0x006cfca8`. The helper requires active scenario state `0x006cec78` plus a live route-store owner, re-enters `0x004934a0(0)`, and then dispatches one of two route-store follow-ons: `0x00491880` when that query returns nonzero, or `0x004932a0` when it returns zero. The registration block at `0x4602b7` ties this body to localized label id `0x0f01` and the same command id `0x47` family. The row is therefore kept at that concrete dispatch-shape and localized-command level.","objdump + command-registration correlation + local disassembly + route-store followon correlation"
0x00441240,21,shell_command_toggle_shared_world_preview_global_0x62be84,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + global-state correlation,2,"Tiny registered shell command that flips global dword `0x0062be84` between `0` and `1`. The same global is already grounded on the station-detail candidate-service preview side and on the city-site connection-bonus label formatter, so this command currently reads as a shared world-preview-global toggle rather than a detail-window-local helper. The registration block at `0x4602e8` ties it to action id `0x4e` and localized label id `0x0d74`.","objdump + command-registration correlation + local disassembly + global-state correlation + shared-preview-global correlation"
0x00441260,49,shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + overlay-control correlation,3,"Registered shell command beneath action id `0x09` and localized label id `0x0d70`. The helper first rejects while sibling singleton `0x006d3b4c` is live, then requires active scenario state `0x006cec78` and the main shell presenter root `0x006d4024`. It derives one boolean from presenter field `[root+0x114216] == 1`, passes that boolean together with variant selector `0` into `0x00433da0`, and that shared helper in turn restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across detail-panel controls `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and forwards the variant into world helper `0x0043a0a0`. The row is therefore kept at that concrete mode-`0x19` variant-open level.","objdump + command-registration correlation + local disassembly + overlay-control correlation + mode-0x19 correlation"
0x004412a0,49,shell_command_open_detail_panel_mode_0x19_variant_1_via_game_uppermost_overlay,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + overlay-control correlation,3,"Variant-`1` sibling of `shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay` `0x00441260`, registered under the same action id `0x09` family with localized label id `0x0d71`. The helper enforces the same `0x006d3b4c` / scenario-state / presenter-root gates, derives the same presenter boolean from `[0x006d4024+0x114216] == 1`, and then re-enters `0x00433da0` with variant selector `1`, which restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across controls `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and forwards the selected variant into world helper `0x0043a0a0`. The row is therefore kept at that concrete mode-`0x19` variant-open level.","objdump + command-registration correlation + local disassembly + overlay-control correlation + mode-0x19 correlation"
0x004412e0,85,shell_command_enable_shell_state_band_0x1df_and_refresh_derived_year_thresholds,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + shell-state correlation,3,"Registered shell command beneath action id `0x45` and localized label id `0x0d75`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then accepts either when shell-state probe `0x00435480` succeeds or when shell flag `[0x006cec74+0x1df]` is already nonzero through `0x00482840`. On the active path it re-enters `scenario_state_rebuild_derived_year_threshold_band` `0x004351c0` with stack flag `1` and then writes shell dwords `[0x006cec74+0x1df/+0x1e3] = 0/0` through `0x00482850`, which also triggers the follow-on refresh helper `0x004354a0`. The row is therefore kept at that shell-state-band and year-threshold refresh level.","objdump + command-registration correlation + local disassembly + shell-state correlation + year-threshold-band correlation"
0x004411e0,31,shell_command_toggle_presenter_flag_0x114276_if_present,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + presenter-root correlation,2,"Small registered shell command beneath action id `0x48` and localized label id `0x0d79`. The helper probes the main shell presenter root at `0x006d4024` and, when that root is live, flips the dword at `[presenter+0x114276]` between `0` and `1`. Current evidence is only strong enough for the direct toggle and owner boundary, not for a tighter user-facing semantic name for that presenter-side latch.","objdump + command-registration correlation + local disassembly + presenter-root correlation + toggle-latch correlation"
0x00441200,52,shell_command_send_message_0xcb_to_control_0x9858_if_active_scenario,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + shell-message correlation,2,"Small registered shell command beneath action id `0x5a` and localized label id `0x0d7b`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then forwards shell message `0xcb` with control id `0x9858` plus three zero trailing arguments into the shared shell runtime at `0x006d401c` through `0x00538e00`. The row is therefore kept at that concrete message-injection and control-`0x9858` level.","objdump + command-registration correlation + local disassembly + shell-message correlation + active-scenario correlation"
0x00441340,15,shell_command_dispatch_cheat_code_modal_if_active_scenario,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + cheat-owner correlation,2,"Tiny registered shell command beneath action id `0x00be` and localized label id `0x0d7c`. The helper requires active scenario state `0x006cec78` and then tail-calls `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` `0x00437d70`. This is therefore the direct command-table entry for the cheat-code modal owner rather than a generic scenario follow-on.","objdump + command-registration correlation + local disassembly + cheat-owner correlation"
0x00441360,68,shell_command_focus_subject_from_collection_0x62b244_via_selector_0x40b2d0,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + focus-handoff correlation,3,"Registered shell command beneath action id `0x47` and localized label id `0x0db3`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, requires live collection root `0x0062b244`, then queries selector `0x0040b2d0(0, 1)`. When that selector returns a nonzero subject id, the helper forwards `(1, 3, subject_id)` into `shell_world_focus_selected_subject_kind_and_id` `0x00437a90`. The row is therefore kept at that concrete focus-handoff and selector-resolved subject level.","objdump + command-registration correlation + local disassembly + focus-handoff correlation + selector-correlation"
0x00441490,85,shell_command_open_overview_for_previous_or_latest_fixed_preview_record,shell,cdecl,inferred,llvm-objdump + local disassembly + fixed-record-family correlation,3,"Small shell-side command over the fixed preview-record family rooted at `0x005ce418`. The helper first queries `fixed_preview_record_query_min_sequence_entry_or_zero` `0x00473e70(0)` from the live preview dataset object `0x006cea4c`; when that inactive-minimum sequence record exists it immediately asks `fixed_preview_record_query_previous_sequence_entry_or_zero` `0x00473ee0` for the predecessor sequence `([entry+0x14] - 1)`. When no inactive minimum entry exists, it falls back to `fixed_preview_record_query_max_sequence_entry_or_zero` `0x00473dc0`. Any resulting record pointer is then forwarded into `shell_open_or_focus_overview_for_fixed_preview_record` `0x004f3a10`, otherwise the command returns silently. The row is therefore kept at that fixed-preview command shape and localized-command level.","llvm-objdump + local disassembly + fixed-record-family correlation + overview-window correlation"
0x00441500,399,shell_command_prompt_for_class0_region_name_and_focus_matching_world_region,shell,cdecl,inferred,llvm-objdump + local disassembly + region-family correlation + world-view correlation,3,"Broader shell command that prompts for one class-`0` world-region name and focuses the matching region in the live world view. The helper requires active scenario state `0x006cec78`, opens one callback-driven prompt rooted at localized id `0x16a` through `0x005193f0 -> 0x004c98a0`, and then walks the live region collection `0x0062bae0`. It skips any nonzero region-class records at `[region+0x23e]`, compares the entered text against each candidate name `[region+0x356]` through the bounded locale-aware string comparator `0x005a5f26`, and on the first match temporarily sets `0x0062be70 = 1`, clears the live world-view latch `[view+0x346]` through `0x0043a190` when the view owner `0x0062be68` is live, and then re-enters `shell_world_view_center_on_object_with_mode_specific_zoom_policy` `0x00433900` with the matched region pointer before restoring `0x0062be70` and refreshing the view through vtable slot `+0x1c`. When no class-`0` region name matches, it instead opens the fixed failure modal rooted at localized id `0x16b`. Current evidence is strongest for the class-`0` region-name prompt and focus owner rather than a narrower city-only label.","llvm-objdump + local disassembly + region-family correlation + world-view correlation + locale-compare correlation"
0x00441690,244,shell_command_prompt_for_text_and_submit_selector1_multiplayer_transport_request_when_auxiliary_preview_ready,shell,cdecl,inferred,llvm-objdump + local disassembly + multiplayer-preview correlation + auxiliary-preview-owner correlation,3,"Broader shell command that opens one text-entry prompt and forwards the entered string into the multiplayer preview-dataset transport path, but only when the auxiliary-preview owner is live. The helper requires active scenario state `0x006cec78`, the auxiliary-preview-owner gate `shell_has_auxiliary_preview_owner` `0x00434050`, and a live queued-preview record at `[world+0x66ae]`. It then increments the shared shell modal depth through `0x00538a30`, sets shell-global `0x0062be80 = 1`, opens one callback-driven prompt rooted at localized id `0x0b6d` through `0x005193f0 -> 0x004c98a0`, and when the returned text buffer is nonempty submits `(request_id 0, selector 1, payload, strlen+1, flag 1, aux 0)` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` on the live preview dataset `0x006cd8d8`. On every exit it decrements the shell modal depth through `0x00538a40`, clears `0x0062be80`, and returns `0`; failed preconditions return `1`. The row is therefore kept at that structural prompt-plus-selector-`1` transport level for prompt `0x0b6d`.","llvm-objdump + local disassembly + multiplayer-preview correlation + auxiliary-preview-owner correlation + shell-modal-depth correlation"
0x00441790,111,shell_resolve_focused_or_fallback_train_owned_by_selected_company,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Shared current-train resolver beneath the shell-side train command strip. The helper first probes the live world-view owner at `0x0062be68`, and when a focused subject exists through `[view+0x60]` plus vtable slot `+0x6c`, it resolves the corresponding live train from collection `0x006cfcbc` by id `[subject+0x390]`. It then requires that train's owner company id `[train+0x51]` to match the current scenario-selected company through `scenario_state_get_selected_chairman_company_id` `0x004337a0`; otherwise it falls back to `0x005130f0` and repeats the same ownership test on that fallback train. Success returns the live train pointer; failure returns null. Current grounded callers are the adjacent shell command leaves `0x00441810`, `0x00441870`, and `0x004418a0`, so this is the safest current read for the focused-or-fallback owned-train resolver rather than a broader world-view query.","objdump + local disassembly + caller inspection + world-view correlation + selected-company correlation + train-command-strip correlation"
0x00441810,79,shell_command_crash_current_or_fallback_owned_train_or_warn,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + RT3.lng strings,3,"Registered shell command beneath action id `0x43` and localized label id `0x0d77` `Current train crashes`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then resolves one owned train through `shell_resolve_focused_or_fallback_train_owned_by_selected_company` `0x00441790`. When no train survives it opens the simple shell modal rooted at localized id `365` `There is no train available to crash!` through `0x005193f0 -> 0x004c98a0`. Otherwise it forwards the resolved train into `train_trigger_crash_state_effects_and_optional_owner_notifications` `0x004ad7a0(1)`.","objdump + command-registration correlation + local disassembly + RT3.lng strings + crash-owner correlation"
0x00441870,34,shell_command_mark_current_or_fallback_owned_train_whistle_request,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + RT3.lng strings,2,"Registered shell command beneath action id `0x57` and localized label id `0x0d76` `Current train whistles`. The helper resolves one owned train through `shell_resolve_focused_or_fallback_train_owned_by_selected_company` `0x00441790`; when that succeeds it resolves the train-side visual owner through `0x004a77b0` and writes request dword `1` into `[owner+0x33a]`. Failure is silent and returns `0`. Current evidence is strong enough for the whistle-request owner shape even though the deeper user-facing meaning of `[owner+0x33a]` remains open.","objdump + command-registration correlation + local disassembly + RT3.lng strings + train-visual-owner correlation"
0x004418a0,79,shell_command_break_down_current_or_fallback_owned_train_or_warn,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + RT3.lng strings,3,"Registered shell command beneath action id `0x42` and localized label id `0x0d78` `Current train breaks down`. The helper enforces the same active-scenario and single-profile gate as the crash sibling `0x00441810`, resolves one owned train through `shell_resolve_focused_or_fallback_train_owned_by_selected_company` `0x00441790`, and when no train survives opens the simple shell modal rooted at localized id `366` `There is no train available to break down!` through `0x005193f0 -> 0x004c98a0`. Otherwise it forwards the train into the sibling failure-state owner `0x004ada00(1)`. Current evidence is strongest for the breakdown-command wrapper above that sibling train-state body rather than a generic shell modal leaf.","objdump + command-registration correlation + local disassembly + RT3.lng strings + failure-state sibling correlation"
0x00441900,53,shell_command_toggle_overview_window_page_0_or_close_if_already_active,shell,cdecl,inferred,objdump + local disassembly + detail-manager correlation,3,"Small shell command-style helper in the `Overview.win` page-toggle strip. The helper probes the shell detail-panel controller at `0x006d0818`; when current mode `[detail+0x8c]` already equals `9` and current overview page `[detail+0x90]` already equals `0`, it closes that page by forwarding `(-1, 0)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Otherwise it requests mode `9`, page `0` through the same owner. Current evidence is strong enough for the page-toggle shape, but I have not grounded the exact registration row for this specific wrapper yet.","objdump + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
0x00441940,52,shell_command_toggle_overview_window_page_1_or_close_if_already_active,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + detail-manager correlation,3,"Registered shell command beneath action id `0x73` and localized label id `0x0d4b`. The helper mirrors `0x00441900`, but it tests for `Overview.win` mode `9` page `1` at `[0x006d0818+0x90]`; a same-page hit closes through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)`, otherwise it requests mode `9`, page `1`. This is the safest current read for the second `Overview.win` page-toggle command rather than another anonymous detail-manager wrapper.","objdump + command-registration correlation + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
0x00441980,52,shell_command_toggle_overview_window_page_2_or_close_if_already_active,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + detail-manager correlation,3,"Registered shell command beneath action id `0x74` and localized label id `0x0d4c`. The helper mirrors the adjacent page-toggle siblings, but it tests for `Overview.win` mode `9` page `2`; same-page hits close through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)`, while every other case requests mode `9`, page `2`. This is the safest current read for the third `Overview.win` page-toggle command rather than another generic shell leaf.","objdump + command-registration correlation + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
0x004419c0,52,shell_command_toggle_overview_window_page_3_or_close_if_already_active,shell,cdecl,inferred,objdump + local disassembly + detail-manager correlation,3,"Small shell command-style helper in the same `Overview.win` page-toggle strip. The helper tests the live detail manager for mode `9`, page `3`, closes that exact page through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)` when already active, and otherwise requests mode `9`, page `3`. Current evidence is strong enough to keep this as the fourth overview-page toggle, but I have not grounded the exact registration row for this specific wrapper yet.","objdump + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
0x00441a00,52,shell_command_toggle_overview_window_page_4_or_close_if_already_active,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + detail-manager correlation,3,"Registered shell command beneath action id `0x72` and localized label id `0x0d4a`. The helper tests the live detail manager for mode `9`, page `4`, closes that exact page through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)` when already active, and otherwise requests mode `9`, page `4`. This is the current safest read for the fifth overview-page toggle command rather than a more semantic page-name claim.","objdump + command-registration correlation + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
0x00441ac0,39,shell_command_load_game_via_map_file_entry_coordinator,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + RT3.lng correlation,2,"Small registered shell command beneath action id `0x77` and localized label id `0x0d4f`, whose RT3.lng caption is `Load game`. The helper requires active scenario state `0x006cec78`, rejects when shell counter `[0x006d401c+0xc64]` is already positive, and then forwards three zero stack arguments into `shell_map_file_entry_coordinator` `0x00445ac0`. Current evidence therefore closes the player-facing identity of the ordinary load-game wrapper as well as its wrapper shape and gate conditions.","objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + shell-idle-gate correlation + RT3.lng correlation"
0x00441af0,39,shell_command_quick_load_via_map_file_entry_coordinator,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + RT3.lng correlation,2,"Small registered shell command beneath action id `0x77` and localized label id `0x0d51`, whose RT3.lng caption is `Quick load`. The helper mirrors `0x00441ac0`, but forwards stack flags `(0, 1, 0)` into `shell_map_file_entry_coordinator` `0x00445ac0` after the same active-scenario and shell-idle gate. Current evidence therefore closes the player-facing identity of the quick-load wrapper as well as its gate and flag-triplet shape.","objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + shell-idle-gate correlation + RT3.lng correlation"
0x00441b20,39,shell_command_clamp_world_dword_0x168d_not_below_0x1689_if_world_live,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + world-root correlation,2,"Small registered shell command beneath action id `0x48` and localized label id `0x0d72`. The helper requires live world root `0x0062c120`, compares dwords `[world+0x1689]` and `[world+0x168d]`, and rewrites `[world+0x168d]` so it is never below `[world+0x1689]`. Current evidence is only strong enough for that direct clamp and owner boundary, not for a tighter semantic name for this world-side scalar pair.","objdump + command-registration correlation + local disassembly + world-root correlation + clamp correlation"
0x00441b50,358,shell_command_toggle_editor_map_mode_with_one_shot_warning_modals,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,3,"Broader registered shell command sibling above the editor-map-mode setter `0x00482e50`. The helper requires active scenario state `0x006cec78` and the live shell-state root `0x006cec74`, then branches on current editor-map mode lane `[shell+0x68]`. When editor-map mode is already active it uses one-shot latch `0x0062be88` to optionally publish localized modal `0x017e` through `0x005193f0 -> 0x004c98a0`; when editor-map mode is inactive it instead opens warning `0x0b6e` if the active-profile-count gate `0x004349a0` exceeds `1`, or uses one-shot latch `0x0062be8c` to optionally publish modal `0x0b24`. After those gates it computes target mode `([shell+0x68] == 0)` and forwards that boolean into `shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects` `0x00482e50`. Current evidence is strong enough to treat this as the real editor-map-mode toggle command with one-shot warning modals rather than another anonymous scenario-side follow-on.","objdump + command-registration correlation + local disassembly + caller inspection + editor-map-mode correlation + warning-modal correlation"
0x00441cb0,111,shell_command_increment_time_of_day_presentation_scalar_by_half_step_and_refresh_calendar,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + calendar-refresh correlation + RT3.lng correlation,3,"Registered shell command beneath action id `0x6b` and localized label id `0x0db5`, whose RT3.lng caption is `Increment Time Of Day`. The helper requires active scenario state `0x006cec78`, rejects when the active-profile-count gate `0x004349a0` exceeds `1`, clears shell dwords `[0x006cec74+0x233]` and `[+0x124]`, adds `0.5` to startup-side scalar `[0x006cec78+0xbfa]`, then re-enters `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute counter `[0x006cec78+0x15]` before refreshing the live view owner at `0x0062be68` through `0x00439a80`. Current evidence therefore closes the player-facing label and narrows the command to the time-of-day presentation family, even though the exact relationship between `[world+0xbfa]` and the mixed-radix calendar state beneath `0x00409e80` still needs one deeper pass.","objdump + command-registration correlation + local disassembly + calendar-refresh correlation + startup-scalar correlation + RT3.lng correlation"
0x00441d20,111,shell_command_decrement_time_of_day_presentation_scalar_by_half_step_and_refresh_calendar,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + calendar-refresh correlation + RT3.lng correlation,3,"Registered shell command beneath action id `0x6d` and localized label id `0x0db6`, whose RT3.lng caption is `Decrement Time Of Day`. The helper mirrors `0x00441cb0`, but subtracts `0.5` from startup-side scalar `[0x006cec78+0xbfa]` before re-entering `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute counter `[0x006cec78+0x15]` and refreshing the live view owner through `0x00439a80`. It shares the same active-scenario gate, active-profile-count gate, and shell dword clears `[0x006cec74+0x233]` and `[+0x124]`. Current evidence therefore closes the player-facing label and narrows the command to the time-of-day presentation family, even though the exact relationship between `[world+0xbfa]` and the mixed-radix calendar state beneath `0x00409e80` still needs one deeper pass.","objdump + command-registration correlation + local disassembly + calendar-refresh correlation + startup-scalar correlation + RT3.lng correlation"
0x00441d90,135,shell_build_percent_status_payload_clamped_0_to_100,shell,cdecl,inferred,objdump + local disassembly + caller inspection + status-publisher correlation,3,"Shared percentage-status payload builder used by the save or load progress strip. The helper divides one caller float by one caller integer, multiplies by fixed scalar `100.0f`, rounds through `0x005a10d0`, clamps the result to at most `100`, and then packages that percentage into the small status payload built through `0x0051b700`, `0x005193f0`, and `0x00518de0`, returning the final shell text handle rooted at `0x0062c0d8`. Current grounded callers include the repeated progress-notice loop inside `shell_map_file_world_bundle_coordinator` `0x00445de0` and the adjacent throttled progress callback `0x00441e20`, so this is best read as the shared percent-status payload builder rather than a one-off modal helper.","objdump + local disassembly + caller inspection + status-publisher correlation + save-load-progress correlation"
0x00441e20,155,shell_progress_callback_publish_incremental_percent_status_until_target,shell,cdecl,inferred,objdump + caller inspection + local disassembly + progress-callback correlation,3,"Shared incremental progress callback above `shell_build_percent_status_payload_clamped_0_to_100` `0x00441d90`. The helper first checks global progress latches `0x0062bec8`, `0x0062becc`, and `0x0062c118`; when the caller target count has not advanced it returns immediately, and when the target equals `0x64` it instead advances `0x0062becc` by `0x14` and clears `0x0062c118`. Otherwise it increments `0x0062c118`, derives one intermediate percentage from the caller target divided by `3`, scaled by `100.0`, offset by current base `0x0062becc`, and then re-enters `shell_build_percent_status_payload_clamped_0_to_100` before publishing the resulting status through `0x00538c70` and servicing the shell frame through `0x00482160`. Current grounded owner correlation is the callback installation at `0x00442960`, which writes this function into global `0x00d93988` before entering a longer staged work loop, plus the same save or load progress family around `0x00445de0`. This is the safest current read for the throttled percent-status callback rather than another direct shell command leaf.","objdump + caller inspection + local disassembly + progress-callback correlation + staged-work correlation + shell-status correlation"
0x00441ec0,107,shell_map_bundle_serialize_or_restore_stage_dword_and_fixed_preview_payload_tags_0x2ee0_0x2ee1_0x3c2,map,cdecl,inferred,objdump + local disassembly + caller inspection + tagged-bundle correlation,2,"Small tagged-bundle helper in the adjacent map-bundle and companion-image strip. The helper first snapshots shared stage-counter dword `0x00620e94` into one stack-local slot, then splits into two concrete transport branches. On the slot-table branch `esi == 0` it writes that 4-byte leading dword through `global_indexed_slot_table_write_bytes` `0x00531030`, emits tagged headers `0x2ee0` and `0x2ee1` through `0x00531340`, and streams one fixed `0x03c2`-byte payload block from the caller buffer between those tags. On the staged-object branch `esi != 0` it opens the incoming object through `0x005a261f` and mirrors the same `dword + 0x2ee0 + 0x03c2 + 0x2ee1` strip through repeated `0x005a276f` transfers. The current incoming branches are tighter now too: direct package-save path `0x00444f47` reaches this helper immediately after `0x00442ba0`, while the companion-image and companion-payload sidecar branches around `0x00445983`, `0x00443cd3`, and `0x004459dd` also re-enter it after their file work. The separate `.smp` slot-table branch at `0x00446312` does not use this helper; it calls `0x00442ba0` and then emits `0x2ee0`, writes `0x403c2` bytes, and closes `0x2ee1` directly. Current local evidence still does not show `0x00441ec0` itself committing the restored leading dword back into `0x00620e94`, so the safest name stays on the serialize-or-restore tag strip rather than a stronger stage-counter restore claim.","objdump + local disassembly + caller inspection + tagged-bundle correlation + companion-image correlation + stage-counter correlation + branch-split correlation + save-branch correlation"
0x00441f70,384,shell_map_bundle_load_companion_image_file_into_global_staging_buffer_and_sync_tags,map,cdecl,inferred,objdump + local disassembly + caller inspection + literal inspection,3,"Broader companion-image load helper paired with `0x004420f0`. The helper derives an extensionless stem from the caller path through `support_copy_string_stem_before_first_dot` `0x0051dde0`, appends either `_A.tga` or `_A.jpg` according to selector byte `[record+0x09]`, opens the resulting path in mode `r+b`, streams the file through `0x005a1b05` into a temporary `0x200`-byte loop buffer, and then mirrors the loaded bytes through `0x005a276f` before writing the companion-image selector tags through `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`. Current grounded caller is the broader save or load coordinator strip around `0x00445983`, and the sibling overlay-surface owner `0x00535430` later consumes the same global fallback descriptor rooted at `0x0062bed4/0x0062bed8`. This is the safest current read for the companion-image file import path rather than a generic external file loader.","objdump + local disassembly + caller inspection + literal inspection + companion-image correlation + global-fallback-buffer correlation"
0x004420f0,476,shell_map_bundle_write_global_staging_buffer_to_companion_image_file_and_return_path,map,cdecl,inferred,objdump + local disassembly + caller inspection + literal inspection,3,"Write-side sibling of `0x00441f70` for the same companion-image family. The helper derives an extensionless stem from the caller destination path, appends either `_A.tga` or `_A.jpg` by selector byte `[record+0x09]`, tries to open that file in mode `r+b`, and when no existing file is present allocates or reuses the global staging buffer rooted at `0x0062bed4/0x0062bed8` before streaming bytes from the source handle in `0x200`-byte chunks. On the existing-file path it writes the same chunks through `0x005a276f`; on completion it clears the temporary typed cache through `0x0053c900`, copies the final companion path into the caller out-buffer, and returns. Current grounded caller is the save-side branch at `0x00443d1c`, which immediately follows this helper by writing the paired tagged headers `0x2ee0/0x2ee1`. The later world-presentation fallback path `0x00535430` also consumes the same global staging descriptor, so this is the safest current read for the companion-image export path rather than a generic file-copy helper.","objdump + local disassembly + caller inspection + literal inspection + companion-image correlation + global-fallback-buffer correlation"
0x00450150,7,world_query_preview_mode_0x15_latch_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny getter for the shared world-side preview-mode latch byte `[this+0x21c5]`. The helper returns that byte unchanged as a boolean-like integer. Current grounded callers are the shell command strip at `0x00441173`, which chooses between the enter and exit siblings `0x00453370` and `0x00453780`, and the TrackLay destructor path at `0x0050db8d`, which only re-enters `0x00453510` when this latch is clear while world mode `[world+0x2175]` still equals `0x15`. This is therefore the safest current read for the direct mode-`0x15` preview-latch query rather than a broader world-mode predicate.","objdump + caller inspection + local disassembly + mode-0x15 correlation + preview-latch correlation"
0x00450160,816,world_recompute_mode3_preview_normalization_window_0x2195_0x2199,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Mode-`3` prepass beneath the shared world preview rebuild owner `0x00450520`. The helper walks the live secondary-grid cells rooted at `[this+0x2129]` across world dimensions `[+0x2145/+0x2149]`, skips blocked class lanes when cell byte `[cell+0xe6]` carries bit `0x01` without `0x04`, and scores each surviving cell either with fixed `200.0f` or with `0x0042c960(remainder(id, 0x35))` against the current primary preview id `[this+0x2179]`. It tracks min, max, average, and one farther qualifying score through `0x0042b350`, then writes the resulting float window into `[this+0x2195]` and `[this+0x2199]`, clamping the final scale lane to at least `1.0f`. Current grounded caller is the shared active preview or tool overlay rebuild owner `0x00450520`, which invokes this prepass only when current world preview mode `[this+0x2175]` equals `3`. This is the safest current read for the mode-`3` normalization-window recompute helper rather than a broader map-load statistic pass.","objdump + caller inspection + local disassembly + mode-3 correlation + normalization-window correlation"
0x00450490,144,world_query_mode3_preview_cell_best_matching_six_byte_list_color,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small per-cell query beneath the same mode-`3` world preview family. The helper indexes one secondary-grid cell from `(x, y)` through `[this+0x2129]`, reads the six-byte entry list described by count dword `[cell+0xeb]` and pointer `[cell+0xef]`, and searches for the strongest matching entry when the caller-supplied selector id matches the row's leading `u16` or when that selector id is `0`. When any match is found it returns the shared tagged color lane `[0x006cec78+0x66ba] | 0x2c000000`; otherwise it returns zero. Current grounded callers are the mode-`3` pixel cases inside `world_rebuild_active_preview_or_tool_overlay_surface_and_publish_normalized_bounds` `0x00450520`, where this helper acts as the local linked-site or service-list color query rather than as a top-level roster scan.","objdump + caller inspection + local disassembly + mode-3 correlation + per-cell list correlation + tagged-color correlation"
0x00450520,4074,world_rebuild_active_preview_or_tool_overlay_surface_and_publish_normalized_bounds,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Broader shared rebuild owner for the world-side preview or tool-mode family rooted at `[this+0x2175]`, `[+0x2179..+0x2191]`, and transient surface root `[this+0x478]`. The helper first rejects when no active mode is set, runs the mode-`3` normalization prepass `world_recompute_mode3_preview_normalization_window_0x2195_0x2199` `0x00450160` when required, derives the current world-cell rectangle and float scale from the active mode table at `0x005ee5e0/0x005ee5e4`, clamps the active sub-rectangle against the live world dimensions and shell presentation caps, reuses or rebuilds the transient overlay surface through `0x00532490`, `0x00534f80`, and `0x005323f0`, then fills that surface by switching over the active mode and computing one packed color per cell. The per-mode pixel cases mix checkerboard fallbacks with several grounded world queries, including mode-`3` helper `world_query_mode3_preview_cell_best_matching_six_byte_list_color` `0x00450490`, the secondary-grid and overlay classifiers `0x00534e10/0x00534e50/0x00534e90/0x00534ec0/0x00534f00/0x00534f40`, terrain and grid queries `0x00448af0`, `0x00448f00`, `0x00448f30`, and one scalar ramp through `0x0051dfc0`. After rasterizing the active rectangle it publishes the active mode byte through `0x00532510`, refreshes the overlay live flag through `0x00532460`, and pushes the normalized preview bounds back through `0x00532520` and `0x005324e0`. Current grounded callers include the shared wrappers `0x00452d80`, `0x00452db0`, `0x00452f20`, `0x00452f60`, and `0x00452fa0`, plus the mode-`0x15` entry or clear siblings `0x00453370` and `0x00453510`. This is therefore the safest current read for the shared active preview or tool overlay rebuild owner rather than any one window family's private raster pass.","objdump + caller inspection + local disassembly + active-mode correlation + overlay-surface correlation + normalized-bounds correlation + paint-tool correlation"
0x00452d30,68,world_clear_aux_preview_mode_0x2171_and_overlay_companion_live_flag,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small shared clear path inside the world-side preview or tool-mode family. When auxiliary preview mode dword `[this+0x2171]` equals `1`, the helper also clears optional flag dword `[this+0x219d]` and decrements the paired shell-presenter counters `[0x006d4024+0x114272/+0x114266]` when flag `[this+0x21a1]` is still set. It then zeroes `[this+0x2171]` unconditionally and tail-jumps into `world_presentation_clear_overlay_companion_block_live_flag` `0x00532360`. Current grounded callers are the mode-`0x15` entry or clear owners `0x00453370` and `0x00453510`, plus the shell-side cleanup paths in `BuildingDetail.win` at `0x004bc1f1` and `StationDetail.win` at `0x00504a90/0x00505bf0`. This is therefore the safest current read for the auxiliary preview-mode clear helper rather than a generic overlay reset.","objdump + caller inspection + local disassembly + auxiliary-preview correlation + overlay-companion correlation"
0x00452ca0,137,world_set_aux_preview_mode_0x2171_and_reseed_overlay_companion_grid,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small shared setter beside the same world-side preview family. The helper stores the caller mode into auxiliary preview dword `[this+0x2171]`, conditionally arms optional companion flag `[this+0x219d]` when the caller mode is `1`, and increments the paired shell-presenter counters `[0x006d4024+0x114272/+0x114266]` when live flag `[this+0x21a1]` is already set at that moment. It then chooses one of three coarse tile-size lanes (`0x40`, `4`, or `1`) from the auxiliary preview mode and forwards those dimensions plus live world size `[0x0062c120+0x2155/+0x2159]` into `0x00532310` to reseed the local overlay-companion grid. Current grounded callers are `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which passes mode `1`, and `shell_change_height_window_construct` `0x004bcb50`, which passes mode `6`. This is therefore the safest current read for the auxiliary preview-mode setter and companion-grid reseed helper rather than a station-detail-only preview latch.","objdump + caller inspection + local disassembly + auxiliary-preview correlation + companion-grid correlation"
0x00452d80,33,world_store_preview_scalar_0x217d_and_refresh_active_mode_if_nonzero,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny setter in the same world-side preview family. The helper stores one caller dword into `[this+0x217d]` and, when current mode `[this+0x2175]` is already nonzero, re-enters `0x00450520(0)` to rebuild the active preview or tool state. Current grounded caller is `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which forwards the current station-detail row through this helper after staging the candidate id. This is the safest current read for the direct scalar setter plus active-mode refresh rather than a more semantic station-only helper.","objdump + caller inspection + local disassembly + preview-scalar correlation"
0x00452db0,88,world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared linked-site id setter beneath the same world-side preview family. The helper first unregisters the previous linked site through `0x00413620` when current mode `[this+0x2175]` equals `3` and old id `[this+0x2181]` is nonzero, stores the caller id into `[this+0x2181]`, then registers the new id through `0x00413750` when mode `3` is still active and the new id is nonzero. When any preview or tool mode is already active it finally re-enters `0x00450520(0)` to rebuild that mode. Current grounded callers are the linked-peer action branches at `0x0040e5b1`, `0x0040e65d`, and `0x0040e97d`, plus `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which uses it while arming the current station preview. This is therefore the safest current read for the preview-family linked-site setter and mode-3 rebind owner rather than a plain id store.","objdump + caller inspection + local disassembly + linked-site correlation + mode-3 rebind correlation"
0x00452e10,136,placed_structure_collection_dispatch_virtual_slot_0x0c_or_0x10_by_optional_subject_and_linked_peer_gate,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Collection-side dispatch helper over every live placed structure in `0x0062b26c`. For each record it chooses between vtable slot `+0x0c` and `+0x10`. When the caller mode arg is not `-1`, slot `+0x0c` is chosen if either the optional subject id resolves through vtable slot `+0x80` plus `0x004129d0` or the structure already satisfies `placed_structure_has_linked_station_or_transit_peer` `0x0040d230`; otherwise the helper falls back to slot `+0x10`. Current grounded callers are the world preview-mode owners `0x00453370`, `0x00453510`, and the broader mode-switch body `0x00452fa0`, which use this helper while entering, leaving, or changing the same site-aware preview states. This is the safest current read for the collection-wide virtual dispatch gate rather than a narrower route-builder helper.","objdump + caller inspection + local disassembly + placed-structure-collection correlation + linked-peer gate correlation"
0x00452ea0,117,world_refresh_preview_flag_0x21a1_from_world_view_float_and_presenter_counters,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small flag-refresh helper in the same world-side preview family. The helper samples float `[0x0062be68+0x20]` from the live world-view owner against one fixed threshold, normalizes the result to boolean flag `[this+0x21a1]`, and only mutates the paired shell-presenter counters `[0x006d4024+0x114272/+0x114266]` when companion enable dword `[this+0x219d]` is already nonzero and the sampled boolean changed. Current grounded caller is the nearby world-view follow-on at `0x0043c5f6`, which invokes this helper before the later local owner refresh path at `0x0043b350`. This is the safest current read for the view-scalar-driven preview-flag updater rather than a broader camera or zoom-mode owner.","objdump + caller inspection + local disassembly + world-view correlation + preview-flag correlation + presenter-counter correlation"
0x00452f20,48,world_refresh_active_preview_mode_from_four_dword_parameter_block,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small active-mode refresh wrapper over the same preview or tool-mode family. The helper copies four caller dwords into a local parameter block and forwards that block into `0x00450520`, leaving the current mode selector unchanged. Current grounded callers are the world-facing preview publish tails at `0x00436164`, `0x004f7958`, `0x004fb4c4`, `0x004fc4a0`, `0x004fc61a`, and `0x004fd4dc`, where it is used as the parameter-block refresh step rather than a top-level mode switch. This is the safest current read for the four-dword active-mode refresh wrapper.","objdump + caller inspection + local disassembly + parameter-block correlation"
0x00452f60,51,world_store_preview_primary_id_0x2179_dispatch_mode3_collection_and_refresh_if_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared primary-id setter in the same world-side preview family. The helper stores one caller dword into `[this+0x2179]`; when current mode `[this+0x2175]` equals `3` it first re-enters `0x00452e10` with that same id to update the placed-structure collection dispatch, and when any mode is active it then re-enters `0x00450520(0)` to rebuild the current preview state. Current grounded caller is `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which uses this helper to stage the candidate id before syncing the station row and linked-site id. This is the safest current read for the primary-id setter plus mode-3 dispatch refresh rather than a station-only helper.","objdump + caller inspection + local disassembly + primary-id correlation + mode-3 collection correlation"
0x00452fa0,704,world_switch_preview_or_tool_mode_and_seed_parameter_block,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Broader shared mode-switch owner for the world-side preview or tool family rooted at `[this+0x2171..+0x2191]`. The helper first releases transient surface root `[this+0x478]` through `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, reconciles the current mode's presenter counters and placed-structure bindings for the grounded families `3`, `6`, and `7`, and then seeds the caller-supplied parameter block into `[this+0x217d/+0x2181/+0x2185/+0x2189/+0x218d/+0x2191]` together with primary scalar `[this+0x2179]` and target mode `[this+0x2175]`. It finishes by re-entering `0x00450520` on that new state and then replaying the mode-specific side binds such as `0x00413750` for mode `6` and `0x00413620/0x00413750/0x00452e10` for mode `3`. Current grounded callers include `PaintRegion.win`, `PaintSound.win`, and `PaintTerritory.win` constructors and message handlers at `0x004f539f`, `0x004f549e`, `0x004f5784`, `0x004fcd10`, and `0x004fcf30`, plus the linked-peer action branches around `0x0040e60a`, `0x0040e9c2`, and `0x00464f8f`. This is therefore the safest current read for the shared world-side preview or tool mode switch owner rather than a single window-family helper.","objdump + caller inspection + local disassembly + mode-switch correlation + parameter-block correlation + paint-tool correlation + linked-peer action correlation"
0x00453370,405,world_enable_preview_mode_0x15_latch_and_enter_if_idle,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared world-side owner for entering the preview-capable mode `0x15`. The helper first rejects when latch byte `[this+0x21c5]` is already nonzero; otherwise it sets that latch and only continues when current mode `[this+0x2175]` is still `0`. On the active path it releases transient surface root `[this+0x478]` through `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, reconciles prior shell-presenter counters for the neighboring mode families `3` and `7` plus optional flag pair `[this+0x219d/+0x21a1]`, adjusts the shared presenter count lane `[0x006d4024+0x11426e]` from the mode table at `0x005ee5e8/0x005ee6e4`, seeds mode `0x15` into `[this+0x2175]`, clears the local scalar band `[+0x2179..+0x2189]`, seeds both timeout-like dwords `[+0x218d/+0x2191] = 0x1869f`, and re-enters `0x00450520` before tailing through `0x00452d30` according to shell field `[0x006cec74+0x12c]`. Current grounded caller is the shell command strip at `0x00441182`, which dispatches here when active scenario plus world state exist and the same preview latch is still clear. This is the safest current read for the mode-`0x15` preview-latch entry owner rather than a generic world reset.","objdump + caller inspection + local disassembly + mode-0x15 correlation + presenter-counter correlation + preview-latch correlation"
0x00453510,621,world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared teardown-or-reseed owner for the same world-side preview-mode family rooted at mode byte `[this+0x2175]` and latch `[this+0x21c5]`. The helper first reconciles the auxiliary preview byte `[this+0x2171]` through the small clear tail at `0x00452d30`, then tears down the current mode state through `0x00532360`, `0x00532500`, and `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, clears the current mode dword `[this+0x2175]`, and decrements the same shell-presenter counter families used by the entry sibling for prior modes `3` and `7` plus optional flags `[this+0x219d/+0x21a1]`. When preview latch byte `[this+0x21c5]` is still set, it then replays the same mode-`0x15` reset strip against the live world root `0x0062c120`, re-seeding `[world+0x2175] = 0x15`, the scalar band `[+0x2179..+0x2191]`, and the later `0x00450520 -> 0x00452d30` tail. When that latch is clear it returns with the mode fully torn down. Current grounded callers include the shell-side linked-peer action branch at `0x0040e94c`, the route or preview wrappers at `0x00449467` and `0x00464f2d`, many shell tool-window destructors such as `0x004f3b50`, `0x004f50fa`, `0x004f5784`, and `0x0050db9c`, plus the explicit latch-clear sibling `0x004537a0`. This is therefore the safest current read for the shared preview-mode clear-or-reseed owner rather than a one-window destructor helper.","objdump + caller inspection + local disassembly + mode-0x15 correlation + presenter-counter correlation + preview-latch correlation + tool-window teardown correlation"
0x00453780,38,world_disable_preview_mode_0x15_latch_and_clear_if_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Tiny paired exit helper for the same world-side preview-mode family. When latch byte `[this+0x21c5]` is nonzero the helper clears that latch and, if current mode `[this+0x2175]` still equals `0x15`, tail-jumps into `world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched` `0x00453510`; otherwise it returns immediately. Current grounded callers are the shell command strip at `0x0044118a` and the neighboring settings-side wrapper at `0x004ff90c/0x004ff94a`, which use it as the direct preview-mode unlatch path when the same mode-`0x15` latch is already active. This is the safest current read for the paired latch-clear helper rather than another generic world-mode toggle.","objdump + caller inspection + local disassembly + mode-0x15 correlation + preview-latch correlation"
0x004422d0,96,shell_status_stack_push_four_shell_byte_latches_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack push helper rooted at the local ring or stack `0x0062be90` with depth index `0x0062bedc`. The helper snapshots five live status bytes into one `5`-byte slot selected by the current depth: the low bytes of shell fields `[0x006cec74+0x140]`, `[+0x13c]`, `[+0x138]`, and `[+0x144]`, plus startup byte `[0x006cec78+0x4c74]`, then increments the depth. The caller boundary is tighter now too: current direct callers are the higher wrapper `0x004423a0` and the world-entry branch `0x00443a50` at `0x444e2c`; the grounded `.smp` serializer and neighboring simulation-side consumers `0x00446240`, `0x0040a9c0`, and `0x0046b9f0` reach this push through `0x004423a0` instead of calling it directly. This is the safest current read for the shared shell or startup status-band push beneath save-load and world-tool choreography rather than a file-family-specific helper.","objdump + caller xrefs + local disassembly + status-stack correlation + byte-lane-correction + direct-caller-boundary correlation + world-entry correlation"
0x00442330,112,shell_status_stack_pop_restore_four_shell_byte_latches_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack pop helper paired with `shell_status_stack_push_four_shell_byte_latches_and_startup_byte` `0x004422d0`. The helper decrements stack depth `0x0062bedc`, restores the same five saved bytes from the selected `0x0062be90` slot back into shell fields `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` and startup byte `[0x006cec78+0x4c74]`, sign-extending the first three shell byte lanes and zero-extending the fourth before writing them back into the wider shell dwords. The caller boundary is tighter now too: current direct callers are the higher wrapper `0x004423d0`, the world-entry branch `0x00443a50` at `0x444ecb`, and the non-`.smp` package-save tail at `0x00445a55`, while the live `.smp` serializer and neighboring simulation-side wrappers reach this pop through `0x004423d0` instead of calling it directly. This is the safest current read for the shared status-band restore beneath save-load and world-tool choreography rather than an ordinary shell-mode setter.","objdump + caller xrefs + local disassembly + status-stack correlation + byte-lane-correction + direct-caller-boundary correlation + package-tail correlation + world-entry correlation"
0x004423a0,48,shell_status_stack_push_and_service_active_tracklay_and_stationplace_tools,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared higher wrapper over the same shell/startup status-band stack. It first re-enters `shell_status_stack_push_four_shell_byte_latches_and_startup_byte` `0x004422d0`, then, when the live TrackLay.win tool object at `0x006d1a8c` is present, calls `0x0050e070`, and when the live StationPlace.win tool object at `0x006d1720` is present, tail-jumps into `0x00507a50`. Current grounded callers include the city-connection route builder `0x00402cb0`, the periodic simulation-side tool wrapper `0x0040a9c0`, the live `.smp` serializer `0x00446240`, and the neighboring collection-side world branch `0x0046b9f0`, so this is the safest current read for pushing the shared status band and then bracketing active world-tool windows rather than another generic shell transition helper.","objdump + caller xrefs + local disassembly + tool-window correlation + status-stack correlation + byte-lane-correction"
0x004423d0,48,shell_status_stack_pop_restore_and_service_active_stationplace_and_tracklay_tools,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared higher restore wrapper paired with `0x004423a0`. It first re-enters `shell_status_stack_pop_restore_four_shell_byte_latches_and_startup_byte` `0x00442330`, then, when the live StationPlace.win tool object at `0x006d1720` is present, calls `station_place_window_service_frame` `0x0050a530`, and when the live TrackLay.win tool object at `0x006d1a8c` is present, tail-jumps into `track_lay_window_service_frame` `0x0050e1e0`. Current grounded direct callers are the periodic simulation-side tool wrapper `0x0040a9c0`, the live `.smp` serializer `0x00446240`, and the collection-side world branch `0x0046b9f0`. The non-`.smp` package-save tail under `0x00445de0` is tighter now too: it does not re-enter this wrapper, but instead calls `0x00442330` directly at `0x00445a55` and then services `0x0050a530/0x0050e1e0` inline. This is the safest current read for restoring the shared shell/startup status band and then servicing active world-tool windows rather than a generic post-frame notifier.","objdump + caller xrefs + local disassembly + tool-window correlation + status-stack correlation + byte-lane-correction + package-tail correlation + direct-caller-boundary correlation"
0x00442400,930,shell_setup_load_selected_profile_bundle_into_payload_record,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Setup-side payload loader beneath `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`. The helper takes one staged profile-path seed in `ECX`, one destination payload record in `EDX`, and one small caller flag on the stack; clears the full `0x100f2`-byte payload record; builds one rooted input path from either the default setup file-root query at `0x004839e0` or the caller's alternate root override; opens that bundle through `0x00530c80`; and then branches on `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0` to read the structured chunk families through `0x00531150` and `0x00531360`. The ordinary saved-profile side reads one smaller startup payload dword through the ordinary tag-`0x0001` family, stores that dword in shared global `0x00620e94`, reads one raw `0x03c2`-byte preview block, and then expands the returned `RGB` byte surface into packed `ARGB` dwords rooted at `[payload+0x03c2]`. The map-style side is a different family, not a second writer for that global: it reads the larger setup payload family under `0x0004`, `0x2ee0`, and `0x2ee1`, and current local disassembly shows no `0x00620e94` store in that branch. For bundle versions `>= 0x3f7` it restores the full `0x403c2`-byte setup-preview payload block directly into the destination record, while older versions only restore `0x402c9` bytes and explicitly zero the trailing `0x1003e`-byte tail rooted at `[payload+0x2c9]`. The `0x00620e94` store is therefore narrower now too: that same global is later reused by the early and late world-entry threshold gates `0x00437737` and `0x00444dc5`, but in this loader it is seeded only by the ordinary saved-profile lane rather than the tagged map-style setup block. Current grounded callers are `0x00502220`, which immediately follows this helper by copying payload fields `+0x14/+0x3b2/+0x3ba/+0x20` into the staged runtime profile through `0x0047be50`, the launch validator `0x004425d0`, and the selector-`0x59` helper `0x00472290`.","objdump + local disassembly + caller inspection + chunk-family correlation + version-gate correlation + preview-surface expansion correlation + stage-counter correlation + caller correlation"
0x004425d0,139,shell_setup_validate_selected_profile_bundle_and_stage_launch_profile,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Validated setup-profile launch helper above shell request `0x0cc`. It allocates one large local scratch block, re-enters `shell_setup_load_selected_profile_bundle_into_payload_record` `0x00442400` on the caller path seed, and only proceeds when the loaded payload carries a nonzero leading byte. On success it force-stages runtime-profile byte `[0x006cec7c+0xc5] = 1`, copies payload byte `+0x22` into profile `+0xc4`, copies payload byte `+0x33` into profile `+0x7d`, mirrors the payload token block `+0x23..+0x32` into profile `+0xc6..+0xd5`, and then issues shell request `0x0cc` through `0x0054e790`. Current grounded callers are the validated setup launch controls inside `shell_setup_window_handle_message` `0x005033d0`, where selector-`3` and selector-`5` siblings share this same staging bridge before the later startup-profile owner runs.","objdump + local disassembly + caller inspection + setup-launch correlation + runtime-profile-staging correlation"
0x00442660,209,shell_publish_progress_sample_notice_from_byte_delta_and_elapsed_ticks,shell,cdecl,inferred,objdump + caller inspection + local disassembly + status-notice correlation,2,"Shared progress-sample notice helper in the surrounding save or load strip. The helper measures the current byte counter through `0x00530b70`, derives one rounded kilobyte delta against previous counter `0x0062c11c`, formats that delta through `%5d`, measures elapsed ticks against `0x0062bed0` through `0x0051d890`, formats the elapsed field through `% 4d`, and then packages both fields plus the caller-supplied status stem into the shared shell text builder `0x005193f0 -> 0x00518de0 -> 0x0051d680`. It finally updates `0x0062c11c` to the current byte counter. Current grounded callers include the bundle-service strip at `0x00413469/0x004134b4` and the save-side progress path inside `shell_map_file_world_bundle_coordinator` around `0x00445098`, so this is the safest current read for the shared byte-delta and elapsed-time progress notice helper rather than a one-off formatter.","objdump + caller inspection + local disassembly + status-notice correlation + save-load-progress correlation"
0x00442740,128,shell_build_temp_surface_from_payload_preview_pixels_and_query_named_resource_field_0x46,shell,cdecl,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Short companion helper in the same save or export strip. The function allocates a temporary `0x40000`-byte RGBA copy of the embedded preview pixel block rooted at `[record+0x03c2]`, constructs one temporary `0xec`-byte surface-like owner through `0x0053b070 -> 0x00543980( pixels, 0x100, 0x100, 0 )`, and then forwards the caller path seed plus fixed selector `0x46` into `0x00542f50`, storing the returned dword into payload field `[record+0x18]`. It finally releases the temporary owner through `0x00542c90 + 0x0053b080`. Current grounded caller is the save-side bundle branch at `0x00445925`, immediately after tagged setup-preview payload export and before the shared progress notice path, so this is the safest current read for the temporary-surface query helper rather than a generic image copier.","objdump + caller inspection + local disassembly + surface-family correlation + save-side bundle correlation"
0x004427c0,624,shell_map_bundle_rewrite_companion_payload_file_via_tmp_extension_path_and_progress_callback,shell,cdecl,inferred,objdump + caller inspection + local disassembly + companion-image correlation,3,"Broader companion-payload rewrite owner in the same save or export strip. The helper copies the caller path into a local buffer, strips its extension through `support_strip_extension_in_place` `0x0051df90`, appends the fixed `.tmp` suffix, opens that temporary-path file, allocates one full-size heap buffer, and reads the whole file body through `0x005a1b05`. It then installs `shell_progress_callback_publish_incremental_percent_status_until_target` `0x00441e20` into global `0x00d93988`, forwards the source tail plus destination tail rooted at `+0x03ce` into `0x00553000`, and writes the rewritten output back through `0x005a276f`, preserving the leading `0x03ce` bytes and the trailing untouched source bands around the transformed middle region. On completion it updates payload dword `[record+0x18]`, re-enters `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`, frees the temporary buffers, and clears `0x00d93988` again. Current grounded caller is the save-side branch at `0x00443cd3`, which enters this helper only when payload byte `[record+0x66c9]` is set before deriving the external companion sidecar path. This is the safest current read for the `.tmp`-extension companion-payload rewrite owner rather than a generic file copy helper.","objdump + caller inspection + local disassembly + companion-image correlation + tmp-path correlation + progress-callback correlation"
0x00442900,304,shell_map_bundle_rewrite_companion_payload_file_from_path_stored_byte_offsets_and_sync_tags,shell,cdecl,inferred,objdump + caller inspection + local disassembly + companion-image correlation,3,"Sibling companion-payload rewrite owner in the same save or export strip. The helper takes the live payload record in `EAX` plus one caller path on the stack, opens and reads the whole source file into a temporary heap buffer, installs progress callback `0x00441e20` in `0x00d93988`, and then rewrites the middle payload band through `0x00553000` using the stored byte offsets in `[record+0x18/+0x1c]`. It writes the rebuilt output in four spans through `0x005a276f`: the leading `0x03ce` bytes, the transformed middle payload, the untouched interval `[record+0x18 .. record+0x1c)`, and the remaining tail. On completion it stores the caller path back into `[record+0x18]`, re-enters `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`, frees the temporary buffers, and clears `0x00d93988` again. Current grounded caller is the save-side branch at `0x004459dd`, reached after companion-image import `0x00441f70` when payload byte `[record+0x66c9]` is set, so this is the safest current read for the path-plus-stored-offset companion-payload rewrite sibling rather than another generic file copier.","objdump + caller inspection + local disassembly + companion-image correlation + progress-callback correlation + save-side bundle correlation"
0x00442a40,31,locomotive_policy_issue_id_is_in_primary_engine_family_band,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save-load correlation,3,"Small range-membership predicate in the locomotive-policy strip. The helper returns true only for issue ids in the two disjoint bands `0x0f1..0x15f` and `0x1c9..0x1da`, and false everywhere else. Current grounded callers are the stream-load path `0x0042ddd0`, the stream-save inverse path `0x00430feb`, the scenario availability-owner path `0x0043160b`, the setup-side terrain or candidate branch `0x004d6125`, and the neighboring primary forward mapper `0x00442a85`, so this is the safest current read for the primary locomotive-engine-family issue-band membership test rather than a generic range helper.","objdump + caller xrefs + local disassembly + stream-save-load correlation + locomotive-policy correlation"
0x00442a5f,38,locomotive_policy_issue_id_is_in_secondary_engine_family_band,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save-load correlation,3,"Sibling range-membership predicate in the same locomotive-policy strip. The helper returns true only for issue ids in the disjoint bands `0x160..0x1c4` and `0x1db..0x1f6`, and false everywhere else. Current grounded callers are the same stream-load and stream-save pair `0x0042ddde` and `0x00431000`, plus the neighboring secondary forward mapper `0x00442aac`, so this is the safest current read for the secondary locomotive-engine-family issue-band membership test rather than another anonymous range check.","objdump + caller xrefs + local disassembly + stream-save-load correlation + locomotive-policy correlation"
0x00442a85,23,locomotive_policy_map_primary_engine_family_index_to_issue_id,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + editor-policy correlation,3,"Primary forward mapper in the locomotive-policy strip. The helper treats the caller value as one compact engine-family or policy index, leaves `0` unchanged, maps `1..0x6f` into issue ids `0x0f1..0x15f`, maps `0x70..` into issue ids `0x1c9..0x1da` by inserting a fixed gap `0x69`, and then bounds the result against the upper limit `0x1db`. Current grounded callers are `locomotive_era_and_engine_type_pass_company_policy_gate` `0x0041d550`, the stream-load branch `0x0042de19`, and the neighboring primary row resolver `0x00442a9c`, so this is the safest current read for the forward map from the primary locomotive engine-family index space into raw issue ids rather than a plain arithmetic shim.","objdump + caller xrefs + local disassembly + editor-policy correlation + locomotive-policy correlation"
0x00442a9c,16,locomotive_policy_resolve_primary_issue_row_ptr_from_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + table-layout correlation,3,"Primary row resolver over the fixed issue table rooted at `0x00610398`. The helper first maps the caller through `locomotive_policy_map_primary_engine_family_index_to_issue_id` `0x00442a85`, then multiplies that issue id by stride `0x6e`, adds the table base `0x00610398`, stores the resulting row pointer in `EDI`, and returns it in `EAX`. Current grounded caller is the shell-side formatter strip at `0x00462449`, which uses the returned row to resolve the primary localized issue-name path. This is the safest current read for the primary issue-row resolver rather than a generic table indexer.","objdump + caller xrefs + local disassembly + table-layout correlation + issue-row correlation"
0x00442aac,23,locomotive_policy_map_secondary_engine_family_index_to_issue_id,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + caller correlation,3,"Secondary forward mapper in the same locomotive-policy strip. The helper leaves index `0` unchanged, maps `1..0x65` into issue ids `0x15f..0x1c4`, maps higher indices into issue ids `0x1db..0x1f6` by inserting fixed gap `0x16`, and bounds the result against the upper limit `0x1f7`. Current grounded callers are the stream-load branch `0x0042de19`, the locomotive scalar owner `0x00461a06`, and the neighboring secondary row resolver `0x00442ac3`, so this is the safest current read for the secondary locomotive-engine-family index-to-issue-id map rather than another plain arithmetic helper.","objdump + caller xrefs + local disassembly + caller correlation + locomotive-policy correlation"
0x00442ac3,16,locomotive_policy_resolve_secondary_issue_row_ptr_from_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + table-layout correlation,3,"Secondary row resolver over the same fixed issue table rooted at `0x00610398`. The helper maps the caller through `locomotive_policy_map_secondary_engine_family_index_to_issue_id` `0x00442aac`, multiplies the resulting issue id by stride `0x6e`, adds the base `0x00610398`, stores the row pointer in `EDI`, and returns it in `EAX`. Current grounded caller is the sibling shell-side formatter strip at `0x004624ae`, where it resolves the alternate localized issue-name row. This is the safest current read for the secondary issue-row resolver rather than a generic pointer arithmetic stub.","objdump + caller xrefs + local disassembly + table-layout correlation + issue-row correlation"
0x00442ad3,14,locomotive_policy_map_primary_issue_id_to_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save correlation,3,"Inverse sibling of `0x00442a85` in the same locomotive-policy strip. The helper subtracts base issue id `0x0f0`, and when the resulting compact index rises above `0x6f` it removes the inserted gap `0x69` to recover the original primary engine-family or policy index. Current grounded caller is the stream-save path `0x00430ff2`, which uses this inverse map when serializing the primary issue band back into the compact save-side index space. This is the safest current read for the primary issue-id-to-index inverse rather than a free-standing subtractive helper.","objdump + caller xrefs + local disassembly + stream-save correlation + locomotive-policy correlation"
0x00442ae1,14,locomotive_policy_map_secondary_issue_id_to_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save correlation,3,"Inverse sibling of `0x00442aac` in the same locomotive-policy strip. The helper subtracts base issue id `0x15f`, and when the resulting compact index rises above `0x65` it removes the inserted gap `0x16` to recover the original secondary engine-family or policy index. Current grounded caller is the stream-save path `0x00431007`, which uses this inverse map when serializing the secondary issue band back into the compact save-side index space. This is the safest current read for the secondary issue-id-to-index inverse rather than another subtractive arithmetic stub.","objdump + caller xrefs + local disassembly + stream-save correlation + locomotive-policy correlation"
0x00442ba0,143,shell_export_live_setup_preview_payload_record_and_normalize_pixel_block_0x100x0x100,shell,thiscall,inferred,objdump + caller inspection + local disassembly + payload-export correlation,3,"Concrete live-payload export helper in the setup and map-bundle strip. The helper copies one `0x403c2`-byte live payload record from `[this+0x66be]` into the caller buffer, forces the leading validity byte to `1`, patches the exported world dimensions from `[0x0062c120+0x2155/+0x2159]` into offsets `+0x01/+0x05`, mirrors two live shell-controlled sidecar dwords from `[0x006d4024+0x11471a]` and `[0x006d4024+0x11471e]` into offsets `+0x09/+0x0a`, mirrors the low byte of shared dword `0x0062bec4` into offset `+0x0b`, and then normalizes the embedded pixel block at `+0x03c2` through `0x0047a120` with fixed dimensions `0x100 x 0x100`. That sidecar-byte trio is tighter now too: the later package-save tail reads `[world+0x66c8]` and `[world+0x66c9]` as the companion-image and companion-payload sidecar gates, so the exported payload bytes `+0x0a` and `+0x0b` are the same two save-side gate lanes inside the copied `0x66be` block. Current local save-side evidence also shows `0x0062bec4` being reseeded by `shell_map_file_world_bundle_coordinator` `0x00445de0` from the shell-owned selector pair `[0x006d4024+0x11472a/+0x11472e]` before this exporter runs, while the broader settings owner `shell_settings_window_handle_message_dispatch_and_persist_display_runtime_sidecar_family` `0x00464c80` toggles the same shell dwords `0x11471a/0x11471e/0x11472a/0x11472e` and enforces the grounded implication rules `!0x11471e -> clear 0x11472a` and `(0x11472a || 0x11472e) -> set 0x11471e`. The two current save-side callers now split cleanly: package-save branch `0x00444f42` calls `0x00442ba0` and then immediately re-enters `0x00441ec0`, while the `.smp` serializer branch at `0x00446312` calls `0x00442ba0` and then emits `0x2ee0`, writes the full `0x403c2` payload through `0x00531030`, and closes `0x2ee1` directly. This is the safest current read for the live setup-preview payload exporter rather than a generic memcpy wrapper.","objdump + caller inspection + local disassembly + payload-export correlation + companion-image correlation + bundle-tag correlation + payload-size correlation + sidecar-gate correlation + save-coordinator correlation + shell-sidecar-selector correlation + save-branch-split correlation"
0x00442c30,3600,shell_apply_scenario_name_specific_post_load_world_and_object_fixups,shell,thiscall,inferred,objdump + caller inspection + local disassembly + scenario-string correlation,4,"Broad post-load fixup owner reached from `world_entry_transition_and_runtime_bringup` at `0x00444b50`. The helper compares the caller-supplied scenario title against many fixed `.rdata` names including `Go West!`, `Germany`, `France`, `State of Germany`, `New Beginnings`, `Dutchlantis`, `Britain`, `New Zealand`, `South East Australia`, `Tex-Mex`, `Germantown`, `The American`, `Central Pacific`, and `Orient Express`, with several branches further gated by campaign-scenario byte `[this+0x66de]`. The matched bodies are no longer just generic title-side edits. Current local disassembly now grounds several concrete examples: the non-campaign `Go West!` branch retags linked world-object row `7` named `Open Aus` by promoting byte `[obj+0x7f9]` from `1` to `2` when its nested opcode-`0x1b` payload is still in the expected starter state; the campaign-gated `Go West!`/`Germany`/`Orient Express` side nudges selected city float pairs `[city+0x25a/+0x25e]` upward when they remain below fixed thresholds; the `Central Pacific` branch injects repeated localized `Company Track Miles`-style text lines into the shell band `[this+0x4f30]` through `0x0051e5d0`; later branches copy paired ten-dword record blocks when specific object-name/class pairs match; patch secondary-raster bits through the fixed table `0x005ee508..0x005ee5cc`; mutate opcode payload dwords and bytes inside collections rooted at `0x0062be18`, `0x0062bae0`, and `0x006ada80`; and update one later collection at `0x0062b268`. This is the safest current read for the scenario-name-specific post-load fixup owner rather than a generic string-dispatch helper.","objdump + caller inspection + local disassembly + scenario-string correlation + live-world mutation correlation + post-load-fixup correlation + campaign-flag correlation"
0x0044c450,96,world_rebuild_all_grid_cell_candidate_cargo_service_bitsets,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Late world-reactivation sweep inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. The helper walks the full live world grid rooted at `[this+0x2129]` through dimensions `[this+0x2145/+0x2149]`, resolves each cell pointer, and re-enters `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` on every cell record. Current grounded caller is the later world-entry tail at `0x444b24`, immediately after `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0` and before the route-style link rebuild at `0x468300`, so this is the current safest read for the world-wide grid-cell cargo-service-bitset refresh wrapper rather than another generic world-grid loop.","objdump + local disassembly + caller inspection + world-grid correlation + cargo-service correlation"
0x0044c4b0,192,world_clear_and_reseed_region_center_world_grid_flag_bit,map,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Late world-reactivation helper inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. The first sweep walks the full live world grid rooted at `[0x0062c120+0x2129]` through dimensions `[+0x2145/+0x2149]` and clears bit `0x10` in each cell byte `[cell+0xe6]`. It then walks the live region collection at `0x0062bae0`, keeps only regions whose class byte `[region+0x23e]` is zero, resolves one representative center cell through `world_region_resolve_center_world_grid_cell` `0x00455f60`, and sets that same bit on the resolved cell. Current grounded caller is the later world-entry tail at `0x444b19`, between the post-bundle runtime refresh phase and the later shell or company-cache follow-ons, so this is the current safest read for the region-center world-grid flag reseed pass rather than another generic grid scrub.","objdump + local disassembly + caller inspection + region-grid correlation"
0x0044c570,256,world_mark_secondary_raster_clear_cell_mask_0x3e_as_class_2_and_cache_bounds,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Small secondary-raster mutation helper beneath the later marked-cell scan and overlay-cache family. After clamping the caller cell coordinates against the current secondary-grid dimensions, the helper resolves the byte raster rooted at `[this+0x2135]` using row stride `[this+0x2155] + 1` and only proceeds when the target byte has no bits in mask `0x3e` and the parallel class predicate `world_secondary_raster_query_cell_class_in_set_1_3_4_5` `0x00534e10` also reports false. On the admit path it widens cached min/max bounds `[this+0x21c6..+0x21d2]`, increments the marked-cell count `[this+0x21d6]`, and then rewrites the target raster byte with `(byte & 0xc3) | 0x02`, i.e. it preserves the outer two bits and the low bit while forcing the masked class field to `0x02`. Current grounded caller is the later radial mutation branch at `0x0044e8e7`, and the written bounds/count fields are the same ones later scanned by `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60`, so this is the safest current read for the small secondary-raster cell-marker helper rather than another generic bounds updater.","objdump + caller xrefs + local disassembly + secondary-raster correlation + marked-cell-bound correlation"
0x0044ce60,272,world_scan_secondary_grid_marked_cell_bounds,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Secondary world-raster bounds scan beneath the later world-entry reactivation tail. The helper clears cached fields `[this+0x21c6/+0x21ca/+0x21ce/+0x21d2/+0x21d6]`, requires the shell-state gate `[0x006cec78+0x4af3]` to be nonzero, and then scans the byte raster rooted at `[this+0x2135]` through dimensions `[this+0x2155/+0x2159]`. Every cell whose byte has any bits in mask `0x3e` contributes to the cached min-X, min-Y, max-X, max-Y, and marked-cell-count slots at those same `0x21c6..0x21d6` fields. Current grounded callers are the later world-entry tail at `0x444c36`, one neighboring startup-side world branch at `0x448168`, and the small count accessor at `0x42f8d8`, so this is the safest current read for the shared marked-cell bounding-box scan over the secondary world raster rather than a fully player-facing overlay owner.","objdump + local disassembly + caller inspection + secondary-raster correlation"
0x00449500,18,world_runtime_release_root_payloads_and_collection_storage,map,thiscall,inferred,objdump + world-shutdown correlation + local disassembly,2,"Release-side companion for the live world root `0x0062c120`. The helper reinstalls vtable `0x005ca9fc`, re-enters `0x00449270`, and then tails into the shared world-presentation release path `0x00537e30`. Current grounded caller is the ordered world-root shutdown strip `0x00434300`.","objdump + world-shutdown correlation + local disassembly + companion correlation"
0x0042ae50,507,world_grid_cell_record_refresh_from_bundle_bitmask_and_optional_6byte_list,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation,3,"Per-cell bundle-load helper used by the heavy world-grid restore path. The helper zeroes three local field bands on the destination record, reads one `0x14`-byte bitmask from the caller bundle, and then conditionally refreshes a repeating trio of payload lanes into the two `0x6a`-byte side bands and the larger band rooted at `[this+0x103]` through repeated `0x00531150` calls. It then refreshes the fixed footer fields `[this+0xd4]`, `[this+0xd6]`, `[this+0xd8]`, `[this+0xe6]`, two signed short coords `[this+0xe7/+0xe9]`, one count dword `[this+0xeb]`, allocates `[this+0xef]` as `count * 6` bytes, and reads that trailing `6`-byte record list from the same bundle. Current grounded caller is the world-grid load body `world_load_runtime_grid_and_secondary_raster_tables_from_bundle` `0x0044cfb0`, which enters this helper on every live grid-cell record after the root arrays are allocated, so this is the safest current read for the per-cell bundle refresh helper rather than a generic small record constructor.","llvm-objdump + local disassembly + caller correlation + world-grid-load correlation + bundle-read correlation"
0x0042b050,227,world_grid_cell_refresh_bits_0x01_0x02_from_anchored_4x4_secondary_raster_class_counts,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + secondary-raster correlation,3,"Per-cell derived-flag refresh helper over one live world-grid record. The helper reads the anchored secondary-raster coordinate pair `[this+0xe7/+0xe9]`, expands that anchor into one `4x4` secondary-raster window, and then scans every cell in that window through the shared class predicates `0x00534e50`, `0x00534f00`, and `0x00534ec0`. One accumulated count treats class families `1/4` and `3/5` as admitted occupancy, while a second count separately tracks class family `2/4/5`. After the scan it rewrites the current world-grid byte `[this+0xe6]`: bit `0x01` is set only when the admitted occupancy count is at least `8`, and bit `0x02` is set only when that same count is at least `2`; otherwise those bits are cleared. Current grounded caller is the first pass inside `world_refresh_all_grid_cell_secondary_raster_derived_bits` `0x00449f80`, which runs this helper over every live grid-cell record before the neighboring bit-`0x08` refresh pass, so this is the safest current read for the anchored `4x4` secondary-raster class-count companion rather than a standalone terrain brush.","llvm-objdump + local disassembly + caller correlation + secondary-raster correlation + world-grid-derived-bit correlation"
0x0042bc70,432,world_grid_cell_refresh_bit_0x08_from_neighbor_cell_bit_0x01_clear_offsets,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + world-grid correlation,3,"Second per-cell derived-flag refresh helper over one live world-grid record. The helper snapshots the current world-grid byte `[this+0xe6]`, reads the anchored coordinate pair `[this+0xe7/+0xe9]`, and then walks the eight signed offset pairs from the fixed tables `0x00624b28..0x00624b54`. For every in-bounds offset target it resolves the peer world-grid record through the live grid rooted at `[0x0062c120+0x2129]`; if any admitted neighbor has bit `0x01` clear in its own byte `[peer+0xe6]`, the helper sets bit `0x08` in the current record, otherwise it clears that bit. Current grounded caller is the second pass inside `world_refresh_all_grid_cell_secondary_raster_derived_bits` `0x00449f80`, which applies this neighbor test after `world_grid_cell_refresh_bits_0x01_0x02_from_anchored_4x4_secondary_raster_class_counts` `0x0042b050` has refreshed bits `0x01/0x02`, so this is the safest current read for the neighbor-offset bit-`0x08` companion rather than a generic border scan.","llvm-objdump + local disassembly + caller correlation + world-grid correlation + neighbor-offset-table correlation"
0x00449f20,93,world_count_secondary_raster_cells_outside_class_set_1_3_4_5_and_store_0x21a9,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + secondary-raster correlation,3,"Small world-wide count pass over the live secondary raster. The helper clears dword `[this+0x21a9]`, walks every secondary-raster cell through live dimensions `[this+0x2155/+0x2159]`, and re-enters `world_secondary_raster_query_cell_class_in_set_1_3_4_5` `0x00534e10` on each `(x,y)` pair. Every cell that does not belong to that admitted class set increments `[this+0x21a9]`. Current grounded callers are the world-grid bundle-load body `world_load_runtime_grid_and_secondary_raster_tables_from_bundle` `0x0044cfb0` and the broader derived-surface rebuild owner `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940`, so this is the safest current read for the shared secondary-raster outsider-count refresh rather than a generic scan loop.","llvm-objdump + local disassembly + caller correlation + secondary-raster correlation + world-load-tail correlation"
0x00449f80,162,world_refresh_all_grid_cell_secondary_raster_derived_bits,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + world-grid correlation,3,"World-wide two-pass refresh over the live grid-cell record family rooted at `[this+0x2129]`. The first full-grid sweep re-enters `world_grid_cell_refresh_bits_0x01_0x02_from_anchored_4x4_secondary_raster_class_counts` `0x0042b050` on every live `0x1d7`-byte cell record, which refreshes bits `0x01` and `0x02` in `[cell+0xe6]` from the anchored secondary-raster window rooted at `[cell+0xe7/+0xe9]`. The second full-grid sweep then re-enters `world_grid_cell_refresh_bit_0x08_from_neighbor_cell_bit_0x01_clear_offsets` `0x0042bc70` on the same live cells, refreshing bit `0x08` from the neighbor-offset tables `0x00624b28..0x00624b54`. Current grounded callers are the broad derived-surface rebuild owner `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940` and the transport/pricing preview ensure path `world_ensure_transport_pricing_preview_surface_and_publish_if_missing` `0x0044faf0`, so this is the safest current read for the full world-grid secondary-raster-derived-bit refresh rather than one narrow post-load loop.","llvm-objdump + local disassembly + caller correlation + world-grid correlation + secondary-raster-derived-bit correlation"
0x0044cf70,56,world_runtime_construct_root_and_seed_global_0x62c120,map,thiscall,inferred,objdump + world-load correlation + local disassembly,3,"Top-level constructor for the live world root later published at `0x0062c120`. The helper enters the shared world-presentation base init `0x00534f60`, installs vtable `0x005ca9fc`, clears dword `[this+0x2125]`, stores `this` into global `0x0062c120`, and then forwards the three caller-supplied constructor arguments into the heavier initialization body `0x00449200`. Current grounded caller is the world-load allocation strip inside `0x00438c70`.","objdump + world-load correlation + local disassembly + global-publication correlation"
0x0044cfb0,1120,world_load_runtime_grid_and_secondary_raster_tables_from_bundle,map,thiscall,inferred,objdump + caller xrefs + local disassembly + bundle-tag correlation,3,"Heavy world-root bundle-load body beneath `world_construct_root_and_load_bundle_payload_thunk` `0x0044e910`. After the immediate base setup and neighboring local initializers `0x00449270` and `0x00448260`, the helper reads one rooted payload through repeated `0x00531150/0x00531360` calls, storing the core grid and stride scalars into `[this+0x2145/+0x2149/+0x214d/+0x2151/+0x2155/+0x2159/+0x215d/+0x2161/+0x2201]`. It allocates the route-entry collection `0x006cfca8` through `0x00491af0`, allocates or zero-fills the main world arrays `[this+0x2139/+0x213d/+0x2141/+0x2131/+0x2135/+0x212d/+0x2129]` from chunk families `0x2ee2/0x2ee3/0x2ef4/0x2ef5/0x2ef6/0x2ee4/0x2ee5/0x2f43/0x2f44`, and on one loaded-raster path clears low bit `0x01` across every byte in `[this+0x2135]` after the bundle read succeeds. The tail then seeds every live world-grid cell record through `0x0042ae50`, re-enters `world_compute_transport_and_pricing_grid` `0x0044fb70`, refreshes neighboring presentation state through `0x00449f20`, and issues one shell-mode pulse through `0x00484d70` before returning. Current grounded caller is the world-root constructor thunk `0x0044e910` at `0x0044e931`, reached from the world-allocation branch inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, so this is the safest current read for the heavy world-grid and secondary-raster bundle-load body rather than the broader bringup owner.","objdump + caller xrefs + local disassembly + bundle-tag correlation + world-grid-array correlation"
0x0044e270,63,world_resolve_secondary_raster_class_record_at_float_xy,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small float-XY lookup over the live world secondary-raster class table. The helper rounds the two caller-supplied float coordinates through `0x005a10d0`, indexes the active byte raster at `[world+0x2131]` with row stride `[world+0x2155]`, shifts the selected byte right by three, and resolves the resulting class token through collection `0x006cfc9c`. Current grounded callers include `city_compute_connection_bonus_candidate_weight` `0x004010f0` and the linked-instance wrapper `0x0047f1f0`, so this is the safest current read for the world-side secondary-raster class-record lookup rather than a city-only predicate.","objdump + caller xrefs + local disassembly + secondary-raster-class correlation"
0x0044e910,42,world_construct_root_and_load_bundle_payload_thunk,map,thiscall,inferred,objdump + world-load correlation + local disassembly,3,"Small world-root load thunk above the heavier bundle-body `0x0044cfb0`. The helper enters the shared world-presentation base init `0x00534f60`, installs vtable `0x005ca9fc`, re-enters `0x00448260` for the neighboring local setup, and then forwards the two caller-supplied bundle arguments into `world_load_runtime_grid_and_secondary_raster_tables_from_bundle` `0x0044cfb0`. Current grounded caller is the world-load allocation strip inside `0x00438c70`, which allocates the `0x0062c120` world root and then immediately enters this thunk.","objdump + world-load correlation + local disassembly + thunk-to-bundle-body correlation"
0x00491af0,295,route_entry_collection_construct_indexed_owner_and_zero_slot_array,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Concrete constructor for the route-entry collection rooted at `0x006cfca8`. The helper installs vtable `0x005cfe18`, re-enters the shared indexed-collection constructor path `0x00518570` with capacity-like scalars `0x3e8` and `0x1f4`, zeros the local side bands `[this+0x88..+0x10a]`, seeds `[this+0x88]` to `-1` and `[this+0x206]` to `-1.0f`, clears the small trailing triplet at `[this+0x10b]`, and allocates then zero-fills the separate slot-array pointer `[this+0x8c]` from caller count argument `arg0 * 4`. Current grounded caller is the world bundle-load body `world_load_runtime_grid_and_secondary_raster_tables_from_bundle` `0x0044cfb0`, so this is the safest current read for the route-entry collection constructor rather than a generic list init.","objdump + caller inspection + local disassembly + indexed-collection correlation + route-entry-collection correlation"
0x00491c20,56,route_entry_collection_refresh_all_live_entries_derived_visual_bands,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small collection-wide post-pass over the route-entry collection `0x006cfca8`. The helper enumerates all live entries through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then re-enters `route_entry_recompute_derived_visual_scalar_bands_and_optional_display_buffer` `0x00539640` on each resolved route entry. Current grounded caller is the later `319`-lane post-load pipeline inside `world_run_post_load_generation_pipeline` `0x004384d0`, where the same pass runs after placed-structure local-runtime refresh and flagged world-grid cleanup, so this is the safest current read for the collection-wide route-entry visual-band refresh pass rather than an anonymous indexed sweep.","objdump + caller inspection + local disassembly + indexed-collection correlation + post-load-pipeline correlation"
0x00491c60,134,route_entry_collection_serialize_records_into_tagged_bundle,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + tag-family correlation,3,"Collection-wide tagged save owner for the main route-entry collection rooted at `0x006cfca8`. The helper emits tag family `0x38a5/0x38a6/0x38a7` through `0x00531340`, serializes collection-side metadata through `0x00517d90`, writes dword `[this+0x90]` directly into the active bundle through `0x00531030`, and then walks every live route-entry record through `0x00517cf0/0x00518380/0x00518140` before dispatching each record through `0x0048a6c0` with the caller bundle. Current grounded caller is the early package-save prelude `0x00444dd0`, where this helper runs before the auxiliary route-entry tracker collection serializer. This is the safest current read for the main route-entry tagged save owner rather than another anonymous collection walk.","objdump + local disassembly + caller correlation + tag-family correlation + route-entry correlation"
0x0044d4e0,512,world_relax_companion_float_grid_cross_average_in_rect_with_raster_bit0_gate,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Local five-pass relaxer over the companion float grid rooted at `[this+0x1605]`. The helper clamps the caller rectangle inward against the live world bounds, derives one radial falloff from the supplied center and radius through `0x0051dc00` when the caller radius is nonzero, averages the four cardinal neighbors around each admitted cell, subtracts the current cell, scales that delta by the falloff, the fixed coefficient at `0x005c8628`, and the caller gain, and only then accumulates the result back into the current float cell. The admit gate is explicit: cells whose paired raster byte in `[this+0x2135]` still has bit `0x01` set are skipped. After the five local passes it always re-enters `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same surviving rectangle. Current grounded caller is the neighboring world-side branch at `0x004bc5d3`, so this is the safest current read for the local cross-neighbor relaxer under the same height-support family rather than a broader global smoothing owner.","objdump + caller xrefs + local disassembly + float-grid correlation + local-relaxation correlation"
0x0044d6e0,912,world_relax_companion_float_grid_cross_average_in_rect_with_acceptance_gate,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Second local five-pass relaxer over the same companion float grid rooted at `[this+0x1605]`. Like the sibling at `0x0044d4e0`, it clamps the caller rectangle, averages the four cardinal neighbors, subtracts the current cell, and scales the resulting delta by a fixed coefficient before optionally accumulating it back into the current float slot. The admit path is tighter here: the cell is skipped whenever the paired raster byte in `[this+0x2135]` still has bit `0x01` set, and otherwise it also consults the neighboring acceptance gate `0x004499c0` before applying the delta. The final caller flag then decides whether the helper tails into `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same rectangle or returns immediately. Current grounded caller is the world-side branch at `0x004190b4`, where it is dispatched once per admitted local cell before the outer owner re-enters `0x0044d410`, so this is the safest current read for the acceptance-gated local cross-neighbor relaxer rather than another generic scalar write.","objdump + caller xrefs + local disassembly + float-grid correlation + acceptance-gate correlation"
0x0044d880,496,world_raise_companion_float_grid_toward_center_sample_in_rect,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Local neighborhood raise helper over the companion float grid rooted at `[this+0x1605]`. The function first validates the caller center cell against live dimensions, optionally seeds one baseline value from the current center sample when the caller gain is positive, expands a square neighborhood around that center by the caller radius, and then for each admitted cell derives one radial falloff through `0x0051dc00`. The body computes a delta from the current cell toward that baseline center sample, scales it by the falloff, the fixed coefficient at `0x005c8628`, and the caller gain, and accumulates the result back into the current float slot. After the neighborhood pass it always re-enters `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same surviving rectangle. Current grounded callers are the nearby world-side branches at `0x004bc676` and `0x004bc716`, so this is the safest current read for the center-sample-biased companion-float raise helper rather than another generic brush or setter.","objdump + caller xrefs + local disassembly + float-grid correlation + center-sample correlation"
0x0044da70,560,world_raise_companion_float_grid_local_peak_in_rect_with_optional_class_3_5_bias,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Local peak-raising helper over the companion float grid rooted at `[this+0x1605]`. The function expands one square neighborhood around the caller cell, clamps that neighborhood to the live world bounds, and then for each admitted cell derives a falloff through `0x0051dc00` when the caller radius is nonzero, scales the current float sample by the caller gain, and quantizes the resulting candidate peak through `0x005a10d0`. When the final caller byte is nonzero it also probes one extra candidate cell through `world_secondary_raster_query_cell_class_in_set_3_5` `0x00534f00`, quantizes that extra sample too, and keeps the larger of the two integer peaks before writing the chosen value back into the float grid. After the neighborhood pass it always re-enters `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same surviving rectangle. Current grounded callers are the nearby world-side branches at `0x004bc51e`, `0x004bc81f`, `0x004f9c74..0x004f9d26`, and `0x004fab45..0x004fad45`, so this is the safest current read for the local peak-raising companion under the same height-support family rather than a generic paint brush.","objdump + caller xrefs + local disassembly + float-grid correlation + local-peak correlation"
0x0044d410,208,world_calculate_height_support_fields_in_rect_and_notify_dependents,map,thiscall,inferred,objdump + caller xrefs + local disassembly + stage-order correlation,3,"Top-level rectangle owner under post-load progress id `322` `Calculating Heights...`. The helper first rejects while generation counter `[this+0x2205]` is live or when the neighboring rect supplier `0x00449e90` cannot produce a surviving work window. On the active path it forwards that rectangle into the shared support owners `0x005374d0`, `0x00533e70`, and `0x00537010`, then notifies the shell owner at `0x0062be68` and refreshes neighboring region or manager companions through `0x00421f50`, `0x00461770`, and `0x00415340`. Current grounded callers include `world_run_post_load_generation_pipeline` `0x004384d0`, the startup-side world path at `0x0044733d`, several recursive local helpers at `0x0044d6cf/0x0044d86e/0x0044da60/0x0044dc86`, and later world-side branches at `0x004143cd`, `0x00415f06`, `0x0041615d`, `0x00418a25`, `0x00418eb7`, `0x004190f0`, and `0x004fb55a..0x004fba30`, so this is the safest current read for the shared height-support and dependent-refresh owner rather than one narrow scalar smoother.","objdump + caller xrefs + local disassembly + stage-order correlation + support-surface correlation"
0x0044dca0,80,world_write_companion_float_grid_cell_and_optionally_refresh_rect,map,thiscall,inferred,objdump + caller xrefs + local disassembly + float-grid correlation,3,"Small write-side helper over the companion float grid rooted at `[this+0x1605]`. The helper flattens the caller-supplied cell coordinates with world width `[this+0x15d9] + 1`, stores the caller-supplied dword into that one grid slot, and when the final caller flag is nonzero immediately re-enters `world_calculate_height_support_fields_in_rect_and_notify_dependents` `0x0044d410` on the same coordinates as a local rectangle. Current grounded callers include world-side branches at `0x00414398`, `0x00415df2`, `0x00415ec5`, `0x00418956/0x00418977/0x00418996/0x004189b3`, the startup-side world path at `0x00446f20`, and later world-side branches at `0x004fb90b..0x004fb9fb`, so this is the safest current read for the companion-float-grid cell setter with optional local recompute rather than a generic scalar write.","objdump + caller xrefs + local disassembly + float-grid correlation + local-recompute correlation"
0x0044dcf0,316,world_refresh_secondary_raster_marked_bit_from_local_class_2_4_5_neighbors_in_rect,map,thiscall,inferred,objdump + local disassembly + internal caller correlation,3,"Local rectangle refresh helper over the same 3-byte secondary-raster family. The function first normalizes the caller rectangle through `0x00449df0`, then walks every cell in that bounded window and checks the eight immediate neighbors through the shared offset tables `0x00624b28/0x00624b48`. A small border-mode split is now explicit: for interior cells it rejects out-of-bounds neighbors early, while on the border path it treats the clipped edge more permissively. If any admissible neighbor belongs to secondary-raster class set `2/4/5` through `0x00534ec0`, the helper sets bit `0x200` in the current cell's companion word; otherwise it clears that bit. Current grounded callers are the two local mutation helpers `0x0044df03` and `0x0044dfcb`, so this is the safest current read for the marked-bit refresh companion under the same secondary-raster mutation family rather than a standalone overlay scan.","objdump + local disassembly + internal caller correlation + secondary-raster marked-bit correlation"
0x0044df10,208,world_clear_local_secondary_raster_cell_sidecars_demote_class_and_refresh_marked_bits,map,thiscall,inferred,objdump + local disassembly + caller xrefs + secondary-raster correlation,3,"Small local secondary-raster clear helper. When the target cell is in class set `2/4/5` through `0x00534ec0`, the function clears the three local sidecar byte planes rooted at `[this+0x162d]`, `[this+0x1661]`, and `[this+0x1665]` for that cell, then rewrites the cell's low three class bits in place: class `4` is demoted to `1`, class `5` is demoted to `3`, and all other admitted cases have those low class bits cleared. After that local demotion it expands the affected window by one cell in each direction and re-enters `world_refresh_secondary_raster_marked_bit_from_local_class_2_4_5_neighbors_in_rect` `0x0044dcf0` on that surrounding rectangle. Current grounded callers are the higher-level rect refresh owner `0x0044e500` and one later world-side caller at `0x004fa81b`, so this is the safest current read for the local class-demotion and sidecar-clear companion beneath the secondary-raster mutation family.","objdump + local disassembly + caller xrefs + secondary-raster correlation + local-class-demotion correlation"
0x0044e500,720,world_refresh_secondary_raster_edge_flags_in_rect_and_reseed_pending_component,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Rectangle-wide secondary-raster edge refresh owner. The helper first normalizes the caller rectangle through `0x00449df0`, then scans every cell in that window that belongs to class set `2/4/5` through `0x00534ec0`. For each admitted cell it snapshots the eight-neighbor occupancy pattern into a local byte ring, counts total plus parity-split neighbors, and then runs two grounded mutation branches. The first branch handles sparse single-neighbor interior cells: when byte-1 edge flags `0x04/0x08` are still clear and the cell is not on the outer border, it derives one aligned neighbor index from the current cell header and sets either bit `0x04` or `0x08` on byte `[cell+0x1]`. The second branch handles denser or incompatible local patterns: it re-enters `world_clear_local_secondary_raster_cell_sidecars_demote_class_and_refresh_marked_bits` `0x0044df10` on selected cells when the local parity counts or alternating-neighbor pattern fail the expected shape. After the full rectangle pass it also checks the pending global seed coordinates at `[0x006d1304+0x78/+0x7c]`; when those are valid it re-enters `world_seed_secondary_raster_class_2_4_5_component_walk_from_cell` `0x0044c200` and then clears that pending pair back to `-1`. Current grounded caller is the broader owner `0x0044e982`, so this is the safest current read for the rect-wide secondary-raster edge refresh plus pending-component reseed owner rather than a generic area scan.","objdump + caller xrefs + local disassembly + secondary-raster correlation + rect-edge-refresh correlation"
0x0044e7d0,320,world_stamp_radial_secondary_raster_class_2_marks_from_world_coords,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Radial secondary-raster stamp helper over world-space coordinates. After validating the caller float coordinate pair through `0x00414bd0`, the helper converts the center into one clamped integer bounding box using the paired radius constants at `0x005c8dc0` and `0x005c8c30`, then walks every cell in that box. For each candidate cell it evaluates the radial falloff helper `0x0051db80` against the current center and only when that score stays positive does it re-enter `world_mark_secondary_raster_clear_cell_mask_0x3e_as_class_2_and_cache_bounds` `0x0044c570`. Current grounded caller is the placed-structure-side branch at `0x0041d2c4`, which first checks shell gate `[0x006cec78+0x4af3]`, candidate family `[entry+0x41] == 5`, and then forwards the owner's normalized coordinates through `0x00455800/0x00455810`, so this is the safest current read for the shared radial class-`2` stamp helper rather than a generic brush or preview-only rasterizer.","objdump + caller xrefs + local disassembly + secondary-raster correlation + radial-falloff correlation"
0x0044e910,44,world_construct_root_and_load_bundle_payload_thunk,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small world-root constructor thunk. It first runs the immediate base initializer `0x00534f60`, installs vtable `0x005ca9fc`, re-enters the neighboring setup helper `0x00448260`, and then forwards the two caller-supplied constructor arguments into the heavier payload-load body `0x0044cfb0` before returning `this`. Current grounded caller is the world-allocation branch at `0x004442c2`, which allocates the `0x2209`-byte world root and then stores the constructed instance into `0x0062c120`, so this is the safest current read for the small world-root construct-and-load thunk rather than the larger runtime bringup owner itself.","objdump + caller xrefs + local disassembly + world-allocation correlation"
0x0044e940,1792,world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Broad rectangle-scoped rebuild owner over the live secondary-raster derived presentation family. The helper first clamps the caller rectangle through `0x00449df0` and reruns `world_refresh_secondary_raster_edge_flags_in_rect_and_reseed_pending_component` `0x0044e500`. It then lazily ensures one presentation target through `0x0051f090` plus `0x00534910/0x00534920/0x00534930`, refreshes neighboring world-presentation state through `0x00449f20`, resolves scaled target dimensions through `0x00534c50`, and allocates a temporary `width*height` mask. The main scan then walks the live secondary raster `[this+0x165d]` and class predicates `0x00534e10/0x00534e50/0x00534f00/0x00534ec0`: class-`1/3/4/5` cells force `0xff` into the four sidecar byte planes `[this+0x1631..+0x163d]`, while the broader per-cell pass computes local windows, emits packed values into the ensured target through `0x00534730`, and also updates nibble lanes at byte offsets `+0x2` and `+0x5` inside the same three-byte secondary-raster cell family. After the publish it notifies the shell owner at `0x0062be68`, re-enters `0x00449f80` and `0x004881b0`, frees the temporary mask, expands the caller rectangle by dirty bounds `[this+0x21ad..+0x21b9]` through `0x00536710`, and finally seeds companion byte `[this+0x162d]` with `0xc4` on cells selected from mask plane `[this+0x1655]`. Current grounded callers include the post-load generation path at `0x00444a42`, the shell-mode toggle branch at `0x004480ec`, the sibling owner at `0x0044fac6`, and later world-side branches at `0x004fb1f9`, `0x004fc21e`, and `0x004ffee4`, so this is the safest current read for the broad secondary-raster derived-surface and companion-plane rebuild owner rather than a one-off shell preview draw.","objdump + caller xrefs + local disassembly + secondary-raster correlation + derived-surface publish correlation"
0x00414bd0,112,world_query_float_coords_within_live_grid_bounds,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small float-coordinate bounds predicate over the live world grid. The helper returns true only when both caller-supplied float coordinates are `>= 0` and `<= [world+0x15d9]-1` / `<= [world+0x15d5]-1` respectively; otherwise it returns false. Current grounded callers include `placed_structure_validate_projected_candidate_placement` `0x004197e0`, the radial secondary-raster stamp helper `0x0044e7d0`, several later world-side branches around `0x00480af8`, `0x00498278`, and `0x004982cb`, and the StationPlace world-surface branch at `0x005085a4`, so this is the safest current read for the shared float grid-bounds gate rather than a tool-specific placement check.","objdump + caller xrefs + local disassembly + grid-bounds correlation"
0x00449df0,144,world_clamp_rect_coords_to_live_grid_and_validate_nonempty,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small rectangle clamp-and-validate helper over integer world-grid coordinates. The function takes four caller-owned coordinate pointers, clamps the two lower bounds to zero, clamps the two upper bounds to `[world+0x2155]-1` and `[world+0x2159]-1`, and then returns true only when the resulting rectangle is still nonempty and fully within those live dimensions. Current grounded callers include the local marked-bit refresh helper `0x0044dcf0`, the rect-wide secondary-raster edge refresh owner `0x0044e500`, the broader owner `0x0044e982`, later secondary-raster siblings around `0x0044ec93` and `0x0044eee9`, the route-entry window gate `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`, and one later world-side caller at `0x00494261`, so this is the safest current read for the shared rect clamp-and-validity predicate rather than a serializer-only rectangle helper.","objdump + caller xrefs + local disassembly + rect-clamp correlation"
0x00444dd0,3301,map_bundle_open_reference_package_and_serialize_early_world_datasets,map,cdecl,inferred,objdump + caller xrefs + local disassembly + chunk-family correlation,4,"Broader package-save prelude beneath the non-`.smp` branch of `shell_map_file_world_bundle_coordinator` `0x00445de0` and the neighboring multiplayer-side fallback path at `0x0046cfcb`. The helper seeds the shared stage/progress globals `0x00620e94 = 0x26ad`, `0x0062bec8 = 0x15`, `0x0062becc = 0`, and `0x0062bed0 = ticks`, optionally runs the editor-map side prepass `0x00436a70` when `[0x006cec74+0x68]` is live, opens one bundle through `0x00530c80(4, 0x30d40, 1)`, and on failure raises the localized modal rooted at `0x0fda` before unwinding the surrounding shell notices. On success it serializes the first broad save/package band in a fixed order with interleaved progress updates through `0x00441d90`, `0x00538c70`, `0x00482160`, and `0x00442660`: chunk `0x32c8` with the fixed `0x4f2c` world block `[world+0x04]`, chunk `0x32c9` with the fixed `0x0bb9` block `[world+0x4f30]`, chunk family `0x332d/0x332e` with the late setup-preview payload band `[world+0x66be]`, the shared indexed-collection serializer `0x00517d90` over candidate named-availability collection `[world+0x66b2]`, chunk `0x32dc`, chunks `0x3714/0x3715` with the `0x108` staged profile block `0x006cec7c`, then that same shared serializer `0x00517d90` over locomotive named-availability collection `[world+0x66b6]` under `0x32dd`, then the early reference and manager families through `world_serialize_runtime_grid_and_secondary_raster_tables_into_bundle` `0x00449520`, the shell notifier vtable `+0x08` on `0x0062be68`, `structure_candidate_collection_serialize_filter_and_year_visible_summary_blocks` `0x0041e930`, `aux_candidate_collection_serialize_records_into_bundle_payload` `0x00416a70`, `placed_structure_collection_serialize_local_runtime_records_into_bundle` `0x00413440`, direct indexed-collection header serialization on the route-link family `0x006ada90` through `0x00517d90`, `placed_structure_collection_serialize_dynamic_side_buffers_into_tagged_bundle` `0x00481310`, `linked_route_object_collection_serialize_records_into_tagged_bundle` `0x0041d4c0`, `train_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` `0x004b27a0`, `company_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` `0x00429b90`, `route_entry_collection_serialize_records_into_tagged_bundle` `0x00491c60`, `aux_route_entry_tracker_collection_serialize_records_into_tagged_bundle` `0x004a4240`, `profile_collection_serialize_records_into_tagged_bundle` `0x004777e0`, `geographic_label_database_serialize_records_into_tagged_bundle` `0x00461650`, `city_database_entry_collection_serialize_records_into_tagged_bundle` `0x00474610`, `world_region_collection_serialize_records_into_tagged_bundle` `0x004215e0`, `territory_collection_serialize_records_into_tagged_bundle` `0x00487cc0`, `support_collection_serialize_tagged_records_into_bundle` `0x0040b6a0`, and `scenario_event_collection_serialize_runtime_records_into_packed_state` `0x00433060`. Its fixed tail is tighter now too: after the tagged collections it writes one direct dword from `[world+0x19]`, one zeroed `0x1f4`-byte slab under chunk `0x32cf`, closes the bundle through `0x00530a00`, derives the output path through `0x00442740`, conditionally emits the companion-image sidecar file branch `0x00441f70` when companion-image byte `[world+0x66c8]` is set, conditionally emits the companion-payload rewrite branch `0x00442900` when companion-payload byte `[world+0x66c9]` is set, and otherwise falls back to the localized no-preview notice path through `0x00441ec0`; those same preview/payload flags also add `+1` and `+0x15` respectively into the shared progress bound `0x0062bec8` before the save steps begin. This is therefore the real early reference-package open-and-save owner rather than a generic database opener.","objdump + caller xrefs + local disassembly + chunk-family correlation + save-order correlation + package-tail correlation +
0x00445ac0,790,shell_map_file_entry_coordinator,map,cdecl,inferred,objdump + analysis-context + local disassembly,4,"Broad shell-side file-open and restore coordinator reached from tutorial launch shell UI editor-panel flows and scenario batch processing. At entry it clears the optional success dword, and every successful path later decrements nested open counter `0x0062be6c`, notifies the shared shell owner at `0x0062be68`, sets shell latch `[0x006cec74+0x501] = 1`, and clears live input word `[0x006d4018+0xa8c]`. The direct-seed side is tighter now too: when the caller supplies a path seed the helper increments `0x0062be6c`, and if a live runtime world is already active or flag bit `0x8` is set it copies that stem, appends the fixed `.smp` token from `0x005ca9a4`, and re-enters `world_load_saved_runtime_state_bundle` `0x00446d40`; otherwise it routes straight into the heavier world-entry branch `0x00443a50` with the flag-derived trailing boolean from `(flags>>2)^1`. The quickload side is explicit too: flag bit `0x1` seeds the shared quicksave base stem from `0x005ca9cc`, appends `.gmp` when editor-map flag `[0x006cec74+0x68]` is live and otherwise appends `.gms/.gmc/.gmx` through the same sandbox/campaign/default split used by the interactive chooser, resolves the final path through `0x004839e0`, validates it through `0x00530c20`, and uses the two localized validation branches rooted at ids `0x181/0x182` plus `0x004c98a0` before continuing. The non-Quicksave interactive path is tighter now too: it routes through `shell_file_request_dialog_collect_target_path` `0x004dd010` using load mode `4=.gmp` when `EditorPanel.win` is live and paired non-editor open modes `8=.gms`, `9=.gmc`, and `10=.gmx`. The shell-state master flag `[0x006cec74+0x68]` reinforces that same mapping on the direct quickload branch too: when it is nonzero the coordinator appends the `.gmp` token immediately instead of choosing among the scenario families, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic post-load toggle. Current surrounding shell evidence still keeps the non-editor trio concrete: `.gmx` aligns with sandbox mode because the sibling shell branch at `0x004dc923` gates on `0x006cec7c+0x82` and surfaces string `3898` `The briefing is not available in sandbox games`; `.gmc` aligns with campaign scenarios because `0x004dc9cd` gates on `0x006cec7c+0xc5` and surfaces string `3018` about resigning back to the campaign screen; the remaining default `.gms` branch is therefore the standalone scenario family.","objdump + analysis-context + local disassembly + caller xrefs + strings + mode-table inspection + string correlation + Quicksave branch inspection + restore-vs-world-entry split"
0x00445de0,1115,shell_map_file_world_bundle_coordinator,map,cdecl,inferred,objdump + analysis-context + local disassembly,4,"Broad shell-side file-save and package coordinator used by direct shell commands scenario batch processing and neighboring shell-editor callers. At entry it clears the optional success dword and seeds shared save-progress selector `0x0062bec4` from one of the two shell-controller dwords `[0x006d4024+0x11472a]` or `[+0x11472e]` depending on the side-owner gate `0x004839b0`. The selector provenance is tighter now too: those two source dwords sit in the same shell-controlled sidecar family as `[0x006d4024+0x11471a/+0x11471e]`, are initialized by the display-runtime defaults path around `0x0051ee48..0x0051ee85`, and are toggled by the broader settings owner `shell_settings_window_handle_message_dispatch_and_persist_display_runtime_sidecar_family` `0x00464c80`, which enforces the grounded implication rules `!0x11471e -> clear 0x11472a` and `(0x11472a || 0x11472e) -> set 0x11471e`. Its filename-selection side is tighter now too: an explicit caller-supplied stem bypasses the chooser, flag bit `0x1` seeds the Quicksave base stem from `0x005ca9cc`, and flag bit `0x2` seeds the localized `Autosave` stem through string id `387` while also clearing `0x0062bec4`. The non-Quicksave interactive path is explicit now too: it routes through `shell_file_request_dialog_collect_target_path` `0x004dd010` using save mode `3=.gmp` for the editor-map package path, `0=.gms` for standalone scenarios, `1=.gmc` for campaign-scenario saves, and `2=.gmx` for sandbox saves, plus the auxiliary `11=.gmt` branch reached only when `shell_has_auxiliary_preview_owner` `0x00434050` reports the side owner at `0x006cd8d8`. The shell-state master flag `[0x006cec74+0x68]` reinforces that editor mapping on the direct save and Quicksave side too: when it is nonzero the coordinator chooses the `.gmp` package mode immediately before the scenario-family checks, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic setup toggle. The active-world split is tighter in the same way: when a live runtime world is present the helper copies the chosen stem, appends the fixed `.smp` token from `0x005ca9a4`, re-enters `world_runtime_serialize_smp_bundle` `0x00446240`, and marks success immediately. Only when no active runtime world is present does it continue into the package side: when the auxiliary preview owner is live it packages the chosen stem into the owner-local request block near `0x006cd8d8+0x8f48` and submits it through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x7d` and payload size `0x48`; otherwise it falls back to `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`. The campaign mapping is still backed by the numbered `%s%02d.gmc` helper at `0x00517c70`, which formats one campaign-progress slot from `0x006cec7c+0xc4` before re-entering this coordinator, while the sandbox mapping is backed by the neighboring shell restriction string `3898` on `0x006cec7c+0x82`. Its package-side order is now explicit too: the non-`.smp` branch delegates the early direct-save band to `0x00444dd0`, which itself serializes the route-entry family, auxiliary tracker family, profile, region, territory, support, and event managers with shared progress/sample notices interleaved through `0x00441d90`, `0x00538c70`, `0x00482160`, and `0x00442660`. The package tail is tighter now too: after the companion sidecar branches it restores the raw shell-status byte band directly through `0x00442330` at `0x00445a55`, then services StationPlace.win and TrackLay.win through `0x00445a64/0x00445a73` without re-entering wrapper `0x004423d0`, before releasing the remaining save-side presentation stack. One editor-only trailing validation branch is tighter now too: after a successful non-runtime package save, when `[0x006cec74+0x68]` and `[world+0x66de]` are both live, the helper scans the fixed 16-entry stem table `0x00621cf0..0x00621d2c` against format stem `0x00
0x00455320,42,runtime_object_collection_construct_vtable_5cae10,map,thiscall,inferred,objdump + world-load correlation + local disassembly,2,"World-load constructor for the `0x005cae10` indexed collection later rooted at `0x006acd34`. The helper enters the common collection base `0x00517ce0`, installs vtable `0x005cae10`, seeds the indexed collection through `0x00518570` with grounded parameters `(record_size=0x21a, initial_slots=0x0a, growth=5, id_base=1)`, and returns `this`. Current grounded caller is the world-load allocation strip inside `0x00438c70`, where the resulting object is stored into global `0x006acd34`.","objdump + world-load correlation + local disassembly + constructor-parameter reconstruction"
0x00455350,22,runtime_object_collection_release_entries_and_collection_storage_vtable_5cae10,map,thiscall,inferred,objdump + world-shutdown correlation + local disassembly,2,"Release-side companion to `runtime_object_collection_construct_vtable_5cae10` `0x00455320`. The helper reinstalls vtable `0x005cae10`, re-enters `0x00518600` to release live entries, and then tails into the common collection teardown `0x00518bd0`. Current grounded caller is the ordered world-root shutdown strip `0x00434300`.","objdump + world-shutdown correlation + local disassembly + companion correlation"
0x00455f60,96,world_region_resolve_center_world_grid_cell,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small region-to-grid resolver that converts one region's cached center coordinate pair into a pointer into the live world-grid cell table rooted at `[0x0062c120+0x2129]`. It reads the cached floats at `[this+0x1ea]` and `[this+0x1e2]`, scales and rounds them through `0x005a10d0`, multiplies the Y-like term by world width `[0x0062c120+0x2145]`, adds the X-like term, and returns the corresponding grid-cell pointer. Current grounded callers include the world-entry region-center flag reseed pass `0x0044c4b0` and several older site- or route-style world-grid query helpers, so this is now the safest current read for the shared region-center world-grid-cell resolver.","objdump + local disassembly + caller inspection + world-grid correlation"
0x00446240,2807,world_runtime_serialize_smp_bundle,map,cdecl,inferred,objdump + analysis-context + local disassembly,3,"Serializes the current live world state into the `.smp` branch used by shell_map_file_world_bundle_coordinator. After dismissing the shell detail controller and running one shell-state service step it first pushes the nested mouse-cursor selection hold through `0x0053f2f0`, snapshots one startup-side status band through `0x004423a0`, allocates a bundle through `0x00530c80`, seeds many typed records through repeated `0x00531030` and `0x00531340` calls, walks world collections under `0x0062c120` and `0x006ada80`, and emits runtime-state payloads through helpers such as `0x00534e50`, `0x00534ec0`, `0x00534f00`, and `0x00534f40`; at the tail it mirrors the paired status follow-on through `0x004423d0`, pops the same mouse-cursor hold through `0x0053f310`, posts the fixed shell status line through `0x00538c70`, and only then closes the bundle through `0x00530a00`. The status-band choreography is tighter now too: `0x004423a0/0x004423d0` bracket the same four shell byte lanes `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` plus startup byte `[0x006cec78+0x4c74]` through the `0x0062be90` stack while also servicing active TrackLay.win and StationPlace.win tool windows. The serializer-side fixed header is explicit now too: it writes bundle version `0x400` first, then, for version `>= 0x3f1`, the late world-status block `[world+0x66be]` under chunk ids `0x2ee0/0x2ee1`, followed by the main world-grid dimensions and stride scalars from `[world+0x2155/+0x2159]`. The raster side is tighter in the same way, because the serializer writes the two one-byte overlay mask planes separately through chunk ids `0x2cee` for `[world+0x1655]` and `0x2d51` for `[world+0x1659]`, then re-enters `world_serialize_four_sidecar_byte_planes_into_runtime_bundle` `0x00448fe0` to write four additional byte planes under chunk family `0x9471..0x9472` from the world-owned pointer band at `[world+0x1631 + index*4]` before the later fixed-band tail continues. One save-side bridge into the editor economic-tuning band is explicit now too: before the region and named-availability runs, the serializer writes the same six-dword block the map-editor economic cost panel exposes at `[world+0x0be2..+0x0bf6]` as one direct dword from `[world+0x0be2]` plus five successive dwords from `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`. The mid-save state bands are tighter now too: after the core raster tables it serializes the twelve `0x4e1`-byte recipe books from `[world+0x0fe7]` book-by-book as one exact `cap dword + 0x3d-byte header + five repeated line tuples` structure. Each repeated `0x30`-byte line is emitted field-by-field as mode dword at `+0x00`, annual amount float at `+0x04`, supplied-token window at `+0x08`, and demanded-token window at `+0x1c`, with no intervening serializer-owned reinterpretation. The named-availability, event, and trailing fixed bands are tighter in the same way: the serializer writes a counted run of fixed `0x22`-byte candidate-name-plus-dword records from `[world+0x66b2]`, then a counted run of fixed `0x41`-byte locomotive-name-plus-dword records from `[world+0x66b6]`, writes a counted region row run from `[0x0062bae0]` as `0x29`-byte headers plus companion profile-subcollection counts and `0x22`-byte rows, brackets the live event collection at `0x0062be18` with chunk ids `0x4e21/0x4e22` before delegating the per-event packed-state save to `scenario_event_collection_serialize_runtime_records_into_packed_state` `0x00433060`, writes the two direct dwords at `[world+0x4c78/+0x4c7c]`, and at version `>= 0x400` writes `49` dwords from `[world+0x4a7f..+0x4b3f]` plus one trailing dword from `[world+0x4b43]`, which grounds a direct `.smp` save of the editor-side scenario-rule band rather than only the smaller fixed matrix inferred from checked `gmp/gms/gmx` files. Current grounded caller is `0x00445de0` on the `.smp` path so this looks like the live-world save or package serializer rather than the restore path.","objdump + analysis-contex
0x00446d40,5401,world_load_saved_runtime_state_bundle,map,cdecl,inferred,objdump + analysis-context + local disassembly,4,"Loads one saved runtime world-state bundle from the `.smp` branch selected by `shell_map_file_entry_coordinator` `0x00445ac0`. The helper dismisses the current shell detail controller, optionally tears down the active tool owner through `0x004ddbd0(-1, 0)`, releases the prior world runtime through `world_runtime_release_global_services` `0x00434300`, drives shell mode and status transitions, rebuilds the startup-side runtime roots through `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`, allocates a new bundle through `0x00530c80`, and constructs a fresh world root at `0x0062c120` through `0x0044cf70` using `(width+1, height+1)` from the serialized grid scalars. The first restore bands are tighter now too: after bundle version `0x400` it restores the late setup-preview payload block `[world+0x66be]` from chunk ids `0x2ee0/0x2ee1` for versions `>= 0x3f1`, immediately re-normalizes that payload through `shell_setup_payload_seed_unique_row_category_bytes_and_marker_slots` `0x0047bc80`, and otherwise explicitly clears the older compatibility tail at `[world+0x6987]`; then it reads one dword per world-grid cell and forwards those values into `world_write_companion_float_grid_cell_and_optionally_refresh_rect` `0x0044dca0` across the full `(width+1)*(height+1)` raster. The restore-side negative boundary is tighter too: current local disassembly still does not show this path republishing shell dword `[0x006cec74+0x178]`; the grounded interactive writer for that policy remains the UI-command dispatcher `0x00464410` through command ids `0x9d26..0x9d28`. The raster and overlay side is explicit in the same way: the loader restores the two one-byte overlay mask planes separately from chunk ids `0x2cee` into `[world+0x1655]` and `0x2d51` into `[world+0x1659]`, then, for versioned bundles at `>= 0x3ec`, re-enters `world_load_four_sidecar_byte_planes_from_runtime_bundle` `0x00448f60` to restore four extra byte planes under chunk family `0x9471..0x9472` into `[world+0x1631 + index*4]`. It also restores the per-cell secondary-raster sideband through the byte-level helpers `0x00448c20`, `0x00448cb0`, `0x00448d90`, `0x00448e60`, `0x00448e90`, and `0x0044de30`, with the later version split now explicit: at `>= 0x400` it restores five separate per-cell compatibility bits into the live secondary-raster word and byte lanes, while older bundles clear those same bits back to the older fixed fallback pattern. One mid-restore preview branch is tighter now too: for versions `>= 0x3ee` it restores one width/height-tagged dword surface, optionally resamples it through `shell_world_presentation_stage_overlay_rect_from_normalized_bounds` `0x00534930`, republishes it through `0x00534730/0x00534af0`, frees the temporary buffer, and then re-enters `0x004882e0` on the neighboring manager family. The recipe and manager bands are tighter in the same way: at version `>= 0x3f5` it restores the same twelve `0x4e1` recipe books back into `[world+0x0fe7]` book-by-book as one exact `cap dword + 0x3d-byte header + five repeated line tuples` structure, with each repeated `0x30`-byte line read field-by-field back into mode dword `+0x00`, annual amount float `+0x04`, supplied-token window `+0x08`, and demanded-token window `+0x1c`. At version `>= 0x3f2` it then restores the same six-dword editor economic-tuning band by reading the first dword into `[world+0x0be2]`, mirroring that value immediately into `[world+0x0bde]`, and reading the five successive dwords into `[world+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, before the later manager bands at `[world+0x4f30]`, the tagged geographic-label collection `0x006ada80`, the trailing scenario-rule band `[world+0x4a7f..+0x4b43]`, and the packed sidecar bitfield at `[world+0x2141]` run under the later version gates `0x3f4/0x3fa/0x3fc`. The region side is explicit now too: after seeding default regions through `world_region_collection_seed_default_regions` `0x00421b60`, the loader rea
0x0044f840,176,world_build_transport_pricing_preview_surface_from_secondary_raster,map,thiscall,inferred,objdump + caller inspection + local disassembly + secondary-raster correlation,3,"Small transport/pricing-side preview builder beneath `world_compute_transport_and_pricing_grid` `0x0044fb70`. The helper allocates one default presentation target through `0x00534930`, queries its dimensions through `0x00534c50`, seeds five fallback palette entries through repeated `0x0051de10` calls, and then walks the target pixels. Each pixel is mapped back into the live secondary raster `[this+0x165d]` through `0x00533970/0x00533980`; low-3-bit classes other than `1/4` get one fixed fallback color, while class-`1/4` pixels scan a local `+/-4` neighborhood for zero-tag cells, score those through the radial falloff helper `0x0051db80`, and then choose either one of the seeded palette entries or the alternate fallback color `0x5f040566`. After filling the whole surface it re-enters `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940` on the full `0..0x270f` rectangle rooted at that target. Current grounded caller is the null-build path at `0x0044fb31` inside `world_compute_transport_and_pricing_grid`, so this is the safest current read for the transport/pricing preview-surface builder rather than another generic overlay helper.","objdump + caller inspection + local disassembly + secondary-raster correlation + preview-surface correlation"
0x0044faf0,128,world_ensure_transport_pricing_preview_surface_and_publish_if_missing,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Thin world-side ensure/publish wrapper above `world_build_transport_pricing_preview_surface_from_secondary_raster` `0x0044f840`. The helper first forwards the caller rectangle and output pointer into `0x00538060`, then samples shell state through `0x0040b830` and the paired shell notifier `0x004834e0`. When the returned preview handle is null it rebuilds the preview surface by re-entering `0x0044f840`; in either case it then refreshes neighboring world presentation through `0x00449f80`, re-enters the region-border overlay refresh `0x004881b0`, posts the same shell notifier again, and finally issues one mode pulse through `0x00484d70` before returning the ensured handle. Current grounded caller is the world-side path at `0x0043901a`, so this is the safest current read for the transport/pricing preview ensure-and-publish wrapper rather than another generic surface allocator.","objdump + caller inspection + local disassembly + world-presentation correlation"
0x0044fb70,1117,world_compute_transport_and_pricing_grid,map,cdecl,inferred,objdump + strings + callsite inspection,3,"Post-load world-generation subphase inside world_run_post_load_generation_pipeline. Reached directly under the localized progress update `Computing Transportation and Pricing...`, the helper iterates the active world grid through dimensions and bounds rooted at `[0x0062c120+0x2145]`, `[+0x2149]`, `[+0x2155]`, `[+0x2159]`, and `[+0x2129]`, samples neighborhood offsets from `0x00624b28` and `0x00624b48`, combines local terrain or transport values through repeated calls to `0x00534e50` and `0x00448aa0`, and writes bounded 16-bit results back into the grid cells. This now looks like the map-wide transportation-cost or pricing-field computation pass rather than a recurring simulation-step loop.",objdump + caller context + RT3.lng strings
0x00487540,221,world_region_border_overlay_reset_companion_record,map,thiscall,inferred,objdump + caller xrefs + field-reset inspection,4,"Shared companion-record initializer under the region-border overlay family rooted at `0x006cfc9c`. The helper zeroes the live region id and accumulated contribution fields, seeds the enable and remap dwords at `[this+0x31]` and `[this+0x35]` to `1`, seeds the budget-like dword `[this+0x39]` to `0x186a0`, clears the paired float or score bands at `[this+0x45/+0x49/+0x4d/+0x51]` and `[this+0x1fd/+0x201/+0x205/+0x209]`, zeros the later summary slots at `[this+0xd51..+0xd69]`, resets `[this+0xd4d]` to `1`, and clears the two large tail arrays rooted at `[this+0x3b5]` and `[this+0xd6d]`. Current grounded callers are the plain wrapper `0x00487620` and the id-setting wrapper `0x00487650`, both used under world_region_border_overlay_rebuild.","objdump + caller xrefs + field-reset inspection"
0x00487650,16,world_region_border_overlay_reset_companion_record_and_assign_region_id,map,thiscall,inferred,objdump + caller xrefs + wrapper inspection,4,"Thin wrapper around world_region_border_overlay_reset_companion_record. After resetting the full companion record, the helper stores the caller-supplied live region id into `[this+0x00]` and returns. Current grounded callers are the region-border overlay setup loops at `0x00487d77` and `0x0048836e`.","objdump + caller xrefs + wrapper inspection"
0x00487c20,143,territory_collection_refresh_records_from_tagged_bundle,map,thiscall,inferred,objdump + world-load correlation + local disassembly + tag correlation,3,"Collection-wide tagged load owner for the live territory collection rooted at `0x006cfc9c`. The helper reads chunk family `0x61a9/0x61aa/0x61ab` through repeated `0x00531360` calls, refreshes the collection-side metadata through `0x00518680`, walks every live territory entry through the indexed-collection helpers `0x00517cf0/0x00518380/0x00518140`, and dispatches each resolved record through vtable slot `+0x40` with the caller-supplied bundle handle before closing tag `0x61ab`. The current per-entry load slot `0x00487670` is a no-op returning zero, so this tagged lane presently rehydrates collection-side metadata and live ids without additional per-entry payload. Current grounded caller is the world-entry bringup strip `0x00443a50`, where this collection is refreshed beside the neighboring region and support families.","objdump + world-load correlation + local disassembly + tag correlation + per-entry-noop-load correlation"
0x00487cc0,118,territory_collection_serialize_records_into_tagged_bundle,map,thiscall,inferred,objdump + package-save correlation + local disassembly + tag correlation,3,"Collection-wide tagged save owner for the live territory collection rooted at `0x006cfc9c`. The helper opens chunk family `0x61a9/0x61aa/0x61ab` through repeated `0x00531340` calls, serializes the collection-side metadata through `0x00517d90`, walks every live territory entry through the indexed-collection helpers `0x00517cf0/0x00518380/0x00518140`, and dispatches each resolved record through vtable slot `+0x44` with the caller-supplied bundle handle before closing tag `0x61ab`. The current per-entry save slot `0x00487680` is a no-op serializer, so this tagged lane presently persists collection-side metadata and live ids without additional per-entry payload. Current grounded caller is the package-save strip beneath `shell_map_file_world_bundle_coordinator` `0x00445de0`, where this family is emitted beside the neighboring region and support managers.","objdump + package-save correlation + local disassembly + tag correlation + per-entry-noop-save correlation"
0x004881b0,272,world_region_border_overlay_refresh_raw_region_cell_counts_from_world_grid,map,thiscall,inferred,objdump + caller xrefs + raster-count inspection,4,"Shared region-raster counting pass over the companion region set `0x006cfc9c`. The helper zeroes one `0x3e8`-entry local count table, sweeps the active world raster at `[0x0062c120+0x2131]` across `[world+0x2155/+0x2159]`, keeps only cells whose secondary-raster low-3-bit tag predicate `world_secondary_raster_query_cell_low3bit_tag_nonzero` `0x00448f00` returns `0`, and bins each surviving cell by the compact region id `cell_byte >> 3`. It then walks the companion region records, stores the corresponding raw cell count into `[entry+0x3d]`, and clears `[entry+0x41]` before later owners fold or reuse those totals. Current grounded callers are the region-border overlay rebuild at `0x004882e0`, the world-build paths around `0x004431ea`, `0x004476ad`, `0x0044f657`, and `0x0044fb43`, plus one shell-side caller at `0x004fcc05`.","objdump + caller xrefs + raster-count inspection + caller correlation + secondary-raster predicate correlation"
0x00487de0,752,world_region_border_overlay_emit_segment_geometry_from_region_grid,map,cdecl,inferred,objdump + caller xrefs + grid-neighbor inspection,4,"Heavy inner geometry pass under world_region_border_overlay_rebuild. The helper first clears or prepares the current overlay surface through `0x00533cf0` on the active world presentation rooted at `0x0062c120`, then walks the companion region-set family at `0x006cfc9c`, counting entries whose enable byte `[entry+0x31]` is nonzero or whose accumulated contribution pair `[entry+0x3d]+[entry+0x41]` stays positive. It seeds a local remap table from either the live region id `[entry+0x00]` or the fallback remap id `[entry+0x35]`, scans the world raster at `[world+0x2131]` across `[world+0x2155/+0x2159]` in two axis directions, compares neighboring mapped ids, and emits border-segment geometry through `0x00536ea0` whenever adjacent cells belong to different mapped regions. Current grounded caller is `0x004882c6` under world_region_border_overlay_rebuild.","objdump + caller xrefs + grid-neighbor inspection + geometry-emitter inspection"
0x004882e0,199,world_region_border_overlay_rebuild,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Rebuilds the border-overlay companion for the numbered region set owned by `0x0062bae0`. After pumping shell progress through `0x004834e0` the helper seeds or refreshes the companion record family at `0x006cfc9c`, using world_region_border_overlay_reset_companion_record_and_assign_region_id `0x00487650` to reset each resolved record before folding active contribution counts back into `[entry+0x3d]+[entry+0x41]`. It then refreshes the raw per-region cell-count band through world_region_border_overlay_refresh_raw_region_cell_counts_from_world_grid `0x004881b0`, and only after that hands the actual world-grid border-segment emission to `world_region_border_overlay_emit_segment_geometry_from_region_grid` `0x00487de0`. Current grounded callsites are the post-load generation pipeline at `0x004384d0` and the broader world-build path around `0x00447560`, which makes this look like a region-border overlay rebuild rather than another generic player or company manager pass.","objdump + caller xrefs + RT3.lng strings + grid-neighbor inspection"
0x00533cf0,180,world_region_border_overlay_clear_all_chunk_segment_queues,map,thiscall,inferred,objdump + caller xrefs + queue teardown inspection,4,"One-owner teardown helper under world_region_border_overlay_emit_segment_geometry_from_region_grid. The helper walks every coarse chunk bucket in the world-presentation table `[this+0x167d]`, and for each bucket with queued nodes it repeatedly pops the queued payload pointers through `0x00556ef0/0x00556f00`, frees those segment records through `0x005a1145`, and then resets the bucket through `0x005570b0`. Current grounded caller is `0x00487df8`, which uses it to clear the prior border-overlay segment queues before rebuilding them from the live region grid.","objdump + caller xrefs + queue teardown inspection"
0x00536ea0,96,world_region_border_overlay_allocate_and_queue_segment_record,map,thiscall,inferred,objdump + caller xrefs + intrusive-queue inspection,4,"One-owner record allocator under world_region_border_overlay_emit_segment_geometry_from_region_grid. The helper allocates one `0x31`-byte segment record through `0x005a125d`, copies the caller-supplied endpoint and orientation fields into that record, optionally expands cached float coordinates through repeated `0x00534490` calls when the final byte flag is nonzero, resolves one coarse bucket in `[this+0x167d]` from the segment midpoint, and appends the finished record to that bucket through `intrusive_queue_push_back` `0x00556e10`. Current grounded caller is `0x00488072` inside the border-overlay geometry emitter.","objdump + caller xrefs + intrusive-queue inspection + segment midpoint bucketing"
0x00533100,16,runtime_object_set_indexed_f32_field_family_0x14e4,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny indexed float setter under the broader `0x23a` runtime-object family. The helper stores the caller float into `[this+0x14e4 + index*4]` and returns. Current grounded callers are the paired setup strips around `0x0043c442/0x0043c479` and `0x00484e6b/0x00484e90`, so the safest current read is an indexed `f32` field-family store rather than a named gameplay scalar.","objdump + caller inspection + local disassembly + field-family correlation"
0x00533120,13,runtime_object_get_indexed_f32_field_family_0x14e4,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny indexed float getter for the same `0x23a` runtime-object field family rooted at `[this+0x14e4]`. The helper loads one caller-selected float slot and returns it on the FPU stack. Current grounded caller is `runtime_object_quantize_world_position_sample_group_metric_and_select_subrecord` `0x0052f370`, where it contributes one sampled scalar to the grouped-subrecord selection metric.","objdump + caller inspection + local disassembly + field-family correlation + quantized-selector correlation"
0x00533130,11,runtime_object_set_dword_field_0x1534,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword setter for field `[this+0x1534]` under the shared runtime-object or presentation-owner family. Current grounded callers are the setup strips around `0x0043b807`, `0x00484eb3`, `0x0052be9a`, `0x0052bf04`, and `0x0052cb83`, so the safest current read is a direct field setter rather than a higher-level mode helper.","objdump + caller inspection + local disassembly + field correlation"
0x00533140,7,runtime_object_get_dword_field_0x1534,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword getter for field `[this+0x1534]` in the same shared runtime-object family. Current grounded callers include `0x005294e7`, `0x0052be8f`, `0x0052c23b`, and `0x0052cb6f`, which keep this safely bounded as the read-side companion to `0x00533130`.","objdump + caller inspection + local disassembly + field correlation"
0x00533150,11,runtime_object_set_dword_field_0x1540,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword setter for field `[this+0x1540]` under the shared runtime-object family. Current grounded callers are the setup strips around `0x00484ef9`, `0x0052bfb0`, and `0x0052bfc1`.","objdump + caller inspection + local disassembly + field correlation"
0x00533160,7,runtime_object_get_dword_field_0x1540,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword getter for field `[this+0x1540]` in the same shared runtime-object family. Current grounded callers include `0x005246b7`, `0x00524754`, `0x0052a346`, `0x0052bf82`, and `0x0052c262`; together with `0x00533180`, this forms the currently grounded threshold pair sampled by `shell_emit_ranked_overlay_cell_items` `0x00524780`.","objdump + caller inspection + local disassembly + field correlation + ranked-overlay correlation"
0x00533170,11,runtime_object_set_dword_field_0x153c,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword setter for field `[this+0x153c]` under the shared runtime-object family. Current grounded callers are the setup strips around `0x00484f1c`.","objdump + caller inspection + local disassembly + field correlation"
0x00533180,7,runtime_object_get_dword_field_0x153c,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword getter for field `[this+0x153c]` in the same shared runtime-object family. Current grounded callers include `0x005247b2`, and together with `0x00533160` this forms the currently grounded two-dword threshold pair sampled by `shell_emit_ranked_overlay_cell_items` `0x00524780`.","objdump + caller inspection + local disassembly + field correlation + ranked-overlay correlation"
0x00533190,11,runtime_object_set_dword_field_0x1544,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword setter for field `[this+0x1544]` under the shared runtime-object family. Current grounded callers are the setup strips around `0x0043b89d`.","objdump + caller inspection + local disassembly + field correlation"
0x005331a0,7,runtime_object_get_dword_field_0x1544,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword getter for field `[this+0x1544]` in the same shared runtime-object family. Current grounded callers include `0x0052bf99` and `0x0052bfa8`, which keep this bounded as the direct read-side companion to `0x00533190`.","objdump + caller inspection + local disassembly + field correlation"
0x005331b0,11,runtime_object_set_f32_field_0x14e0,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny float setter for field `[this+0x14e0]` under the shared runtime-object family. Current grounded caller is the setup strip around `0x00484e2e`.","objdump + caller inspection + local disassembly + field correlation"
0x005331c0,7,runtime_object_get_f32_field_0x14e0,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny float getter for field `[this+0x14e0]` in the same shared runtime-object family. Current grounded callers include `0x0043b468`, `0x0043b48a`, `0x00484de9`, and `0x00484e07`, which keep this bounded as the direct read-side companion to `0x005331b0`.","objdump + caller inspection + local disassembly + field correlation"
0x005331d0,7,runtime_object_get_dword_field_0x1548,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny dword getter for field `[this+0x1548]` under the shared runtime-object family. Current grounded callers include `0x0052bd13`, `0x0052bd41`, and `0x0052bd6f`. The matching setter remains outside the current local strip.","objdump + caller inspection + local disassembly + field correlation"
0x005331e0,592,world_rebuild_overlay_sample_triplet_cell_for_scale,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Scale-specific local reducer under the secondary-overlay multiscale support family. Given one selected cell plus one scale index, the helper clamps a local neighborhood to the live world bounds, walks the per-scale float surface rooted at `[this+0x15ed + scale*4]`, accumulates three float channels across that neighborhood, normalizes by sample count, rescales the local vector magnitude against shared constants, and writes one packed three-float sample record into the matching per-scale triplet buffer family rooted at `[this+0x15f1 + (scale-1)*4]`. Current grounded callers are `0x00533845` and `0x00533929`, both inside `world_rebuild_secondary_overlay_multiscale_support_surfaces_in_rect` `0x00533890`.","objdump + caller inspection + field correlation + multiscale-support correlation"
0x00532310,80,world_presentation_store_seven_dword_overlay_companion_block_and_mark_live,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small local setter in the world-presentation overlay family. The helper copies seven caller-supplied dwords into the companion block `[this+0x15b5..+0x15cd]` and then marks byte `[this+0x15b4] = 1`. Current grounded caller is the neighboring overlay-family setup strip, so the safest current read is a seven-dword companion-block store plus live mark rather than a broader reset.","objdump + caller inspection + local disassembly + overlay-companion-block correlation"
0x00532360,16,world_presentation_clear_overlay_companion_block_live_flag,map,thiscall,inferred,objdump + local disassembly,1,"Tiny companion to `world_presentation_store_seven_dword_overlay_companion_block_and_mark_live` `0x00532310`. The helper clears byte `[this+0x15b4]` and returns immediately. Current evidence grounds it only as the live-flag clear side of the same local seven-dword block.","objdump + local disassembly + overlay-companion-block correlation"
0x00532370,16,world_presentation_query_overlay_companion_block_live_flag,map,thiscall,inferred,objdump + local disassembly,1,"Tiny getter for overlay-family live flag byte `[this+0x15b4]`. The helper returns that byte as an integer without additional side effects. Current evidence grounds it only as the direct live-flag query for the neighboring seven-dword companion block.","objdump + local disassembly + overlay-companion-block correlation"
0x00532380,96,world_presentation_copy_seven_dword_overlay_companion_block_out,map,thiscall,inferred,objdump + local disassembly,1,"Small read-side companion to the local seven-dword overlay companion block `[this+0x15b5..+0x15cd]`. The helper copies those seven dwords into caller output storage and returns. Current evidence grounds it only as the direct copy-out helper for the same block set by `0x00532310`.","objdump + local disassembly + overlay-companion-block correlation"
0x005323e0,16,world_presentation_overlay_family_trivial_ret_0x14_stub,map,stdcall,inferred,objdump + local disassembly,1,"Tiny five-argument stdcall stub that only executes `ret 0x14`. The function currently has no grounded side effects or local ownership beyond sitting inside the same overlay-family strip, so the safest current read is a literal no-op vtable or callback stub.","objdump + local disassembly + stdcall-stub correlation"
0x005323f0,112,world_presentation_lazy_ensure_cached_surface_root_0x478_and_stage_saved_dims,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Lazy ensure helper over cached surface root `[this+0x478]` in the world-presentation overlay family. When that root is null, the helper allocates one backing object through `0x00543980` using saved dimensions `[this+0x159c/+0x15a0]`, stores the result into `[this+0x478]`, and then dispatches the live root through `0x00541970`. Current grounded callers are the neighboring cached-surface service strip and broader overlay rebuild paths, so the safest current read is a cached-surface ensure plus staged-dimension setup owner rather than a generic allocator.","objdump + caller inspection + local disassembly + cached-surface correlation"
0x00532460,48,world_presentation_service_cached_surface_root_0x478_and_publish,map,thiscall,inferred,objdump + local disassembly,1,"Small service companion to the cached surface root `[this+0x478]`. The helper dispatches that root through `0x00541970` and then through `0x005438d0`, which makes it the publish or finalize side of the same cached-surface strip rather than another allocator.","objdump + local disassembly + cached-surface correlation"
0x00532490,80,world_presentation_query_from_cached_surface_root_for_saved_dims,map,thiscall,inferred,objdump + local disassembly,1,"Read-side helper over cached surface root `[this+0x478]` plus saved dimensions `[this+0x159c/+0x15a0]`. The helper resolves one current result from the live root using those dimensions and forwards the answer back through caller out-storage. Current evidence grounds it only as a cached-surface query sibling of `0x005323f0` and `0x00532460`.","objdump + local disassembly + cached-surface correlation"
0x005324e0,32,world_presentation_mark_cached_surface_live_flag_if_root_present,map,thiscall,inferred,objdump + local disassembly,1,"Tiny cached-surface flag helper. When root `[this+0x478]` is nonnull, the helper marks byte `[this+0x159b] = 1`; otherwise it leaves that byte unchanged. Current evidence grounds it only as the live-flag set side for the cached-surface strip.","objdump + local disassembly + cached-surface-flag correlation"
0x00532500,16,world_presentation_clear_cached_surface_live_flag,map,thiscall,inferred,objdump + local disassembly,1,"Tiny companion to `world_presentation_mark_cached_surface_live_flag_if_root_present` `0x005324e0`. The helper clears byte `[this+0x159b]` and returns. Current evidence grounds it only as the cached-surface live-flag clear path.","objdump + local disassembly + cached-surface-flag correlation"
0x00532510,16,world_presentation_store_overlay_mode_byte_0x159a,map,thiscall,inferred,objdump + local disassembly,1,"Tiny setter for overlay-family mode byte `[this+0x159a]`. The helper stores caller byte arg0 and returns immediately. Current evidence grounds it only as a direct local mode-byte setter.","objdump + local disassembly + local-mode-byte correlation"
0x00532520,48,world_presentation_store_saved_overlay_dimension_quad,map,thiscall,inferred,objdump + local disassembly,1,"Small setter over the saved dimension quad `[this+0x15a4..+0x15b0]` in the world-presentation overlay family. The helper copies four caller-supplied dwords into that quad and returns. Current evidence grounds it only as the direct saved-dimension store for the neighboring cached-surface strip.","objdump + local disassembly + saved-dimension correlation"
0x00532550,64,world_presentation_copy_saved_overlay_dimension_quad_out,map,thiscall,inferred,objdump + local disassembly,1,"Read-side companion to `world_presentation_store_saved_overlay_dimension_quad` `0x00532520`. The helper copies the four saved dwords from `[this+0x15a4..+0x15b0]` into caller output storage and returns. Current evidence grounds it only as the direct copy-out helper for that saved-dimension quad.","objdump + local disassembly + saved-dimension correlation"
0x00532590,455,world_presentation_reset_overlay_runtime_state_and_pointer_roots,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Broad hard-reset owner beneath the world-presentation overlay family. The helper clears the live overlay-state bytes `[this+0x1588/+0x1599/+0x159b/+0x15b4]`, reseeds `[this+0x159a]` to `1`, resets scalar fields like `[this+0x154c/+0x155c/+0x15d9/+0x15d5]`, nulls the main pointer roots `[this+0x478]`, `[this+0x1558..+0x1570]`, `[this+0x159c/+0x15a0]`, `[this+0x15e1]`, the support-family roots `[this+0x1605/+0x15f1/+0x1619/+0x162d]`, the four sidecar byte planes `[this+0x1631..+0x163d]`, both mask planes `[this+0x1655/+0x1659]`, the packed raster `[this+0x165d]`, the vector byte planes `[this+0x1661/+0x1665]`, and the neighboring overlay tables `[this+0x1669..+0x1685]`, then zero-fills the local `0x100` slot band at `[this+0x08]` and the `0x1b`-entry companion slot table at `[this+0x40c]`. Current grounded callers are the local constructor at `0x00534f73` and the broader presentation reinitializer `0x00537e70`, so this is the safest current read for the shared overlay-family hard reset rather than a narrow resize helper.","objdump + caller inspection + field correlation + overlay-reset correlation"
0x00532760,64,world_presentation_release_current_overlay_slot_root_by_index_0x1558,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small release helper in the same world-presentation overlay family. When selector dword `[this+0x1558]` is nonzero, the helper resolves one slot root from `[this+0x08 + [this+0x1558]*4]`, releases that object through `0x00542c90` plus `0x0053b080`, and clears the slot pointer back to `0`. Current grounded caller is the neighboring setup strip at `0x00534fe3`, so the safest current read is a current-slot release helper rather than a broader reset.","objdump + caller inspection + local disassembly + overlay-slot-release correlation"
0x005327a0,192,world_presentation_clamp_two_surface_dimensions_to_supported_power_of_two_and_display_caps,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Shared surface-dimension clamp beneath the world-presentation overlay family. The helper first derives one minimum supported dimension from shell memory-budget queries `0x0051fa40` and `0x0055d430`, choosing either `0x100` or `0x400`, then round-down-clamps the two caller dimension pointers to exact powers of two through `0x0051df50`, and finally enforces shell display caps from `[0x006d4024+0x114243]` and `[0x006d4024+0x114247]` after converting those cap lanes back into four-pixel units. Current grounded callers are the local overlay rebuild paths `0x00535115` and `0x00535492`, so the safest current read is a shared supported-surface dimension clamp rather than a one-shot texture allocator.","objdump + caller inspection + local disassembly + power-of-two correlation + display-cap correlation"
0x00532860,243,world_presentation_stitch_12_overlay_slot_surfaces_from_parallel_bands_and_finalize_primary,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Local stitching pass over twelve consecutive overlay-slot families starting at selector `[this+0x155c]`. For each of those twelve entries the helper queries buffer pointers and row geometry from the parallel slot roots in the `[this+0x08 + index*4]` and `[this+0x18 + index*4]` bands through `0x00541970`, copies one terminal row from the latter buffer into the former, and on indices whose local position is not `3 mod 4` it also queries the sibling root in `[this+0x0c + index*4]` and copies one leading-column dword from that sibling into the right edge of the `[this+0x18 + index*4]` buffer. After each local stitch it finalizes the primary root through `0x00541c10`. Current grounded callers are the two neighboring rebuild branches `0x00527d05` and `0x00527d6a`, so the safest current read is a twelve-slot surface-edge stitching pass rather than a generic allocator or publish helper.","objdump + caller inspection + local disassembly + parallel-slot-band correlation + surface-stitch correlation"
0x00532960,115,world_presentation_project_two_out_offsets_from_grid_pair_through_4x4_and_16x16_quanta,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small paired projection helper beneath the same overlay family. The function rounds live grid dimensions `[this+0x15d9/+0x15d5]` up to both `16`-cell and `4`-cell quanta, scales the two caller input dwords by `4`, divides each by the corresponding `16`-cell quantum, multiplies by the opposite-axis `4`-cell quantum, and writes the resulting projected offsets back through the two caller out-pointers. Current grounded caller is the neighboring branch `0x00525ce9`, so the safest current read is a paired coarse-offset projection helper rather than a more semantic placement or cell-query owner.","objdump + caller inspection + local disassembly + coarse-projection correlation"
0x005329e0,48,world_presentation_map_xy_into_coarse_4x4_overlay_region_index,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small coordinate packer beneath the same overlay family. The helper rounds live grid dimensions `[this+0x15d9/+0x15d5]` up to `16`-cell quanta, scales the two caller coordinates by `4`, divides them by those rounded quanta, and returns one `1`-based coarse region index laid out as a `4x4` grid. Current grounded caller is the neighboring builder branch `0x00526f8a`, so the safest current read is a reusable `(x,y) -> coarse 4x4 overlay region id` helper rather than a broader geometry transform.","objdump + caller inspection + local disassembly + coarse-region-index correlation"
0x00532a30,7,world_presentation_query_overlay_slot_band_live_count_or_tag_0x1554,map,thiscall,inferred,objdump + caller inspection + field correlation,1,"Tiny direct getter over dword `[this+0x1554]` in the same overlay family. The field is cleared by the slot-band reset owner `0x00532b30`, feeds the primary companion-plane write helper `0x00448d40`, and is also sampled by neighboring world-presentation branches around `0x00525c07`, `0x0052b3b5`, and `0x0052ba0d`. Current evidence supports only the structural read that this dword is the live count or tag for the local overlay slot band, not a tighter semantic label yet.","objdump + caller inspection + field correlation + overlay-slot-band correlation"
0x00532d90,464,world_normalize_secondary_overlay_float_summary_plane_globally,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Global normalization pass over the base secondary-overlay float summary plane rooted at `[this+0x1605]`. The helper first scans the full live plane across `[this+0x15d9/+0x15d5]` to find one global maximum, clamps that maximum into a stable range, synthesizes a `0..100` weight table from the resulting scale factor, and then reruns the full plane to remap every positive cell through that table. Current grounded caller is `0x005385ea` inside the larger secondary-overlay rebuild owner around `0x00538360`, immediately before the companion radius-expansion pass `0x00532f60`.","objdump + caller inspection + field correlation + global-normalization correlation"
0x00532f60,403,world_expand_positive_secondary_overlay_float_summary_by_radius,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Radius-style expansion pass over the same base secondary-overlay float summary plane rooted at `[this+0x1605]`. Given one caller radius, the helper walks the full live plane, keeps only positive source cells, samples their local neighborhood with distance falloff, and writes back the strongest surviving propagated value into the same float plane. Current grounded caller is `0x005385fd` inside the larger secondary-overlay rebuild owner around `0x00538360`, immediately after `world_normalize_secondary_overlay_float_summary_plane_globally` `0x00532d90`.","objdump + caller inspection + field correlation + radius-expansion correlation"
0x00532a40,80,world_presentation_query_time_selected_slot_from_first_seeded_overlay_band,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Time-selected query over the first template-seeded overlay slot band. The helper samples one shared tick source through function pointer `0x005c8068`, scales that tick against count field `[this+0x156c]`, caches the resulting local index in `[this+0x1570]`, adds base slot index `[this+0x1568]`, and returns the corresponding slot root from `[this+0x08 + slot*4]`. Current grounded caller is the neighboring world-presentation branch `0x0052c41a`, and the stored fields align with the first slot-band seeder `0x005356e0`, so the safest current read is a time-selected query over that first seeded overlay band rather than a generic random picker.","objdump + caller inspection + local disassembly + seeded-slot-band correlation"
0x00532a90,16,world_presentation_query_trailing_fallback_slot_from_first_seeded_overlay_band,map,thiscall,inferred,objdump + local disassembly + field correlation,1,"Tiny getter for trailing fallback slot index `[this+0x1578]` in the first template-seeded overlay slot band. The corresponding fallback slot is seeded by `world_presentation_seed_first_overlay_slot_band_from_static_templates` `0x005356e0`, so the safest current read is a direct fallback-slot query rather than an independent selector.","objdump + local disassembly + field correlation + seeded-slot-band correlation"
0x00532aa0,48,world_presentation_query_time_selected_slot_from_second_seeded_overlay_band,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Time-selected query over the second template-seeded overlay slot band. The helper samples the same shared tick source, folds that tick through the reciprocal divide sequence keyed by count field `[this+0x1564]`, adds base slot index `[this+0x1560]`, and returns the corresponding slot root from `[this+0x08 + slot*4]`. Current grounded caller is shell-side branch `0x0054e2f0`, and the stored fields align with the second slot-band seeder `0x00535890`, so the safest current read is a time-selected query over that second seeded overlay band rather than another generic slot accessor.","objdump + caller inspection + local disassembly + seeded-slot-band correlation"
0x00532b30,332,world_presentation_release_overlay_slot_band_and_reset_band_indices,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared release or reset owner for the local overlay slot band at `[this+0x08]`. The helper first releases slot `0` through either `0x00542c90 + 0x0053b080` or `0x0053c000` depending on shell flag `[0x006d4024+0x11422e]`, then walks slots `1..count-1` where count comes from `[this+0x1554]`, releasing each live root with the same split except that the special forced-direct range `1..0x10` always goes through `0x00542c90 + 0x0053b080`. After the sweep it clears the live slot pointers and resets the controlling band fields `[this+0x1554]`, `[this+0x1568]`, `[this+0x1570]`, `[this+0x155c]`, `[this+0x1560]`, and `[this+0x1564]`. Current grounded caller is the default companion-set refresh path `0x00537356`, so the safest current read is a shared overlay-slot-band release plus band-index reset owner rather than another broad world reset.","objdump + caller inspection + local disassembly + overlay-slot-band correlation + release-path split correlation"
0x00527ce0,243,world_presentation_ensure_dim_tag_matched_stitched_overlay_helper_and_clear_global_scratch_planes,map,thiscall,inferred,objdump + local disassembly + cache-field correlation,2,"Broader owner directly above the stitched overlay-slot family. The helper queries current grid extents from the world presentation object through `0x00533970/0x00533980`, compares those against cached globals `0x00624d40/0x00624d3c` and the world-side tag `[world+0x2121]` mirrored in `0x00624d38`, and when any of those differ it re-enters the twelve-slot stitch pass `0x00532860`, rebuilds local helper `[this+0x65]` through `0x0053b070` and `0x00565370`, or releases the prior helper through `0x00565440` plus `0x0053b080`. Whether rebuilt or unchanged, it then clears the two large global scratch planes rooted at `0x008f2520` and `0x00b33530`. Current evidence keeps the helper structural rather than fully semantic, but it is clearly the dimension-and-tag-matched stitched-overlay ensure owner above `0x00532860`.","objdump + local disassembly + cache-field correlation + stitched-overlay correlation"
0x00532ad0,81,world_presentation_allocate_overlay_slot_from_static_template,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small shared slot allocator over the local `0x100` overlay pointer band at `[this+0x08]`. The helper finds the first empty slot, forwards the caller-supplied static template row into `0x0053c1c0` together with the fixed tuple `(0, 0, 0x7f)`, stores the resulting object pointer into `[this+0x08 + slot*4]`, and increments live count `[this+0x04]`. Current grounded callers are the neighboring setup owners `0x00535070`, `0x005356e0`, and `0x00535890`, the broader reinitializer `0x00537e60`, and one earlier world-presentation branch at `0x00454f40`, so this is the safest current read for the shared static-template overlay-slot allocator rather than one narrow UI control helper.","objdump + caller inspection + field correlation + static-template correlation"
0x00532c80,529,world_allocate_base_secondary_overlay_planes_for_current_dimensions,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Lower secondary-overlay allocator or reset owner for the current world-grid dimensions. The helper clears shift field `[this+0x15e1]`, optionally overwrites live grid dimensions `[this+0x15d9/+0x15d5/+0x15dd]` from caller width and height, allocates the base float-summary plane `[this+0x1605]`, the four sidecar byte planes `[this+0x1631..+0x163d]`, the two one-byte mask planes `[this+0x1655]` and `[this+0x1659]`, and the packed secondary 3-byte raster `[this+0x165d]`, then seeds those planes with their default byte patterns: `0x02` for the primary mask plane, `0x01` for the secondary mask plane, and zero for the packed raster. Current grounded callers are the broader presentation reinitializer `0x00537e60` and the shell-side size-reset path around `0x00537f1a`, so this is the safest current read for the base secondary-overlay plane allocator rather than the wider multiscale support owner.","objdump + caller inspection + field correlation + mask-plane default correlation"
0x00533430,368,world_rebuild_overlay_float_plane_cell_for_scale,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Scale-specific float-plane sibling under the secondary-overlay multiscale support family. The helper clamps one local neighborhood around the selected cell, reads the contributing float samples from the per-scale plane rooted at `[this+0x1601 + (scale-1)*4]`, averages that neighborhood, and stores the resulting float into the companion per-scale summary plane family rooted at `[this+0x1605 + (scale-1)*4]` for the same cell. Current grounded callers are `0x0053384f` and `0x00533933`, both inside `world_rebuild_secondary_overlay_multiscale_support_surfaces_in_rect` `0x00533890`.","objdump + caller inspection + field correlation + multiscale-support correlation"
0x005335a0,320,world_rebuild_overlay_rank_u16_plane_cell_for_scale,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Scale-specific 16-bit smoothing sibling under the same multiscale support family. The helper reads one per-scale unsigned-word plane from the family rooted at `[this+0x1615 + (scale-1)*4]`, gathers the clamped eight-neighbor ring around the selected cell, averages those values, and stores the resulting word into the companion smoothed-plane family rooted at `[this+0x1619 + (scale-1)*4]`. Current grounded callers are `0x00533859` and `0x0053393d`, both inside `world_rebuild_secondary_overlay_multiscale_support_surfaces_in_rect` `0x00533890`.","objdump + caller inspection + field correlation + multiscale-support correlation"
0x00533890,224,world_rebuild_secondary_overlay_multiscale_support_surfaces_in_rect,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Rectangle-wide multiscale support-surface rebuild above the raw secondary-overlay byte planes. The helper clamps the caller rectangle to the live world bounds, then for scale levels `1..4` downshifts that rectangle and re-enters three scale-specific reducers: `world_rebuild_overlay_sample_triplet_cell_for_scale` `0x005331e0` refreshes the five-entry packed sample-triplet buffer family rooted at `[this+0x15f1..+0x1601]`, `world_rebuild_overlay_float_plane_cell_for_scale` `0x00533430` refreshes the five-entry float summary family rooted at `[this+0x1605..+0x1615]`, and `world_rebuild_overlay_rank_u16_plane_cell_for_scale` `0x005335a0` refreshes the five-entry smoothed unsigned-word family rooted at `[this+0x1619..+0x1629]`. Current grounded caller is `0x005375b2` inside the larger rect owner `0x005374d0`, and the same helper also has one tiny local wrapper at `0x00533845..0x00533859`, so this is the safest current read for the shared multiscale secondary-overlay support rebuild rather than another raw cell accessor.","objdump + caller inspection + field correlation + multiscale-support correlation"
0x00533970,7,world_query_world_grid_max_x_cell_index,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny dimension getter over the live world-grid family. The helper returns the cached maximum X cell index from `[this+0x15d9]` directly. Current grounded callers are shell-side presentation and staging branches around `0x0043b0ea`, `0x0044d893`, `0x00523edd`, `0x00524e9b`, `0x00525b4c`, `0x005266ae`, and `0x0056935e`, which consistently pair it with `world_query_world_grid_max_y_cell_index` `0x00533980` rather than treating it as a more player-facing world metric.","objdump + caller inspection + field correlation"
0x00533980,7,world_query_world_grid_max_y_cell_index,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Y-axis sibling of world_query_world_grid_max_x_cell_index. The helper returns the cached maximum Y cell index from `[this+0x15d5]` directly. Current grounded callers are the same shell-side presentation and staging branches that pair it with `0x00533970`, including `0x0043b101`, `0x0044d8af`, `0x00523eeb`, `0x00524ea6`, `0x00525b57`, `0x005273e9`, and `0x00569368`.","objdump + caller inspection + field correlation"
0x00533990,11,world_store_secondary_overlay_shift_field_0x15e1,map,thiscall,inferred,objdump + local disassembly + field correlation,2,"Tiny setter for the secondary-overlay shift or scale-selector dword `[this+0x15e1]`. Current local evidence grounds it only as the direct write-side accessor under the broader multiscale overlay family.","objdump + local disassembly + field correlation"
0x00533ae0,7,world_query_secondary_raster_root,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny root-pointer getter for the packed secondary 3-byte cell raster at `[this+0x165d]`. Current grounded callers include shell-side staging branches around `0x00524eb1` and `0x00569351`, while the same root is also consumed directly by the neighboring secondary-raster read/write helpers `0x00448eec..0x00448f57` and several world-side scans, so this is the safest current read for the raw secondary-raster base accessor.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x00533af0,7,world_query_secondary_overlay_vector_x_byte_plane_root,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny root-pointer getter for the signed X-component overlay vector byte plane at `[this+0x1661]`. Current grounded callers are the shell-side staging path around `0x0056933d`, while neighboring byte read/write helpers at `0x00448e60` and `0x00448ec0` plus the rectangle rebuild pass `0x00536710` use the same root directly.","objdump + caller inspection + field correlation + vector-plane correlation"
0x00533b00,7,world_query_secondary_overlay_vector_y_byte_plane_root,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny root-pointer getter for the signed Y-component overlay vector byte plane at `[this+0x1665]`. Current grounded callers are the shell-side staging path around `0x00569347`, and the same root is consumed directly by `world_secondary_overlay_vector_y_byte_plane_query_cell_value` `0x00448ee0`, `world_secondary_overlay_vector_y_byte_plane_set_cell_value` `0x00448e90`, and the rectangle rebuild pass `0x00536710`.","objdump + caller inspection + field correlation + vector-plane correlation"
0x00533b10,7,world_query_companion_float_raster_root,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny root-pointer getter for the companion float raster family rooted at `[this+0x1605]`. Current grounded callers are shell-side presentation and staging branches around `0x00524e87`, `0x0052525b89`, `0x00526bb4`, `0x00528253`, `0x0052ae97`, `0x0052b4fa`, `0x0054dd60`, and `0x0056b2dd`, which consistently pair it with neighboring LUT or dimension getters rather than treating it as a gameplay scalar owner.","objdump + caller inspection + field correlation"
0x00533b20,7,world_query_overlay_normalized_x_coordinate_lut_ptr,map,thiscall,inferred,objdump + caller inspection + allocation-path inspection,3,"Tiny root-pointer getter for the X-axis normalized coordinate lookup table at `[this+0x15e9]`. The table is allocated in the world-presentation setup path around `0x00537b48` and then filled from the current grid width quarter-count in `0x00537c45..0x00537c5c`. Current grounded caller is the shell-side overlay staging branch at `0x00525b65`, which consumes it together with the Y-axis sibling and the companion sample tables.","objdump + caller inspection + allocation-path inspection + field correlation"
0x00533b30,7,world_query_overlay_normalized_y_coordinate_lut_ptr,map,thiscall,inferred,objdump + caller inspection + allocation-path inspection,3,"Y-axis sibling of world_query_overlay_normalized_x_coordinate_lut_ptr. The helper returns the normalized coordinate lookup table pointer from `[this+0x15ed]`. The table is allocated in the same setup path around `0x00537b28` and filled from the current grid height quarter-count in `0x00537c82..0x00537c99`. Current grounded caller is the same shell-side overlay staging branch at `0x00525b70`.","objdump + caller inspection + allocation-path inspection + field correlation"
0x00533b40,13,world_query_sidecar_byte_plane_ptr_by_index,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny indexed accessor over the four-plane sidecar byte-raster family rooted at `[this+0x1631]`. The helper treats the caller byte argument as an index `0..3` and returns the corresponding plane pointer from `[this+0x1631 + index*4]`. Current grounded callers include the four-plane bundle load/save siblings `0x00448f60` and `0x00448fe0`, plus shell-side plane-copy branches around `0x004f5ae6`, `0x004f5bfb`, `0x004f5cc7`, and `0x0052b0a4`, so this is the safest current read for the shared sidecar byte-plane pointer accessor rather than a more player-facing raster helper.","objdump + caller inspection + field correlation + sidecar-plane correlation"
0x00533b50,7,world_query_secondary_overlay_primary_mask_byte_plane_root,map,thiscall,inferred,objdump + caller inspection + allocation-path inspection,3,"Tiny root-pointer getter for the primary mask or occupancy byte plane at `[this+0x1655]`. The plane is allocated in the world-presentation setup path around `0x0053775e` and initialized to byte value `0x02`. Current grounded callers are the shell-side overlay staging branch at `0x00525b9f`, several world-side mutators around `0x00448c38`, `0x00448cc8`, and `0x00448d53`, the later vector-field rebuild path `0x00536710`, and the neighboring world-side scan around `0x005383f0`, which all treat nonzero cells in this plane as blocking, occupied, or already-classified samples.","objdump + caller inspection + allocation-path inspection + field correlation + mask-plane correlation"
0x00533b60,7,world_query_secondary_overlay_secondary_mask_byte_plane_root,map,thiscall,inferred,objdump + caller inspection + allocation-path inspection,3,"Tiny root-pointer getter for the second one-byte overlay mask plane at `[this+0x1659]`. The plane is allocated in the same setup path around `0x00537799` and initialized to byte value `0x01`. The only grounded getter caller is the shell-side overlay staging branch at `0x00525bad`, and that branch immediately discards the returned pointer before calling `0x005458a0`. Beyond that, current local evidence only grounds allocation, default-seed, bulk copy, bundle save-load, zero-fill, rectangle-clear, teardown, and existence-gate behavior on this plane, not a distinct semantic reader comparable to the primary mask plane at `[this+0x1655]`. Taken together with the asymmetry in `0x00538360`, the safest current read is that this is the separately persisted secondary mask-plane base accessor, not a second actively rebuilt runtime mask root.","objdump + caller inspection + allocation-path inspection + field correlation + negative-consumer correlation + persisted-sibling-plane correlation"
0x00536710,1660,world_rebuild_secondary_overlay_vector_byte_planes_in_rect,map,thiscall,inferred,objdump + caller inspection + field correlation,4,"Rectangle-wide rebuild pass over the secondary overlay byte-plane family. The helper clamps the caller rectangle to the live world bounds, scans the packed secondary raster at `[this+0x165d]` together with the primary mask plane `[this+0x1655]`, clears or preserves local state according to the low-3-bit class families, writes signed distance-scaled byte components into the paired vector planes `[this+0x1661]` and `[this+0x1665]`, and invalidates four neighboring sidecar byte planes at `[this+0x1631/+0x1635/+0x1639/+0x163d]` where needed. Current grounded callers are the post-build world-side rectangle refresh around `0x0044f6d7` and the two local owner passes at `0x005374bf` and `0x0053759b`, so this is the safest current read for the shared overlay-vector rebuild owner rather than another tiny cell helper.","objdump + caller inspection + field correlation + vector-plane correlation + sidecar-plane invalidation correlation"
0x00535070,138,world_presentation_ensure_primary_overlay_surface_or_fallback_template_slot,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small setup owner under the broader world-presentation reinitializer. The helper clears the local `0x100` overlay slot band `[this+0x08]`, resets live count `[this+0x04]`, and then splits on the shell presentation gate at `[0x006d4024+0x11422e]`: when that gate is armed it allocates one `0xec`-byte surface object, initializes it through `0x00541b00` and `0x005417e0` with the current shell root plus fixed `0x100 x 0x100` dimensions, stores the resulting object in slot `0`, and updates byte `[0x006d4024+0x1146eb]` on failure; otherwise it falls back to one static-template slot allocation through `world_presentation_allocate_overlay_slot_from_static_template` `0x00532ad0` using template row `0x005dd26c`. Current grounded caller is `world_presentation_apply_grid_dimensions_and_reinitialize_secondary_overlay_family` `0x00537e60`, so this is the safest current read for the primary overlay-surface-or-template setup owner rather than a more specific player-facing panel builder.","objdump + caller inspection + field correlation + static-template correlation"
0x00535100,816,world_presentation_apply_requested_dimensions_and_rebuild_four_overlay_surface_slots,map,thiscall,inferred,objdump + caller inspection + local disassembly + field correlation,3,"Broader world-presentation resize or rebuild owner above the short four-slot surface band rooted at `[this+0x08 + [this+0x155c]*4]`. The helper first clamps the caller-supplied dimensions through `0x005327a0`, stores the resulting quarter-scaled widths into `[this+0x157c/+0x1580]`, ensures or reuses a contiguous four-slot output band under selector `[this+0x155c]`, and then builds one temporary RGBA buffer sized from the new scaled dimensions. When the optional third argument is non-null it samples that source through `0x00541970` and resamples it into the temporary buffer; otherwise it fills the buffer with the fixed pattern seeded through `0x557f50`. It then allocates four `0xec`-byte destination surfaces through `0x00543980` and stores them into the selected four-slot band. Current grounded callers include the setup-side world reset or regeneration branch at `0x004390a0`, the load-side bundle path at `0x004473d4`, and the neighboring owner wrappers at `0x00535654` and `0x005356a9`, so this is the safest current read for the shared requested-dimension apply and four-slot overlay-surface rebuild owner rather than a smaller slot allocator.","objdump + caller inspection + local disassembly + field correlation + four-slot-band correlation + optional-source-resample correlation"
0x005356e0,428,world_presentation_seed_first_overlay_slot_band_from_static_templates,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Static-template slot-band seeder under the broader world-presentation reinitializer. The helper allocates or reuses one anchor slot through `world_presentation_allocate_overlay_slot_from_static_template` `0x00532ad0` using template row `0x005dd2b0`, records that anchor index and running count in `[this+0x1568]` and `[this+0x156c]`, then seeds a contiguous slot band from template rows `0x005dd2a4` upward for ids `0x66..0x84`. After that first series it revisits the created slots, clears byte `[slot+0x05]`, runs `0x00542550` on the earlier series, and fills two trailing fallback slots from template rows `0x005dd298` and `0x005dd28c`, storing the resulting indices in `[this+0x1574]` and `[this+0x1578]`. Current grounded caller is `world_presentation_apply_grid_dimensions_and_reinitialize_secondary_overlay_family` `0x00537e60`, so this is the safest current read for the first template-driven overlay slot-band seeder rather than a stronger UI-label owner.","objdump + caller inspection + field correlation + static-template correlation"
0x00535890,177,world_presentation_seed_second_overlay_slot_band_from_static_templates,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Second static-template slot-band seeder under the broader world-presentation reinitializer. The helper allocates one anchor slot through `world_presentation_allocate_overlay_slot_from_static_template` `0x00532ad0` using template row `0x005dd2d0`, stores that anchor index in `[this+0x1560]`, then seeds a contiguous slot band from template rows rooted at `0x005dd2bc` for ids `2..0x20`, finally storing the terminal count `0x20` in `[this+0x1564]`. Current grounded caller is `world_presentation_apply_grid_dimensions_and_reinitialize_secondary_overlay_family` `0x00537e60`, so this is the safest current read for the second template-driven overlay slot-band seeder rather than a more player-facing overlay panel owner.","objdump + caller inspection + field correlation + static-template correlation"
0x00535430,687,world_presentation_rebuild_four_overlay_surface_slots_from_source_or_fallback,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Broader four-slot overlay-surface rebuild owner under the world-presentation reinitializer. The helper derives local dimensions through `0x005327a0`, increments the shared shell-side progress counter at `[0x006d4024+0x11427e]`, allocates one temporary RGBA buffer sized from the quarter-scaled dimensions in `[this+0x157c/+0x1580]`, and then fills that buffer either by resampling the caller-supplied source surface or by falling back to a global descriptor at `0x0062bed4` when present. It uses several shell-side resource and range queries through `0x00518de0` and `0x0053c930`, can stage a temporary source surface through `0x0053c1c0`, `0x00541930`, and `0x00541970`, and then emits up to four `0xec`-byte destination surface objects through `0x00543980`, storing them into the local overlay slot band starting at `[this+0x08 + [this+0x155c]*4]`. Current grounded callers are the broader world-presentation reinitializer `0x00537e60` and one neighboring owner at `0x00538060`, so this is the safest current read for the shared four-slot overlay-surface rebuild owner rather than a more specific UI panel constructor.","objdump + caller inspection + field correlation + temporary-surface correlation"
0x00535950,112,world_presentation_allocate_overlay_companion_record_from_static_template,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small allocator over the local `0x1b`-entry overlay companion slot table at `[this+0x40c]`. The helper finds the first empty companion slot, allocates one `0x141`-byte record, seeds it through `0x00554830` from the caller-supplied static template row, stores the resulting pointer into `[this+0x40c + slot*4]`, and increments live count `[this+0x408]`. Current grounded caller is `world_presentation_seed_default_overlay_companion_record_set` `0x005373b0`, which invokes it seven times with static template rows `0x005dd300..0x005dd378`, so this is the safest current read for the shared companion-record allocator rather than a broader overlay rebuild owner.","objdump + caller inspection + field correlation + static-template correlation"
0x00536044,468,world_presentation_release_secondary_overlay_support_buffers,map,thiscall,inferred,objdump + local inspection + field correlation,3,"Teardown owner for the secondary-overlay support family. The helper frees the five-entry packed sample-triplet family rooted at `[this+0x15f1..+0x1601]`, the five-entry float summary family rooted at `[this+0x1605..+0x1615]`, the five-entry smoothed unsigned-word family rooted at `[this+0x1619..+0x1629]`, the packed local-byte staging buffer `[this+0x162d]`, the four sidecar byte planes `[this+0x1631..+0x163d]`, the neighboring coarse-cell and support tables, both one-byte mask planes `[this+0x1655]` and `[this+0x1659]`, the packed secondary raster `[this+0x165d]`, and the signed vector byte planes `[this+0x1661]` and `[this+0x1665]`, then nulls the corresponding pointers. The body also re-enters several neighboring support-family destructors `0x00535b40/0x00535c70/0x00535d30/0x00535df0/0x00535a10/0x00535f20`, so this is the safest current read for the shared overlay-support teardown owner rather than another generic presentation reset.","objdump + local inspection + field correlation + multiscale-support correlation + teardown correlation"
0x005375c0,2144,world_presentation_ensure_secondary_overlay_support_buffers_and_seed_defaults,map,thiscall,inferred,objdump + caller inspection + allocation-path inspection,3,"Broad setup or ensure-owner above the secondary-overlay support family. When the caller-supplied enable byte is nonzero, the helper allocates and zero-fills the five-entry packed sample-triplet family rooted at `[this+0x15f1..+0x1601]`, the five-entry float summary family rooted at `[this+0x1605..+0x1615]`, the five-entry smoothed unsigned-word family rooted at `[this+0x1619..+0x1629]`, the packed local-byte staging buffer `[this+0x162d]`, the four neighboring sidecar byte planes `[this+0x1631..+0x163d]`, the packed secondary 3-byte raster `[this+0x165d]`, the signed vector byte planes `[this+0x1661]` and `[this+0x1665]`, the ranked-overlay and geographic-label coarse cell tables `[this+0x1685]` and `[this+0x1675]`, plus several neighboring support tables. The same body also allocates and seeds the two one-byte mask planes with different defaults: `[this+0x1655]` is filled with byte `0x02`, while `[this+0x1659]` is filled with byte `0x01`. Later in the same body it rebuilds the local support surfaces through `0x00536230`, `0x00536420`, `0x00537420`, and the neighbor object allocator `0x005337f0`. Current grounded callers are the shell world-mode branch at `0x00484e47`, the world-presentation resize or rebuild tail at `0x00537f44`, one neighboring world-side refresh at `0x00538629`, and the `.smp`-side restore or reload branch at `0x00553539`, so this is the safest current read for the shared secondary-overlay support-buffer ensure and default-seed owner rather than a narrower vector-field helper.","objdump + caller inspection + allocation-path inspection + multiscale-support correlation + mask-plane default correlation"
0x00537e60,503,world_presentation_apply_grid_dimensions_and_reinitialize_secondary_overlay_family,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Broader world-presentation reinitializer above the secondary-overlay family. The helper publishes one shell progress step, stores the incoming live grid dimensions into `[this+0x15d9/+0x15d5/+0x15dd]`, re-enters `world_allocate_base_secondary_overlay_planes_for_current_dimensions` `0x00532c80` when the dimensions are nonzero, then re-enters `world_presentation_ensure_secondary_overlay_support_buffers_and_seed_defaults` `0x005375c0` and several neighboring overlay initializers or constant-table publishers (`0x00535070`, `0x00535430`, `0x00532ad0`, `0x005356e0`, `0x00534fc0`, `0x00535890`, `0x005373b0`) before returning. Current grounded callers are the world-side reattach branch at `0x0044922a` and the `.smp` restore-side presentation rebuild path at `0x005532d7`, so this is the safest current read for the shared dimension-apply and secondary-overlay-family reinitializer rather than one narrow resize helper.","objdump + caller inspection + field correlation + overlay-reinitialization correlation"
0x00538060,992,world_load_named_tga_into_secondary_overlay_float_summary_and_publish_transport_preview,map,thiscall,inferred,objdump + caller inspection + local disassembly + field correlation,3,"Transport/pricing-preview-side owner beneath `world_ensure_transport_pricing_preview_surface_and_publish_if_missing` `0x0044faf0`. The helper first builds a short descriptor around literal `C_` through `0x00518de0`, re-enters `world_presentation_rebuild_four_overlay_surface_slots_from_source_or_fallback` `0x00535430` to seed one preview handle, temporarily overrides shell globals `[0x006d4024+0x11423b/+0x11423f/+0x114254/+0x114255]`, and then loads `%1.tga` through `0x0053c1c0 -> 0x00541970`. After clamping the sampled dimensions into the `0x401 x 0x401` range, it rewrites the base secondary-overlay float summary plane `[this+0x1605]` together with mask planes `[this+0x1655/+0x1659]` and the packed raster `[this+0x165d]` from the sampled image, optionally re-enters `world_normalize_secondary_overlay_float_summary_plane_globally` `0x00532d90` and `world_expand_positive_secondary_overlay_float_summary_by_radius` `0x00532f60`, republishes the preview handle through `0x0053c000`, re-enters `world_presentation_ensure_secondary_overlay_support_buffers_and_seed_defaults` `0x005375c0(1, 0, 0)`, and returns the handle originally produced by `0x00535430`. Current grounded caller is `0x0044faf0`, so this is the safest current read for the named-TGA preview loader plus secondary-overlay summary rebuild owner rather than a generic surface import helper.","objdump + caller inspection + local disassembly + field correlation + named-tga correlation + transport-preview correlation"
0x00538360,732,world_rebuild_secondary_overlay_base_float_summary_and_primary_mask,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Broader rebuild owner for the base secondary-overlay float-summary plane rooted at `[this+0x1605]` and the paired one-byte mask planes `[this+0x1655]` and `[this+0x1659]`. The helper samples one caller-supplied coarse lookup field, writes one unclamped float score per live cell into the base summary plane, clears both mask planes across the same rectangle, and updates the packed secondary raster at `[this+0x165d]` as it goes. The later interior pass is the useful asymmetry: after the clear, the helper only repopulates the primary mask plane `[this+0x1655]` for low-3-bit class-`1` cells whose neighboring float-summary samples cross the positive threshold, while the second mask plane `[this+0x1659]` remains only reset or preserved for later owners. After that interior sweep it re-enters `world_normalize_secondary_overlay_float_summary_plane_globally` `0x00532d90`, then `world_expand_positive_secondary_overlay_float_summary_by_radius` `0x00532f60`, calls the neighboring refresh owner `0x0053c000`, and finally re-enters `world_presentation_ensure_secondary_overlay_support_buffers_and_seed_defaults` `0x005375c0`. This asymmetry now closes the local split: the helper actively rebuilds only the primary runtime mask, while the second plane stays as the separately persisted sibling for later setup, restore, or compatibility paths.","objdump + caller inspection + field correlation + mask-plane asymmetry correlation + local-split-closure correlation"
0x00538640,160,shell_control_status_owner_construct_and_zero_active_token_tables,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Constructor for the shell-global owner stored at `0x006d401c` during the bootstrap path around `0x0052130b`. The helper zero-fills the `1000`-byte active-token table `[this+0x20]`, clears byte `[this+0xc68]`, allocates one `0x88`-byte helper through `0x0053b070 -> 0x00518b90` into `[this+0xc69]`, clears the remaining text, handle, and deadline fields `[this+0x00..+0x1c]`, `[this+0xc58/+0xc60/+0xc64]`, and seeds scalar `[this+0xc5c] = 0.25f`. Current grounded caller is the bootstrap-side allocation path at `0x0052130b`, so this is the safest current read for the shell status/control owner constructor rather than a generic list-model initializer.","objdump + caller inspection + local disassembly + bootstrap-global correlation"
0x005386e0,192,shell_control_status_owner_publish_primary_text_with_timeout,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Primary timed-text publisher over the shell-global owner at `0x006d401c`. Guarded by reentrancy latch `0x00ccba18`, the helper refreshes owned string field `[this+0x14]` through `0x0051d820`, ensures or releases helper handle `[this+0x18]` through `0x0053c6f0(7)` or `0x0053c000` depending on whether the new text is non-empty, and then writes deadline `[this+0x1c]` as `shell_get_elapsed_tick_count_since_bootstrap_seed` `0x0051d890` plus the caller-supplied timeout or zero when the timeout is absent. Current grounded callers include the shell-side status publishers at `0x00434785`, `0x004829e1`, `0x00482ab7`, `0x00483948`, `0x00538a80`, and `0x00538b94`, so this is the safest current read for the owner's primary timed-text lane rather than a generic string setter.","objdump + caller inspection + local disassembly + timed-text correlation + global-owner correlation"
0x005387a0,112,shell_control_status_owner_publish_secondary_text_with_fixed_10s_timeout,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Secondary timed-text publisher over the same shell-global owner at `0x006d401c`. Guarded by reentrancy latch `0x00ccba1c`, the helper writes deadline `[this+0x08] = shell_get_elapsed_tick_count_since_bootstrap_seed() + 0x2710`, refreshes owned string field `[this+0x10]` through `0x0051d820`, and leaves the lane untouched when the guard is already armed. Current grounded callers include the shell-side publishers at `0x0046d1b3`, `0x0046d4f7`, `0x00483a93`, `0x00483ab3`, `0x00483ad5`, `0x00489b52`, `0x00489c16`, and `0x004df7a7`, so this is the safest current read for the owner's fixed-10-second secondary text lane rather than another generic string setter.","objdump + caller inspection + local disassembly + timed-text correlation + global-owner correlation"
0x00538810,48,shell_find_registered_window_containing_child_control_id,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Search helper over the shell-global owner at `0x006d401c`. The helper walks the registered shell-window list rooted at `[this+0x00]`, asks each window whether it owns the requested child control id through `shell_window_find_registered_child_control_by_id` `0x0053f830`, and returns the first matching window pointer or null. Current grounded callers include the `Setup.win`-adjacent shell paths at `0x004beeb1`, `0x004c9ade`, `0x004c9b30`, `0x004c9b58`, `0x004e07a2`, and `0x0056301f`, so this is the safest current read for the global window-by-child-control-id lookup rather than another child-list walker.","objdump + caller inspection + local disassembly + child-control correlation + global-owner correlation"
0x00538840,64,shell_control_status_owner_clear_active_tokens_for_child_control_id,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Clears every active token-table entry in the shell-global owner whose recorded 16-bit child control id matches the caller input. The helper linearly scans the `1000`-entry id table `[this+0x408]` together with the parallel active-byte table `[this+0x20]`, and for each active matching entry clears the corresponding active byte. Current grounded callers are the two child-control teardown or replacement paths at `0x0055fc8a` and `0x00561632`, so this is the safest current read for the owner's control-id-based token invalidation helper rather than a generic list clear.","objdump + caller inspection + local disassembly + token-table correlation + child-control teardown correlation"
0x00538880,16,shell_control_status_owner_release_active_token_handle,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny release companion for the shell-global active token table. The helper treats the caller dword as one previously returned token handle and clears the corresponding active-byte slot in `[this+0x20]`. Current grounded callers are the local shell-control paths at `0x0055a0fe`, `0x0055a12a`, and `0x00561652`, so this is the safest current read for the owner's token-handle release helper rather than a broader table reset.","objdump + caller inspection + local disassembly + token-table correlation"
0x00538890,64,shell_control_status_owner_allocate_active_token_handle_for_child_control_id,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Allocates one active token-table slot for the caller-supplied 16-bit child control id. The helper linearly scans the `1000`-entry active-byte table `[this+0x20]` for the first clear slot, marks it active, stores the control id into the parallel id table `[this+0x408]`, and returns the opaque token handle `0xea60 + slot_index`; when no free slot exists it returns `0`. Current grounded callers are the shell-control allocation or replacement paths at `0x0055a3cd`, `0x0055a4a4`, `0x00560140`, `0x00561322`, and `0x00561428`, so this is the safest current read for the owner's control-id-scoped token allocator rather than a generic id registry.","objdump + caller inspection + local disassembly + token-table correlation + child-control correlation"
0x005388d0,177,shell_dispatch_12_dword_descriptor_across_registered_windows_with_optional_override,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Dispatch owner for one stack- or caller-supplied `12`-dword shell descriptor. The helper first copies the descriptor into a local work buffer, then consults the optional override validator at `[0x006d401c+0xc75]` through vtable slot `+0x04`; when that override vetoes the descriptor it falls back to the registered shell-window list rooted at `[this+0x00]` and forwards the same descriptor through `0x0053fe90` on each window until one handler returns the stop code. When the incoming kind dword is `6`, the helper also recursively redispatches a rewritten copy with kind `0xb7`. Current grounded callers include the higher publishers `0x00538c70`, `0x00538e00`, and `0x00538f10`, so this is the safest current read for the shared shell descriptor dispatcher rather than a window-family-local callback.","objdump + caller inspection + local disassembly + registered-window correlation + descriptor-rewrite correlation"
0x00538990,48,shell_registered_window_list_call_virtual_slot_0_until_one_returns_zero,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small list-walk gate over the registered shell-window list rooted at `[this+0x00]`. The helper walks each node through link field `+0x58`, calls that node's vtable slot `+0x00` with the caller payload, and stops on the first zero return; when the list is empty it returns `1`. Current grounded caller is the shell dispatch gate at `0x00483a47`, which uses the helper as an early allow or veto pass before deeper message handling, so this is the safest current read for the registered-window virtual-slot gate rather than a generic iterator.","objdump + caller inspection + local disassembly + shell-window-list correlation"
0x005389c0,80,shell_registered_window_list_unlink_node_and_optionally_release,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Unlinks one shell-window or shell-node record from the doubly linked list rooted at `[this+0x00/+0x04]`. When the caller-supplied node is non-null the helper first re-enters `0x005400c0(node)` to run the node's local release or reset path, then repairs predecessor and successor links through fields `+0x54/+0x58`, and updates the list root or tail when the removed node occupied either end. Current grounded callers include the shell-window teardown paths at `0x00482f17`, `0x004830d9`, `0x004bc19c`, `0x004c9b92`, `0x004cf8cc`, `0x004ddc56`, `0x004e1c99`, `0x004e5010`, `0x00501ef2`, `0x00507942`, and `0x00517512`, so this is the safest current read for the shared registered-window unlink helper rather than a window-family-specific destructor.","objdump + caller inspection + local disassembly + shell-window-list correlation + doubly-linked-list correlation"
0x00538a10,16,shell_control_status_owner_query_float_scalar_0xc5c,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny x87 getter over float scalar `[this+0xc5c]` in the shell-global owner at `0x006d401c`. Current grounded caller is `0x0053decb`, which multiplies the returned value into one presentation-side scalar chain, so the safest current read stays structural around the direct float getter.","objdump + caller inspection + local disassembly"
0x00538a20,16,shell_control_status_owner_set_float_scalar_0xc5c,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny setter companion for float scalar `[this+0xc5c]` in the shell-global owner at `0x006d401c`. Current grounded callers are the shell-mode branches at `0x00483025`, `0x00483182`, `0x00483294`, `0x004832c2`, `0x004832f0`, `0x0048331e`, `0x00483348`, and `0x00483372`, so the safest current read stays structural around the direct float setter.","objdump + caller inspection + local disassembly"
0x00538a30,16,shell_control_status_owner_increment_counter_0xc60,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny increment helper over counter dword `[this+0xc60]` in the shell-global owner at `0x006d401c`. Current grounded callers include shell and world-side branches at `0x00437d99`, `0x004416dd`, `0x004561ba`, `0x00464548`, `0x004b92a3`, `0x004c7ff9`, `0x004ed8a8`, `0x004fec80`, `0x00517512`, and `0x0055c0bd`, so the safest current read stays structural around the direct counter bump rather than a stronger semantic label.","objdump + caller inspection + local disassembly"
0x00538a40,19,shell_control_status_owner_decrement_counter_0xc60_clamped_to_zero,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny decrement companion for counter dword `[this+0xc60]` in the shell-global owner at `0x006d401c`. The helper decrements the counter in place and clamps the stored value back to `0` when the subtraction would underflow below zero. Current local context keeps this as the direct counter-decrement helper rather than a stronger named semaphore owner.","objdump + caller inspection + local disassembly"
0x00538a60,16,shell_control_status_owner_query_counter_0xc60_is_zero,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny boolean gate over counter dword `[this+0xc60]` in the shell-global owner at `0x006d401c`. The helper returns `1` when that counter is zero and `0` otherwise. Current grounded callers include the shell dispatch-side branches at `0x0043d753`, `0x00483a2b`, `0x00483b20`, `0x004fe485`, `0x004fec71`, and `0x00500423`, so the safest current read stays structural around the zero-counter predicate.","objdump + caller inspection + local disassembly"
0x00538a70,272,shell_control_status_owner_publish_reset_text_and_release_registered_windows,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader teardown owner over the shell-global status/control object at `0x006d401c`. The helper first republishes the fixed text payload `0x005c87a8` through `shell_control_status_owner_publish_primary_text_with_timeout` `0x005386e0(0xbb8)`, then walks the registered shell-window list rooted at `[this+0x00/+0x04]`, releasing each node through `0x005400c0` and unlinking it from the list. After that it frees the counted pointer band `[this+0xbd8]` using count `[this+0xc58]`, clears the owned text buffers rooted at `[this+0x10]` and `[this+0x14]`, and releases payload handle `[this+0x0c]` through `0x0053c000` when present. Current grounded caller is the bootstrap-side teardown path at `0x0052146e`, which immediately follows by freeing the owner and nulling `0x006d401c`, so this is the safest current read for the global status/control owner reset-and-release body rather than a generic shell shutdown.","objdump + caller inspection + local disassembly + bootstrap-teardown correlation + shell-window-list correlation"
0x00538b60,272,shell_runtime_prime_service_registered_windows_and_timed_text_lanes,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Primary service owner over the shell-global runtime object at `0x006d401c`. When disable byte `[this+0xc68]` is clear, the helper first re-enters `0x0054f6a0`, refreshes the primary timed-text lane by comparing deadline `[this+0x1c]` against `shell_get_elapsed_tick_count_since_bootstrap_seed` `0x0051d890` and republishing fixed payload `0x005c87a8` through `0x005386e0(0xbb8)` when that deadline has expired, then walks the registered shell-window list from tail `[this+0x04]` through link field `+0x54`, servicing each node through `shell_service_one_object_child_queue_and_deferred_state` `0x0053fda0` and `0x0051f1d0`. After the walk it conditionally presents the secondary lane `[this+0x10/+0x0c]` while deadline `[this+0x08]` is still live, and then presents the primary lane `[this+0x14/+0x18]` when its text is non-empty. Current grounded callers are the shell-state service branches at `0x0048218e`, `0x004835ed`, and `0x00483d2e`, so this is the safest current read for the shell runtime-prime service owner rather than a narrow text-only publisher.","objdump + caller inspection + local disassembly + shell-runtime-prime correlation + timed-text correlation + registered-window-service correlation"
0x00538c70,400,shell_control_status_owner_publish_prioritized_cached_text_and_dispatch_descriptor_0xae,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader cached-text publisher on the shell-global owner at `0x006d401c`. Guarded first by shell-global byte `[0x006d4024+0x57]`, the helper falls back to default text pointer `0x00624d64` when the caller passes null, compares the new request against the currently cached text band `[this+0xbd8/+0xbdc/+0xbe0/+0xbe4]`, and suppresses the update when one still-live cached entry of equal-or-higher priority is already active. Otherwise it replaces the owned cached string at `[this+0xbd8]`, stores the caller priority at `[this+0xbdc]`, stores the caller style or lane token at `[this+0xbe0]`, derives one near or long-lived deadline into `[this+0xbe4]`, and then emits the corresponding shell descriptor by rewriting local kind `0xae` through `shell_dispatch_12_dword_descriptor_across_registered_windows_with_optional_override` `0x005388d0`. Current grounded callers include the linked-peer status publishers at `0x0040e4e0`, `0x0041f720`, `0x0041f7b0`, `0x004b84f0`, and several shell detail or popup builders, so this is the safest current read for the prioritized status-text-plus-descriptor owner rather than a plain string cache.","objdump + caller inspection + local disassembly + priority-cache correlation + descriptor-dispatch correlation + shell-status correlation"
0x00538e00,77,shell_dispatch_synthetic_12_dword_descriptor_from_five_scalars,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small descriptor-synthesis wrapper above `shell_dispatch_12_dword_descriptor_across_registered_windows_with_optional_override` `0x005388d0`. The helper zero-fills one local `12`-dword descriptor, copies the caller's five scalar arguments into the leading five slots, and then forwards that synthetic descriptor into `0x005388d0`. Current grounded callers include `shell_transition_mode` `0x00482ec0` and the route-entry collection follow-on at `0x004c3470`, which use it to post compact shell events without building a full descriptor structure by hand.","objdump + caller inspection + local disassembly + descriptor-synthesis correlation"
0x00538e50,100,shell_registered_window_list_insert_node_sorted_by_priority_and_optionally_prepare_node,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Insertion owner for the registered shell-window list rooted at `[this+0x00/+0x04]`. When the caller-supplied prepare flag is nonzero, the helper first re-enters `0x0053f7f0(node, 1)` on the node itself, then inserts that node into the doubly linked list using sort key dword `[node+0x21]`, walking backward from the current tail through link field `+0x54` until the insertion point is found and repairing predecessor or successor fields `+0x54/+0x58`. Current grounded callers include `shell_transition_mode` `0x00482ec0`, several shell window ensure paths, and the broader blocking loop `0x00538f10`, so this is the safest current read for the shared registered-window insert owner rather than a window-family-local show helper.","objdump + caller inspection + local disassembly + doubly-linked-list correlation + sort-key correlation"
0x00538ec0,72,shell_control_status_owner_refresh_indexed_helper_collection_c69,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Refresh sweep over the indexed helper collection rooted at `[this+0xc69]` in the shell-global owner `0x006d401c`. The helper enumerates live entries through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then forwards each resolved entry into `0x0053e2b0`. Current grounded callers are shell-global setter paths such as `0x00464e4f`, `0x00464e7c`, `0x0051f9d4`, and `0x0051f9f4`, so this is the safest current read for the owner's helper-collection refresh sweep after selection-state changes rather than a generic collection walk.","objdump + caller inspection + local disassembly + indexed-collection correlation + shell-selection correlation"
0x00538f10,657,shell_publish_optional_window_and_run_blocking_descriptor_loop,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader blocking shell loop owner over the shell-global runtime object at `0x006d401c`. The helper first increments nested-loop counter `[this+0xc64]`, optionally seeds one caller-supplied shell window by writing sort key `[window+0x21]` and auxiliary dword `[window+0x6c]` before publishing it through `shell_registered_window_list_insert_node_sorted_by_priority_and_optionally_prepare_node` `0x00538e50`, optionally resolves and nudges one child control id through `shell_find_registered_window_containing_child_control_id` `0x00538810` and `0x0055c8b0`, snapshots shell controller state through `0x0054e7e0/0x0054f4d0`, and then loops on one `12`-dword descriptor buffer. Inside that loop it special-cases descriptor kind `6` into `0xb7` through `0x005388d0`, consults the optional global override validator at `[0x006d401c+0xc75]`, lets one optional global filter at `0x006d3b4c` and the caller-supplied window's vtable slot `+0x04` inspect the descriptor, pumps the shell controller through `0x0051f950`, and exits when the descriptor reaches one of the explicit completion kinds `0xc9` or `0xcd`, deriving the final return code from descriptor word `+0x04` or from `0x0054e9c0`. Current grounded callers include the modal window openers at `0x004d9dc0` and `0x004d9e40`, the shell settings opener `0x00501e50`, and several broader shell teardown or transition branches, so this is the safest current read for the optional-window publish plus blocking descriptor loop rather than a simple show-window helper.","objdump + caller inspection + local disassembly + descriptor-loop correlation + modal-loop correlation + registered-window correlation"
0x005391b0,121,route_entry_release_optional_world_space_attachment_and_owned_buffer_then_dispatch_vtable_slot_0,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Release-side helper in the broader route-entry family. When the caller-supplied boolean is nonzero and shell-global gate `[0x006d4024+0x114256]` is clear, the helper projects current world-space floats `[this+0x0c/+0x10]` into local integers, forwards them together with byte `[this+0x55]` into `0x00533e00` on attachment root `[this+0x04]`, then frees owned pointer `[this+0x1e3]` through `0x005a1145` when present and finally dispatches the object's vtable slot `+0x00`. Current grounded callers include the route-entry-side branches at `0x00490f6e` and `0x0053a598`, so this is the safest current read for the optional world-space attachment release plus virtual teardown helper rather than a generic destructor.","objdump + caller inspection + local disassembly + route-entry correlation + attachment-release correlation"
0x00539230,336,route_entry_apply_local_visual_scalar_preset_by_state_byte,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Applies one of several local visual-scalar presets to a route-entry-family object from one small state byte. The helper writes the chosen state into byte `[this+0x5a]` and then seeds paired float bands at `[this+0x73/+0x77/+0x8b/+0x8f/+0xa3/+0xa7/+0xbb/+0xbf/+0xd3/+0xd7/+0xeb/+0xef/+0x103/+0x107/+0x11b/+0x11f]`, with distinct layouts for the grounded caller states `0`, `1`, `2`, and `3`. Current grounded callers include the route-entry-side update branches at `0x0048a003`, `0x0048a00f`, `0x0048b5ab`, and `0x0048b61e`, so this is the safest current read for the route-entry local visual-scalar preset setter rather than a generic float initializer.","objdump + caller inspection + local disassembly + route-entry correlation + visual-scalar correlation"
0x00539380,295,route_entry_apply_table_driven_visual_profile_and_optional_display_latch,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Table-driven profile setter in the same route-entry family. The helper first normalizes the caller's state byte into one compact profile index, optionally maps the 'display-latched' byte `[this+0x44]` from that index, and then copies several static table-driven dwords into the object's higher visual bands, including `[this+0x1f5/+0x1f9]`, `[this+0x17b..+0x1af]`, `[this+0x193/+0x197]`, `[this+0x1c3/+0x1c7]`, `[this+0x1db/+0x1df]`, and `[this+0x1fd]`. Current grounded callers include `0x0048f59d`, `0x0049154a`, `0x004916ae`, and `0x0053ae23`, where the same helper runs immediately before the neighboring route-entry visual refresh `0x00539640`, so this is the safest current read for the route-entry table-driven visual profile loader rather than a generic palette setter.","objdump + caller inspection + local disassembly + route-entry correlation + table-driven-profile correlation"
0x005394b0,112,route_entry_copy_four_3d_triplet_bands_out,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small export helper over four consecutive `3*dword` triplet bands in the route-entry-family object. The helper copies the optional output triplets from `[this+0x14]`, `[this+0x20]`, `[this+0x2c]`, and `[this+0x38]` into up to four caller-supplied output pointers. Current grounded caller is `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0`, which uses the helper to stage the current route-entry shape or bounding triplets into its builder-state area before deeper search continues, so this is the safest current read for the four-triplet export helper rather than a generic memcpy wrapper.","objdump + caller inspection + local disassembly + route-entry-builder correlation + triplet-band correlation"
0x00539580,77,route_entry_broadcast_three_scalar_args_to_each_attached_handle_in_list_8,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small broadcast helper over the optional attached-handle list rooted at `[this+0x08]` in the same route-entry-family object. When that list exists and yields live entries through `0x00556ef0/0x00556f00`, the helper forwards the caller's three scalar arguments into `0x00530720` on each resolved attached handle. Current grounded caller is `0x0053a5b0`, which forwards current scalar lanes `[this+0x0c/+0x10]` plus one caller argument through this helper, so this is the safest current read for the route-entry attached-handle broadcast owner rather than a generic collection walk.","objdump + caller inspection + local disassembly + route-entry correlation + attached-handle-list correlation"
0x005395d0,112,route_entry_ensure_attached_handle_list_add_handle_and_publish_aggregate_scalar,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Attach-and-publish helper in the same route-entry-family object. The helper ensures attached-handle list root `[this+0x08]` through `0x0053b070(0x18) -> 0x00556db0`, adds the caller-supplied handle into that list through `0x00556e10`, derives one aggregate scalar from the four local scalar lanes `[this+0x18/+0x24/+0x30/+0x3c]` plus one caller-supplied height or bias term, and then publishes the resulting three-scalar packet through `0x00530720` using the local head lanes `[this+0x0c/+0x10]`. Current grounded caller is the small wrapper `0x0053a5b0`, which keeps the safest current read structural around attached-handle registration plus aggregate-scalar publish rather than a stronger subtype label.","objdump + caller inspection + local disassembly + route-entry correlation + attached-handle-list correlation + aggregate-scalar correlation"
0x00539640,1854,route_entry_recompute_derived_visual_scalar_bands_and_optional_display_buffer,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Heavy derived-band rebuild in the same route-entry family. The helper first treats the four stored `3*dword` triplet bands at `[this+0x14]`, `[+0x20]`, `[+0x2c]`, and `[+0x38]` as two endpoint pairs, derives midpoint and half-delta scalars on each axis, and then uses profile weights `[this+0x1f5/+0x1f9/+0x1fd]` plus repeated root query `0x00534490([this+0x04], x, y)` to populate the larger derived visual bands rooted at `[this+0x63]`, `[+0x7b]`, `[+0x93]`, `[+0xab]`, `[+0xc3]`, `[+0xdb]`, `[+0xf3]`, `[+0x10b]`, `[+0x123]`, `[+0x13b]`, `[+0x153]`, `[+0x16b]`, `[+0x183]`, `[+0x19b]`, `[+0x1b3]`, and `[+0x1cb]`. It also updates one global sample lane through `0x00624e00` selected by `0x00ccba24`, clamps several rebuild results against constants `0x005c8c18` and `0x005c8888`, refreshes the center scalars `[this+0x0c/+0x10]`, and conditionally maintains the optional owned `0xc0`-byte display buffer at `[this+0x1e3]`: display-state byte `[this+0x44] == 0` frees it, state `1` writes a compact two-column layout from the raw triplet endpoints and local offset dwords `[this+0x45/+0x49/+0x4d/+0x51]`, and states `2/3` populate the same buffer from weighted midpoint and half-delta bands. Current grounded callers include the route-entry profile setters `0x0048f5aa`, `0x00491599`, `0x004916bf`, collection-wide post-pass `0x00491c20`, and the local rebuild wrappers `0x0053a7f9`, `0x0053a910`, `0x0053a94c`, and `0x0053ac90`, so this is the safest current read for the main route-entry derived-visual-band and optional-display-buffer rebuild rather than a generic interpolation helper.","objdump + caller inspection + local disassembly + route-entry correlation + weighted-derived-band correlation + optional-display-buffer correlation"
0x0053a520,63,global_replace_optional_shell_owned_root_0xccba20_from_single_payload_ptr,bootstrap,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small global replace helper over root `0x00ccba20`. When the caller-supplied payload pointer is non-null, the helper first releases any existing owned root at `0x00ccba20` through shell owner `0x006d4020` plus `0x0053c000`, then rebuilds that root through `0x0053c1c0(payload,0,0,0x7f)` and stores the result back into `0x00ccba20`. Current grounded caller is the broader bootstrap-side branch at `0x0055e739`, so this is the safest current read for the small replace-in-global-root helper rather than a route-entry-local constructor.","objdump + caller inspection + local disassembly + global-root correlation"
0x0053a560,32,global_release_optional_shell_owned_root_0xccba20,bootstrap,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Tiny release-side companion over global root `0x00ccba20`. When that root is live, the helper releases it through shell owner `0x006d4020` plus `0x0053c000` and then clears `0x00ccba20` back to null. Current grounded caller is the broader shutdown branch at `0x0055e171`, so this is the safest current read for the focused global-root release helper rather than a family-local destructor.","objdump + caller inspection + local disassembly + global-root correlation"
0x0053a590,13,route_entry_vtable_5dd3d8_release_thunk_set_vtable_and_reenter_optional_attachment_teardown,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny release thunk in the route-entry object family. The helper reinstalls vtable `0x005dd3d8`, pushes release flag `1`, and immediately re-enters `route_entry_release_optional_world_space_attachment_and_owned_buffer_then_dispatch_vtable_slot_0` `0x005391b0`. This is the safest current read for the route-entry release thunk rather than a standalone destructor body.","objdump + caller inspection + local disassembly + route-entry correlation"
0x0053a5b0,18,route_entry_broadcast_current_head_lanes_and_caller_scalar_to_attached_handles,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny wrapper above `route_entry_broadcast_three_scalar_args_to_each_attached_handle_in_list_8` `0x00539580`. The helper forwards current head lanes `[this+0x0c/+0x10]` together with the caller-supplied scalar to every live attached handle in `[this+0x08]`. This is the safest current read for the simple attached-handle broadcast wrapper rather than a broader update owner.","objdump + caller inspection + local disassembly + route-entry correlation"
0x0053a5d0,247,route_entry_attach_handle_ensure_list_and_optionally_clone_seed_from_first_live_entry,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader attached-handle add helper in the same route-entry family. When attached-handle list root `[this+0x08]` is null, the helper ensures that list and falls straight through to `route_entry_ensure_attached_handle_list_add_handle_and_publish_aggregate_scalar` `0x005395d0`. When the list already exists, it resolves the first live entry, clones one temporary helper from that seed through `0x0052e880/0x0052e8b0/0x0052e720`, releases the temporary source through `0x00530680 + 0x0053b080`, publishes the cloned handle through `0x00530720`, and finally inserts that cloned handle back into `[this+0x08]` through `0x00556e10`. Current grounded caller is the optional `Infrastructure` child-attach branch `0x0048a325`, so this is the safest current read for the attached-handle ensure plus seed-clone path rather than a plain list add.","objdump + caller inspection + local disassembly + route-entry correlation + attached-handle-clone correlation"
0x0053a6d0,101,route_entry_release_attached_handle_list_and_entries,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Release helper over the optional attached-handle list rooted at `[this+0x08]` in the same route-entry family. The helper walks every live attached handle through `0x00556ef0/0x00556f00`, releases each one through `0x00530680`, frees it through `0x0053b080`, tears the list root down through `0x005570b0` and `0x005571d0`, and finally clears `[this+0x08]` back to null. This is the safest current read for the attached-handle-list teardown owner rather than a broader route-entry destructor.","objdump + caller inspection + local disassembly + route-entry correlation + attached-handle-release correlation"
0x0053a740,322,route_entry_copy_four_triplets_refresh_attachment_tile_and_recompute_center_scalars,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Primary four-triplet setter in the route-entry family. The helper copies up to four caller-supplied triplet buffers into the local bands `[this+0x14]`, `[+0x20]`, `[+0x2c]`, and `[+0x38]`, and when shell-global gate `[0x006d4024+0x114256]` is clear and root `[this+0x04]` is present it quantizes current world-space floats `[this+0x0c/+0x10]` into coarse tile coords, re-enters `route_entry_recompute_derived_visual_scalar_bands_and_optional_display_buffer` `0x00539640`, and refreshes optional attachment id `[this+0x55]` by releasing the previous attachment through `0x00533e00(root, old_id, old_x, old_y)` and acquiring the new one through `0x00533dd0(root, this, new_x, new_y)`. It finally recomputes center scalars `[this+0x1ed/+0x1f1]` from the second and fourth triplets. Current grounded callers include `0x0053ac82` and `0x0053ae53`, so this is the safest current read for the shared four-triplet setter plus attachment refresh owner rather than another raw memcpy wrapper.","objdump + caller inspection + local disassembly + four-triplet correlation + attachment-refresh correlation"
0x0053a890,137,route_entry_reproject_all_four_triplet_midlines_and_rebuild,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small route-entry rebuild wrapper above `0x00539640`. The helper reprojects the Y component of all four stored triplets by re-entering `0x00534490([this+0x04], x, z)` on each pair, normalizes the second and fourth triplets so each pair collapses to its lower or upper member when inverted, recomputes center scalars `[this+0x1ed/+0x1f1]`, and then re-enters `route_entry_recompute_derived_visual_scalar_bands_and_optional_display_buffer` `0x00539640`. Current grounded callers are the route-entry world-refresh branches around `0x0053a5b0`, so this is the safest current read for the local reproject-and-rebuild wrapper rather than a generic sort helper.","objdump + caller inspection + local disassembly + root-height-query correlation + route-entry-rebuild correlation"
0x0053a920,51,route_entry_fill_all_four_triplets_and_center_scalars_from_uniform_scalar_then_rebuild,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Uniform-scalar reset wrapper in the route-entry family. The helper writes the same caller-supplied dword into all four triplet bands rooted at `[this+0x18]`, copies that same scalar into center lanes `[this+0x1ed/+0x1f1]`, and then re-enters `route_entry_recompute_derived_visual_scalar_bands_and_optional_display_buffer` `0x00539640`. This is the safest current read for the uniform triplet-fill reset path rather than another scalar setter.","objdump + caller inspection + local disassembly + uniform-triplet-fill correlation"
0x0053ac40,91,route_entry_rebind_root_reset_attachment_and_optionally_rebuild_from_current_triplets,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Root-rebind reset helper in the route-entry family. The helper detaches and forgets optional display buffer `[this+0x1e3]`, current root `[this+0x04]`, and current attachment id `[this+0x55]`, resolves one fresh root through `0x0051f090`, re-enters `route_entry_copy_four_triplets_refresh_attachment_tile_and_recompute_center_scalars` `0x0053a740` with the current local triplet bands, clears attached-handle list pointer `[this+0x08]`, and only re-enters `route_entry_recompute_derived_visual_scalar_bands_and_optional_display_buffer` `0x00539640` when an owned display buffer was present before the reset. This is the safest current read for the route-entry root rebind plus optional rebuild helper rather than a bare clear routine.","objdump + caller inspection + local disassembly + root-rebind correlation + optional-rebuild correlation"
0x0053aca0,357,route_entry_construct_default_state_and_seed_visual_profile_tables,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Concrete constructor for the same route-entry object family. The helper installs vtable `0x005dd3d8`, clears root, attachment, and optional display-buffer pointers `[this+0x04/+0x55/+0x1e3]`, seeds local style bytes `[this+0x44]=0` and `[this+0x5a]=0xff`, initializes the larger visual-color bands to repeated packed default `0xff7f7f7f`, seeds four local offset dwords `[this+0x45/+0x49/+0x4d/+0x51]`, seeds several default scalar bands such as `[this+0x73/+0x77/+0x8b/+0x8f/+0xa3/+0xa7/+0xbb/+0xbf/+0xd3/+0xd7/+0xeb/+0xef/+0x103/+0x107/+0x11b/+0x11f]`, loads default profile-table dwords from `0x00624d88..0x00624dd4` into `[this+0x17b..]`, `[+0x163..]`, `[+0x133..]`, `[+0x14b..]`, and `[+0x1fd]`, clears the triplet bands and center scalars `[this+0x0c/+0x10/+0x1ed/+0x1f1]`, and normalizes style byte `[this+0x59]` to keep the low nibble while forcing bit `0x10`. This is the safest current read for the default route-entry constructor rather than a generic visual preset helper.","objdump + caller inspection + local disassembly + constructor-state correlation + default-profile-table correlation"
0x0053ae10,85,route_entry_bind_root_apply_state_profile_copy_four_triplets_and_reset_style_latch,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small construction-time binder above the route-entry helpers. The helper stores caller root at `[this+0x04]`, applies the requested state byte through `route_entry_apply_table_driven_visual_profile_and_optional_display_latch` `0x00539380`, zeroes live center scalars `[this+0x0c/+0x10]` and attachment id `[this+0x55]`, copies four caller-supplied triplets through `route_entry_copy_four_triplets_refresh_attachment_tile_and_recompute_center_scalars` `0x0053a740`, then clears the low-nibble style bits in `[this+0x59]` and resets packed color dword `[this+0x5f]` to `0xff7f7f7f`. This is the safest current read for the root-bind plus profile-and-triplet initialization wrapper rather than another plain setter.","objdump + caller inspection + local disassembly + root-bind correlation + state-profile correlation"
0x005373b0,112,world_presentation_seed_default_overlay_companion_record_set,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Seeds the default static overlay-companion record set after a broader presentation reinit. The helper zero-fills the local `0x1b`-entry companion slot table at `[this+0x40c]`, clears live count `[this+0x408]`, and then invokes `world_presentation_allocate_overlay_companion_record_from_static_template` `0x00535950` seven times with the static template rows `0x005dd300`, `0x005dd314`, `0x005dd328`, `0x005dd33c`, `0x005dd350`, `0x005dd364`, and `0x005dd378`. Current grounded caller is `0x0053804e` inside `world_presentation_apply_grid_dimensions_and_reinitialize_secondary_overlay_family` `0x00537e60`, so this is the safest current read for the shared default companion-record seeder rather than a later border-overlay rebuild owner.","objdump + caller inspection + field correlation + static-template correlation"
0x005374d0,240,world_refresh_secondary_overlay_support_surfaces_and_vector_field_in_rect,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Rectangle-wide owner above the secondary-overlay support family. The helper clamps the caller rectangle to the live world bounds, clears shift field `[this+0x15e1]`, runs `0x00536230` across the selected cells to refresh one packed three-float local sample field rooted at `[this+0x15f1]`, runs `0x00536420` across the same rectangle to rebuild one companion unsigned-word field rooted at `[this+0x1619]`, then rebuilds the signed vector byte planes through `world_rebuild_secondary_overlay_vector_byte_planes_in_rect` `0x00536710`, and finally regenerates the multiscale support surfaces through `world_rebuild_secondary_overlay_multiscale_support_surfaces_in_rect` `0x00533890`. Current grounded callers are the late world-side rectangle branch at `0x0044d45c` and the shell-side scan or brush branch at `0x004fc4bf`, so this is the safest current read for the shared secondary-overlay rectangle refresh owner rather than a one-shot startup allocator.","objdump + caller inspection + field correlation + multiscale-support correlation + vector-plane correlation"
0x00533b70,7,world_query_overlay_strip_offset_lut_ptr,map,thiscall,inferred,objdump + caller inspection + allocation-path inspection,3,"Tiny root-pointer getter for the overlay strip-offset lookup table at `[this+0x15e5]`. The table is allocated in the world-presentation setup path around `0x00537b68` and filled with `i * 0x5c` offsets in `0x00537cb0..0x00537ccc`. Current grounded callers are shell-side presentation and staging branches around `0x00524e92`, `0x00525b7e`, `0x0052ae90`, `0x0052b4ef`, and `0x0054dd50`, which consume it together with the normalized coordinate LUTs and sample-record roots.","objdump + caller inspection + allocation-path inspection + field correlation"
0x00533b90,7,world_query_overlay_sample_triplet_buffer_ptr,map,thiscall,inferred,objdump + caller inspection + allocation-path inspection,3,"Tiny root-pointer getter for the packed overlay sample-triplet buffer at `[this+0x15f1]`. The buffer is allocated in the world-presentation setup path around `0x00537616` at `3 * 4` bytes per entry, and the neighboring producer `0x005333eb` writes three floats per selected sample record into that buffer. Current grounded caller is the shell-side overlay staging branch at `0x00525b94`, which uses it alongside the normalized coordinate LUTs and strip-offset table rather than as a standalone geometry owner.","objdump + caller inspection + allocation-path inspection + field correlation"
0x00534f40,29,world_secondary_raster_resolve_cell_record_ptr,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small address resolver for the secondary 3-byte raster rooted at `[this+0x165d]`. The helper flattens the caller-supplied cell coordinates through width `[this+0x15dd]`, multiplies the linear index by `3`, and returns a direct pointer to that 3-byte cell record. Current grounded callers include neighboring world-side presentation or scan branches around `0x004464b8`, `0x00447120`, `0x0044be9c`, `0x00450f8b`, and `0x004fa7a2`, plus the `.smp` serializer `world_runtime_serialize_smp_bundle` `0x00446240`, so this is the safest current read for the shared secondary-raster cell-pointer resolver rather than a more player-facing overlay helper.","objdump + caller inspection + field correlation + secondary-raster correlation"
0x004c9da0,496,map_editor_chairman_slot_panel_format_slot_card,map,cdecl,inferred,objdump + RT3.lng strings + control-flow inspection,4,"Formats one selected chairman-slot card for the shell editor panel rooted under control group `0x5a6e`. The helper reads the 9-byte local slot record rooted at `[0x006cec78+slot*9+0x69d8]`, formats the staged chairman profile label from the static persona table at `0x005f2d28`, appends the localized `Optional` versus `Mandatory` suffix from ids `2997` and `2998` based on `[slot+0x01]` with nonzero=`Optional` and zero=`Mandatory`, then appends one of `Human` `Computer` or `Human or Computer` from ids `3001` `3000` and `2999` based on `[slot+0x02]` plus the separate per-slot gate at `[0x006cec78+slot*9+0x0bc3]`. It also formats the numeric tuning field from `[slot+0x04]` into the same card. Current grounded caller is the selection callback rooted at `0x004cc230`.","objdump + RT3.lng strings + UI callback inspection"
0x004ca010,432,map_editor_chairman_slot_panel_refresh_selected_slot,map,thiscall,inferred,objdump + RT3.lng strings + UI control inspection,4,"Refreshes the active detail controls for one selected chairman slot in the shell editor panel. It stores the selected slot index at `[this+0x80]`, publishes the staged profile id from `[slot+0x00]`, the persona icon byte from `0x005f2d29`, and the localized profile label from `0x005f2d47`, then updates the role and policy controls from the same local record. `[slot+0x01]` drives the Optional-versus-Mandatory control pair with nonzero=`Optional` and zero=`Mandatory`; `[slot+0x02]` plus the separate per-slot gate at `[0x006cec78+slot*9+0x0bc3]` drive the `Human`, `Computer`, and `Human or Computer` controls; and `[slot+0x04]` is surfaced through the numeric field editor. Current grounded caller is the list-selection callback at `0x004cc230`.","objdump + RT3.lng strings + UI control inspection"
0x004ca1c0,514,map_editor_chairman_slot_panel_refresh_slot_counters,map,thiscall,inferred,objdump + UI control inspection,3,"Recomputes the aggregate slot counters displayed by the chairman-slot editor panel. The helper walks the 16 local slot records rooted at `[0x006cec78+0x69d8]`, splits them by the Optional-versus-Mandatory byte `[slot+0x01]`, and separately counts slots whose live-seat markers come from the ordinary seat byte `[slot+0x02]` versus the special occupied-seat byte `[slot+0x03]`. It then formats the resulting `%1/%2` summaries through the shared pattern block at `0x005cfda8`, republishes those summaries to the panel controls under groups `0x5a6f`, `0x5a70`, and `0x5a71`, and stores the aggregate counts at `0x006cec78+0x6a68..0x6a7c` for neighboring shell validation. Current grounded callers are the panel constructor at `0x004cc2d0` and the role-policy update handlers in `0x004cecc0`.","objdump + UI control inspection + format-string inspection"
0x004ca540,304,map_editor_available_chairman_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + static-table inspection,4,"Constructs the shell-side `Player Pool` page in the map-editor control panel. The helper binds the row formatter `0x004ca450` and range callback `0x004ca430` on the shared panel root `0x5aa0`, walks the 40-entry persona table slice at `0x005f2d6e` in `0x27`-byte steps, publishes one localized chairman-name row for each persona, counts enabled scenario-side availability bytes in `[0x006cec78+0x6987..]`, and then republishes the `%1 out of %2 are selected.` summary from localized id `1035` through control `0x5aa4`. The neighboring localized page text `996` `Player Pool` plus help text `1016` `Control of which specific players (i.e. Jay Cooke) allowed in the scenario.` now make this the strongest current shell owner for the scenario's available-chairman pool rather than another generic persona browser.","objdump + RT3.lng strings + static-table inspection + UI callback inspection"
0x004ca670,280,map_editor_scenario_metadata_panel_refresh_briefing_mode,map,thiscall,inferred,objdump + RT3.lng strings + UI control inspection,4,"Refreshes the briefing-mode controls inside one shell-side map-editor scenario metadata panel. The helper uses the global selector `0x621f50` to choose whether the visible long-text editor is the ordinary scenario briefing or the multiplayer briefing, publishes the corresponding heading from localized ids `1491` `Briefing (dialog appears when scenario starts):` and `3586` `Multi-Player Briefing (dialog appears when scenario starts):` onto control `0x5b73`, flips the paired selector controls around `0x5b71` and `0x5b72`, and republishes the stored single-player and multiplayer briefing texts from `[0x006cec78+0x4f30]` and `[+0x5ae9]` into the paired edit controls `0x5b6d` and `0x5b6f`. Current grounded caller is the broader scenario metadata refresh at `0x004ca790`.","objdump + RT3.lng strings + UI control inspection + state-field correlation"
0x004ca790,384,map_editor_scenario_metadata_panel_refresh_controls,map,thiscall,inferred,objdump + RT3.lng strings + UI control inspection,4,"Refreshes the shell-side map-editor scenario metadata controls under the shared control band `0x5b69..0x5b74`. The helper first re-enters `map_editor_scenario_metadata_panel_refresh_briefing_mode` at `0x004ca670`, then republishes the scenario description from `[0x006cec78+0x672e]` to control `0x5b69`, the start-year trio from `[+0x66ca]`, `[+0x66d2]`, and `[+0x66ce]` into `0x5b6a`, `0x5b6c`, and `0x5b6b`, the direct campaign-designated byte `[+0x66de]` into control `0x5b6e`, and the inverse of the paired metadata byte `[+0x66f3]` into control `0x5b74`. The resource-side anchor is now explicit too: `editorDetail.win` contains one control record rooted at `0x5b6e` that carries localized ids `3160/3161` `Campaign Scenario` and `If checked, this map will be reserved as a campaign scenario.` before the next control record begins at `0x5b74`, which grounds `[+0x66de]` as the actual campaign-scenario flag rather than a generic metadata boolean. The neighboring message dispatcher at `0x004cb4a0` clamps the three year fields to `1829..2100` and maintains `minimum <= default <= maximum`, which aligns the rest of this panel with the localized editor strings `Description:` `Minimum Start Year:` `Default Start Year:` `Maximum Start Year:` and the paired briefing labels in `RT3.lng` ids `1483..1492` and `3586`.","objdump + RT3.lng strings + UI control inspection + state-field correlation + editorDetail.win resource record"
0x004ca910,474,map_editor_building_density_panel_refresh_controls,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + UI control inspection,4,"Refreshes the shell-side `Building Density` page in the map-editor control panel. The helper reads two scenario-state bytes at `[0x006cec78+0x4c78]` and `[+0x4c7c]` and reflects them into two separate three-choice control bands `0x5c3a..0x5c3c` and `0x5c44..0x5c46`, with both fields seeded to the middle state `1` by constructor-time defaults and persisted through the ordinary map-state bundle path. The localized field captions now make the page materially tighter: `[state+0x4c78]` is the `Starting Building Density Level:` selector from ids `1642` and `1643`, where the default middle state `1` corresponds to the documented `100%` baseline and the lower world-building branches later treat the stored ordinal as a real three-state numeric mode; `[state+0x4c7c]` is the paired `Building Density Growth:` selector from id `1644`, which combines with city or region-specific density changes as described by `1641` and is likewise consumed later as a three-state growth-mode byte rather than a pure UI label. Related localized report text such as `1037`, `1048`, and `1070` points back to this same pair as the map-wide starting-density and later growth controls.","objdump + RT3.lng strings + caller inspection + UI control inspection + save-load correlation"
0x004ca980,315,map_editor_economic_cost_slider_dispatch,map,thiscall,inferred,objdump + RT3.lng strings + .data descriptor table inspection,3,"Slider-update dispatcher for one shell-side map-editor economic tuning family. The helper handles the bounded slider event range `0xa433..0xa43d` and grounds as the real writer for the persisted six-dword tuning band serialized by `.smp`: lane `0` is written directly into `[0x006cec78+0x0be2]` by scaling the incoming slider position through its dedicated divisor at `0x005c85d8`, while the trailing five lanes `[+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]` share the centered `(value-0xce)/0x005c87f8` path. It then mirrors the freshly written leading lane into `[state+0x0bde]` and, when the live panel owner `0x006cff84` is present, immediately re-enters `map_editor_economic_cost_slider_panel_construct` `0x004cadf0` to rebuild the visible slider strip. Current neighboring constructor evidence binds this callback to six visible controls under `0x5bcd..0x5bd7`, while the surrounding `.data` descriptor run at `0x00611c70..0x00612220` now bounds the wider editor lane as the live owner for `Prime Rate`, `Merger Premium`, and the construction and maintenance cost labels `Build Stations Cost` through `Steam Engine Cost` with help texts `2433..2437`, rather than leaving that help-text family orphaned.","objdump + slider jump-table inspection + state-field correlation + RT3.lng strings + .data descriptor table inspection + lane-scaling correlation"
0x004caaf0,751,map_editor_economic_cost_panel_refresh_preview_curve_and_numeric_rows,map,cdecl,inferred,objdump + local disassembly + constructor correlation + state-field correlation,4,"Refreshes the shell-side preview and numeric readout strip beneath the map-editor economic tuning page. The helper is attached to control `0x5be1` by `map_editor_economic_cost_slider_panel_construct` `0x004cadf0`, reads the live six-float tuning band from `[0x006cec78+0x0be2/+0x0be6/+0x0bea/+0x0bee/+0x0bf2/+0x0bf6]`, and then does two distinct presentation passes. First it builds one curve preview into the `0x418` drawing path on `0x6cff8c`, using `[state+0x0be2]` as the leading scalar and the five trailing floats as one stepped multiplier table across successive ten-step buckets. Second it republishes the same six values back into the neighboring text controls `0x5bce`, `0x5bd0`, `0x5bd2`, `0x5bd4`, `0x5bd6`, and `0x5bd8`: the leading lane is formatted through one integer `%d`-style path, while the five trailing float lanes are formatted through one shared decimal formatter before all six strings are pushed through the generic type-`0x6f` dynamic-text control path. This is therefore the preview/formatter sibling of the economic slider dispatcher, not another mutator.","objdump + local disassembly + constructor correlation + state-field correlation + control-band correlation"
0x004cadf0,751,map_editor_economic_cost_slider_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + .data descriptor table inspection,4,"Constructs one shell-side map-editor economic cost tuning panel. The helper registers `map_editor_economic_cost_slider_dispatch` at `0x004ca980` on the six slider controls `0x5bcd`, `0x5bcf`, `0x5bd1`, `0x5bd3`, `0x5bd5`, and `0x5bd7`, attaches the neighboring preview or formatter callback `0x004caaf0` on control `0x5be1`, and then republishes the current scenario-state tuning values from `[0x006cec78+0x0be2..0x0bf6]` back into those controls through the shared slider formatting helpers. Current surrounding evidence now grounds this as the live editor-side economic tuning subsystem that was previously only visible through the orphaned help-text family: the adjacent descriptor block at `0x00611c70..0x00612220` pairs the wider lane with localized fields `Prime Rate`, `Merger Premium`, and `Build Stations Cost` through `Steam Engine Cost`, plus help texts `2433..2437`. Current grounded caller is the larger editor-panel dispatcher at `0x004ce244`.","objdump + caller inspection + slider registration + state-field correlation + RT3.lng strings + .data descriptor table inspection"
0x004cb1a0,22,map_editor_scenario_special_conditions_panel_clear_visible_row_band,map,thiscall,inferred,objdump + constructor correlation + local disassembly,3,"Tiny list-range clear helper beneath the map-editor special-conditions page. The helper resolves the page-owned list host at `[this+0x86]` and clears the visible row band `0xabe0..0xafc7` through `0x0053fe00`. Current grounded caller is the constructor `map_editor_scenario_special_conditions_panel_construct` `0x004cb2b0`, which binds this as the range callback on list control `0xa7fa`, so this is the visible-row reset sibling of the later per-row formatter rather than a generic list helper.","objdump + constructor correlation + local disassembly + control-range correlation"
0x004cb1c0,236,map_editor_scenario_special_conditions_panel_format_row_by_index,map,cdecl,inferred,objdump + constructor correlation + static-table inspection + local disassembly,4,"Per-row formatter callback for the map-editor special-conditions list control `0xa7fa`. The helper accepts one rule ordinal, builds one transient row payload through the shared shell dynamic-list path, reads the corresponding live rule dword from `[0x006cec78+0x4a7f + index*4]`, and republishes that value into the per-row toggle control band rooted at `0xabe0 + index`. The localized label/help side is explicit too: the helper walks the same nine-byte static rule table at `0x005f3ab0` used by `map_editor_scenario_special_conditions_panel_construct` `0x004cb2b0`, resolves each paired label/help id through `0x005193f0`, and emits the row text through the generic shell control path before the live enabled state is published. This makes it the actual row-format owner over the persisted 49-dword scenario-rule band rather than leaving that list on constructor-only evidence.","objdump + constructor correlation + static-table inspection + local disassembly + rule-band correlation"
0x004cb2b0,485,map_editor_scenario_special_conditions_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + static-table inspection,4,"Constructs the special-conditions side of the shell map-editor scenario setup page. The helper binds the row formatter `0x004cb1c0` and range callback `0x004cb1a0` on list control `0xa7fa` through `Setup_Options_Buttons.imb`, walks the 49-entry static toggle table at `0x005f3ab0`, counts enabled dword flags in `[0x006cec78+0x4a7f]`, formats each row from paired label/help ids such as `2535/2564` `Disable Stock Buying and Selling`, `2874/2875` `Use Bio-Accelerator Cars`, `3722/3723` `Disable Cargo Economy`, `3850/3851` `Disable Train Crashes`, `3852/3853` `Disable Train Crashes AND Breakdowns`, and `3920/3921` `AI Ignore Territories At Startup`, and republishes the `Special Conditions In Effect` summary from localized id `1053` through control `0xa7f8`. The same constructor also reads one trailing dword at `[0x006cec78+0x4b43]`, so the live editor-owned scenario-rule band is now best bounded as `49` dwords plus one scalar rather than the smaller fixed matrix inferred in the checked `gmp/gms/gmx` files. It then re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`, which makes this a bounded scenario special-conditions panel rather than a generic option list. Current grounded caller is the larger editor-panel dispatcher at `0x004ce28e`.","objdump + RT3.lng strings + static-table inspection + UI callback inspection + fixed-runtime-band correlation"
0x004cb4a0,468,map_editor_scenario_metadata_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the adjacent map-editor scenario metadata controls. The helper handles the bounded event band `0xa497..0xa4a2` with concrete per-control writes now grounded: `0xa497` and `0xa498` flip briefing selector `0x621f50` to multiplayer or single-player mode and immediately re-enter `map_editor_scenario_metadata_panel_refresh_briefing_mode` `0x004ca670`; `0xa499` toggles metadata byte `[0x006cec78+0x66f3]`; `0xa49a` toggles the direct campaign-scenario byte `[+0x66de]`; `0xa49b` copies one bounded `0x258`-byte scenario description payload from the edit-control text band into `[+0x672e]`; `0xa49c` and `0xa49d` copy bounded `0xbb8`-byte single-player and multiplayer briefing payloads into `[+0x4f30]` and `[+0x5ae9]`; and `0xa49e/0xa49f/0xa4a0` parse the three year edit fields through `0x005a1ea5`, clamp each result to `1829..2100`, and store them into `[+0x66ca]`, `[+0x66ce]`, and `[+0x66d2]`. The post-parse normalization is explicit too: it raises minimum to at most the default and lowers maximum to at least the default, enforcing `minimum <= default <= maximum` before the helper re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`. The resource correlation is now explicit too: `editorDetail.win` ties control `0x5b6e` to localized ids `3160/3161` `Campaign Scenario` and `If checked, this map will be reserved as a campaign scenario.`, so the direct toggle path at `0x4cb519` is now grounded as the editor-side campaign-designation bit rather than a generic metadata checkbox. This confirms that the shared control band `0x5b69..0x5b74` is the live scenario description, briefing, and start-year editor rather than another generic editor options block. Current grounded caller is the panel callback installation rooted at `0x004ce28e`.","objdump + RT3.lng strings + UI dispatch inspection + state-field correlation + editorDetail.win resource record + message-id-to-field correlation"
0x004cb6f0,496,map_editor_available_chairman_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + static-table inspection + UI dispatch inspection,4,"Message dispatcher for the shell-side `Player Pool` editor page. The helper handles the three bulk-selection buttons `0x5aa1..0x5aa3` by rewriting the scenario-side availability bytes rooted at `[0x006cec78+0x6987]` from preset-selection bytes embedded in the same `0x005f2d28` persona table family, and it also commits direct per-row toggle changes from the control range `0x5aaa..0x5b03` back into that byte array. After either path it re-enters `map_editor_available_chairman_panel_construct` at `0x004ca540`, which keeps the visible chairman-name list and the `selected out of total` summary in sync. The localized page text `996` `Player Pool` and help text `1016` now make this the live owner for the scenario's chairman-availability mask rather than a passive list callback block.","objdump + RT3.lng strings + static-table inspection + UI dispatch inspection + state-field correlation"
0x004cb8e0,271,map_editor_scenario_special_conditions_panel_handle_message,map,thiscall,inferred,objdump + static-table inspection + UI dispatch inspection,4,"Message dispatcher for the special-conditions side of the shell map-editor scenario setup page. The helper handles the bulk selection controls `0xa7fb` and `0xa7fc` by writing the whole `49`-dword special-condition array rooted at `[0x006cec78+0x4a7f]`, commits direct per-row state changes from the callback band `0xabe0..0xafc7` into that same array, and updates the neighboring scalar at `[0x006cec78+0x4b43]` through control id `0xa7ff` by parsing the edited text through `0x005a1ea5` before re-entering `map_editor_scenario_special_conditions_panel_construct` at `0x004cb2b0` to refresh the visible list and the `Special Conditions In Effect` summary. The two special-cased ordinals are now explicit from the body: row `0x19` immediately re-enters `0x00493150` after the direct toggle write, and row `0x1a` immediately re-enters `0x00413620` before the same rebuild. That makes this the live state owner for the wider scenario-rule matrix rather than only a passive list callback block.","objdump + static-table inspection + UI dispatch inspection + state-field correlation + fixed-runtime-band correlation + special-row correlation"
0x004cb9f0,134,map_editor_building_density_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + UI dispatch inspection,4,"Message dispatcher for the shell-side `Building Density` page. The helper handles the two three-choice control bands `0x5c3a..0x5c3c` and `0x5c44..0x5c46`, committing ordinal values `0`, `1`, or `2` into the scenario-state bytes `[0x006cec78+0x4c78]` and `[+0x4c7c]` respectively before re-entering the same page refresh path at `0x004ca910`. The localized captions now pin the semantics more directly: `[state+0x4c78]` is the map-wide `Starting Building Density Level:` selector whose default middle state is the documented `100%` baseline, while `[state+0x4c7c]` is the paired `Building Density Growth:` selector. Current downstream xrefs also show both stored bytes steering later world-generation and growth math as concrete three-state mode selectors rather than only UI summaries.","objdump + RT3.lng strings + caller inspection + UI dispatch inspection + state-field correlation"
0x004cba34,15,scenario_state_store_starting_building_density_mode_from_eax,map,cdecl,inferred,objdump + local disassembly + state-field correlation,2,"Tiny direct setter for scenario-state dword `[0x006cec78+0x4c78]`, the same map-wide `Starting Building Density Level:` mode later surfaced by `map_editor_building_density_panel_refresh_controls` `0x004ca910` and committed by `map_editor_building_density_panel_handle_message` `0x004cb9f0`. It simply stores the caller-supplied `EAX` value and returns. Local adjacency now shows this setter living in the same tiny callback or preset strip as the fixed-value helpers immediately below it, so this is the safest current generic write-side sibling for that saved density field.","objdump + local disassembly + state-field correlation + setter-strip correlation"
0x004cba43,19,scenario_state_force_starting_building_density_mode_2,map,cdecl,inferred,objdump + local disassembly + state-field correlation,2,"Tiny fixed-preset setter for scenario-state dword `[0x006cec78+0x4c78]`. The helper writes literal mode `2` and returns. The same field is the map-wide `Starting Building Density Level:` selector surfaced by `map_editor_building_density_panel_refresh_controls` `0x004ca910`, so this is the current strongest read for the hard-wired high-density preset sibling in that setter strip.","objdump + local disassembly + state-field correlation + setter-strip correlation"
0x004cba56,19,scenario_state_force_building_density_growth_mode_0,map,cdecl,inferred,objdump + local disassembly + state-field correlation,2,"Tiny fixed-preset setter for scenario-state dword `[0x006cec78+0x4c7c]`. The helper writes literal mode `0` and returns. The same field is the map-wide `Building Density Growth:` selector surfaced by `map_editor_building_density_panel_refresh_controls` `0x004ca910` and committed by `map_editor_building_density_panel_handle_message` `0x004cb9f0`, so this is the current strongest read for the hard-wired low-growth preset sibling in the same direct setter strip.","objdump + local disassembly + state-field correlation + setter-strip correlation"
0x004cba69,15,scenario_state_store_building_density_growth_mode_from_eax,map,cdecl,inferred,objdump + local disassembly + state-field correlation,2,"Tiny direct setter for scenario-state dword `[0x006cec78+0x4c7c]`, the same `Building Density Growth:` mode later surfaced by `map_editor_building_density_panel_refresh_controls` `0x004ca910` and persisted through the ordinary map-state save path. It simply stores the caller-supplied `EAX` value and returns. Local adjacency now shows this setter living in the same tiny callback or preset strip as the fixed-value helpers immediately above and below it, so this is the safest current generic write-side sibling for that saved growth field.","objdump + local disassembly + state-field correlation + setter-strip correlation"
0x004cba78,19,scenario_state_force_building_density_growth_mode_2,map,cdecl,inferred,objdump + local disassembly + state-field correlation,2,"Tiny fixed-preset setter for scenario-state dword `[0x006cec78+0x4c7c]`. The helper writes literal mode `2` and returns. The same field is the map-wide `Building Density Growth:` selector surfaced by `map_editor_building_density_panel_refresh_controls` `0x004ca910`, so this is the current strongest read for the hard-wired high-growth preset sibling in that setter strip.","objdump + local disassembly + state-field correlation + setter-strip correlation"
0x004cc340,1506,map_editor_city_region_panel_format_selected_region_detail_stats_and_projected_building_rows,map,cdecl,inferred,objdump + local disassembly + constructor correlation + tuning-band correlation,4,"Detail formatter callback for the shell-side `Cities/Regions` editor page. The helper resolves the current selected region id from `0x006cff74` through collection `0x0062bae0`, exits quietly when no live row is selected, and otherwise formats the selected-region detail card through the shared UI host `0x006cff90`. When live region class `[region+0x23e]` is nonzero it first scales current building-count dword `[region+0x242]` by `16`, formats that value through localized id `0x40c`, and publishes the resulting text row. It then reads the persisted economic tuning band from `[0x006cec78+0x0be2/+0x0be6/+0x0bea/+0x0bee]`, formats the leading lane through localized id `0x40d`, and uses `world_region_accumulate_structure_category_totals` `0x00422900` plus `world_region_query_projected_structure_count_scalar_by_category` `0x004234e0` to build the projected/live category rows published through localized ids `0x40e..0x414`. The category split is explicit from the body: it accumulates live totals and weights for categories `0..3`, emits one special aggregate row when any of categories `0/2/3` are present, and then iterates four category rows whose projected values come from `0x004234e0(region, category)`. This is therefore the live `Cities/Regions` detail stats owner consuming the same save-loaded economic tuning band as the runtime post-load path, not just another generic list formatter.","objdump + local disassembly + constructor correlation + tuning-band correlation + projected-structure correlation"
0x004cc930,80,map_editor_city_region_panel_store_selected_region_density_scalar_and_rebuild,map,cdecl,inferred,objdump + local disassembly + constructor correlation,3,"Small write-side callback on the shell-side `Cities/Regions` editor page. When the page-local rebuild guard `0x006cff98` is clear and a live region id is selected in `0x006cff74`, the helper resolves that row through collection `0x0062bae0`, writes the caller-supplied scalar into both `[region+0x25a]` and `[region+0x25e]`, and then re-enters `map_editor_city_region_panel_construct` `0x004cc980` to republish the visible controls. Current grounded registration is the callback bound on control `0x5086` by the page constructor, so this is the selected-region density or scale setter rather than a list-selection handler.","objdump + local disassembly + constructor correlation + state-field correlation"
0x004cc980,943,map_editor_city_region_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Cities/Regions` editor page. The helper uses the current selected city-or-region id in `0x006cff74`, falls back to the first live entry in the region collection at `0x0062bae0`, and shows the empty-page warning from localized id `1045` `You currently have no cities or regions to edit.` when the collection is empty. In the live path it binds the detail formatter `0x004cc340` on control `0x5088` and the selected-region density setter `0x004cc930` on control `0x5086`, populates the visible city-or-region list from `0x0062bae0`, publishes the selected region density and rounded current scalar through controls `0x66/0x5087`, and formats the page summary from localized ids including `3002`, all of which makes this the main owner for the `Cities/Regions` editor section rather than a subordinate helper.","objdump + RT3.lng strings + UI callback inspection + region-collection correlation + control-band correlation"
0x004cc250,112,map_editor_chairman_slot_panel_refresh_slot_list,map,thiscall,inferred,objdump + UI control inspection,4,"Rebuilds the visible slot list in the chairman-slot editor panel. It clears the list control under group `0x5a6e`, then walks the 16 local slot records rooted at `[0x006cec78+0x69d8]` and appends one row for each slot whose active-seat bytes `[slot+0x02]` or `[slot+0x03]` are set. After repopulating the list it re-enters `map_editor_chairman_slot_panel_refresh_slot_counters` at `0x004ca1c0`. Current grounded callers are the panel constructor at `0x004cc2d0` and several message-handler update paths in `0x004cecc0`.","objdump + UI control inspection"
0x004cc2d0,99,map_editor_chairman_slot_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Players` editor panel under control group `0x5a6e`. The helper attaches the selected-slot formatter at `0x004c9da0`, the profile-cycle button at `0x004c9fa0`, and the list-selection callback at `0x004cc230`, then populates the current slot list through `map_editor_chairman_slot_panel_refresh_slot_list` and publishes one top-level panel control. The localized page text `995` `Players` plus help text `1015` `Control of how many players, human and/or A.I., allowed in the scenario.` now make this the clearest current shell owner for the local chairman-slot record family rooted at `0x006cec78+0x69d8`.","objdump + RT3.lng strings + UI callback inspection"
0x004ceb90,291,map_editor_chairman_slot_panel_cycle_selected_slot_profile,map,thiscall,inferred,objdump + static-table inspection,4,"Cycles the staged chairman profile assigned to the currently selected local slot. Starting from the slot-local profile id at `[slot+0x00]`, the helper wraps through the bounded persona id range `0..40`, skips any profile already marked busy in the static persona table byte at `0x005f2d28`, writes the chosen id back to `[slot+0x00]`, and mirrors the same choice into any already-materialized persona object in `0x006ceb9c`, including its display name, biography text, and icon byte. Current grounded callers are the profile-cycle control in `map_editor_chairman_slot_panel_handle_message` and the neighboring shell callback block around `0x004c9fa0`.","objdump + static-table inspection + UI callback inspection"
0x004cecc0,1049,map_editor_chairman_slot_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell chairman-slot editor panel rooted at `0x5a6e`. The helper handles add and remove slot actions, profile cycling, the Optional-versus-Mandatory toggle, the three-way `Human` `Computer` `Human or Computer` role group, and numeric tuning edits for the selected slot. The current slot-record semantics are bounded directly from these branches: control id `0x5a77` writes `[slot+0x01]=1` for `Optional`, `0x5a78` writes `[slot+0x01]=0` for `Mandatory`, and `0x5a79`, `0x5a7a`, plus `0x5a7b` select `Human`, `Computer`, and `Human or Computer` by combining the ordinary seat byte `[slot+0x02]` with the separate per-slot gate at `[0x006cec78+slot*9+0x0bc3]`; `0x5a7c` commits the numeric tuning field back to `[slot+0x04]`. The add-slot path allocates a new live slot, seeds `[slot+0x00]` to one persona id, `[slot+0x01]` to `Optional`, `[slot+0x02]` to the broad `Human or Computer` state, mirrors that same broad state into the external gate at `+0x0bc3`, and seeds `[slot+0x04]` to the default `100000` tuning value. The remove path clears the whole 9-byte record rooted at `[slot+0x00]`, resets `[slot+0x04]` back to `100000`, and clears any already-materialized persona object, but it does not directly write the special occupied-seat byte `[slot+0x03]`, which remains seeded elsewhere in the currently grounded code. Current grounded caller is the shell panel callback attachment in `map_editor_chairman_slot_panel_construct` at `0x004cc2d0`.","objdump + RT3.lng strings + UI dispatch inspection"
0x004ce070,1549,map_editor_panel_select_active_section,map,thiscall,inferred,objdump + caller inspection + UI dispatch inspection,4,"Top-level map-editor control-panel section selector. The helper switches over the active page byte at `[this+0x78]`, tears down or replaces the current page owner at `[this+0x7c]`, and then constructs the bounded editor pages reached so far including the scenario metadata panel `0x004ca790`, city-or-region page `0x004cc980`, territory page `0x004cd070`, available-chairman panel `0x004ca540`, economic tuning panel `0x004cadf0`, locomotives-availability page `0x004cd680`, industry-availability page `0x004cdbd0`, special-conditions panel `0x004cb2b0`, the bounded dual tri-state policy panel rooted at `0x004ca910`, the now-grounded `Port/Warehouse Cargos` page `0x004cf910`, and the resolved report pages at `0x004d3000`, `0x004d3020`, `0x004d3060`, `0x004d3080`, `0x004d30a0`, `0x004d4110`, and `0x004d4130`. Current neighboring shell evidence is enough to treat this as the broad editor-side page owner rather than another local panel helper.","objdump + caller inspection + UI dispatch inspection + page-constructor correlation"
0x004ce380,1174,map_editor_city_region_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Cities/Regions` editor page. The helper routes message `0xca` and `0xcb` traffic through the city-or-region controls around `0x507e..0x5088`. The page-navigation side is tighter now too: one branch cycles the selected row through the visible list rooted at `0x507e`, republishes the new ordinal to control `0x66`, and re-enters `map_editor_panel_select_active_section` `0x004ce070`; another branch re-enters that same page selector with caller payload `1`. The write-side branches are explicit in the body: it opens the rename prompt from localized id `1054` `Enter the new name:` for the currently selected city-or-region and then reconstructs the page; it writes callback payloads straight into `[region+0x272]` on one small numeric branch; and it forwards another callback payload through `0x004204c0` on the selected region before rebuilding. The copy-industry-data flow anchored by localized id `1055` `Choose the city to copy industry data from` is also concrete now: one branch walks the candidate pool at `0x0062b268` and reapplies per-candidate weighting or enable state against the selected city-or-region through `0x004206b0`, using either `0.0` or `1.0` as the copied weight depending on the triggering control, while the source-selection branch builds one bounded name/id list from the live region collection and, when the chooser returns `0x3f2`, re-enters `0x00420e00` to clone the source region's profile subcollection into the current target before refreshing the page. Current grounded globals `0x006cff74`, `0x006cff78`, and the region collection `0x0062bae0` make this the live handler for the `Cities/Regions` editor section rather than a generic shell callback block.","objdump + RT3.lng strings + UI dispatch inspection + region and candidate correlation + copy-industry-flow correlation"
0x004ce820,1221,map_editor_territory_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Territories` editor page. The handler uses the selected territory ids in `0x00621f48` and `0x00621f4c`, routes selection and navigation through controls around `0x50dc..0x50df`, opens the territory rename prompt from localized id `1054`, and owns the border-remap or hide-border policy path that warns through localized ids `1056` and `1057` when a territory's borders cannot be hidden because other territories already remap to it. After committing the selected territory's border and remap fields it re-enters `map_editor_territory_panel_construct`, which makes this the live `Territories` page handler rather than another local modal callback.","objdump + RT3.lng strings + UI dispatch inspection + territory-state correlation"
0x004cd070,1280,map_editor_territory_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Territories` editor page. The helper uses `0x00621f48` and `0x00621f4c` as the selected-territory latches, falls back to the first live territory in the territory collection at `0x006cfc9c`, and shows the empty-page warning from localized id `1046` `You currently have no territories to edit.` when no territories exist. In the live path it populates the visible territory list from `0x006cfc9c`, publishes the selected territory's id, name, border mode, remap target, and numeric tuning fields through controls `0x50dc..0x50e5`, and builds the secondary remap list from other territories that reference the currently selected one. Current grounded neighbors make this the main owner for the `Territories` editor section.","objdump + RT3.lng strings + UI callback inspection + territory-collection correlation"
0x004cd680,1168,map_editor_locomotive_availability_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Locomotives` availability page in the map-editor control panel. The helper reflects three scenario-state policy bytes from `[0x006cec78+0x4c97]`, `[+0x4c98]`, and `[+0x4c99]` into controls `0x5b09..0x5b0b`, binds the row formatter `0x004cd570` and the neighboring callback `0x004ca960` on root control `0x5b05`, and iterates the collection at `0x006ada84` to build the visible locomotive list plus the localized title from id `1050` `Locomotives Available\n\n%1 of %2 available`. The detail path formats each selected locomotive through `EditorDetail.win` and counts live world usage by resolving the record through `0x00461c80` and the world-side lookup at `0x00435030`. Current grounded evidence is therefore strong enough to treat this as the main locomotives-available page rather than a generic detail widget.","objdump + RT3.lng strings + UI callback inspection + locomotive-usage correlation"
0x004cf0d0,861,map_editor_locomotive_availability_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Locomotives` availability page. The helper routes selection and bulk-toggle traffic through controls `0x5b06..0x5b0c`, rewrites the three scenario-state policy bytes at `[0x006cec78+0x4c97]`, `[+0x4c98]`, and `[+0x4c99]`, and walks the locomotive collection at `0x006ada84` to commit per-row availability changes through the same record family used by the constructor. Bulk branches apply enable or disable policy across the visible locomotive set before the handler re-enters `map_editor_locomotive_availability_panel_construct` at `0x004cd680`, which makes this the live availability-policy owner rather than a local detail callback.","objdump + RT3.lng strings + UI dispatch inspection + locomotive-policy correlation"
0x004cdbd0,1357,map_editor_industry_availability_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Industry (Overall)` availability page in the map-editor control panel. The helper binds the detail-row callback `0x004cc130` and the neighboring callback `0x004c9d80` on root control `0x9c42`, then walks the global candidate pool at `0x0062b268`, skipping the category-1 family and sorting the remaining candidates by label before building the visible industry list. The detail side formats the selected industry through `EditorDetail.win`, appends up to eight compatible city-or-region names from the region collection at `0x0062bae0`, and publishes the localized summary from id `1051` `There are %1 Cities and/or Regions using %2 right now`, while the page title uses id `1052` `Industries Available\n\nIndustries: %1 of %2 available`. Current grounded evidence therefore treats this as the main industry-availability page rather than an unnamed detail browser.","objdump + RT3.lng strings + UI callback inspection + candidate-pool correlation"
0x004cf430,714,map_editor_industry_availability_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Industry (Overall)` availability page. The handler has two grounded write paths into the saved named-availability table. On the direct row-callback path under message `0xca`, controls `0xa028..0xa40f` resolve the clicked candidate row from the callback payload, forward its live name plus the caller-supplied boolean state into `scenario_state_upsert_named_candidate_availability_record_and_refresh_runtime_filters` `0x00434f20`, and then reconstruct the page. On the top-level bulk path it recognizes control `0x9c43` as one boolean preset and the sibling path as the opposite boolean preset, walks the live candidate pool `0x0062b268`, keeps only rows that pass the same industry-page filter, and forwards each surviving candidate name plus that bulk boolean into the same `0x00434f20` upsert owner before reconstructing the page through `map_editor_industry_availability_panel_construct` `0x004cdbd0`. Current grounded control usage and localized strings now make this the live industry-availability handler rather than another shared editor callback block.","objdump + RT3.lng strings + UI dispatch inspection + candidate-state correlation + callback-payload correlation + bulk-boolean sweep correlation"
0x004cf910,1770,map_editor_port_warehouse_cargo_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Port/Warehouse Cargos` page in the map-editor control panel. The helper uses the selected recipe-book index latches at `0x006cffa0` and `0x006cffa4`, immediately re-enters `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` `0x00435630`, falls back across the per-book state blocks rooted at `[0x006cec78+0x0fe7+index*0x4e1]`, and populates the visible cargo-page controls under `0x59d8`, `0x5a0a`, and `0x5b74`. Current page-state work now bounds the structure more concretely too: the selected recipe-book index wraps modulo `12`, each recipe-book block stores the shared maximum annual production float at `book+0x3ed`, and the constructor then walks five fixed cargo-line entries starting at `book+0x3f1` with stride `0x30`. Each line now grounds as one row-owned mode dword at `+0x00`, one annual amount float at `+0x04`, one supplied-cargo token at `+0x08`, and one demanded-cargo token at `+0x1c`; the constructor resolves those persisted token strings against the visible live cargo catalog through direct `0x005a57cf` exact-name compares and only reflects matched ordinals back into the selector controls. That closes the editor-side marker boundary materially: there is still no special decode path here, and nonmatching token strings simply leave the selector index at its zero default while the raw scenario-state strings remain unchanged. The constructor-side usage summary is tighter in the same way: before showing the current book it scans the live city-or-region collection at `0x0062bae0`, keeps only rows whose usage gates `[entry+0x242]` and `[entry+0x2f6]` are live and whose current recipe ordinal `[entry+0x2f2]` matches the selected book, concatenates up to eight visible names from `[entry+0x356]` with separator `0x005c9f38`, counts any remainder, and then formats the bounded usage-summary pair from localized ids `508` and `509`. The row-control mapping is now bounded too: the selector and label pair at `+0x14/+0x1e` is the supplied-cargo side because it is the pair enabled in modes `2/3`, while the pair at `+0x28/+0x0a` is the demanded-cargo side because it is the pair enabled in modes `1/3`. The same gating also tightens the single numeric field at `+0x46/+0x32`: it is labeled `Annual Demand:` only for mode `1`, but `Annual Supply:` for modes `2/3`. The localized page-title and help-text cluster now bounds the page much more tightly: `1001` `Port/Warehouse Cargos`, `1021` `Control over what ports and warehouses demand and supply.`, `1499` `Port/Warehouse Cargo Recipe Book:`, `1671` `Rename this cargo recipe book`, `1672` and `1673` for previous or next recipe-book cycling, `1674` and `1675` for the shared maximum annual production field, `1676` `Demanded:`, `1677` `Supplied:`, and `1678` for the per-cargo annual amount field. The same constructor also surfaces the four per-cargo mode labels `501` `<Disabled>`, `502` `Demand Only`, `503` `Supply Only`, and `504` `Production Demand->Supply`, publishes the annual demand or supply captions from `510` and `511`, formats rename and usage summaries through localized ids `507`, `508`, and `509`, and exposes the sandbox toggle text from id `3901` `Sandbox Allowed`. Current mode gating now makes the fourth mode tighter too: `Production Demand->Supply` is the only line state that clearly keeps both supplied-cargo and demanded-cargo branches active, while the shared numeric field stays on the supply side in that mode. That matches the wording around `1674`, `1675`, and `504` that ties it to one shared production-capacity pool and raw-material conversion into supplied output. It also emits the bounded high-production and high-load warnings from ids `505` and `506`, both of which explicitly reference ports or warehouses, which makes this the strongest current owner for the recipe-book or port-cargo editor lane rather than another generic detail page.","objdump + RT3.lng strings + UI callback inspection + r
0x004d0040,1643,map_editor_port_warehouse_cargo_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Port/Warehouse Cargos` editor page. The helper routes selection and navigation traffic through the same recipe-book control bands rooted at `0x59d8`, `0x5a0a`, and `0x5b74`, opens the rename prompt from localized id `507`, and commits per-book cargo policy, sandbox-allowed state, and recipe-book text changes back into the scenario-state blocks at `[0x006cec78+0x0fe7+index*0x4e1]`. The edit-side dispatch is now tighter than before: the recipe-book selector wraps modulo `12`; top-level control `0x59d8` parses the shared maximum annual production text field, clamps the entered value to at most `8`, warns through modal `0x1f9` when needed, and writes the resulting float to `book+0x3ed`; top-level control `0x59d9` opens the bounded rename modal over the current book root with one `0x3c`-byte text span; controls `0x59da/0x59db` cycle the selected recipe-book index backward or forward modulo `12`; and top-level control `0x59de` commits the selected recipe-book ordinal directly into `0x006cffa4`. The per-line edit groups then commit into five fixed cargo-line records beginning at `book+0x3f1` with stride `0x30`. Those line groups now ground exactly as one mode dword at `+0x00`, one annual amount float at `+0x04`, one supplied-cargo token string at `+0x08`, and one demanded-cargo token string at `+0x1c`, with the concrete control ids now resolved too: `0x5a0a..0x5a0e` write the five line-mode dwords at `book+0x3f1+line*0x30`; `0x5a1e..0x5a22` resolve one live cargo entry through `0x00518140` and copy its name field into the supplied-token lane at `book+0x3f9+line*0x30`; `0x5a32..0x5a36` do the same for the demanded-token lane at `book+0x40d+line*0x30`; and `0x5a50..0x5a54` parse the per-line annual amount text, clamp it to at most `6`, warn through modal `0x1fa` when needed, and write the resulting float to `book+0x3f5+line*0x30`. Current local control flow now closes the persistence boundary too: this handler stores the selected cargo names back into those token fields verbatim and does not normalize unmatched marker-like payloads before they reach the constructor or importer. The same handler keeps the single amount field on the demand side only for mode `1`; in modes `2/3` it writes that same `+0x04` field as annual supply, which matches the constructor captions `510` `Annual Demand:` versus `511` `Annual Supply:`. Current localized row text now makes the bounded edit surface much clearer: the page cycles among recipe books through `1672` and `1673`, renames them through `1671`, updates the shared maximum annual production field under `1674` and `1675`, and edits five fixed per-book line entries whose mode labels are `501` `<Disabled>`, `502` `Demand Only`, `503` `Supply Only`, and `504` `Production Demand->Supply` with annual amount captions `510` `Annual Demand:` and `511` `Annual Supply:` plus row labels `1676` `Demanded:` and `1677` `Supplied:`. The wording on `1675` also tightens the fourth mode specifically: `Production Demand->Supply` is the branch where the shared production-cap field is relevant and raw materials on hand are converted through production lines into supplied output, rather than only free-standing demand or free-standing supply. One bounded branch walks the city-or-region collection at `0x0062bae0` while rebuilding the usage summaries from localized ids `508` and `509`, and the warning branches re-use ids `505` and `506` when production-rate or supply-demand settings become too high for ports or warehouses. Before returning it re-enters `map_editor_port_warehouse_cargo_panel_construct` at `0x004cf910`, which makes this the live handler for the port or warehouse recipe-book page rather than a shared page-table callback.","objdump + RT3.lng strings + UI dispatch inspection + recipe-book state correlation + mode-table correlation + control-write correlation + exact-name-token-persistence-correlation + rename-modal-correlation
0x004cf700,370,map_editor_panel_dispatch_active_section_message,map,thiscall,inferred,objdump + caller inspection + UI dispatch inspection,4,"Top-level message dispatcher for the active map-editor control-panel section. The helper reuses the same page selector byte at `[this+0x78]` and routes incoming shell messages to the current page-local handlers, including the grounded city-or-region handler `0x004ce380`, territory handler `0x004ce820`, scenario metadata handler `0x004cb4a0`, available-chairman handler `0x004cb6f0`, special-conditions handler `0x004cb8e0`, the bounded dual tri-state handler `0x004cb9f0`, the grounded port-or-warehouse cargo handler `0x004d0040`, and the resolved report-page handlers rooted at `0x004d38c0`, `0x004d3d90`, and the neighboring editor report family. Current grounded caller and page-table evidence now make this the broad editor-side active-page dispatcher rather than another page-local callback block.","objdump + caller inspection + UI dispatch inspection + page-handler correlation"
0x004d0420,1618,map_editor_city_count_stats_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `City Count Stats` editor report. The helper aggregates land-cell and city counts from the active world and region collections, derives per-10K density ratios, and formats the visible summary through localized ids `1059..1070`, including `Total Land Cells`, `Total Cities`, `Average City Building Density`, `Average Region Building Density`, and the projected starting-industry and non-industry building counts. The projected-building side is tighter now too: it walks the live region collection `0x0062bae0`, sums world_region_query_projected_structure_count_scalar_by_category `0x004234e0` for categories `2`, `3`, and `0`, and then combines those projected category scalars with the live-region count byte `[region+0x242]` and density float `[region+0x25a]` to build the final industry and non-industry summary terms. Current grounded caller is the neighboring report-page constructor at `0x004d30a0`.","objdump + RT3.lng strings + caller inspection + world and region count correlation + projected-structure-scalar correlation"
0x004d0a90,3416,map_editor_general_validation_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `General Validation` editor report. The helper walks the current scenario and world state looking for high-level validation failures, including missing industry in a city or region, mismatches between available player slots and the current player-pool setup, missing briefing text, and missing scenario description, then emits the matching warning lines through localized ids such as `1071`, `1073`, `1074`, and `1075`. Current grounded caller is the page constructor at `0x004d3080`, which makes this the actual general-validation report rather than the tree-stats page previously grouped under that label.","objdump + RT3.lng strings + caller inspection + validation-string correlation"
0x004d1b80,536,map_editor_tree_stats_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `Tree Stats` editor report. The helper scans the active world grid through dimensions rooted at `0x0062c120`, accumulates total-tree and density counts into the neighboring global scratch slots at `0x006cffa8` and `0x006cffb8`, and then formats the visible report through localized id `1086`, which includes `Total Trees`, `Trees per any cell`, `Trees per land cell`, and the adjacent performance guidance text. Current grounded caller is the tree-stats page constructor at `0x004d3060`.","objdump + RT3.lng strings + caller inspection + world-grid scan correlation"
0x004d1d60,1679,map_editor_city_region_growth_stats_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `Stats - City/Region` growth report. The helper walks the city or region collection at `0x0062bae0`, reads display names from each entry, and formats the multi-column growth summary through localized ids `1087..1096`, including `Industry Bldg Count`, `Industry Revenue`, `Industry Profit`, `Modified Rail Revenue`, `Weighted Profit Margin`, `Annual Density Adjust`, `Start Density`, `Current Density`, `Start Bldg Count`, and `Current Bldg Count`. The column-to-field mapping is tighter now too: the report prints the weighted-profit-margin scalar from `[region+0x2e2]` as `%3.2f`, the annual-density-adjust scalar from `[region+0x2ee]` as `%3.1f%%`, the start/current density pair from `[region+0x25a/+0x25e]`, and the start/current building-count pair from `[region+0x286/+0x296]`. The neighboring constructor also publishes localized id `1114`, whose explanatory text says cities grow from industry profit margins plus modified rail revenue, so this now looks like the main city-region growth analytics page rather than a generic validation helper. Current grounded caller is `0x004d3020`.","objdump + RT3.lng strings + caller inspection + city-region stat correlation + column-field correlation"
0x004d2430,1597,map_editor_cargo_stats_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `Stats - Cargo` editor report. The helper iterates the cargo or building candidate pool at `0x0062b268`, groups entries by category, and emits the report columns from localized ids `1097..1113`, including `Category`, `Raw Producers`, `Factories`, `Total`, and the adjacent supply-demand and weighted-price summary fields. Current grounded caller is the neighboring page constructor at `0x004d3000`.","objdump + RT3.lng strings + caller inspection + cargo-pool correlation"
0x004d3000,32,map_editor_cargo_stats_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Stats - Cargo` page in the map-editor control panel. The helper binds the report callback `0x004d2430` and attaches the resulting page into the broader editor section owner. Current grounded neighboring labels and report fields align this page with the cargo analytics family rather than with general validation.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d3020,32,map_editor_city_region_growth_stats_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Stats - City/Region` page in the map-editor control panel. The helper binds the report callback `0x004d1d60`, and the surrounding page text includes localized id `1114`, whose explanatory note about city growth from industry profit margins and modified rail revenue matches the same report callback. Current grounded evidence therefore treats this as the city-region growth analytics page.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d3060,100,map_editor_tree_stats_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Stats - Trees` page in the map-editor control panel. The helper binds the report callback `0x004d1b80` and attaches it into the broader editor page owner. This corrects the earlier overbroad validation naming: current grounded evidence says this constructor owns the dedicated tree-stats page rather than the whole general-validation lane.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d3080,32,map_editor_general_validation_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `General Validation` page in the map-editor control panel. The helper binds the report callback `0x004d0a90` and sits alongside the neighboring stats and event-report pages in the same page table. Current grounded warning strings and validation checks make this the actual general-validation page rather than the adjacent tree-stats constructor.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d30a0,32,map_editor_city_count_stats_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Stats - City Count` page in the map-editor control panel. The helper binds the report callback `0x004d0420` and sits alongside the other editor report constructors in the active-section page table. Current grounded labels and report fields align it with the city-count and projected-density summary page.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d38c0,1228,map_editor_event_variable_values_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `Event Variable Values` editor tracking report. The helper walks the active scenario issue-state arrays across the game, company, player-profile, and territory slices and emits the visible rows through localized ids `1118..1125`, including `Game : %1`, `Comp. : %1 : %2`, `Player : %1 : %2`, `Terr. : %1 : %2`, and the page title `Event Variable Values`. Current grounded caller is the event-variable page constructor at `0x004d4110`.","objdump + RT3.lng strings + caller inspection + scenario-issue-array correlation"
0x004d3d90,878,map_editor_event_validation_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the editor event-validation report over the live event collection at `0x0062be18`. The helper checks for missing required outcome events and per-event validation failures, then emits the bounded result strings `No Status event.`, `No Lose event.`, `No Win - Gold event.`, `No Win - Silver event.`, `No Win - Bronze event.`, `Error with event %1.`, and `No event errors detected.` from localized ids `1127..1133`. Current grounded caller is the neighboring page constructor at `0x004d4130`.","objdump + RT3.lng strings + caller inspection + event-collection correlation"
0x004d4110,32,map_editor_event_variable_values_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Event Variable Values` tracking page in the map-editor control panel. The helper binds the report callback `0x004d38c0` and sits beside the neighboring event-validation page in the active-section page table.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d4130,32,map_editor_event_validation_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side event-validation page in the map-editor control panel. The helper binds the report callback `0x004d3d90`, which checks for missing status or win-lose events and other per-event errors before formatting the result list.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x00456920,3247,unit_visual_init_weapon_airframe_and_exhaust_effects,bootstrap,thiscall,inferred,ghidra-headless,4,Initializes one armed-unit visual bundle spanning turret and cannon hardware exhaust emitters and aircraft airframe attachments. The routine creates static Turret Mantlet Cannon and MuzzleFlash assets at [this+0x31a] through [this+0x326] direct JetExhaust and PropExhaust sprite emitters at [this+0x2f6] and [this+0x2fa] a cannon-audio attachment at [this+0x32a] indexed WingL and WingR assets plus plane-audio state at [this+0x32e] through [this+0x346] and cached Aileron Elevator Rudder and Thrust vectors at [this+0x2d1] [this+0x2c5] [this+0x2b9] and [this+0x2dd].,ghidra + rizin + llvm-objdump + strings
0x0045a700,240,placed_structure_specialization_accumulate_anim_record_anchor_delta_for_key,map,cdecl,inferred,objdump + local disassembly + field correlation,2,"Small shared helper beneath the specialization `%1_Anim.3dp` transient family. Starting from either the base or alternate basis bands rooted at `0x006acd4c+0x04/+0x34` and `0x006acd4c+0x40/+0x70`, the helper scans every live `0x168`-byte row in the current shared collection `0x006acd50`, filters rows whose key dword matches the supplied id and whose `[row+0x8c]` does not carry bit `0x400`, converts the paired integer triplets through the current basis floats, and accumulates the resulting three-float offset into the caller output vector. Current grounded callers are the heavier shared animation-record service body at `0x0045a9c0`, so this is the safest current read for a keyed anchor-delta accumulator rather than a constructor or renderer.","objdump + local disassembly + field correlation + shared-collection correlation"
0x0045a7f0,453,placed_structure_specialization_replace_anim_record_key_rebind_references_and_activate_selected_effect_slot,map,thiscall,inferred,objdump + local disassembly + global-state correlation,2,"Keyed replace-or-publish helper for the same shared `%1_Anim.3dp` transient family. After validating the caller object through `0x00459c30`, the helper scans the current shared record collection rooted at `0x006acd50/0x006acd4c`, replaces every matching record key dword with the supplied replacement pointer, and also rewrites that same key through the embedded four-lane pointer bands inside each live row while setting row flag bit `0x40` when the top-level record key changes. When the current mode gate in global state `0x006acd48` is negative and the replacement row is not already linked, it inserts that row into the intrusive active list rooted at `0x006acd5c`, stores the caller object at `[row+0x04]`, mirrors the replacement pointer into `[0x006acd48-0x04]`, conditionally dispatches vtable slot `+0x10` on the replacement object, clears byte bit `0x20` when the current shared controller says no emitter owner is active, and if selector table `0x006acd44` is live it allocates one selector-`0` effect slot through `0x00475ed0` before forwarding that slot into `0x00475240(-1,0)`. Current grounded caller is the specialization animation-record build pass at `0x0045b760`, so this is the safest current owner for keyed anim-record replacement plus selected effect-slot activation rather than a generic container insert helper.","objdump + local disassembly + global-state correlation + shared-collection correlation + effect-slot correlation"
0x0045a9c0,1043,placed_structure_specialization_service_shared_anim_record_for_owner_and_publish_two_triplets,map,thiscall,inferred,objdump + local disassembly + global-state correlation,2,"Heavier per-record service body beneath the shared `%1_Anim.3dp` transient family. After validating the caller object through `0x00459c30`, the helper first honors the current controller gates in `0x006acd48/0x006acd58`: when the active selector-owner list `0x006acd44` is live it clears and re-arms flag bit `0x01000000` plus `0x555e50(0)` across those effect slots, and it also mirrors one caller dword into row field `[row+0x80]` when controller bit `0x20` is armed. It then resolves two current world-anchor triplets for the owner through `0x0052e880` and `0x0052e720`, scans every matching row in the current shared collection `0x006acd50/0x006acd4c`, updates each row's timing or countdown fields, derives three local scalar deltas through `0x0045a280`, accumulates those deltas into two caller-facing triplets, optionally subtracts keyed anchor-delta corrections through `0x0045a700`, and finally republishes the finished triplets through `0x0052e8b0` and `0x00530720`. Current grounded caller is the shared 15-tick service loop at `0x0045ade0`, so this is the safest current owner for per-owner anim-record service and triplet republish rather than a constructor or generic transform helper.","objdump + local disassembly + global-state correlation + shared-collection correlation + triplet-publish correlation"
0x0045ade0,158,placed_structure_specialization_service_shared_anim_record_list_in_15_tick_windows,map,cdecl,inferred,objdump + local disassembly + global-state correlation,2,"Shared service loop for the `%1_Anim.3dp` transient list rooted at `0x006acd5c`. On first entry it seeds the current tick cursor `0x006acd60` from `[0x006cec78+0x15]`; thereafter it marks reentrancy latch `0x006acd58 = 1`, advances the cursor in `0x0f`-tick windows until it catches the current world tick, and for every linked record whose owner pointer at `[record+0xf0]` is live it dispatches the heavier per-record service body at `0x0045a9c0(owner, cursor, 0)`. Once the cursor catches the current tick it clears the latch again. Current evidence is strongest for a windowed shared anim-record service loop rather than another global constructor or teardown helper.","objdump + local disassembly + global-state correlation + shared-list correlation"
0x0045ae80,206,placed_structure_specialization_load_shared_anim_payload_root_if_percent1_anim_present,map,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Bootstrap side for the shared `%1_Anim.3dp` payload root used by the specialization animation-record family. The helper formats literal `%1_Anim.3dp`, probes the named-bank owner `0x006d4020` through `0x0053c930`, resolves the matched entry handle through `0x0053b5c0`, queries its payload length through `0x0053c9c0`, reads the raw bytes through `0x0053bd40`, copies them into a fresh heap buffer through `0x0053b7c0`, and lazily allocates the intrusive list root `0x006acd5c` when it does not already exist. On success it returns the loaded payload buffer; otherwise it returns null. Current grounded caller is the specialization build pass at `0x0045b760`, so this is the safest current read for `%1_Anim.3dp` payload-root bootstrap rather than a generic bank read helper.","objdump + local disassembly + literal inspection + named-bank correlation + shared-list correlation"
0x0045af50,232,placed_structure_specialization_bind_shared_anim_row_collection_and_prune_owner_active_records,map,thiscall,inferred,objdump + local disassembly + global-state correlation,2,"Shared collection bind or reset helper for the same `%1_Anim.3dp` transient family. The helper clears globals `0x006acd44/48/54`, publishes the caller row collection into `0x006acd50`, computes the current row-data base into `0x006acd4c`, and scans every row header to mirror the last seen row selector into `0x006acd44` while releasing any oversize selector root through `0x00475100` when the per-row count exceeds `0x0f`. It then walks the intrusive active list rooted at `0x006acd5c`, removes every linked record whose owner pointer at `[record+0xf0]` matches the current collection owner, and frees the list root itself when the list becomes empty. Current grounded callers are the specialization release and rebuild family around `0x0045b160`, so this is the safest current read for shared anim-row collection bind plus owner-prune rather than a generic destructor.","objdump + local disassembly + global-state correlation + shared-list correlation + collection-bind correlation"
0x0045b040,11,placed_structure_specialization_demote_to_base_vtable_and_tail_into_common_cleanup,map,thiscall,inferred,objdump + caller correlation,2,"Tiny specialization-to-base cleanup thunk. The helper overwrites the current vtable with base table `0x005cb4c0` and then tails directly into the common placed-structure cleanup path at `0x00455650`. Current grounded callers are the specialization teardown wrappers at `0x0040c970` and `0x0045b160`, so this is the safest current read for a direct demote-to-base cleanup leaf rather than another constructor or publish helper.","objdump + caller correlation + vtable-demotion correlation"
0x0045b050,86,placed_structure_specialization_reset_payload_and_transient_fields_and_optionally_clear_base_state,map,thiscall,inferred,objdump + local disassembly + field correlation,2,"Small reset helper for the concrete placed-structure specialization. The function clears payload roots `[this+0x23e]` and `[this+0x242]`, transient handles `[this+0x246]`, `[this+0x24a]`, and `[this+0x24e]`, resets `[this+0x262] = -1`, zeroes timer or state fields `[this+0x266]` and `[this+0x26a]`, clears the packed flag band at `[this+0x23a..+0x23d]`, and when the caller argument is nonzero it re-enters the common placed-structure clear path at `0x00455610`. This is the safest current read for specialization field reset plus optional base-state clear rather than another constructor or destructor thunk.","objdump + local disassembly + field correlation + specialization-family correlation"
0x0045b0b0,53,placed_structure_specialization_publish_integer_triplet_to_owner_and_primary_transient_if_live,map,thiscall,inferred,objdump + local disassembly + field correlation,2,"Small publish-side helper in the same concrete placed-structure specialization family. The function forwards one caller-supplied integer triplet plus fixed mode `1` through `0x0052e680` on the specialization owner itself, then repeats the same publish into the primary transient handle `[this+0x246]` when that handle is live. Current evidence is strongest for one integer-triplet publish leaf shared by the owner and its primary transient rather than a builder or teardown helper.","objdump + local disassembly + field correlation + triplet-publish correlation"
0x0045b0f0,23,placed_structure_specialization_forward_packed_rgb_triplet_into_vtable_slot_0x58,map,thiscall,inferred,objdump + local disassembly,2,"Tiny packed-color forwarder in the concrete placed-structure specialization family. The helper splits one caller-supplied packed dword into its low, middle, and high bytes and dispatches those three components through vtable slot `+0x58` on the current object. Current evidence is only strong enough for a packed RGB-triplet forwarder, not a stronger user-facing semantic name.","objdump + local disassembly + packed-byte-split correlation"
0x0045b110,5,placed_structure_specialization_tail_into_shared_world_anchor_triplet_publisher,map,thiscall,inferred,objdump + caller correlation,2,"Tiny tail-call wrapper into `runtime_object_publish_world_anchor_triplet_from_normalized_xy_and_height_bias` `0x00455660`. Current grounded callers are the nearby specialization-side rebuild and refresh branches, so this is safest as a direct wrapper into the shared world-anchor triplet publisher rather than as a distinct geometry owner.","objdump + caller correlation + world-anchor-wrapper correlation"
0x0045b120,64,placed_structure_specialization_publish_small_payload_record_from_arg_string,map,thiscall,inferred,objdump + local disassembly + allocator correlation,2,"Small specialization-side publisher beneath the concrete placed-structure table `0x005c8c50`. The helper allocates a fixed `0x35`-byte record through `0x0053b070`, populates that record from the caller-supplied string plus `this` through `0x00553ac0`, and then forwards the resulting pointer into `0x0052d9a0`; on allocation failure it forwards `null` through that same sink. Current local evidence grounds the fixed-size allocation and the arg-string forwarding, but not the exact semantic role of the published record, so this note stays at the payload-record level.","objdump + local disassembly + allocator correlation + specialization-table correlation"
0x0045b160,176,placed_structure_specialization_release_transient_handles_and_payload_strings,map,thiscall,inferred,objdump + local disassembly + field-release inspection,3,"Release-side cleanup helper in the concrete placed-structure specialization family. The function sets bit `0` in `[this+0x23a]`, clears `[this+0x24a]`, conditionally tears down the transient handles rooted at `[this+0x256]`, `[this+0x25a]`, `[this+0x25e]`, and `[this+0x24e]` through `0x0045af50`, `0x00475100`, and `0x00418d40`, then re-enters vtable slot `+0x78`, the common placed-structure cleanup slice `0x00455d20`, and finally frees the two payload strings rooted at `[this+0x23e]` and `[this+0x242]` through `0x0053aff0`. This is the strongest current owner for releasing the specialization's transient handles and payload strings rather than a base destructor.","objdump + local disassembly + field-release inspection + cleanup-chain correlation"
0x0045b210,352,placed_structure_specialization_build_ambient_transient_from_candidate_payload,map,thiscall,inferred,objdump + local disassembly + string correlation,2,"Transient-build helper beneath the concrete placed-structure specialization table `0x005c8c50`. The function requires a live candidate through vtable slot `+0x80`, formats one payload string around the literal `amb_%1_01.wav` through `0x00518de0`, allocates a `0x141`-byte transient object through `0x0053b070`, initializes that object through `0x00554830`, `0x00554340`, and `0x00554450`, stores the result at `[this+0x24a]`, and registers it through `0x0052da00`. The `amb_%1_01.wav` literal grounds this as one ambient-side transient builder, but not the exact user-facing subtype name of the owning specialization.","objdump + local disassembly + string correlation + transient-build correlation"
0x0045b5f0,123,placed_structure_specialization_refresh_ambient_transient_from_current_world_position,map,thiscall,inferred,objdump + local disassembly + world-position correlation,2,"Ambient-transient refresh helper for the same concrete placed-structure specialization. The function resolves the current local position through `0x0052e720`, converts that position through the world or view helpers `0x0051f090` and `0x00534490`, then forwards the derived scalar plus one caller-supplied argument into `placed_structure_specialization_build_ambient_transient_from_candidate_payload` `0x0045b210`. When the resulting ambient transient at `[this+0x24a]` is live it immediately re-enters `0x005543f0(0)`. Current evidence grounds this as a refresh of the ambient-side transient from current world position rather than the primary transient-handle builder.","objdump + local disassembly + world-position correlation + ambient-transient correlation"
0x0045b6f0,694,placed_structure_specialization_rebuild_named_variant_descriptors_and_effect_handles,map,thiscall,inferred,objdump + local disassembly + string-table correlation,2,"Large subtype-specific rebuild helper beneath the concrete placed-structure specialization table `0x005c8c50`. The function first clears the optional handles at `[this+0x25a]` and `[this+0x25e]`, then builds and probes multiple named variant families rooted in `[this+0x23e]` through format strings such as `%1_`, `%1_Upgrade1`, `%1_Anim%2.3dp`, `%1_Upgrade1Anim%2.3dp`, and `%1_Upgrade1Light%2.3dp`. It loops over numbered variants `1..0xfe`, probes resource existence through `0x0053c930`, materializes follow-on records through `0x00530640`, publishes them through `0x0052d8a0`, and couples the ambient-side refresh path through `placed_structure_specialization_refresh_ambient_transient_from_current_world_position` `0x0045b5f0` plus the ambient builder `0x0045b210`. The exact subtype semantics remain open, but this is now the strongest current owner for rebuilding the specialization's named animation, light, and sibling effect descriptors rather than a generic serializer-side helper.","objdump + local disassembly + string-table correlation + descriptor-rebuild correlation"
0x0045b760,583,placed_structure_specialization_build_base_or_upgrade_variant_descriptors_emitters_and_anim_records,map,thiscall,inferred,objdump + local disassembly + literal inspection,2,"Broader specialization-side builder beneath the same `0x005c8c50` family. The helper first scans one base-or-upgrade descriptor family rooted in `[this+0x23e]` through `%1_` or `%1_Upgrade1`, probing each numbered variant through `0x0053c930` and dispatching every accepted hit through vtable slot `+0x7c`. It then builds the matching attached-emitter list through `placed_structure_build_attached_emitter_variant_list_by_owner_stem` `0x0045e940`, ensures transient root `[this+0x256]` exists through `0x0045ae80`, and finally scans one animation family through `%1_Anim%2.3dp` or `%1_Upgrade1Anim%2.3dp`, materializing each accepted hit into a `0x206` record through `0x00530640`, publishing that record through `0x0052d8a0`, hashing the generated name through `0x0053d810`, and forwarding the result into `[this+0x256]` through `0x0045a7f0`. Current evidence is strongest for a base-or-upgrade descriptor, emitter, and animation-record build pass rather than a serializer or teardown helper.","objdump + local disassembly + literal inspection + specialization-family correlation + transient-record correlation"
0x0045baf0,850,placed_structure_specialization_service_timed_anim_light_and_random_sound_variants,map,thiscall,inferred,objdump + local disassembly + string-table correlation + timer-field inspection,2,"Timed service or emission helper for the same concrete placed-structure specialization. The function updates the two timer-like fields `[this+0x26a]` and `[this+0x266]`, derives local world-grid and distance terms from `[this+0x1e2/+0x1e6/+0x1ea]`, gates on candidate availability through vtable slot `+0x80` and the nearby candidate-side workers `0x00411e10/0x00411e50`, and when the local timing and distance checks pass it formats one output around the literal `rnd_%1_%2.wav` together with the neighboring anim or light string family `%1_Anim%2.3dp`, `%1_Upgrade1Anim%2.3dp`, and `%1_Upgrade1Light%2.3dp`. The final dispatch goes through `0x00531e50` under owner `0x006d402c`. Current evidence is strongest for a timed anim, light, or random-sound variant service lane rather than another payload loader or steady-state scalar updater.","objdump + local disassembly + string-table correlation + timer-field inspection + random-sound correlation"
0x0045be50,768,placed_structure_specialization_service_runtime_scalar_and_transient_state,map,thiscall,inferred,objdump + local disassembly + field correlation,2,"Recurring runtime-service helper for the same concrete placed-structure specialization. The function consults transient handle `[this+0x256]`, site-side link `[this+0x75]`, scenario globals under `0x006cec78`, and the iterator pair `0x00556ef0/0x00556f00`; it then updates the derived scalar triplet `[this+0x22e]`, `[this+0x232]`, and `[this+0x236]`, republishes that triplet through `0x00530720`, and re-enters `0x0052e8e0` for the final side-effect. The exact high-level behavior remains open, but the field ownership is strong enough to ground this as the runtime scalar and transient-state service slice for the specialization rather than another serializer or constructor.","objdump + local disassembly + field correlation + service-loop correlation"
0x0045c150,448,placed_structure_specialization_load_payload_and_rebuild_transients,map,thiscall,inferred,objdump + local disassembly + serializer-tag correlation,3,"Primary payload-loader counterpart to `0x0045b560` in the concrete placed-structure specialization family. The helper reseeds the derived field band `[this+0x23a..+0x26a]`, re-enters the common placed-structure initializers `0x00455610` and `0x00455fc0`, opens the derived payload bracket tagged `0x5dc1`, reads two string-like payload fields through `0x00531380`, copies them into `[this+0x23e]` and `[this+0x242]` via `0x0051d820`, clears the transient handle roots `[this+0x24e]`, `[this+0x256]`, `[this+0x25a]`, and `[this+0x25e]`, rebuilds follow-on specialization state through `0x0045b5f0` and `0x0045b6f0`, conditionally dispatches vtable slot `+0x74`, reads back `[this+0x24e]` and `[this+0x252]`, and finally closes the bracket tagged `0x5dc2`. This is now the strongest current owner for specialization payload load plus transient rebuild rather than a generic stem-refresh helper.","objdump + local disassembly + serializer-tag correlation + transient-rebuild correlation"
0x0045c310,176,placed_structure_specialization_build_primary_transient_handle_from_payload_strings,map,thiscall,inferred,objdump + local disassembly + field correlation,2,"Specialization-side transient builder rooted in payload strings `[this+0x23e]` and `[this+0x242]`. The helper formats one payload around the literal family at `0x005cb5d4`, allocates a `0x23a`-byte object through `0x0053b070`, initializes it through `0x00456100`, stores the handle at `[this+0x246]`, registers it through `0x00530720`, re-enters `0x0045b6f0(1)`, forwards the handle into `0x0052d8a0`, and when the current placed structure is active through `0x004557f0` it also dispatches vtable slot `+0x5c`. This is the strongest current owner for the primary specialization transient-handle build path rather than the ambient-side `[this+0x24a]` builder.","objdump + local disassembly + field correlation + transient-build correlation"
0x0045c3c0,160,placed_structure_specialization_release_primary_transient_handle_and_siblings,map,thiscall,inferred,objdump + local disassembly + field-release inspection,2,"Release-side companion to `0x0045c310`. When `[this+0x246]` is live the helper re-enters `0x00455d20`, iterates the linked transient family through `0x00556ef0/0x00556f00`, destroys every sibling object except the current `[this+0x246]` through `0x00530680` and `0x0053b080`, conditionally re-enters `0x0045b6f0(0)` when bit `0` in `[this+0x23a]` is clear, then destroys `[this+0x246]` through `0x00455650`, frees it, clears the field, and tails into `0x005570b0`. Current evidence grounds this as the primary transient-handle release path for the specialization rather than another base cleanup thunk.","objdump + local disassembly + field-release inspection + transient-release correlation"
0x0045cc90,677,train_visual_toggle_three_selector_effect_slots_and_reseed_shared_anchors,map,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Paired build-or-release owner for three selector-driven effect slots stored at `[table+0x34]`, `[table+0x38]`, and `[table+0x3c]` inside the train visual row table rooted at `[this+0x316]`. In build mode `arg0 == 1`, the helper derives one mode scale from current local geometry, allocates selector `1`, `2`, and `3` bundles through `0x00475ed0`, writes those handles into the three table fields, reseeds their shared anchors through `0x00475010/0x00475030`, and then enables every live attached emitter in the main row-object list by writing byte `1` into `[emitter+0x1d8]`. In release mode it tears those same three slot handles down through `0x00475100`, clears the table fields, and disables the same emitter list by writing byte `0` into `[emitter+0x1d8]`. Current grounded callers include the train visual-family teardown `0x0045e3d6` and later world-side service branches `0x004ad841` and `0x004b1944`, so this is best read as the shared three-slot train-effect toggle rather than a generic emitter helper.","objdump + local disassembly + caller inspection + train-visual correlation + effect-slot correlation"
0x0045cf40,224,train_visual_toggle_selector5_effect_slot_and_row_emitter_enable_state,map,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Sibling build-or-release owner for the selector-`5` effect slot stored at `[table+0x40]` inside the same train visual row table rooted at `[this+0x316]`. In build mode `arg0 == 1`, the helper derives one mode scale from current local geometry, allocates selector `5` through `0x00475ed0`, stores that handle into `[table+0x40]`, and then enables every live emitter in the main row-object list by writing byte `1` into `[emitter+0x1d8]`. In release mode it tears that one slot down through `0x00475100`, clears `[table+0x40]`, and disables the same emitter list by writing byte `0` into `[emitter+0x1d8]`. Current grounded callers include the train visual-family teardown `0x0045e3de` and later world-side service branches `0x004ab942`, `0x004adaa1`, and `0x004b18d6`, so this is best read as the selector-`5` sibling toggle for the train visual family rather than another generic emitter-slot wrapper.","objdump + local disassembly + caller inspection + train-visual correlation + effect-slot correlation"
0x0045d130,176,train_effect_attach_named_handle_by_owner_profile_and_register,map,thiscall,inferred,objdump + local disassembly + literal inspection + caller inspection,2,"Builds and registers one named train-effect handle beneath the adjacent train-side transient family. The helper first resolves one owner-side profile through the collection at `0x006ada84`, allocates a `0x141`-byte object through `0x0053b070`, and initializes it through `0x00554830` using one mode-selected stem from the small selector at `0x0045d22e`, the caller's owner and anchor parameters, and one fixed mode byte `1`. It then writes two fixed float-like parameters through `0x00554340` and `0x00554450`, stores the live handle at `[this+0x336]`, and finally forwards that handle into `0x0052da00`. Current grounded caller is the broader train-side effect builder at `0x0045e375`, so this is best read as the shared attach-and-register builder for one named train effect handle rather than a generic pool allocation stub.","objdump + local disassembly + literal inspection + caller inspection + train-effect correlation"
0x0045d260,120,train_effect_update_live_handle_rate_distance_and_optional_mode,map,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Updates one previously attached train-effect handle stored at `[this+0x336]`. When that handle is live, the helper queries one current scalar through `0x00554230`, multiplies it by the caller float, clamps the result into `0x1f40..0xac44`, writes the clamped value through `0x005542c0`, pushes the caller gain through `0x00554450`, and when the live handle mode at `[handle+0x138]` equals `1` also forwards zero through `0x005543f0`. Current grounded caller is the later world-side service path at `0x004a8cf9`, so the safest current read is a live train-effect parameter updater rather than a constructor.","objdump + local disassembly + caller inspection + handle-parameter correlation"
0x0045d2e0,451,train_effect_refresh_breakdown_or_burning_sound_handle,map,thiscall,inferred,objdump + local disassembly + literal inspection + caller inspection,2,"Owns the sound-side branch above the adjacent train-effect handle helpers. The function first republishes the current world anchor triplet through `0x0052e720`; when an attached sound handle already exists at `[this+0x346]` it updates that live handle's anchor fields `[+0x10/+0x14/+0x18]` through `0x00531ef0` and marks flag bit `0x02`. Otherwise it selects one sound stem according to the current train-state latches `[this+0x33a/+0x33e/+0x342]`: fixed `Train_Burning.wav`, fixed `Train_Breakdown_loop.wav`, or one dynamic stem from the table at `0x005f3a84` after the `0x0041b8f0 -> 0x004a8840` branch. It then creates a fresh sound handle through `0x00531e50`, stores it into `[this+0x346]`, sets fixed flag bits `0x18`, seeds two scale fields from the chosen mode factor through constants at `0x005c8c48` and `0x005cb698`, and finally clears the three state latches again. Current grounded caller is the train-side world service branch at `0x004acf5d`, so this is best read as the breakdown-or-burning train sound-handle refresh owner rather than another generic transient setter.","objdump + local disassembly + literal inspection + caller inspection + train-effect correlation + sound-handle correlation"
0x0045d4b0,1684,train_visual_preload_variant_tables_and_service_point_body_handles,map,thiscall,inferred,objdump + local disassembly + literal inspection + caller inspection,2,"Large train-side preload owner above the adjacent sound and handle helpers. The function optionally clears prior state through `0x00455610`, copies the caller primary and secondary stems into `[this+0x32e]` and `[this+0x332]`, probes the named-bank owner `0x006d4020` for the secondary stem, then falls back through the primary stem and the suffixed `_C.tga` form at `0x005cb7e8`. It resolves one `ServicePoint.3dp` payload into `[this+0x23e/+0x23a]`, one `Body.3dp` payload into `[this+0x242/+0x246]`, counts existing `%1_Truck%2.3dp` variants into `[this+0x31a]`, allocates the larger per-variant table at `[this+0x316]`, and then enters the later subloops that populate the cargo-icon, bogie, drivewheel, piston, connecting-rod, coupling-bar, body, and track-point bands. Current grounded callers are the train-side setup or refresh branches at `0x0041ce2f`, `0x0042acc6`, and `0x0045e653`, so this is best read as the train visual variant-table and service-point or body preload owner rather than a small local helper.","objdump + local disassembly + literal inspection + caller inspection + train-visual correlation + variant-table correlation"
0x0045e390,415,train_visual_release_sound_handle_variant_table_and_payload_strings,map,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Release-side owner for the same train visual family. The helper drops the optional sound handle `[this+0x346]` through `0x00531ef0` plus the mode-gated `0x005317b0` path, clears the live train-effect handle root `[this+0x336]` by re-entering `0x0045cc90(0)` and `0x0045cf40(0)`, iterates the variant table at `[this+0x316]` to free per-row pointer arrays, the two per-row heap buffers at offsets `+0x98/+0x9c`, and any nested owned list rooted at `[row+0x0c]->[+0x75]`, then frees the main table itself and finally releases the two payload strings at `[this+0x32e]` and `[this+0x332]`. Current grounded caller is the train-side teardown branch at `0x0042ac49`, so this is best read as the train visual-family release owner rather than another generic destructor.","objdump + local disassembly + caller inspection + train-visual correlation + teardown correlation"
0x0045e530,855,train_visual_load_payload_rebuild_variant_table_and_optional_child_records,map,thiscall,inferred,objdump + local disassembly + serializer-tag correlation + local disassembly,2,"Load-side owner for the same train visual family. The helper clears the current table and string roots, opens bundle tags `0x61a9` and `0x61aa` through `0x00531360`, reads two variable-length heap strings through `0x00531380`, optionally rewrites the first caller string by scanning the live collection at `[0x006d4020+0x429b8]`, then rebuilds the train visual family through `train_visual_preload_variant_tables_and_service_point_body_handles` `0x0045d4b0` with unit scale `1.0f`. After that it republishes the early per-row handles through `0x005548d0`, frees the temporary heap strings, and when scenario latch `[0x006cec78+0x46c34] > 0x2585` is true it enters the optional child-record branch under tag `0x61b2`, dispatching vtable slot `+0x48` across the rebuilt row collection before closing tag `0x61ab`. This is the clearest current load-side owner for the train visual payload plus optional child-record branch rather than another small table helper.","objdump + local disassembly + serializer-tag correlation + train-visual correlation + load-branch correlation"
0x0045e8c0,124,train_visual_service_row_object_strip_and_optionally_refresh_selected_entry,map,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small service helper over the fixed 32-entry row-object strip rooted at `[this+0x277]`. The function first walks all 32 slots and, for every live row object pointer, dispatches vtable slot `+0x10`. When the caller passes a valid row index instead of `-1`, it then resolves that selected row again, dispatches vtable slot `+0x0c`, and when the paired per-row flag byte in the neighboring strip is nonzero it also pushes `0,0,1.0f,1.0f` through `0x0052eab0` on that selected row object. Current grounded callers are the two train-side update branches at `0x0041c680` and `0x0041c69a`, which derive the selected index from byte `[cargo+0x20]`, so this is best read as the row-object service plus optional selected-entry refresh helper rather than a generic list walk.","objdump + local disassembly + caller inspection + train-visual correlation + row-object-strip correlation"
0x004614d0,40,runtime_object_vtable_wrapper_query_local_companion_float_relief_score_at_rounded_coords,map,thiscall,inferred,objdump + local disassembly + wrapper correlation,2,"Tiny virtual-style wrapper over `world_query_local_companion_float_relief_score_at_cell_with_distance_and_mode_bias` `0x0044afa0`. It rounds the current object's normalized secondary and primary coordinates through `0x00455810`, `0x00455800`, and `0x005a10d0`, then forwards the resulting cell pair plus world root `0x0062c120` into `0x0044afa0`. Current evidence grounds it only as the table-local wrapper over the heavier world-scalar query, not the owning subtype name.","objdump + local disassembly + wrapper correlation + world-scalar-query correlation"
0x00461500,39,runtime_object_query_flag_byte_0x42_with_class0_true_fallback_when_mode_gate_inactive,map,thiscall,inferred,objdump + local disassembly + mode-gate correlation,2,"Small mode-gated flag query on the same virtual-family boundary as `0x004614d0`. The helper first checks shell mode gate `0x004338c0` on scenario root `0x006cec78`; when that gate is active it returns byte `[this+0x42]` directly. When the gate is inactive it returns literal `1` only for class-0 records with `[this+0x23e] == 0`, and otherwise falls back to the same byte `[this+0x42]`. Current evidence is strong enough only for that structural fallback rule, not for a tighter semantic name for the flag or owning subtype.","objdump + local disassembly + mode-gate correlation + field inspection"
0x00461580,202,geographic_label_database_refresh_records_from_tagged_bundle,map,thiscall,inferred,objdump + caller inspection + local disassembly + collection-correlation + load-order correlation,4,"Collection-wide tagged load owner for the geographic-label database rooted at `0x006ada80`. The helper opens chunk `0x5209`, refreshes collection-side metadata through `indexed_collection_refresh_header_and_live_id_band` `0x00518680`, opens chunk `0x520a`, then walks every live record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` before dispatching each resolved record through vtable slot `+0x40` with the caller-supplied bundle or stream context. It closes with chunk `0x520b` and returns the accumulated tagged-load byte count. Current grounded caller is the world-entry bringup branch at `0x00444812`, where it runs directly on `0x006ada80` beside neighboring tagged collection families, so this is the safest current read for the geographic-label tagged load owner.","objdump + caller inspection + local disassembly + collection-correlation + load-order correlation + geographic-label correlation"
0x00461650,120,geographic_label_database_serialize_records_into_tagged_bundle,map,thiscall,inferred,objdump + caller inspection + local disassembly + collection-correlation + save-order correlation,4,"Collection-wide tagged save owner for the geographic-label database rooted at `0x006ada80`. The helper writes the collection bracket `0x5209/0x520a/0x520b` through `0x00531340`, serializes collection-side metadata through `0x00517d90`, then walks every live record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` before dispatching each entry's save-side virtual slot `+0x44` with the caller bundle. Current grounded caller is the early package-save prelude `map_bundle_open_reference_package_and_serialize_early_world_datasets` `0x00444dd0`, so this is the current safest read for the geographic-label tagged save owner.","objdump + caller inspection + local disassembly + collection-correlation + save-order correlation + geographic-label correlation"
0x00461f10,1552,locomotive_collection_stream_load_records_link_era_labels_and_refresh_runtime_availability,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + tagged-import correlation,4,"Broader tagged import owner for the live locomotive collection rooted at `0x006ada84`, reached directly from constructor `0x00462520`. The helper runs two outer passes over the repeated tagged source opened through callback trio `0x005c8190/0x005c8194/0x005c819c` around the fixed stem `0x005ce0ec`, validates the imported field set against the built-in tag strings `0x005ce0e4..0x005ce07c`, and when the record layout passes materializes one parsed stack image before dispatching collection vtable slot `+0x04` to allocate or insert one live `0xad`-byte locomotive record. The parsed live record keeps its fixed scalar and string bands in-place, resolves one linked era record through the live era collection `0x0062ba88`, folds that era record's float lane `[era+0xfd]` into two imported scalar lanes, copies the matched era name at `[era+0x82]` into the temporary locomotive label band, and formats the two player-facing text rows through string ids `0x1b3` and `0x1b4` before copying those labels into `[loco+0x08]` and its paired display band. The live record also stores its own id into `[loco+0x4f]`, and when the current scenario or shell mode allows it the helper tails into `locomotive_collection_refresh_runtime_availability_overrides_and_usage_state` `0x00461e00` after the import sweep completes. Current grounded caller is `locomotive_collection_construct_and_stream_load_records` `0x00462520`. Current package-save inspection still finds no mirrored early world-bundle serializer for `0x006ada84`; the neighboring package path persists only the named locomotive-availability mirror at `[world+0x66b6]`, so the safest current read remains a load-side content family rather than a bundle-saved runtime collection.","objdump + local disassembly + caller correlation + tagged-import correlation + era-link correlation + label-build correlation + runtime-refresh correlation + package-save-order correlation"
0x00462520,49,locomotive_collection_construct_and_stream_load_records,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + constructor correlation,3,"Constructor-side world-load owner for the live locomotive collection rooted at `0x006ada84`. The helper runs the shared indexed-collection base initializer `0x00517ce0`, installs vtable `0x005ce068`, seeds the collection through `0x00518570` with literal tuple `(1, 0xad, 0x0a, 5, 1, 0, 0)`, and then immediately re-enters `locomotive_collection_stream_load_records_link_era_labels_and_refresh_runtime_availability` `0x00461f10`. Current grounded caller is the world-entry load branch at `0x00438d29`, which stores the finished object into global `0x006ada84`. Current package-save inspection still finds no early world-bundle serializer for this live locomotive root, so the strongest current boundary is a world-load content family whose player-facing availability state is mirrored separately through the named collection at `[world+0x66b6]` rather than a package-saved runtime collection.","objdump + local disassembly + caller correlation + constructor correlation + world-load correlation + package-save-order correlation"
0x00461c00,126,locomotive_collection_resolve_entry_by_primary_or_alias_stem,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared string resolver over the live locomotive collection at `0x006ada84`. The helper walks every live locomotive row, first compares the caller text against the primary stem at `[entry+0x34]`, then against the alias or secondary stem at `[entry+0x53]`, and returns the first matching live row pointer through the collection accessors `0x00518380/0x00518140`. Failure returns null. Current grounded caller is the cheat-code owner `0x00437d70`, where selector `4` resolves stems like the hidden locomotive cheat aliases before applying them to every train owned by the selected company through `0x004aefb0`. This is therefore the safest current read for the primary-or-alias locomotive stem resolver rather than a more specific dialog helper.","objdump + local disassembly + caller inspection + locomotive-stem correlation + cheat-branch correlation"
0x00461c80,30,locomotive_entry_query_linked_era_name_ptr,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small accessor over one live locomotive entry. The helper resolves linked era id `[loco+0x72]` through the era collection at `0x0062ba88` and, on success, returns the raw era-name pointer at `[era+0x45]`; missing era ids return null. Current grounded callers are the locomotives-availability and recipe-side editor families around `0x004cd641`, `0x004cdaf2`, `0x004cf16c`, `0x004cf1f2`, `0x004cf2ed`, `0x004cf3f0`, the world-entry rehydrate lane at `0x004478de`, and the smaller shell-side branch at `0x00438d5f`, so this is the safest current read for the linked-era name-pointer accessor rather than a display-only helper.","objdump + local disassembly + caller inspection + era-collection correlation + locomotive-editor correlation"
0x00461ca0,35,locomotive_entry_format_linked_era_name_or_null,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Formatting companion to `locomotive_entry_query_linked_era_name_ptr` `0x00461c80`. The helper resolves linked era id `[loco+0x72]` through the same era collection at `0x0062ba88` and, on success, forwards the era-name pointer `[era+0x45]` into `0x0051c920`; missing era ids return null. Current grounded callers are the train-upgrade news formatter `0x00409300` and the neighboring company-side upgrade branch at `0x00409903`, where it supplies the old and new locomotive-era display names embedded in localized news id `2897`.","objdump + local disassembly + caller inspection + era-name formatting correlation + train-upgrade-news correlation"
0x00461cd0,298,locomotive_collection_select_best_era_matched_non_electric_fallback_id,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + engine-type correlation,2,"Fallback locomotive chooser beneath `company_select_preferred_available_locomotive_id` `0x004078a0`. The helper walks the live locomotive collection, explicitly skips records whose engine-type dword `[record+0x10]` is `2`, and then scores the remaining records from the linked era record at `[record+0x72]`: the current grounded score uses the absolute distance from the current scenario year to the era start field `[era+0x105]`, adds `500` when the era has not started yet, adds `50` when the current year has passed the era-end field `[era+0x109]`, and adds `2000` when the linked approval helper `0x0041d550` rejects the era or engine family for the current context. The lowest-penalty locomotive id wins, so the current best read is an era-matched non-electric fallback rather than a general preferred-locomotive chooser. Current grounded caller is `company_select_preferred_available_locomotive_id` `0x004078a0`.","objdump + caller xrefs + callsite inspection + engine-type correlation + fallback-choice correlation"
0x00461e00,262,locomotive_collection_refresh_runtime_availability_overrides_and_usage_state,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Collection-wide runtime refresh over the live locomotive pool at `0x006ada84`. The helper guards itself with reentrancy latch `0x006ada88`, walks every live locomotive record, resolves the linked era record through `[loco+0x72]`, and combines the locomotive-side requirement bytes `[loco+0x30/+0x31/+0x32]` with the active scenario-state availability toggles at `[0x006cec78+0x4c97..+0x4c99]`. When the current locomotive or its linked era passes those gates it upserts one boolean availability override through `scenario_state_upsert_named_locomotive_availability_record_and_refresh_runtime_usage` `0x004350b0`; it then immediately queries the resulting named override through `scenario_state_query_named_locomotive_availability_record_value` `0x00435030` and stores that value into `[loco+0x7b]`. When the collection sweep finishes it tails into `0x00436af0` to rebuild the dependent locomotive-side scalar band. Current grounded callers are the world-entry rehydrate tail inside `world_entry_transition_and_runtime_bringup` `0x00443a50` and the startup or restore-side upsert family that also re-enters this helper through `0x004350b0`, so this is the safest current read for the collection-wide locomotive runtime-availability refresh rather than a single dialog-owned toggle helper.","objdump + caller xrefs + local disassembly + locomotive-availability correlation + scenario-state override correlation + reentrancy-latch correlation"
0x00464410,12679,shell_dispatch_ui_command,shell,cdecl,inferred,ghidra-headless + objdump + local disassembly,4,"Large shell UI command dispatcher reached from shell-side event callbacks and direct command pushes. The currently grounded write-side branches are tighter now too: command ids `0x7530..0x7532` drive the graphics-preset family through `0x0051ebc0`, `0x00484590`, and `0x004853c0`; command ids `0x7540..0x7543` drive the scenario-text/report build side through `0x00489830`, `0x004886e0`, and `0x00489a20`; and command ids `0x9d26..0x9d28` store `command_id - 0x9d26` directly into shell dword `[0x006cec74+0x178]`, yielding the live values `0`, `1`, and `2` later consumed by the selected-year adjustment and setup fast-forward gate under `0x00436d10`, `0x004384d0`, and `0x00437b20`. The surrounding body also toggles several adjacent shell settings such as `[shell+0x16c]`, `[shell+0x174]`, and `[shell+0x110]`, plus the later report-side command families, so the safest current read remains the broad shell UI command owner rather than a narrower setup-only helper.","ghidra + rizin + llvm-objdump + strings + objdump + local disassembly + selected-year-gate correlation"
0x00464c80,10528,shell_settings_window_handle_message_dispatch_and_persist_display_runtime_sidecar_family,shell,cdecl,inferred,objdump + local disassembly + settings-window family correlation + load-save sidecar correlation,4,"Broad `SettingsWindow.win` message/control dispatcher in the shell-side settings family. At entry it refreshes the stored sound-backend index at `[0x006d4024+0x114706]` from `0x00531640`, then switches over a large control-id range and mutates many shell/world-side settings before the common tail persists config through `shell_save_graphics_config` `0x00484910(1)` and re-enters the shared shell follow-on `0x004625b0(1, ...)`. The load/save-facing sidecar seam is explicit here now too: controls `0xe101/0xe102/0xe103/0xe104` directly toggle the four shell dwords `[0x006d4024+0x11471a/+0x11471e/+0x11472a/+0x11472e]` whose current values are later copied into setup-preview payload bytes `+0x09/+0x0a` and save-side selector dword `0x0062bec4` by `shell_export_live_setup_preview_payload_record_and_normalize_pixel_block_0x100x0x100` `0x00442ba0` and `shell_map_file_world_bundle_coordinator` `0x00445de0`. The implication rules are grounded too: disabling `0x11471e` clears `0x11472a`, while enabling either `0x11472a` or `0x11472e` forces `0x11471e = 1`. The broader dispatcher also toggles several adjacent display/runtime and world-side settings, but the strongest current read is the common settings-window owner above that sidecar family rather than another narrow toggle leaf.","objdump + local disassembly + settings-window family correlation + load-save sidecar correlation + common-tail correlation"
0x00474030,167,city_database_entry_build_mode_selected_anchor_helper_from_triplet,map,cdecl,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Small helper-object builder beneath the current city-database entry family. The function switches over caller-supplied mode enum `0..10`, maps those cases into `0x00475ed0` with selector families `4`, `0xd`, or `0xe` plus fixed scalar constants `0.5`, `0.75`, `1.0`, `1.5`, or `2.0`, and when helper allocation succeeds it publishes the caller-supplied world triplet through the helper-owned pointer at `[helper+0x4]` via `0x00530720`. Current grounded callers are `0x004741ac` during constructor-side setup and `0x004742bd` during refresh, so this is now the strongest current read for the mode-selected anchor-helper builder rather than a generic effect allocator.","objdump + caller xrefs + local disassembly + city-database family correlation + helper-builder correlation"
0x00474110,32,city_database_entry_initialize_stack_temporary_entry,map,thiscall,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Tiny temporary-entry initializer in the city-database entry family. The helper re-enters shared base initializer `0x00455b20`, clears helper fields `[this+0x23a]` and `[this+0x242]`, installs vtable `0x005ce428`, and returns `this`. Current grounded callers are the stack-local temporary-entry paths at `0x004744ae` and `0x004745ae`.","objdump + caller xrefs + local disassembly + city-database family correlation + temp-entry correlation"
0x00474130,195,city_database_entry_construct_from_id_coords_mode_and_default_triplet,map,thiscall,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Primary constructor beneath the current city-database entry family. The helper stores the caller-supplied entry id into `[this+0x23e]`, clears the trailing helper payload block at `[this+0x246..+0x24e]`, stores the caller-supplied mode into `[this+0x242]`, derives one world-height scalar from the supplied coordinate pair through `0x00448bd0`, builds helper field `[this+0x23a]` through `city_database_entry_build_mode_selected_anchor_helper_from_triplet` `0x00474030`, and then seeds the remaining default scalar or flag tuple through `0x00455b70` using the fixed default bundle at `0x005ce49c/0x005ce4a0/0x005ce4a4`. Current grounded caller is the live-entry allocator `0x004744ed`.","objdump + caller xrefs + local disassembly + city-database family correlation + constructor correlation"
0x00474260,111,city_database_entry_reload_payload_and_refresh_mode_selected_anchor_helper,map,thiscall,inferred,objdump + caller inspection + local disassembly + city-database family correlation,2,"Refresh-side helper in the current city-database entry family. The function first re-enters `0x00455fc0` on the caller-supplied payload stream, then samples the entry's normalized secondary and primary coordinates through `0x00455810` and `0x00455800`, derives one world-height scalar through the world helper `0x00448bd0`, rebuilds helper field `[this+0x23a]` through `city_database_entry_build_mode_selected_anchor_helper_from_triplet` `0x00474030` using mode `[this+0x242]`, and returns the status from the earlier `0x00455fc0` reload. Current evidence is strongest for a payload reload plus mode-selected anchor-helper refresh rather than a generic constructor.","objdump + caller inspection + local disassembly + city-database family correlation + helper-refresh correlation"
0x004743d0,42,city_database_entry_release_mode_selected_anchor_helper_and_base_payload,map,thiscall,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Release-side helper in the current city-database entry family. The function destroys helper field `[this+0x23a]` through `0x00475100` when live, clears that field, restores the base vtable tag at `[this] = 0x005ce428`, and then tails into base cleanup `0x00455650`. Current grounded callers are the temporary-entry teardown inside `0x004744f6` and the collection load loop at `0x004745d0`, so this is the safest current read for releasing the mode-selected anchor helper plus base payload state.","objdump + caller xrefs + local disassembly + city-database family correlation + release-path correlation"
0x00474400,36,city_database_entry_release_mode_selected_anchor_helper_and_dynamic_payload,map,thiscall,inferred,objdump + caller xrefs + local disassembly + city-database family correlation,2,"Sibling release helper beside `0x004743d0`. It destroys helper field `[this+0x23a]` through `0x00475100` when live, clears the field, and then tails into `0x00455d20` rather than the smaller base cleanup at `0x00455650`. Current grounded caller is the collection removal path at `0x00474520`, so the safest current read is a release helper for mode-selected anchor helper plus the heavier dynamic-payload branch.","objdump + caller xrefs + local disassembly + city-database family correlation + removal-path correlation"
0x00474430,29,city_database_entry_query_mode_gate_or_runtime_flag_byte_0x42,map,thiscall,inferred,objdump + local disassembly + city-database family correlation,1,"Small city-database-entry-family predicate over byte `[this+0x42]`. When shell mode gate `0x004338c0` is inactive it returns literal `1`; otherwise it returns the current entry byte `[this+0x42]`. The row is therefore kept at that mode-gated runtime-flag-query level.","objdump + local disassembly + city-database family correlation + mode-gate correlation"
0x00474450,39,city_database_entry_collection_construct_with_fixed_capacity_0x14,map,thiscall,inferred,objdump + caller xrefs + local disassembly + collection-layout correlation,2,"Constructor for the current city-database entry collection rooted at vtable `0x005ce4a8`. The helper resets collection state through `0x00517ce0`, installs vtable `0x005ce4a8`, and then initializes the collection through `0x00518570` with the fixed parameter tuple `(0, 0, 0, 0x14, 0x0a, 0, 0)`. Current grounded caller is the global collection bootstrap at `0x004487a9`, which stores the resulting pointer into `0x006cea50`.","objdump + caller xrefs + local disassembly + collection-layout correlation + bootstrap correlation"
0x00474480,18,city_database_entry_collection_release_and_free,map,thiscall,inferred,objdump + caller xrefs + local disassembly + collection-layout correlation,1,"Small destructor-side wrapper for the current city-database entry collection. The helper installs collection vtable `0x005ce4a8`, re-enters `0x00518600`, and then tails into `0x00518bd0`. Current grounded caller is the global teardown path at `0x004492c3`, which frees the collection rooted at `0x006cea50`.","objdump + caller xrefs + local disassembly + collection-layout correlation + teardown correlation"
0x004744a0,101,city_database_entry_collection_allocate_and_construct_entry,map,thiscall,inferred,objdump + local disassembly + caller xrefs + collection-layout correlation,2,"Shared allocator and constructor beneath the city-database entry collection. The helper initializes one stack-local temporary entry through `0x00474110`, allocates a `0x250`-byte live record through `0x00518900`, resolves that record through `0x00518140`, then constructs it through `0x00474130` with the caller-supplied entry id plus three caller arguments, and finally tears down the temporary entry through `0x004743d0`. Current grounded caller is the collection load or clone lane at `0x004744ed`.","objdump + local disassembly + caller xrefs + collection-layout correlation + temp-entry correlation"
0x00474510,32,city_database_entry_collection_remove_entry_by_id_and_release,map,thiscall,inferred,objdump + local disassembly + collection-layout correlation,2,"Small collection-side removal helper for the current city-database entry family. The function resolves the caller-supplied entry id through `0x00518140`, releases the resolved entry through `0x00474400`, and then removes the id from the collection through `0x00518a30`.","objdump + local disassembly + collection-layout correlation + removal-path correlation"
0x00474540,197,city_database_entry_collection_refresh_records_from_tagged_bundle,map,thiscall,inferred,objdump + caller xrefs + local disassembly + collection-load correlation,2,"Collection-owned tagged load owner for the live city-database entry collection. The helper opens tag family `0x61a9/0x61aa/0x61ab` on the caller-supplied bundle, binds the selected path context through `0x00518680`, iterates every live record in the current collection, seeds a stack-local temporary entry through `0x00474110`, dispatches each record's vtable slot `+0x40` with the current bundle context, accumulates the returned byte count, tears the temporary entry down through `0x004743d0`, and finally closes tag `0x61ab`. Current grounded caller is the map-load branch at `0x00444834`, so this is now the safest current read for the collection-owned city-database tagged refresh loop.","objdump + caller xrefs + local disassembly + collection-load correlation + bundle-tag correlation"
0x00474610,120,city_database_entry_collection_serialize_records_into_tagged_bundle,map,cdecl,inferred,objdump + local disassembly + collection-load correlation,2,"Collection-wide tagged save owner for the live city-database entry collection. The helper opens tag family `0x61a9/0x61aa/0x61ab` on the caller bundle through `0x00531340`, binds the selected path or payload context into the collection through `0x00517d90`, walks every live record through `0x00517cf0/0x00518380/0x00518140`, and dispatches each record through vtable slot `+0x44` with the same bundle context before finally closing tag `0x61ab`. This is the strongest current read for the direct tagged save companion to the collection-owned load loop `0x00474540`, rather than a generic map-load stub.","objdump + local disassembly + collection-load correlation + bundle-tag correlation"
0x00474690,107,effect_emitter_table_publish_mode1_ratio_labels,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Walks the global emitter-definition table rooted at `0x006cea60` and, for each live entry whose mode dword `[entry+0x30]` equals `1`, derives one rounded ratio from float fields `[entry+0x00] / [entry+0x08]`, combines that with keyed field `[entry+0x34] | 0x10000` through `0x0053d810`, and forwards the resulting token into owner `0x006d4030` through `0x00556c50`. Current evidence grounds the iteration and derived ratio shape, but not the exact user-facing caption of the published label lane.","objdump + local disassembly + literal inspection + emitter-table correlation"
0x00474700,133,effect_table_load_particles_dat_into_global_root_and_register_particles_texture,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Reloads the global particle-data table from banked file `particles.dat`. The helper frees any previous root at `0x006cea5c`, checks for the named banked record through `0x0053c930`, resolves its keyed handle and payload length through `0x0053b5c0/0x0053c9c0`, allocates a new payload slab, reads that payload through `0x0053b7c0`, stores the resulting root at `0x006cea5c`, and finally registers literal `ParticlesTexture` through `0x00556370` on owner `0x006d4030`. This is the clearest current owner for the `particles.dat` load path rather than a generic banked-record fetch helper.","objdump + local disassembly + literal inspection + banked-record correlation + particle-table correlation"
0x00474790,133,effect_table_load_emitters_dat_into_global_root,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Reloads the global emitter-definition table from banked file `emitters.dat`. The helper frees any previous root at `0x006cea60`, checks for the named banked record through `0x0053c930`, resolves its keyed handle and payload length through `0x0053b5c0/0x0053c9c0`, allocates a new payload slab, reads that payload through `0x0053b7c0`, and stores the resulting root at `0x006cea60`. This is the clearest current owner for the `emitters.dat` load path rather than a generic banked-record fetch wrapper.","objdump + local disassembly + literal inspection + banked-record correlation + emitter-table correlation"
0x00474820,58,effect_emitter_table_find_entry_by_hashed_name,bootstrap,thiscall,inferred,objdump + local disassembly + literal inspection,2,"Hashes the caller-supplied NUL-terminated name through `0x0053d810(…,1)` and linearly scans the global emitter-definition table rooted at `0x006cea60` for the first entry whose leading dword matches that hash. On success it returns the matched entry root; otherwise `0`. Current grounded callers are the emitter-builder families at `0x00475420`, `0x00475550`, and their neighbors, where the names come from literal stems such as `steam`.","objdump + local disassembly + literal inspection + emitter-table correlation + hashed-name correlation"
0x00474860,257,effect_emitter_table_select_next_existing_formatted_3dp_variant,bootstrap,thiscall,inferred,objdump + local disassembly + literal inspection + caller inspection,2,"Selector-style iterator over the global emitter-definition table rooted at `0x006cea60`. When the caller passes `EDX = 1`, the helper resets global scan state `0x005f2c30` and row ordinal `0x006ceb94`; otherwise it resumes from that saved state. For each remaining emitter row it formats one candidate name into the local stack buffer through format string `%s%s%i.3dp` at `0x005ce4e8`, using the caller-supplied owner stem, the current row suffix at `[row+0x04]`, and the current ordinal. It then probes that formatted name through `0x0053c930`; on the first accepted variant it stores the chosen row root into `0x006cea90`, copies the formatted name into `0x006cea94`, advances the saved ordinal state, and returns `0x006cea90`. On exhaustion it restores the scan state to `(1,0)` and returns `0`. Current grounded caller is the attached-emitter build loop at `0x0045e940`, so this is best read as the formatted `*.3dp` variant enumerator above the emitter instantiator rather than a general banked-record lookup helper.","objdump + local disassembly + literal inspection + caller inspection + emitter-table correlation + formatted-variant correlation"
0x00474970,39,effect_handle_array_release_all_handles,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Linear release helper over one simple handle-array root whose live handle count sits at `[this+0x08]` and whose first handle pointer sits at `[this+0x0c]`. The helper forwards each live handle into `0x00554d50` and returns. Current grounded caller is the broader emitter-template teardown path at `0x00474db0`.","objdump + local disassembly + caller inspection + handle-array correlation"
0x004749a0,33,effect_name_matches_literal_steam,bootstrap,thiscall,inferred,objdump + local disassembly + literal inspection,1,"Tiny literal-compare predicate that tests the caller string at `[this+0x44]` against literal `steam` at `0x005ce4f4` through `0x005a57cf` and returns `1` only on an exact match.","objdump + local disassembly + literal inspection + string-compare correlation"
0x004749d0,653,effect_apply_emitter_definition_to_attached_sprite_handle,bootstrap,cdecl,inferred,objdump + local disassembly + caller inspection + table correlation,2,"Lower emitter-definition applicator beneath `effect_slot_create_attached_sprite_emitter` `0x00474e20`. The helper copies multiple scaled float bands and packed dword fields from the caller emitter-definition row into the target attached-emitter handle, seeds the handle transform or extent bands at `[handle+0x70..+0x90]` and `[handle+0xf0..+0x108]`, resolves the particle-data row named by the emitter definition through `0x0053d810` against the global `particles.dat` table rooted at `0x006cea5c` and mirrors that row into `[handle+0x10c..]`, applies several flag-sensitive scalar adjustments from definition fields `[+0xc0]` and `[+0xc8]`, and writes one referenced owner-side template or handle field into `[handle+0x1ac]`. Current grounded callers are the flagged emitter-template prebuild `0x00474c60` and the broader attached-emitter creator `0x00474e20`, so this is the safest current read for the concrete definition-to-handle materialization body rather than another table lookup or slot allocator.","objdump + local disassembly + caller inspection + emitter-table correlation + particle-table correlation + handle-layout correlation"
0x00474c60,114,effect_emitter_table_build_attached_emitter_templates_for_flagged_entries,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection + caller inspection,2,"Walks the global emitter-definition table rooted at `0x006cea60` and, for each live entry whose build-flag dword `[entry+0xb8]` equals `1`, hashes its inline name at `[entry+0x04]`, resolves or reuses one owner-side template through `0x00556ce0` on `0x006d4030`, mirrors emitter flags `[entry+0xbc] | 0x10004` into both that owner-side template and the later attached-emitter build call, and then creates the attached emitter through `effect_slot_create_attached_sprite_emitter` `0x004749d0` with scale `1.0f`. Current grounded caller is the global bootstrap path `0x00474ce0`, so this is the clearest current owner for the flagged emitter-template prebuild pass.","objdump + local disassembly + literal inspection + caller inspection + emitter-table correlation + bootstrap correlation"
0x00474ce0,195,effect_system_bootstrap_particle_tables_slot_pool_and_flagged_emitter_templates,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection + caller inspection,2,"Global bootstrap owner for the particle or emitter subsystem rooted at `0x006cea54..0x006cea98`. The helper reloads `emitters.dat` through `0x00474790`, reloads `particles.dat` through `0x00474700`, publishes current mode-`1` ratio labels through `0x00474690`, lazily allocates one pooled slot descriptor root of size `0x1c` at `0x006cea58`, allocates the backing slab `0x88b80` into `0x006cea54`, seeds that slab into the pooled descriptor through `0x0053dcf0(…,0x38,0x2710,1)`, clears the global linked-slot heads `0x006cea74/78/7c` and shared anchor globals `0x006cea68/6c/70/80/84/88`, marks latch `0x006ceb98 = 1`, rebuilds flagged emitter templates through `0x00474c60`, and finally publishes enable state `1` through owner `0x006d4030` via `0x00556500`. This is the clearest current bootstrap owner for the grounded `particles.dat` and `emitters.dat` globals rather than another small table loader.","objdump + local disassembly + literal inspection + caller inspection + pooled-slot correlation + particle-table correlation + emitter-table correlation"
0x00474db0,112,effect_system_teardown_particle_tables_and_pooled_slot_root,bootstrap,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Global teardown companion for the same particle or emitter subsystem rooted at `0x006cea54..0x006cea60`. The helper frees backing slab `0x006cea54`, particle table root `0x006cea5c`, and emitter-definition table root `0x006cea60` through `0x005a1145`; then, when the pooled slot descriptor root `0x006cea58` is live, it resets that descriptor through `0x0053dcb0`, frees it through `0x0053b080`, and clears the global root. Current grounded callers include the emitter data reload family around `0x00474700/0x00474790`, so this is the clearest current owner for subsystem teardown rather than a slot-local release helper.","objdump + local disassembly + caller inspection + pooled-slot correlation + particle-table correlation + emitter-table correlation"
0x00474e20,336,effect_slot_create_or_clone_attached_sprite_emitter_from_definition_and_optional_owner_template,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection + table correlation,2,"Creates one attached sprite emitter from one emitter-definition row, either by cloning an owner-side template or by constructing a fresh runtime handle. The helper first seeds or allocates the optional `0x206` owner record when the caller did not supply one, strips high flag bits from `CargoMoney_DollarSign`, clears incoming flag bit `0x400` when definition gate `[def+0xb8]` is zero, and then takes one of two branches. When final flags still carry `0x400`, it hashes the definition name at `[def+0x04]` together with owner token `[def+0x84]`, resolves or reuses one owner-side template through `0x00556ce0` on `0x006d4030`, and uses that clone as the live emitter. Otherwise it derives one rounded scale index from `[def+0x88] / [def+0x90]`, allocates a fresh `0x1fd` emitter through `0x0053b070`, constructs it through `0x00556920`, and then materializes the definition fields into that handle through `effect_apply_emitter_definition_to_attached_sprite_handle` `0x004749d0`. On success it publishes the created emitter through `0x0052d950`, stores the owner definition pointer into `[emitter+0x60]`, and when the final flags carry `0x02000000` it forces persistent flag dword `[emitter+0xbc] = 1`. Current grounded callers are the slot builders under `0x004752d0..0x00475e30` plus the owner-stem loop at `0x0045e940`, so this is the safest current owner for attached sprite-emitter creation or clone selection rather than a generic slot helper.","objdump + local disassembly + caller inspection + emitter-table correlation + template-clone correlation + handle-construction correlation"
0x00474f70,112,effect_slot_service_emitters_or_all_globally_linked_slots_with_update_mode_zero,bootstrap,thiscall,inferred,objdump + local disassembly + global-list correlation,2,"Shared update sweep for attached sprite emitters. When the caller supplies one slot container, the helper iterates that slot's live emitter pointer band `[slot+0x0c..]` and dispatches each emitter through `0x00555e50(0)`. When the caller passes null instead, it walks the global linked slot list rooted at `0x006cea74` and runs the same per-emitter `0x00555e50(0)` sweep across every linked slot. This is the clearest current owner for the common emitter service pass rather than just another slot-local iterator.","objdump + local disassembly + global-list correlation + emitter-slot correlation"
0x00474fe0,38,effect_slot_write_emitter_flag_dword_to_all_emitters,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small per-slot flag writer over the attached-emitter container. The helper iterates every live emitter pointer in `[this+0x0c..]` and writes the caller-supplied dword from `EDX` directly into each emitter's flag field `[emitter+0xbc]`. Current grounded callers are the placed-structure transient rebuild branches `0x0040cf79`, `0x0040f137`, `0x0040f35c`, and the later world-side service path `0x004a87e8`, so this is best read as the shared emitter-flag broadcast helper rather than a fuller update pass.","objdump + local disassembly + caller inspection + emitter-slot correlation + flag-field correlation"
0x00475010,25,effect_slot_cache_shared_anchor_triplet,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Caches the caller-supplied world-anchor triplet into globals `0x006cea68`, `0x006cea6c`, and `0x006cea70`. Current grounded callers are the attached-emitter setup paths `0x0040cf00` and several higher emitter-slot builders starting at `0x004752d0`.","objdump + local disassembly + caller inspection + shared-triplet correlation"
0x00475030,101,effect_slot_apply_cached_shared_anchor_triplet_to_all_or_one_emitters,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Copies the cached triplet globals `0x006cea68/0x006cea6c/0x006cea70` into the per-emitter triplet band at `[emitter+0x1b0..+0x1b8]` for either all emitters in the current slot container or one selected emitter index. When the caller passes `-1` in `EDX`, the helper updates every live emitter pointer in `[this+0x0c..]`; otherwise it updates only the selected slot index. Current grounded callers include the placed-structure transient builder `0x0040cf00`.","objdump + local disassembly + caller inspection + shared-triplet correlation + emitter-slot correlation"
0x00475100,308,effect_slot_release_emitters_unlink_global_list_and_recycle_or_free_slot,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Release-side owner for one attached-emitter slot container. The helper walks any owner-side intrusive list reachable from `[this+0x04]->[+0x79]`, releasing matching attached emitters stored in `[this+0x0c..]` through the `0x00556ef0/0x00556f00/0x00556f20` sweep; when slot flag dword `[this+0x34] == 1` it also unlinks the current slot from the global linked list rooted at `0x006cea74/0x006cea78/0x006cea7c`. Finally it either recycles the slot into the pooled descriptor rooted at `0x006cea58` when the slot address falls inside that pool range or frees it directly through `0x0053b080`. Current grounded callers are the placed-structure and city-entry helper release paths at `0x0045b160`, `0x004743d0`, and `0x00474400`.","objdump + local disassembly + caller inspection + emitter-slot correlation + pooled-slot correlation"
0x00475240,108,effect_slot_set_emitter_enabled_state_for_all_or_one,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Toggles the per-emitter enable byte at `[emitter+0x1d8]` for either all emitters in the current slot container or one selected emitter index. When caller mode `EDX == 1`, the helper writes byte `0` to the selected emitters; otherwise it writes byte `1`. Passing index `-1` applies the update to every live emitter pointer in `[this+0x0c..]`. Current evidence is strongest for an enabled-state setter because the paired query `0x004752b0` reports true only when this byte stays zero.","objdump + local disassembly + emitter-slot correlation + enable-flag correlation"
0x004752b0,31,effect_slot_query_emitter_is_enabled_by_index,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Returns `1` when the selected emitter pointer in `[this+0x0c + index*4]` exists and its enable byte `[emitter+0x1d8]` is zero; otherwise returns `0`. This is the paired boolean query beside `effect_slot_set_emitter_enabled_state_for_all_or_one` `0x00475240`.","objdump + local disassembly + emitter-slot correlation + enable-flag correlation"
0x004752d0,340,effect_slot_construct_broken_down_steam_flame_and_crash_smoke_bundle,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a three-emitter slot bundle beneath the same pooled effect-slot family rooted at `0x006cea58`. After acquiring one slot container, the helper resolves emitter definitions `BrokenDown_Steam`, `FlamespoutB`, and `Crash_SmokeA` from the global emitter table `0x006cea60` through `effect_emitter_table_find_entry_by_hashed_name` `0x00474820`, creates three attached emitters through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, stores those emitters into `[slot+0x0c/+0x10/+0x14]`, and sets slot count `[slot+0x08] = 3`. This is the clearest current owner for the named broken-down fire/steam/crash-smoke bundle rather than a generic slot allocator.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475420,302,effect_slot_construct_tier_selected_volcano_lava_and_black_smoke_bundle,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a two-emitter volcano bundle in the pooled effect-slot family rooted at `0x006cea58`. The helper first selects one literal pair from `Volcano_BlackSmoke1..4` plus `Volcano_Lava1..4` or the untiered `Volcano_BlackSmoke` plus `Volcano_Lava`, based on the caller float tier `0.5f`, `0.75f`, `1.0f`, `1.5f`, or `2.0f`; it then resolves those emitter definitions through `effect_emitter_table_find_entry_by_hashed_name` `0x00474820`, creates the black-smoke emitter first with flags `arg3 | 0x10000`, copies the selected black-smoke descriptor field `[def+0xc8]` into the created emitter at `[emitter+0x94]`, creates the paired lava emitter second, stores the two emitters into `[slot+0x0c/+0x10]`, stamps one fixed dword `0x371c0732` into the second emitter at `[emitter+0x1e9]`, and sets slot count `[slot+0x08] = 2`. This is the clearest current owner for the tier-selected volcano lava or smoke pair rather than a generic two-emitter allocator.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475550,244,effect_slot_construct_broken_down_steam_and_smoke_bundle,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a two-emitter slot bundle in the same pooled effect-slot family. After acquiring one slot container, the helper resolves `BrokenDown_Steam` and `BrokenDown_Smoke` from the global emitter table `0x006cea60` through `0x00474820`, creates the two attached emitters through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, stores them into `[slot+0x0c/+0x10]`, and sets slot count `[slot+0x08] = 2`. This is the current grounded two-emitter broken-down steam/smoke bundle owner.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475650,339,effect_slot_construct_service_tower_water_triple_bundle,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a three-emitter service-tower water bundle in the same pooled effect-slot family. After acquiring one slot container, the helper resolves the literal pairs `ServiceTower_Water2` plus `ServiceTower_Anim2#water.3dp`, `ServiceTower_Water` plus `ServiceTower_Anim3#water.3dp`, and `ServiceTower_Water3` plus `ServiceTower_Anim4#water.3dp` from the global emitter table `0x006cea60`; it creates three attached emitters through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, threads the default attachment token from the first emitter into the second and third builds when the caller did not supply one, stores the resulting emitters into `[slot+0x0c/+0x10/+0x14]`, and sets slot count `[slot+0x08] = 3`. This is the clearest current owner for the named three-stage service-tower water bundle rather than another anonymous effect-slot builder.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x004757b0,339,effect_slot_construct_fireworks_rocket_triple_bundle,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a three-emitter fireworks bundle in the pooled effect-slot family. After acquiring one slot container, the helper resolves `Rocket_Flame` plus `Fireworks_Anim2#water.3dp`, `Rocket_Smoke` plus `Fireworks_Anim3#water.3dp`, and `Rocket_Sparkle` plus `Fireworks_Anim4#water.3dp` from the global emitter table `0x006cea60`; it creates the three attached emitters through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, threads the first emitter's default attachment token into the later two builds when the caller did not supply one, stores the resulting emitters into `[slot+0x0c/+0x10/+0x14]`, and sets slot count `[slot+0x08] = 3`. This is the clearest current owner for the named fireworks rocket bundle rather than a generic multi-emitter constructor.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475910,218,effect_slot_construct_random_fireworks_single_emitter,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a one-emitter fireworks slot bundle with one randomized named variant. The helper advances the shared PRNG state at `0x00624324`, rejects the immediately previous residue stored at `0x005f2c2c`, selects one of the three emitter names `Fireworks1`, `Fireworks2`, or `Fireworks3`, resolves that emitter from the global emitter table `0x006cea60`, creates one attached emitter through `effect_slot_create_attached_sprite_emitter` `0x00474e20` using literal `Fireworks_Anim5#water.3dp`, stores the emitter into `[slot+0x0c]`, writes fixed dword `0x3c` into `[emitter+0xbc]`, and sets slot count `[slot+0x08] = 1`. This is the clean local owner for the randomized single-firework effect bundle.","objdump + local disassembly + literal inspection + PRNG-state correlation + emitter-table correlation + named-bundle correlation"
0x004759f0,154,effect_slot_construct_cargo_money_dollar_sign_emitter,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a one-emitter slot bundle around literal `CargoMoney_DollarSign`. After acquiring one slot container, the helper resolves that named emitter from the global emitter table `0x006cea60`, creates one attached emitter through `effect_slot_create_attached_sprite_emitter` `0x00474e20` with flags `arg2 | 0xc000`, stores the emitter into `[slot+0x0c]`, and sets slot count `[slot+0x08] = 1`. This is the clean local owner for the cargo-money dollar-sign effect bundle.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475a90,154,effect_slot_construct_select_object_emitter,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a one-emitter slot bundle around literal `SelectObject`. After acquiring one slot container, the helper resolves that named emitter from the global emitter table `0x006cea60`, creates one attached emitter through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, stores it into `[slot+0x0c]`, and sets slot count `[slot+0x08] = 1`. This is the current grounded owner for the standalone select-object effect bundle.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475b30,154,effect_slot_construct_spend_money_dollar_sign_emitter,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a one-emitter slot bundle around literal `SpendMoney_DollarSign`. After acquiring one slot container, the helper resolves that named emitter from the global emitter table `0x006cea60`, creates one attached emitter through `effect_slot_create_attached_sprite_emitter` `0x00474e20` with flags `arg2 | 0xc000`, stores the emitter into `[slot+0x0c]`, and sets slot count `[slot+0x08] = 1`. This is the clean local owner for the spend-money dollar-sign effect bundle.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475bd0,480,effect_slot_construct_construct_pos_left_right_back_forward_bundle,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a five-emitter slot bundle from the directional construction literals `Construct_Pos`, `Construct_Left`, `Construct_Right`, `Construct_Back`, and `Construct_Forward`. After acquiring one slot container, the helper resolves each named emitter from the global emitter table `0x006cea60`, creates the five attached emitters through `effect_slot_create_attached_sprite_emitter` `0x00474e20` with flags `arg2 | 0xc000`, threads the first emitter's default attachment token into the later four builds when the caller did not supply one, stores the resulting emitters into `[slot+0x0c/+0x10/+0x14/+0x18/+0x1c]`, and sets slot count `[slot+0x08] = 5`. This is the clearest current owner for the directional construction effect bundle rather than a generic multi-emitter constructor.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475dc0,106,effect_slot_construct_mist_or_mist_small_emitter,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a one-emitter slot bundle around either `Mist` or `MistSmall`. After acquiring one slot container, the helper chooses `Mist` when the caller float argument differs from `1.0f` and chooses `MistSmall` when it equals `1.0f`, resolves that named emitter from the global emitter table `0x006cea60`, creates one attached emitter through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, stores it into `[slot+0x0c]`, and sets slot count `[slot+0x08] = 1`. This is the clean local owner for the mist-effect single-emitter bundle.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475e30,152,effect_slot_construct_vent_emitter,bootstrap,cdecl,inferred,objdump + local disassembly + literal inspection,2,"Constructs a one-emitter slot bundle around literal `Vent`. After acquiring one slot container, the helper resolves that named emitter from the global emitter table `0x006cea60`, creates one attached emitter through `effect_slot_create_attached_sprite_emitter` `0x00474e20`, stores it into `[slot+0x0c]`, and sets slot count `[slot+0x08] = 1`. This is the current grounded owner for the standalone vent effect bundle.","objdump + local disassembly + literal inspection + emitter-table correlation + named-bundle correlation"
0x00475ed0,315,effect_slot_construct_named_bundle_by_selector_and_optionally_link_globally,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection + literal inspection,2,"Selector-dispatch owner above the current named effect-slot builders. The helper treats `EDX-1` as a small selector spanning the broken-down, volcano, service-tower, money-sign, construction, fireworks, select-object, mist, and vent bundle constructors rooted at `0x004752d0`, `0x00475420`, `0x00475550`, `0x00475650`, `0x004757b0`, `0x00475910`, `0x004759f0`, `0x00475a90`, `0x00475b30`, `0x00475bd0`, `0x00475dc0`, and `0x00475e30`. After building the selected slot bundle it mirrors the first emitter's attachment token into `[slot+0x04]`, stores caller mode into `[slot+0x34]`, and when that mode equals `1` pushes the finished slot onto the global linked active list rooted at `0x006cea74/0x006cea78/0x006cea7c`. This is the clearest current local owner for selector-driven named effect-slot construction rather than another low-level emitter helper.","objdump + local disassembly + caller inspection + literal inspection + named-bundle correlation + global-linked-list correlation"
0x00476050,31,profile_entry_add_signed_integer_delta_into_qword_field_0x154,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Tiny signed-accumulate helper over one profile-style object field. The helper converts the caller-supplied integer delta into floating-point and adds it into qword field `[this+0x154]`, then returns. Current grounded callers are the preset multiplayer normalization passes `0x00470ed0` and `0x00470fa0` over the guarded named-profile table `0x006ceb9c`, and the new-company commit path `0x0047d120`, so the safest current read is a signed additive update for field `0x154` rather than a more semantic metric name.","objdump + local disassembly + caller inspection + qword-field correlation + named-profile correlation"
0x004760a0,35,profile_entry_resolve_company_dword_slot_0x2ab_by_index_and_optionally_refresh_generation,shell,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small raw field helper over one named-profile record. The function compares the caller-supplied generation or stamp dword against `[this+0xc43]`; when they already match or the caller stamp is zero it returns `0`, otherwise it updates `[this+0xc43]` and returns the address of the indexed dword slot `[this + company_index*4 + 0x2ab]`. Current evidence only grounds the raw field relationship and the optional generation-stamp write, not the higher semantic meaning of either field.","objdump + local disassembly + caller correlation + raw-field correlation"
0x004760c6,29,profile_entry_store_company_dword_slot_0x2ab_by_index_and_optionally_refresh_generation,shell,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Companion raw setter for the same named-profile record family. The helper stores the caller dword into indexed slot `[this + company_index*4 + 0x2ab]` and, when the caller-supplied stamp in `EDX` is nonzero, also writes that stamp into `[this+0xc43]`. Current evidence grounds it only as the paired store-side helper beside `0x004760a0`.","objdump + local disassembly + caller correlation + raw-field correlation"
0x004760f0,77,profile_static_persona_table_allocate_wrapped_unused_row_flag,map,cdecl,inferred,objdump + local disassembly + table correlation + caller inspection,2,"Allocates one wrapped unused row out of the static persona table rooted at `0x005f2d28`. Starting from one bounded pseudo-random seed from `0x00518be0(0,0x28)`, the helper walks the row flag byte at stride `0x27` until it finds a zero entry, wrapping modulo `0x29` across the table. It then marks that row flag byte to `1` and returns the chosen row index. Current grounded caller is the named-profile constructor `0x00476140`, so this is the safest current read for the static persona-row allocator rather than a broader profile generator.","objdump + local disassembly + table correlation + caller inspection + static-persona correlation"
0x00476140,471,named_profile_record_construct_with_default_fields_strings_and_static_persona_row,shell,thiscall,inferred,objdump + local disassembly + caller correlation + table correlation,3,"Broad constructor for one named-profile record in the collection rooted at `0x006ceb9c`. The helper seeds several fixed state bytes under `[this+0x291..+0x295]`, stores the caller profile id at `[this+0x00]`, marks the record live through `[this+0x04] = 1`, zeros several local counters and state dwords including `[this+0x154]`, `[this+0x296]`, `[this+0x29a]`, `[this+0x2a7]`, and `[this+0x29e]`, seeds `[this+0x158]` to `7.763f`, zeroes the large record band `[this+0x1e9..]`, mirrors the special `id == 1` case into guard dword `[this+0x1e1]`, allocates one static persona-row flag through `0x004760f0`, copies the caller byte into `[this+0x15c]`, formats a localized fallback name through `0x005193f0(0x0b87)` when the caller name string is empty or otherwise copies that name into `[this+0x08]`, copies the caller biography string into `[this+0x27]`, seeds one random multiple-of-`0x5a0` scalar into `[this+0x1e5]`, and finally clears the per-company dword band `[this+0x2ab..]` plus the trailing state strip `[this+0xc66..]`. Current grounded callers are the chairman-profile seeding and materialization passes `0x004377a0` and `0x00437220`, so this is the clearest current owner for named-profile record construction rather than a generic string-copy helper.","objdump + local disassembly + caller correlation + table correlation + chairman-profile seeding correlation"
0x00476320,131,profile_entry_sum_per_company_holding_value_using_selected_company_scalar_source,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Accumulates one direct weighted sum across the per-company dword band `[this+0x15d..+0x1d9]`. For each positive entry, the helper resolves the matching live company record from `0x0062be10`; when the caller stack flag is nonzero it queries the cached company scalar through `0x00423eb0`, otherwise it queries the broader company scalar through `0x00424fd0(0,0)`. It then multiplies that company scalar by the corresponding profile holding dword and adds the result into one running floating accumulator. Current grounded caller is the `LoadScreen.win` player-list renderer `0x004e6ef0`, where this is one of the chairman-side ranking metrics.","objdump + local disassembly + caller correlation + per-company-holding correlation + player-list metric correlation"
0x004763b0,166,profile_entry_sum_threshold_adjusted_per_company_holding_value_using_selected_company_scalar_source,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Companion weighted accumulator over the same per-company holding band `[this+0x15d..+0x1d9]`. For each positive entry, the helper resolves the matching live company record from `0x0062be10`, queries either `0x00423eb0` or `0x00424fd0(0,0)` by the same caller flag split as `0x00476320`, and then folds the resulting per-company contribution through a thresholded transform using constants `0x005c8608` and `0x005c85d0` before adding it into one running floating accumulator. Current grounded caller is again the `LoadScreen.win` player-list renderer `0x004e6ef0`, so the safest current read is a threshold-adjusted holding-value accumulator rather than a fully named finance metric.","objdump + local disassembly + caller correlation + per-company-holding correlation + player-list metric correlation"
0x00476460,243,profile_entry_sell_company_holding_units_and_add_cash_metric,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Sell-side mutation over one named-profile record's per-company holding slot. The helper resolves the target company from `0x0062be10`, clamps the caller-requested unit count against current slot `[this + company_id*4 + 0x15d]` and, on the negative-holding branch, against company-side limit query `0x00429910(0)`. It then queries the company scalar through `0x00424fd0(-units,1)`, rounds the resulting proceeds twice through `0x005a10d0`, subtracts the sold unit count from `[this + company_id*4 + 0x15d]`, adds the scaled proceeds into qword cash-like field `[this+0x154]`, and finally refreshes scenario-side chairman state through `0x00433850` and `0x0050a670`. Current grounded callers are the two shell-side trade branches around `0x0050bf82` and `0x0050c24e`, plus the earlier policy branch at `0x0040722f`, so this is the clearest current sell or liquidation helper over the chairman holding band rather than another raw slot mutator.","objdump + local disassembly + caller inspection + holding-slot correlation + cash-metric correlation + trade-branch correlation"
0x00476560,539,profile_entry_apply_issue39_tiered_cash_metric_adjustment,simulation,thiscall,inferred,objdump + local disassembly + caller inspection + issue-39 correlation,3,"Applies one issue-39-driven periodic adjustment to qword cash-like field `[this+0x154]`. When scenario gate `[0x006cec78+0x46c38]` is clear, the helper first reads one scenario baseline through `0x00433740`, adds the raw issue-39 total through `scenario_state_sum_issue_opinion_terms_raw` `0x00436710(issue=0x39, company=0, profile=this[0], territory=0)`, and then clamps the resulting factor against several current-cash thresholds using constants `0x005c8608`, `0x005ce820`, `0x005ce818`, `0x005ce810`, and `0x005c8810`. The tail multiplies that factor by `[this+0x154]`, divides by `0x005c8978`, rounds through `0x005a10d0`, and adds the resulting integer delta back into `[this+0x154]`. Current grounded caller is the collection sweep at `0x0040a760`, which applies this adjustment to every active chairman profile before firing trigger kind `2` through `0x00432f40`, so this is the safest current read for an issue-39-tiered periodic cash-metric adjustment rather than a generic profile scaler.","objdump + local disassembly + caller inspection + issue-39 correlation + cash-metric correlation + collection-sweep correlation"
0x00476780,21,profile_entry_query_direct_holding_total_plus_cash_metric,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper that queries the direct per-company holding total through `0x00476320` and then adds qword cash-like field `[this+0x154]` before returning the resulting floating total. Current grounded callers are the player-list renderer `0x004e6ef0`, the ratio-style helper at `0x00406da9`, and the later support branch at `0x0050acc7`, so this is the clean direct-total-plus-cash sibling beside the threshold-adjusted path at `0x00476c20`.","objdump + local disassembly + caller inspection + cash-metric correlation + holdings-total correlation"
0x00476950,224,profile_entry_query_start_new_company_funding_scale_factor,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + field correlation,2,"Queries one bounded funding-scale factor from the current chairman profile for the `Start New Company` dialog family. The helper defaults to a constant factor when profile gate `[this+0x1e1]` is clear; otherwise it optionally adjusts one local score from owner-company field `[company+0x43]` and selected-chairman lane `[0x006cec78+0x0d]`, folds that delta into profile dword `[this+0x28d]`, converts the result through the local float constants at `0x005c85d8/0x005c85f0`, and clamps the final factor into a bounded positive range before returning it. Current grounded caller is the funding-band helper `0x0047bea0`, so this is the clean profile-side scale-factor source for the start-company funding UI rather than a general wealth metric.","objdump + local disassembly + caller correlation + field correlation + start-company funding correlation"
0x004767a0,96,profile_entry_query_cash_or_direct_holding_metric_by_selector,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small selector wrapper over the same chairman profile metric strip. Selector `0` returns qword cash-like field `[this+0x154]` directly, selector `1` returns the direct holding-value total from `0x00476320(0)`, selector `2` returns their sum by recursively combining selectors `0` and `1`, and all other selectors return the constant floor at `0x005c8608`. Current grounded callers are the local cache refresher `0x00476810`, the player-list renderer `0x004e5577/0x004e561f`, and the policy-side branch `0x0042ebb5/0x0042ebd4`, so this is the safest current read for the direct cash-versus-holdings metric selector rather than a broader ranking owner.","objdump + local disassembly + caller inspection + cash-metric correlation + selector-branch correlation"
0x00476810,170,profile_entry_refresh_cached_cash_and_direct_holding_metric_pair,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Refreshes two cached qword metric lanes under one named-profile record. After clearing the local cache band `[this+0x1e9..+0x278]`, the helper stores selector `0` and selector `1` outputs from `profile_entry_query_cash_or_direct_holding_metric_by_selector` `0x004767a0` into the two qword slots rooted at `[this+0x1e9]` and `[this+0x1f1]`. Current grounded caller is the active-profile sweep at `0x0040a3fe`, so this is the strongest current read for the cash-plus-direct-holdings cache refresh pass rather than a generic record reset.","objdump + local disassembly + caller inspection + cache-band correlation + selector-branch correlation"
0x00476a60,80,scenario_state_query_named_profile_trade_or_replace_gate_enabled,map,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Small scenario-side gate used by the named-profile transaction and replacement family. The helper returns true when any of three scenario conditions is active: toggle `[0x006cec78+0x4acb]` with `0x004337a0` returning nonzero, toggle `[0x006cec78+0x4ad7]` with the selected chairman profile record from `0x004348c0` having `[profile+0x2a7] >= 1`, or toggle `[0x006cec78+0x4ad3]`. Otherwise it returns false. Current grounded callers are the broader profile-side owner `0x00476d10` and two shell renderers `0x004e5ab6` and `0x004e6911`, so the safest current read is a named-profile trade-or-replace gate rather than a stronger user-facing policy name.","objdump + local disassembly + caller inspection + scenario-toggle correlation + selected-profile correlation"
0x00476ab0,122,profile_static_persona_row_query_string_ptr_0x40_by_profile_byte_0x15c_or_fallback,shell,thiscall,inferred,objdump + local disassembly + caller inspection + table correlation,2,"Resolves one pointer into the static persona table rooted at `[0x006d4020+0x429b4]` by matching the profile stem buffer `[this+0xc47]` against each row and then returns the matching row's `+0x40` field; on lookup failure it falls back to `[this+0x40]`. Current grounded caller is the load-screen renderer branch at `0x004e207e`, where the returned string is copied into a local buffer before the surrounding shell payload build continues. The safest current read is therefore a structural `+0x40` persona-row string-pointer query rather than a more semantic biography or title name.","objdump + local disassembly + caller inspection + table correlation + string-buffer correlation"
0x00476b30,122,profile_static_persona_row_query_asset_stem_ptr_by_profile_byte_0x15c_or_fallback,shell,thiscall,inferred,objdump + local disassembly + caller inspection + table correlation,2,"Resolves one pointer into the static persona table rooted at `[0x006d4020+0x429b4]` by matching the profile stem buffer `[this+0xc47]` against each row and then returns the matching row's `+0x20` field; on lookup failure it falls back to `[this+0x20]`. Current grounded callers are the CompanyDetail chairman portrait band at `0x004c2ec9/0x004c2ef0` and the load-screen side renderers, where the returned string is passed onward as a banked asset key through `0x0053c930`, so this is the safest current read for the persona-row asset-stem pointer query rather than a generic string helper.","objdump + local disassembly + caller inspection + table correlation + asset-key correlation"
0x00476bb0,112,profile_static_persona_table_query_row_index_by_profile_byte_0x15c_and_stem,shell,thiscall,inferred,objdump + local disassembly + caller inspection + table correlation,2,"Resolves the zero-based row index inside the static persona table rooted at `[0x006d4020+0x429b4]` whose row key matches profile stem buffer `[this+0xc47]`. The helper returns `-1` when no row matches. Current grounded callers are the load-screen player-detail and shell status renderers around `0x004e5332`, `0x004e72d8`, `0x004e736d`, `0x0050a932`, and `0x0050a994`, where the resulting row index is folded into the visible persona byte at `[profile+0x15c]`. This is therefore the current row-index query sibling beside the pointer-returning helpers at `0x00476ab0` and `0x00476b30`.","objdump + local disassembly + caller inspection + table correlation + persona-byte correlation"
0x00476c20,21,profile_entry_query_threshold_adjusted_holding_total_plus_cash_metric,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper that queries the threshold-adjusted holding-value total through `0x004763b0` and then adds qword cash-like field `[this+0x154]` before returning the resulting floating total. Current grounded callers are the player-list renderer `0x004e7133/0x004e74cc`, the overview-side branch `0x0047c085`, and the later support path `0x0050acd0`, so this is the clean threshold-adjusted-total-plus-cash sibling beside `0x00476780`.","objdump + local disassembly + caller inspection + threshold-adjusted correlation + cash-metric correlation"
0x00476c40,208,profile_entry_query_can_reduce_company_holding_slot_by_units_with_optional_threshold_fallback,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Sell-side or reduction-side feasibility gate over one chairman profile and company slot. The helper resolves the target company from `0x0062be10`, defaults the requested unit count through `0x00476e50(company_id,0)` when the caller passes zero, and succeeds immediately when current slot `[this + company_id*4 + 0x15d]` already covers that reduction. When the direct slot check fails, the helper only continues on the caller's fallback branch; there it rejects reductions against the profile's own company id `[company+0x3b] == [this+0x00]`, requires the requested units to remain below company-side limit query `0x00429910(arg4)`, and then compares `company_scalar(0,0) * units` against the threshold-adjusted-total-plus-cash lane from `0x00476c20(1)`. Current grounded callers are the trade-block helper `0x00476e50`, the ratio or policy branch `0x00406e13`, and several shell-side sell branches around `0x0050b681`, `0x0050b747`, and `0x0050beaf`, so this is the safest current read for the reduction-feasibility sibling beside the buy gate `0x00476ff0`.","objdump + local disassembly + caller inspection + holding-slot correlation + threshold-fallback correlation + trade-branch correlation"
0x00476d10,318,profile_entry_query_can_start_new_company_or_publish_failure_notice,shell,thiscall,inferred,objdump + local disassembly + caller inspection + RT3.lng correlation,3,"Start-new-company eligibility gate above the shell dialog paths. The helper first checks scenario gate `0x00476a60`; when that gate is active it formats localized id `0x0b88` `2952` `You're not able to start a new company.` and routes the result through `0x004c98a0` as a notice, then returns failure. Otherwise it queries the caller profile's threshold-adjusted-total-plus-cash value through `0x004763b0(1) + [this+0x154]` and succeeds immediately when that result reaches threshold `0x005c8830`. When the threshold fails, it resolves the currently selected chairman profile through `0x004348c0`, formats localized id `0x010f` `271` `You don't have enough money to start a new company!...` with the required threshold and the selected chairman's current purchasing-power figure, publishes that notice through `0x004c98a0`, and returns failure. Current grounded callers are the company-list and load-screen branches at `0x004c7134` and `0x004de3f0`, so this is the clearest current owner for the start-new-company eligibility check plus failure-notice path rather than a generic purchasing-power helper.","objdump + local disassembly + caller inspection + RT3.lng correlation + purchasing-power correlation + start-company dialog correlation"
0x00476e50,407,profile_entry_compute_rounded_company_trade_block_size_by_mode,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Computes one rounded trade-block size for a caller-selected company slot. When profile guard `[this+0x1e1]` is clear the helper returns the floor block `1000`. Otherwise it derives a tentative block size from the current holding slot `[this + company_id*4 + 0x15d]`, rounds that size to the nearest `1000` through the shared `0x10624dd3` divide sequence, and then constrains it through either the buy-feasibility helper `0x00476ff0` or the sell-feasibility helper `0x00476c40` depending on the caller mode flag. On the positive path it also clamps against company-side availability query `0x004261b0`, then rounds the final result back to a `1000`-sized block with midpoint bias `+500`. Current grounded callers are the buy-feasibility and buy-commit path at `0x00476ff0/0x00477110` and the shell-side commit branches at `0x0050c16d/0x0050c20d`, so this is the safest current read for the rounded trade-block-size helper rather than a general metric scaler.","objdump + local disassembly + caller inspection + holding-slot correlation + trade-block correlation"
0x00476ff0,275,profile_entry_query_can_buy_company_holding_units_with_optional_cash_fallback,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Buy-side feasibility gate over one chairman profile and company slot. The helper resolves the target company from `0x0062be10`, defaults the requested unit count through `0x00476e50(company_id,1)` when the caller passes zero, clamps that request to at least `1`, and rejects it when company-side availability query `0x004261b0` is smaller. It then compares the cash-like field `[this+0x154]` against the current purchase cost derived from `0x00424fd0(0,0)` times the requested units. When that cash test fails and the caller's fallback flag is nonzero, it retries the same comparison after adding the direct holdings total from `0x00476320(1)` to `[this+0x154]`. Current grounded callers are the buy commit path `0x00477110`, the ratio branch `0x00406df1`, and several shell-side trade branches around `0x0050b3ba`, `0x0050b4b4`, and `0x0050bcf0`, so this is the clearest current owner for the company-holding buy-affordability gate rather than a generic transaction predicate.","objdump + local disassembly + caller inspection + trade-affordability correlation + cash-metric correlation + holding-total fallback correlation"
0x00477110,202,profile_entry_buy_company_holding_units_and_subtract_cash_metric,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Buy-side mutation over one named-profile record's per-company holding slot. Unless the caller explicitly bypasses the precheck, the helper first requires `profile_entry_query_can_buy_company_holding_units_with_optional_cash_fallback` `0x00476ff0` to succeed for the requested company and unit count. It then resolves the target company from `0x0062be10`, applies the company-side update path through `0x00424fd0(1, units)` and `0x00424fd0(0,0)`, adds the requested units into holding slot `[this + company_id*4 + 0x15d]`, converts the resulting purchase cost through `0x005a10d0` and constant `0x005c8930`, subtracts that scaled cost from qword cash-like field `[this+0x154]`, and finally refreshes scenario-side chairman state through `0x00433850` and `0x0050a670`. Current grounded callers are the shell-side buy branches around `0x0050c1ae` and the broader transaction family beside `0x00476460`, so this is the clearest current buy companion to the sell-side helper.","objdump + local disassembly + caller inspection + holding-slot correlation + cash-metric correlation + trade-branch correlation"
0x00477820,59,profile_collection_count_active_chairman_records,map,thiscall,inferred,objdump + callsite inspection,4,"Counts active chairman-profile records in the global persona collection at `0x006ceb9c`. The helper iterates the collection and increments the result only for entries whose live flag at `[profile+0x4]` is nonzero. Current grounded caller is `world_conditionally_seed_named_starting_railroad_companies` at `0x0047d440`, where count `>= 2` gates whether the second seeded railroad can be bound to another active chairman profile.","objdump + callsite inspection + caller correlation"
0x00477860,90,profile_collection_get_nth_active_chairman_record,map,thiscall,inferred,objdump + callsite inspection,4,"Returns one zero-based active chairman-profile record from the global persona collection at `0x006ceb9c`. The helper skips any entry whose live flag `[profile+0x4]` is zero and decrements the requested ordinal across the remaining active entries until it resolves one record or returns null. Current grounded caller is `world_conditionally_seed_named_starting_railroad_companies` at `0x0047d440`, which requests ordinal `1` to bind the second seeded railroad to the second active chairman profile when present.","objdump + callsite inspection + caller correlation"
0x004778c0,84,profile_collection_get_nth_active_chairman_record_id,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Returns the live collection id of the zero-based active chairman-profile entry selected by the caller ordinal. The helper walks the global persona collection at `0x006ceb9c`, skips any entry whose live flag `[profile+0x4]` is zero, decrements the requested ordinal across the remaining active entries, and returns the matched live record id through `indexed_collection_get_nth_live_entry_id` `0x00518380`; on failure it returns `0`. Current grounded caller is the `LoadScreen.win` player-list renderer `0x004e6ef0`.","objdump + local disassembly + caller correlation + active-chairman correlation"
0x00477920,91,profile_collection_count_active_chairmen_before_record_id,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Counts how many active chairman-profile records appear before one caller-supplied live record id in the global persona collection at `0x006ceb9c`. The helper walks the live collection in order, stops when the current live id equals the target id, increments the running count only for entries whose live flag `[profile+0x4]` is nonzero, and returns that active-prefix count; missing targets return `0`. Current grounded caller is the `LoadScreen.win` player-list renderer `0x004e6ef0`, where it provides the active-rank position for one selected profile id.","objdump + local disassembly + caller correlation + active-chairman correlation"
0x00477a70,94,shell_overlay_state_measure_scaled_max_world_span_with_min_floor,shell,thiscall,inferred,objdump + local disassembly + field correlation,2,"Small scalar helper over the local shell overlay-state strip. The function compares the current world-cell span widths `[this+0xbb]-[this+0xb3]` and `[this+0xbf]-[this+0xb7]`, clamps the larger span upward to minimum floor `[this+0x11f]`, scales that result by factor `[this+0xdb]`, rounds through `0x005a10d0`, and returns the final floating-point span. Current grounded caller is the nearby clamp-and-refresh owner `0x00479510`, so this is the safest current read for the overlay state's scaled max-span query rather than a generic arithmetic helper.","objdump + local disassembly + field correlation + caller correlation"
0x00477ad0,16,shell_overlay_try_get_primary_active_mode_collection,shell,thiscall,inferred,objdump + local disassembly + flag correlation,1,"Tiny mode-gated accessor over shell flag band `[this+0x33]`. When bit `0x00010000` is set it tail-jumps into `0x005130f0` and returns that active-mode collection root; otherwise it returns `0`. Current grounded caller is the broader overlay-list family around `0x00478330`.","objdump + local disassembly + flag correlation + caller correlation"
0x00477af0,272,shell_overlay_state_reset_default_world_bounds_and_normalized_rect,shell,thiscall,inferred,objdump + local disassembly + field correlation,2,"Constructor-style reset for the local shell overlay-state strip used by the world-anchor overlay builders. The helper seeds type word `[this+0x06] = 0x1000`, clears several cached ids and bounds lanes `[this+0xa3..+0xb7]` and `[this+0x10f..+0x11b]`, clamps minimum span floor `[this+0x11f]` against current world dims `0x0062c120+0x2155/+0x2159` with ceiling `0xa0`, seeds default cell bounds `[this+0xbb/+0xbf/+0xcb/+0xcf] = 10`, seeds scalar bands `[this+0xdb/+0xd3/+0xd7/+0xf3/+0x103/+0x10b] = 1.0`, and seeds the paired integer lanes `[this+0xdf/+0xe3/+0xe7/+0xeb] = 5`. Current grounded callers sit in the adjacent overlay owner family, so this is the safest current read for the overlay-state default reset rather than a generic shell constructor.","objdump + local disassembly + field correlation + world-dimension correlation"
0x00477c10,353,shell_overlay_map_screen_point_to_world_cell_pair_under_current_bounds,shell,thiscall,inferred,objdump + local disassembly + caller correlation + field correlation,2,"Maps one screen-space point into a world-cell pair under the current shell overlay-state bounds. When flag band `[this+0x33]` carries `0x02030000`, the helper uses the current bound rectangle `[this+0xc3..+0xcf]`, world-anchor bias `[this+0x86]+0x05/+0x09`, local offsets `[this+0x0b/+0x0f]`, and scale lanes `[this+0x13/+0x17]` to convert the caller point into two output floats. Otherwise it falls back to live world dims `0x0062c120+0x2155/+0x2159`, compensates for aspect mismatch, and derives the same two outputs from the broader full-world view. Current grounded caller is the drag-side owner `0x00478cb0`, so this is the safest current read for the overlay screen-point mapper rather than a generic projection helper.","objdump + local disassembly + caller correlation + field correlation + world-dimension correlation"
0x00478200,291,shell_queue_single_city_database_owner_world_anchor_overlay,shell,cdecl,inferred,objdump + local disassembly + caller-side field correlation,2,"Builds and queues one world-anchor marker for the city-database-style owner referenced by id `[this+0x11b]` in collection `0x0062bae0`. The helper first validates that owner id through `0x00517d40`, resolves the live owner through `0x00518140`, samples its normalized XY through `0x00455800/0x00455810`, derives one localized overlay label through `0x0053de00([this+0xaf],2)`, measures projected half-height through `0x00477a10` using caller bounds `[this+0xc3/+0xcb]`, local height bias `[this+0x0b]`, scale `[this+0x13]`, and owner-side vertical bias `[this+0x86]+0x05`, and finally queues the finished marker through `0x005521a0/0x00552160/0x00552560`. This is the strongest current read for the single-owner city-database overlay builder rather than a generic object marker wrapper.","objdump + local disassembly + caller-side field correlation + city-database collection correlation + world-anchor marker correlation"
0x00478330,2432,shell_queue_world_anchor_overlay_markers_for_active_mode_collections_and_optional_region_focus,shell,cdecl,inferred,objdump + local disassembly + caller-side field correlation + collection correlation,2,"Broad shell-side overlay marker owner above `shell_queue_single_city_database_owner_world_anchor_overlay` `0x00478200`. The helper first chooses one active-mode source collection through flags `[this+0x33] & 0x00010000/0x00020000` and derives the current world-space view box from `[this+0xc3/+0xc7/+0xcb/+0xcf]` plus live world dims `[0x0062c120+0x2155/+0x2159]`. It then runs six category passes `0..5`: one pass walks the active-mode collection returned by `0x005130f0 -> 0x004b2b70` or `0x0050f600` and emits bounded label ids `0x3d..0x44` for accepted rows; the other passes walk live placed structures in `0x006cec20`, filter them through station-or-transit gate `0x0047fd50`, owner/category tests, and local bounds queries `0x0047df30/0x0047df50`, and then emit category-specific overlay labels through `0x0053de00` and marker builders `0x00477a10/0x004779c0/0x005521a0/0x00552160/0x00552560`. After those six passes it also walks collection `0x006cfcbc` and, when optional focused region id `[this+0x113]` resolves in `0x006cfca8`, emits one final label-`0x3c` marker from `0x0048a170`. This is the strongest current read for the active-mode world-anchor overlay list owner rather than a single collection iterator.","objdump + local disassembly + caller-side field correlation + collection correlation + world-anchor marker correlation"
0x00478cb0,272,shell_overlay_drag_loop_apply_view_focus_updates_and_refresh_overlay_state,shell,thiscall,inferred,objdump + local disassembly + caller correlation + state correlation,2,"Interactive drag-side owner above the local shell overlay-state strip. The helper snapshots the initial controller cursor position from `[0x006d4018+0xa94/+0xa98]`, enters the surrounding shell input or capture mode through `0x0054e7e0`, repeatedly maps the current cursor through `shell_overlay_map_screen_point_to_world_cell_pair_under_current_bounds` `0x00477c10`, applies the resulting screen delta to the world view through `world_view_apply_screen_delta_to_focus_position` `0x0043d0c0`, pumps the shell-side timing or input path through `0x0054f4d0` and `0x0051d890`, and exits through `0x0054e7f0` once the current drag state reaches terminal value `7`. Current grounded sibling is the later clamp-and-refresh pass `0x00479510`, so this is the safest current read for the overlay drag loop rather than a generic modal input helper.","objdump + local disassembly + caller correlation + state correlation + world-view correlation"
0x00478dc0,1855,shell_overlay_state_rebuild_world_cell_bounds_and_normalized_rect_from_mode_flags,shell,thiscall,inferred,objdump + local disassembly + field correlation,2,"Heavy rebuild pass over the same shell overlay-state strip used by the world-anchor overlay builders. When shell flag band `[this+0x33]` lacks bits `0x02030000`, the helper leaves the derived screen rect at defaults `[this+0xef/+0xf3/+0xf7/+0xfb] = (0,1,0,1)` and returns. Otherwise it rebuilds current cell bounds `[this+0xb3..+0xbf]` either from full-world dims or by scanning world raster byte `0x0062c120+0x2131` for flag bit `0x02`, derives extent and density scalars into `[this+0xd3/+0xd7/+0xdb/+0xdf/+0xe3]`, optionally checks live placed structures in `0x006cec20` against the rebuilt bounds through `0x0047efe0`, `0x0047df00`, and `0x0047ded0`, and finally projects the resulting cell rectangle into normalized screen rect `[this+0xef/+0xf3/+0xf7/+0xfb]` using scalar bands `[this+0xff/+0x103/+0x107/+0x10b]`. This is the strongest current read for the overlay-state rebuild owner above the marker-list builders rather than a generic shell geometry helper.","objdump + local disassembly + field correlation + world-raster correlation + placed-structure correlation"
0x00479510,1134,shell_overlay_state_clamp_recenter_bounds_and_refresh_normalized_rect,shell,thiscall,inferred,objdump + local disassembly + field correlation + caller correlation,2,"Clamp-and-refresh companion for the same shell overlay-state strip. When flag band `[this+0x33]` lacks bits `0x02030000`, the helper resets normalized rect `[this+0xef/+0xf3/+0xf7/+0xfb]` to `(0,1,0,1)` and returns. Otherwise it copies current derived bounds `[this+0xb3..+0xbf]` into working bounds `[this+0xc3..+0xcf]`, uses `shell_overlay_state_measure_scaled_max_world_span_with_min_floor` `0x00477a70` plus scalar bands `[this+0xdf/+0xe3/+0xdb]` to expand or recenter those bounds when needed, clamps the resulting rectangle back inside live world dims `0x0062c120+0x2155/+0x2159`, refreshes scale lane `[this+0xd7]`, and reprojects the clamped cell rectangle into normalized rect `[this+0xef/+0xf3/+0xf7/+0xfb]` through `[this+0xff/+0x103/+0x107/+0x10b]`. Current grounded caller is the drag-or-zoom-side owner `0x00478cb0`, so this is the safest current read for the overlay-state clamp and normalized-rect refresh sibling rather than a second constructor.","objdump + local disassembly + field correlation + caller correlation + world-dimension correlation"
0x00479b50,475,shell_overlay_find_nearest_placed_structure_or_region_within_pick_radius,shell,thiscall,inferred,objdump + local disassembly + field correlation + collection correlation,2,"Nearest-target query under the same shell overlay-state family. The helper zeroes the caller's optional placed-structure and region out-ids, derives one pick radius from the current overlay width `[this+0xcb]-[this+0xc3]`, scales that radius by current shell metric `[0x006d4018+0xa8c]`, then scans live placed structures in `0x006cec20` using local coordinates `0x0047df30/0x0047df50` and Euclidean distance `0x0051db80`; when the candidate passes `0x0047fd50` it applies one extra weighting before comparing against the current best radius and writing the winning placed-structure id through the first out-pointer. When no placed structure wins and shell metric flag bit `0x4` is set, it then scans regions in `0x006cfca8` through `0x0048a170`, applies the same nearest-distance test, and writes winning region-like field `[region+0x202]` through the second out-pointer. The function returns success when either out-id becomes nonzero. Current grounded caller is the click-side owner `0x00479d30`, so this is the safest current read for the nearest overlay target query rather than a generic distance helper.","objdump + local disassembly + field correlation + collection correlation + nearest-target correlation"
0x00479d30,1519,shell_overlay_handle_click_target_dispatch_or_preview_request,shell,thiscall,inferred,objdump + local disassembly + caller correlation + request-packet correlation,2,"Click-side dispatch owner for the same shell overlay family. The helper first maps the caller screen point through `shell_overlay_map_screen_point_to_world_cell_pair_under_current_bounds` `0x00477c10`, resolves the nearest placed-structure or region target through `shell_overlay_find_nearest_placed_structure_or_region_within_pick_radius` `0x00479b50`, and then takes one of three bounded paths. Under the active-mode collection path it can reject the clicked region through `0x0048e3c0` and publish restriction notices `0x0c12/0x0c13` through `0x004c98a0`. Otherwise it packages one small local request block rooted at stack id `0x384`, populates that block from the resolved target, and either forwards it to the Multiplayer preview owner `0x006cd8d8` through `0x00407870(selector 0x41)` or dispatches it through the local active-mode handlers `0x004b3160`, `0x004b2c10`, and `0x004ab980`. The tail always eases one shell scalar through `0x0045ea20(0x38,0.5f)`. This is the strongest current read for the overlay click-dispatch owner rather than a generic modal or point-query wrapper.","objdump + local disassembly + caller correlation + request-packet correlation + active-mode dispatch correlation + multiplayer-preview correlation"
0x0047a120,3919,shell_overlay_rasterize_visible_map_classification_buffer_and_stage_rect,shell,thiscall,inferred,objdump + local disassembly + field correlation + caller correlation,2,"Broad rasterization owner above the same shell overlay-state family. The helper first resolves or stages one visible overlay rect through `0x00534930/0x00534c50`, optionally allocates a caller-owned RGBA buffer when the caller did not supply one, and then, when live world root `0x0062c120` is present, rasterizes the visible map window into that buffer. Under caller flag `0x00400000` it builds two temporary `0x100`-entry lookup tables from collection `0x006cfc9c` and helper `0x004c16f0`, then fills the visible rect by sampling world classification helpers such as `0x00534e50`, `0x00534f00`, `0x00449bd0`, and `0x00448aa0`, mapping the resulting classes through palette table `0x005f2c34`, and finally marking city-database owners from `0x0062bae0` into the same raster. When the caller supplied staging out-pointers it finishes by publishing the staged rect through `0x00534af0(1)`. This is the strongest current read for the shell-side visible overlay rasterizer rather than a small per-cell helper or the later marker builders.","objdump + local disassembly + field correlation + caller correlation + visible-raster correlation + rect-staging correlation"
0x0047b070,83,shell_overlay_state_construct_from_controller_template_copy,shell,thiscall,inferred,objdump + local disassembly + caller correlation + field correlation,2,"Small constructor beneath the shell overlay rasterizer family. The helper seeds base state through `0x00558580`, installs vtable `0x005ce840`, resets local overlay defaults through `shell_overlay_state_reset_default_world_bounds_and_normalized_rect` `0x00477af0`, allocates one temporary `0x60`-byte slab through `0x005a125d`, fills that slab from controller-owned source `0x006d4020` through `0x0053b7c0`, copies it into the live overlay state through `0x00557f80`, mirrors trailing byte `[template+0x5f]` into `[this+0xa2]`, and frees the temporary slab. This is the safest current read for the controller-template copy constructor rather than a generic allocator.","objdump + local disassembly + caller correlation + field correlation + constructor correlation"
0x0047b0d0,47,shell_overlay_state_construct_from_supplied_template_block,shell,thiscall,inferred,objdump + local disassembly + field correlation,2,"Direct copy-constructor sibling for the same shell overlay-state family. The helper seeds base state through `0x00558580`, installs vtable `0x005ce840`, reuses `shell_overlay_state_reset_default_world_bounds_and_normalized_rect` `0x00477af0`, copies trailing template byte `[src+0x5f]` into `[this+0xa2]`, and then returns the constructed overlay state. Compared with `0x0047b070`, this sibling assumes the caller already owns the source `0x60`-byte template block.","objdump + local disassembly + field correlation + constructor correlation"
0x0047b110,87,shell_overlay_state_release_template_handle_and_surface_then_tail_into_base_release,shell,thiscall,inferred,objdump + local disassembly + field correlation,2,"Primary release body for the same `0x005ce840` overlay-state family. The helper reinstalls vtable `0x005ce840`, drops optional template handle `[this+0xaf]` through `0x0053c000` on controller-owned root `0x006d4020`, releases optional surface or payload root `[this+0xab]` through `0x00542c90` and `0x0053b080`, clears both fields, and then tail-jumps into common base release `0x00558000`.","objdump + local disassembly + field correlation + release-path correlation"
0x0047b170,591,shell_overlay_state_service_surface_and_queue_overlay_markers,shell,thiscall,inferred,objdump + local disassembly + field correlation + caller correlation,2,"Main service or render owner for the `0x005ce840` overlay-state family. When the state is active and live world root `0x0062c120` exists, the helper checks whether the current overlay bounds intersect the visible world rectangle through `0x0051f2b0`, refreshes the clamped normalized rect through `shell_overlay_state_clamp_recenter_bounds_and_refresh_normalized_rect` `0x00479510`, draws the current overlay surface `[this+0xab]` through `0x0054f640/0x0051f460`, and then queues one of the overlay marker families depending on shell flag band `[this+0x33]`: the repeated active-mode list `0x00478330`, the single city-database owner marker `0x00478200`, or the fallback quad builder `0x00477d80`. When controller mask `[0x006d401c+0xc79]` includes this state's type word `[this+0x06]`, it also pushes one or two extra framed quads through `0x0054f9f0` from the local offset bands `[this+0x0b..+0x27]`. On the positive visibility path it exits through `0x0051f320` to restore the shell view state. This is the strongest current read for the overlay-state service and draw owner rather than a generic per-frame helper.","objdump + local disassembly + field correlation + caller correlation + overlay-marker correlation"
0x0047b3d0,123,shell_overlay_state_rasterize_into_surface_handle,shell,thiscall,inferred,objdump + local disassembly + caller correlation + field correlation,2,"Surface-rasterization wrapper for the same overlay-state family. When surface handle `[this+0xab]` is live, the helper acquires one temporary raster target through `0x00541970`, forwards the current overlay bounds, flags, cached ids, and normalized rect bands into `shell_overlay_rasterize_visible_map_classification_buffer_and_stage_rect` `0x0047a120`, and then commits that rasterized payload back into the live surface through `0x005438d0`. This is the safest current read for the overlay-state rasterize-to-surface wrapper rather than a second constructor or free helper.","objdump + local disassembly + caller correlation + field correlation + raster-wrapper correlation"
0x0047b450,27,shell_overlay_state_destructor_thunk_with_optional_free,shell,thiscall,inferred,objdump + local disassembly + caller correlation,1,"Destructor thunk for the `0x005ce840` overlay-state family. It re-enters `shell_overlay_state_release_template_handle_and_surface_then_tail_into_base_release` `0x0047b110` and, when the caller's low flag bit is set, frees the state object through `0x0053b080`.","objdump + local disassembly + caller correlation + destructor-thunk correlation"
0x0047b470,360,shell_overlay_state_ensure_surface_allocated_with_zoom_scaled_power_of_two_dims,shell,thiscall,inferred,objdump + local disassembly + field correlation + caller correlation,2,"Surface-allocation owner for the same `0x005ce840` overlay-state family. When live surface handle `[this+0xab]` is absent, the helper derives requested width and height either from the caller or from the current shell zoom table rooted at `[0x006d4024+0x11421e/+0x34]`, scales those dimensions by local float bands `[this+0x13]` and `[this+0x17]`, rounds them through `0x005a10d0`, and then grows each axis as a power of two starting at `0x40` until it reaches the scaled threshold bounded by the controller caps `[0x006d4024+0x11423b/+0x11423f]`. It stores the selected dimensions in `[this+0xa3/+0xa7]`, allocates one `0xec`-byte surface-like owner through `0x0053b070 -> 0x00543980(0,width,height,1)`, stores that root in `[this+0xab]`, and immediately reruns `shell_overlay_state_rasterize_into_surface_handle` `0x0047b3d0`. If the surface already exists it simply returns it. This is the strongest current read for the overlay-state ensure-surface owner rather than another constructor or draw helper.","objdump + local disassembly + field correlation + caller correlation + shell-zoom-table correlation + surface-allocation correlation"
0x0047b5e0,304,shell_overlay_state_update_hover_target_or_class_cell_and_forward_cursor_state,shell,thiscall,inferred,objdump + local disassembly + field correlation + caller correlation,2,"Pointer-move or hover-update owner for the same shell overlay-state family. The helper first maps the current screen point through `shell_overlay_map_screen_point_to_world_cell_pair_under_current_bounds` `0x00477c10`. Under overlay flag `0x00400000`, it rounds the mapped cell pair, validates it through `0x00534e50/0x00534f00`, resolves one classification-word pointer through `0x0044ade0`, and compares the resulting hovered class id against cached field `[this+0x117]`; when that class changes it stores the new id and reruns `shell_overlay_state_rasterize_into_surface_handle` `0x0047b3d0`. Otherwise it resolves the nearest placed-structure or region target through `shell_overlay_find_nearest_placed_structure_or_region_within_pick_radius` `0x00479b50`, clears cached target ids `[this+0x10f/+0x113]`, and when a hit exists stores those two resolved ids. The tail always forwards the caller coordinates plus the mapped world pair into `0x00558760`. This is the safest current read for the overlay-state hover or cursor-state updater rather than a general click dispatcher.","objdump + local disassembly + field correlation + caller correlation + hover-class correlation + nearest-target correlation"
0x0047b720,613,shell_overlay_state_handle_message,shell,thiscall,inferred,objdump + local disassembly + caller correlation + message-switch correlation,2,"Main message dispatcher for the `0x005ce840` overlay-state family. The helper switches on a small sparse message-id set rooted at `msg_id-6`, with current grounded cases for id `6`, the refresh pair `0xba/0xbb`, and the scalar-update id `0xbc`. On id `6` it first checks the state's live interaction gates through vtable slots `+0x30` and `+0x20` plus `0x005586c0`; if optional callback `[this+0x9a]` is present it forwards local-space coordinates derived from `[this+0x86]` and offset bands `[this+0x0b/+0x0f]`, otherwise it either enters `shell_overlay_handle_click_target_dispatch_or_preview_request` `0x00479d30` under flag mask `0x00030000` or the drag or focus-update owner `0x00478cb0`. On `0xba/0xbb` it toggles global gate `0x006ceba0` only for `0xbb`, ensures or rerasterizes the live surface through `0x0047b470/0x0047b3d0`, and rebuilds bounds through `0x00478dc0`. On `0xbc` it rescales cached world-span bands `[this+0xdf/+0xe3]` from message floats through `shell_overlay_state_measure_scaled_max_world_span_with_min_floor` `0x00477a70`. Every live case exits through `0x00558a10` with the original message. This is the strongest current read for the overlay-state message owner rather than a loose callback trampoline.","objdump + local disassembly + caller correlation + message-switch correlation + overlay-interaction correlation"
0x0047ba60,17,shell_overlay_reset_global_pointer_marker_slots,shell,cdecl,inferred,objdump + caller correlation + global-state correlation,2,"Clears the ten-entry global pointer-marker slot table rooted at `0x006ceba4`. The helper simply zeroes ten dwords and returns. Current grounded caller is the world-side setup or rebuild branch at `0x00449252`, so this is the clean global reset sibling for the later pointer-marker slot constructors rather than a generic scratch clear.","objdump + caller correlation + global-state correlation + pointer-marker slot-table correlation"
0x0047ba80,268,shell_overlay_rebuild_global_pointer_marker_slot,shell,thiscall,inferred,objdump + caller correlation + local disassembly + literal correlation,2,"Rebuilds one indexed global pointer-marker slot in the ten-entry table rooted at `0x006ceba4`. The caller supplies the slot index in `ECX`, one variant selector in `EDX`, two world-space anchor coordinates on the stack, and one scalar lane that is rounded through `0x005a10d0`. If the indexed slot already owns a live marker object, the helper releases it through `0x0045b160`, `0x0045b040`, and `0x0053b080`. It then allocates one `0x26e`-byte placed-structure-specialization-like object through `0x0053b070 -> 0x0045b680`, seeds it through `0x0045b9b0` from one of the three literal roots `pointer`, `pointer2`, or `pointer3`, publishes the caller world anchor through `0x004556f0`, applies scalar `0.8f` through `0x00455720`, and clears bit `0x20` in the derived state byte `[slot+0x20]`. Current grounded callers are the clustered world-side branches at `0x0051677b`, `0x00516797`, `0x005167df`, and `0x005167fe`, which makes this the indexed global pointer-marker slot builder rather than a general placed-structure constructor.","objdump + caller correlation + local disassembly + literal correlation + slot-table correlation + specialization-constructor correlation"
0x0047bb90,60,shell_overlay_release_global_pointer_marker_slots,shell,cdecl,inferred,objdump + caller correlation + global-state correlation,2,"Releases the ten-entry global pointer-marker slot table rooted at `0x006ceba4`. The helper walks each slot, and for any live marker object re-enters `0x0045b160`, `0x0045b040`, and `0x0053b080` before clearing the slot pointer. Current grounded callers are the world-side teardown branches at `0x00449292` and `0x005166d8`, so this is the matching global release loop for `shell_overlay_rebuild_global_pointer_marker_slot` `0x0047ba80`.","objdump + caller correlation + global-state correlation + slot-release correlation"
0x0047bbf0,95,runtime_profile_reset_default_setup_and_campaign_seed_fields,shell,thiscall,inferred,objdump + caller correlation + field correlation,2,"Resets the staged `0x108`-byte runtime-profile record to its default setup or campaign seed state. The helper clears the whole record, seeds compact option byte `[this+0x7d] = 1`, selected-year lane `[this+0x77] = 0x726`, live-row threshold `[this+0x79] = 1`, scroll lane `[this+0x7b] = 0`, clears bytes `[this+0x82]`, `[this+0xc4]`, `[this+0xc5]`, and `[this+0x01]`, writes one bounded random-like dword from `0x00518d70(0,0x7fff)` into `[this+0x83]`, seeds the first setup row-marker byte `[this+0x87] = 1`, and forces the file-backed launch or rehydrate latch `[this+0x97] = 1`. Current grounded callers are the setup constructor side at `0x005040aa` and the late world-entry branch at `0x004440f1`, so this is the clean default-profile reset helper rather than a setup-only local clear.","objdump + caller correlation + field correlation + staged-profile correlation"
0x0047bc50,37,runtime_profile_query_first_campaign_selector_byte_below_2,shell,cdecl,inferred,objdump + caller correlation + field correlation,2,"Scans the staged campaign selector band `[0x006cec7c+0xc6..+0xd5]` and returns the first index whose byte value is below `2`, or `16` if none match. Current grounded caller is the campaign-window side branch at `0x004b908e`, which keeps this on the staged campaign selector or unlock side of the profile rather than the earlier setup payload fields.","objdump + caller correlation + field correlation + campaign-selector-band correlation"
0x0047bea0,368,start_new_company_dialog_rebuild_primary_funding_band_and_publish_card,shell,cdecl,inferred,objdump + local disassembly + caller correlation + field correlation,2,"Rebuilds the primary funding-band globals for the `Start New Company` dialog and republishes the matching summary controls. The helper resolves the selected chairman profile through `0x004348c0`, queries one profile-side scale factor through `profile_entry_query_start_new_company_funding_scale_factor` `0x00476950`, multiplies that factor by current funding lane `0x006cec14`, chooses a step-size bucket, derives a bounded snapped band into globals `0x006cebcc`, `0x006cebd0`, and count `0x005f2c50`, and then formats the resulting range summary into controls `0x73` and `0x66` on window root `0x006cec18` through localized id `0x7150`. Current grounded callers are the dialog open path at `0x0047d051/0x0047d062/0x0047d070`, the snap-and-republish helper `0x0047c220`, and the child-control callback gate `0x0047c360`, so this is the clean primary funding-band builder beneath the dialog rather than a generic slider formatter.","objdump + local disassembly + caller correlation + field correlation + funding-band correlation"
0x0047c070,273,start_new_company_dialog_rebuild_secondary_funding_band_and_publish_card,shell,cdecl,inferred,objdump + local disassembly + caller correlation + field correlation,2,"Rebuilds the secondary funding-band globals for the `Start New Company` dialog and republishes the matching summary controls. The helper resolves the selected chairman profile through `0x004348c0(1)`, queries the threshold-adjusted total-plus-cash lane through `profile_entry_query_threshold_adjusted_holding_total_plus_cash_metric` `0x00476c20`, chooses a bounded step-size bucket, writes the resulting snapped band into globals `0x006cebd4`, `0x006cec0c`, and count `0x005f2c4c`, and then formats the summary into controls `0x73` and optionally `0x66` through localized id `0x714f` on window root `0x006cec18`. Current grounded caller is the start-company open path at `0x0047d047`, so this is the secondary funding-band sibling beside `0x0047bea0`.","objdump + local disassembly + caller correlation + field correlation + funding-band correlation"
0x0047c190,138,start_new_company_dialog_publish_current_funding_pair_labels,shell,cdecl,inferred,objdump + local disassembly + caller correlation + control-id correlation,2,"Publishes the two current funding-lane values for the `Start New Company` dialog. The helper formats current globals `0x006cec14` and `0x006cec10` through `0x0051c000` and writes them into controls `0x6f:0x7149` and `0x6f:0x714a` on the live dialog root `0x006cec18`. Current grounded caller is the funding snap-and-republish helper `0x0047c220`, so this is the narrow current-value label publisher beneath the broader funding-band builders.","objdump + local disassembly + caller correlation + control-id correlation + funding-label correlation"
0x0047c220,314,start_new_company_dialog_snap_current_funding_pair_to_band_steps_and_republish,shell,thiscall,inferred,objdump + local disassembly + caller correlation + control-id correlation,2,"Snaps the two current funding lanes for the `Start New Company` dialog into their currently computed band steps and republishes the affected labels. The helper first realigns current value `0x006cec14` inside the primary band rooted at `0x006cebd4..0x006cec0c` using the live control extent for id `0x714f`; it then optionally rebuilds the primary funding band through `0x0047bea0(0)`, realigns current value `0x006cec10` inside the secondary band rooted at `0x006cebcc..0x006cebd0` using the live control extent for id `0x7150`, rebuilds that band through `0x0047bea0(0)`, and finally republishes the current pair labels through `0x0047c190`. Current grounded callers are the dialog open path at `0x0047d058/0x0047d069` and the child-control callback gate `0x0047c360`, so this is the funding-lane snap-and-refresh owner beneath the start-company dialog.","objdump + local disassembly + caller correlation + control-id correlation + funding-band correlation"
0x0047c360,52,start_new_company_dialog_child_control_callback_refresh_funding_bands,shell,thiscall,inferred,objdump + local disassembly + caller correlation + control-id correlation,2,"Small child-control callback gate for the `Start New Company` funding dialog. The helper uses recursion latch `0x006cec1c`, checks whether the callback owner control id is `0x714f`, and then re-enters `start_new_company_dialog_snap_current_funding_pair_to_band_steps_and_republish` `0x0047c220` with the corresponding primary-band flag before clearing the latch. Current grounded caller is the dialog constructor `0x0047c590`, which installs this beneath the same funding-label family.","objdump + local disassembly + caller correlation + control-id correlation + callback-latch correlation"
0x0047c3a0,1573,start_new_company_dialog_handle_message,shell,thiscall,inferred,objdump + local disassembly + caller correlation + control-id correlation,2,"Primary message dispatcher for the `Start New Company` dialog family. The current grounded control split is narrower now: the helper handles shell messages `0xca/0xcb`, routes control `0x714b` into the staged company-name buffer at `0x006cebd8`, routes the two funding-step controls `0x714c/0x714d` through the local step selector around `0x005f2c48` and the `0x714e` summary lane, and keeps the confirmation or warning branch rooted at ids `0x03f2/0x03f4` on the modal-notice side through `0x004c98a0`. The handler also reuses the funding-band family through `0x0047c220` and the staged funding globals `0x006cec14/0x006cec10`, so the safest current read is the dialog's main message owner rather than a narrow name-field callback.","objdump + local disassembly + caller correlation + control-id correlation + funding-band correlation + modal-notice correlation"
0x0047c590,2631,start_new_company_dialog_construct,shell,thiscall,inferred,objdump + local disassembly + caller correlation + control-id correlation,2,"Constructs the modal `Start New Company` dialog instance used by `0x0047d080`. The constructor publishes the live dialog root at `0x006cec18`, builds the staged funding summary controls `0x714f`, `0x7150`, `0x7149`, and `0x714a`, installs the funding callback `0x0047c360` on the two band controls, seeds the staged company-name field `0x714b`, the step or arrow family `0x714c/0x714d`, and the companion summary lane `0x714e`, and allocates the required child-control payload blocks through the `0x0053b070 -> 0x0055ba70/0x0055ab50/0x0055a040/0x00540430` constructor strip before registering them through `0x0053f9c0`. Current grounded caller is the pre-open modal path at `0x0047d0fd`, so this is the clean dialog constructor above the funding-band and name-buffer helpers rather than a generic shell child builder.","objdump + local disassembly + caller correlation + control-id correlation + constructor-strip correlation"
0x0047d020,92,start_new_company_dialog_prepare_name_buffer_and_funding_bands,shell,cdecl,inferred,objdump + local disassembly + caller correlation + field correlation,2,"Pre-open preparation helper for the `Start New Company` dialog. The helper optionally resolves one staged name buffer through `0x0055ba70`, publishes that text through `0x0053f9c0`, frees the temporary heap copy through `0x005a1145`, and then rebuilds the dialog's funding-band state through the clustered sequence `0x0047c070(1) -> 0x0047bea0(1) -> 0x0047c220(0) -> 0x0047bea0(1) -> 0x0047c220(0) -> 0x0047bea0(0)`. This is the strongest current read for the start-company pre-open seed path directly above `start_new_company_dialog_open` `0x0047d080`.","objdump + local disassembly + caller correlation + field correlation + pre-open funding-band correlation"
0x0047d080,186,start_new_company_dialog_open,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Opens the shell-side `Start New Company...` dialog rooted at localized id `574`. The helper rolls one persona-dependent shell color or portrait token through a small static table, allocates the modal shell window through the constructor/callback pair `0x0047c590` and `0x0047c3a0`, increments the scenario-side start-company generation counter at `[0x006cec78+0x41]`, and enters the shared callback-driven modal path through `shell_open_custom_modal_dialog_with_callbacks` at `0x004c98a0`. Current grounded caller is the company-list window handler at `0x004c6f30`, which reaches this helper from the synthetic company-row id `0x7fff` after optional resignation confirmation through localized string `272` `You're currently chairman of the %1... Proceed?`. The older claim that this helper stored one live dialog owner at `0x006d3b4c` is no longer supported by direct disassembly; current stronger evidence treats `0x006d3b4c` as part of the broader shell tutorial state family instead.","objdump + RT3.lng strings + caller inspection + modal-path inspection + tutorial-state correction"
0x0047d120,509,start_new_company_dialog_commit_create_company,shell,cdecl,inferred,objdump + caller inspection + company-constructor inspection,4,"Commits the shell-side `Start New Company...` dialog and creates one fresh live company record rather than claiming one of the pre-seeded named railroads. After validating the dialog state it resolves the selected chairman-profile summary from `0x006cec78`, unlinks any existing company from that chairman through `0x00427c70`, allocates a new company id from the live company collection at `0x0062be10`, formats the dialog-owned company-name buffer at `0x006cebd8`, and initializes the new company through `0x00428420`. It then clamps one startup-funding lane against the new company's local limit fields, writes the chosen funding back to `0x006cec14`, updates one per-profile financing slot at `[profile+company_id*4+0x15d]`, applies the resulting debt through `0x00476050`, publishes the new selected company id through `0x00433790`, and triggers one shell refresh through `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kind `7`. When the dialog instead diverts into the `0x3f2` side path, it packages the same staged company payload into the Multiplayer preview request owner at `0x006cd8d8` through `0x00469d30`.","objdump + caller inspection + company-constructor inspection + global-state correlation + runtime-effect trigger-kind correlation"
0x0047d320,280,start_new_company_request_create_company,map,thiscall,inferred,objdump + caller inspection + company-constructor inspection,4,"Creates one fresh company record from a compact startup-company request block. The request layout is now partly grounded: `[this+0x0]` is the chairman profile id in `0x006ceb9c`, `[this+0x4]` is the localized railroad-name id or equivalent name token, `[this+0x8]` plus `[this+0xc]` form the startup-funding total later divided by the new company rate lane, and `[this+0x10]` is the staged company-name buffer. The helper unlinks any existing company from the referenced chairman through `0x00427c70`, allocates a fresh company id from the live company collection at `0x0062be10`, initializes that company through `0x00428420`, and updates one per-profile financing slot at `[profile+company_id*4+0x15d]`. If the request chairman matches the current selected chairman summary from `0x006cec78`, it also publishes the new selected company id through `0x00433790`. The surrounding startup-company owner is tighter now too: the neighboring post-create branch at `0x0047d42b` immediately re-enters `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kind `7`. Current grounded caller is the neighboring startup-company branch at `0x00470e48`, which reaches this helper when the request cannot be resolved to an existing company record.","objdump + caller inspection + company-constructor inspection + global-state correlation + runtime-effect trigger-kind correlation"
0x0047df70,208,placed_structure_service_candidate_local_service_comparison_cache_decay_and_row_propagation,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Broad aging and propagation pass over the placed-structure local service-comparison cache bands. The helper first resolves the optional linked placed instance through `0x00455f60`, then walks all `0x35` candidate lanes in the paired float tables rooted at `[this+0x3e]` and `[this+0x112]`, comparing their age stamps at `[this+0x1e6]` against the current scenario tick `[0x006cec78+0x15]`: entries older than `0x1d8800` are zeroed, while younger positive entries are decayed by the fixed scales at `0x005ce900` and `0x005ce8f8`. It then walks the three five-float row bands referenced by `[this+0x24]`, `[this+0x28]`, and `[this+0x2c]`, bumps active rows by the small constant at `0x005c9f18`, and propagates stronger marked row values back into the current site when the peer row-marker bytes at offsets `+0x04`, `+0x09`, `+0x0e`, or `+0x13` are set. Current grounded caller is the world-side sweep at `0x0040a6aa`, immediately before the same pass re-enters `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kind `3`, so this is the safest current read for the recurring local-service comparison-cache service pass rather than a one-off overlay helper.","objdump + caller xrefs + local disassembly + cache-age correlation + marked-row propagation correlation"
0x0047e240,240,placed_structure_query_candidate_local_service_metrics,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Queries one candidate-specific local service metric pair for the current placed-structure or site context. The helper first resolves the requested candidate index through the live structure collection at `0x0062ba8c` and rejects entries that fail `structure_candidate_is_enabled_for_current_year` at `0x0041e220`; on rejection it returns `0`, writes count `0` to the optional first out-pointer, and writes fallback float `1.0` to the optional second out-pointer. For live candidates it resolves the optional linked placed instance at `[this+0x04]`, passes that context through `0x00455f60`, and queries the base integer metric through `0x0042c960`; when the caller has a nonzero local sample list at `[this+0x38]` and `[this+0x34]`, it then accumulates matching per-cell float contributions from the world-grid table rooted at `[0x0062c120+0x2129]` into the second out-value. Current grounded callers include the shell or world-side branches at `0x0043f72e`, `0x0043f936`, `0x0047e365`, `0x0047ecd3`, `0x0047faff`, `0x004ba072`, `0x004bb51c`, and `0x00504d0f`, so this now looks like the first higher-level site query above the cargo-service bitset lane rather than another raw editor-runtime helper.","objdump + caller xrefs + callsite inspection + world-grid correlation"
0x0047e330,96,placed_structure_count_candidates_with_local_service_metrics,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Counts how many live structure candidates currently produce a valid local service-metric result for the current placed-structure or site context. The helper walks the full candidate collection at `0x0062ba8c`, resolves each entry id through `0x00518380`, and reuses `placed_structure_query_candidate_local_service_metrics` at `0x0047e240` with null out-pointers; it increments the return value only when that lower query succeeds. Current grounded callers keep this in the same site-query family as `0x0047e240`, so it now looks like the bounded count wrapper above the candidate-local service-metric lane.","objdump + caller xrefs + callsite inspection"
0x0047e390,656,placed_structure_query_cached_express_service_class_score,map,thiscall,inferred,objdump + caller xrefs + string correlation + callsite inspection,3,"Cached site-side query for one express-service class score. The helper special-cases request ids `0x384`, `0x385`, and `0x386` through three cached float-plus-timestamp pairs at `[this+0x14]/[+0x20]`, `[this+0x10]/[+0x1c]`, and `[this+0x0c]/[+0x18]`; when a cached value is younger than `0x0b40` ticks it returns immediately. On a cold path it scans all `0x35` live structure candidates, uses `0x0041e260` to keep only candidates that match the requested class, and then accumulates local per-cell contributions from the repeated sample list at `[this+0x34]` and the same world-grid tables under `[0x0062c120+0x2129]`. Nearby strings now strongly align the three class ids with the express cargo family `Passengers`, `Mail`, and `Troops`, but current grounded callers still treat this as a generic class-score query rather than a fully named UI lane. Current grounded callers include the shell or world-side branches at `0x00506c2d`, `0x00506c3d`, `0x00506e97`, and `0x00506ebf`.","objdump + caller xrefs + string correlation + callsite inspection + express-family correlation"
0x0047e620,112,placed_structure_get_nth_candidate_id_with_local_service_metrics,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,3,"Resolves the `n`th live structure candidate that currently produces a valid local service-metric result for the current placed-structure or site context. The helper walks the full candidate collection at `0x0062ba8c`, resolves each entry id through `0x00518380`, reuses `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`, and decrements the caller-supplied ordinal only on successful matches before returning the surviving candidate id. Current grounded callers keep this firmly on the read-side: `shell_station_detail_refresh_candidate_service_rows` `0x00505760` uses it to enumerate the visible service rows, while `company_rebuild_linked_transit_autoroute_site_score_cache` `0x00407bd0` uses it to walk the bounded candidate-local amount and scaling bands that feed the downstream site-ranking cache. That makes this the ordinal selector sibling above the local service-metric query rather than a mutation-side helper.","objdump + caller xrefs + local disassembly + callsite inspection + station-row correlation + company-score-cache correlation"
0x0047eb90,1048,placed_structure_refresh_candidate_local_service_comparison_cache_against_peer_site,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,3,"Rebuilds one per-candidate local service comparison cache for a `(current site, peer site)` pair. The helper resolves both sites' linked placed instances through `0x00455f60`, scans the full candidate collection at `0x0062ba8c`, filters candidates through `0x0041e260` plus `placed_structure_query_candidate_local_service_metrics` `0x0047e240`, and then computes several bounded float bands in three stack-local `0x35`-entry arrays before blending the result back into the caller-owned cache at `[this+0x3e]`, `[this+0x112]`, and `[this+0x1e6]`. The grounded caller at `0x004adcf5` immediately follows this rebuild by reading directional route-summary state through `0x0047de50` and `0x0047de90`, which keeps this helper on the comparison or preview side of the site-service family rather than the mutation side.","objdump + caller xrefs + local disassembly + callsite inspection + peer-site comparison correlation + route-summary correlation"
0x0047f910,1080,placed_structure_select_best_candidate_id_by_local_service_score,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,3,"Selects the strongest candidate id for the current placed-structure or site context under one caller-supplied candidate-class filter. The helper scans the live candidate collection at `0x0062ba8c`, keeps only candidates allowed by `0x0041e260`, and scores each survivor through either the direct local-service query `0x0047e240` or the heavier directional-route helper `0x0047e690` when route-backed state is present. It then applies the current shell or world-mode gates from `0x006cec74`, `0x006cec78`, and `0x006cec7c`, tracks the best candidate id and one parallel winner flag, and optionally writes the selected id or winner-state back through caller-owned out-pointers. Current grounded callers at `0x004ac8d6` and `0x004ac917` use it as a best-candidate selector inside a larger service-summary or preview family, which keeps it on the read-side selection path rather than the mutation path.","objdump + caller xrefs + local disassembly + callsite inspection + route-helper correlation + shell-gate correlation"
0x0047dda0,83,placed_structure_linked_route_entry_dispatch_primary_or_secondary_vfunc_if_anchor_slots_empty,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Linked-peer route-entry dispatcher beneath the placed-structure linked-site maintenance family. The helper reads route-entry anchor id `[this+0x08]` from the caller-supplied linked peer, resolves that anchor through the live route-entry collection `0x006cfca8`, and then re-enters `0x0048a090` with stack flag `1`. Only when that gate reports false does it dispatch one of two route-entry vtable calls on the resolved route-entry object: stack flag nonzero takes vtable `+0x4`, stack flag zero takes vtable `+0x8`. Current grounded callers are the paired placed-structure helpers `0x0040dba0` and `0x0040dbf0`, so this is the safest current read for the narrower linked-peer route-entry state dispatcher rather than a route builder.","objdump + caller xrefs + local disassembly + linked-route-entry-dispatch correlation"
0x0047fd50,60,placed_structure_is_station_or_transit_site_class,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Boolean class allowlist over one linked placed-structure record. The helper resolves the linked peer id at `[this+0x04]` through the live placed-structure collection `0x0062b26c`, re-enters that peer's candidate vtable `+0x80`, reads candidate class byte `[candidate+0x8c]`, and returns true only for class values `0`, `1`, or `2`; values `3`, `4`, and anything above `4` fail. Current grounded callers include the linked-transit company cache family at `0x00408280`, `0x00408f70`, and `0x004093d0`, the `cargo id 0` bypass branch inside the placed-structure sweep at `0x00452e60`, the nearby-site bucket builder `0x0047fdb0`, the linked-transit reachability gate `0x004801a0`, and the linked-site display-name or route-anchor refresh at `0x00480bb0`, so this is the safest current read for the narrower station-or-transit class gate rather than a route-reachability helper.","objdump + caller xrefs + callsite inspection + candidate-class correlation"
0x0047f320,1511,placed_structure_rebuild_local_service_sampled_cell_list_and_reset_route_link_scratch,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Broader linked-site runtime rebuild owner over the sampled local-service cell list rooted at `[this+0x34]/[this+0x38]`. The helper resolves the effective comparison mode from the linked candidate class byte `[candidate+0x8c]` unless the caller overrides it, derives one radius threshold from current world coordinates `[this+0x4a8/+0x4ac]`, frees the prior sampled-cell buffer at `[this+0x34]`, always clears the route-link scratch pair `[this+0x462/+0x466]`, and then scans one bounded world-grid rectangle through `[0x0062c120+0x2129]` with per-cell distance measured by `math_measure_float_xy_pair_distance` `0x0051db80`. For accepted cells it emits one temporary twelve-byte `(grid x, grid y, sampled score)` row through `0x0042b190`, `0x0042c530`, and `0x0042c580`; when caller arg0 is zero it then compacts one representative subset of those temporary rows into a newly allocated persistent list at `[this+0x34]` and stores the surviving row count in `[this+0x38]`, while nonzero arg0 callers use the same helper as a clear-and-scan companion without the final materialization step. Current grounded callers are the linked-site refresh and teardown strip at `0x00480542`, `0x004805c2`, `0x00480727`, and `0x004807e2`, so this is the safest current read for the local sampled-cell list rebuild plus route-link scratch reset rather than a plain route-entry-list clear helper.","objdump + caller xrefs + callsite inspection + local-service sampled-cell correlation + linked-site-runtime correlation"
0x0047e690,784,placed_structure_query_candidate_directional_route_overlay_summary,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Builds the heavier directional route-summary channel used by the station-detail candidate-service overlay when the active candidate carries a nonzero route-style byte at `[candidate+0x46]`. The helper converts one caller-supplied distance or bucket limit into a capped step count up to `0x28`, resolves the requested candidate's grouped routing class from `0x0062ba8c+0x9a`, then walks the current placed structure's linked route list at `[this+0x466]` and follows each route-linked placed structure through the live instance collections at `0x0062b26c` and the route-link collection `0x006ada90`. For matching class entries it re-enters `0x004676a0` to measure one directional route value against the peer placed-structure argument, keeps the strongest bounded values in a sorted local lane, and finally accumulates those kept route values into the caller-owned out-pointers. Current grounded overlay callers at `0x0043f89a` and `0x0043f8ee` invoke it in both directions between the preview station and each scanned placed structure before `world_render_station_candidate_service_map_overlay` turns those two returned channels into the `Coming To` and `Going From` legend rows.","objdump + caller xrefs + callsite inspection + overlay-caller correlation + legend-correlation + route-link-collection correlation"
0x00477740,42,profile_collection_construct,simulation,thiscall,inferred,objdump + world-load correlation + local disassembly,3,"World-load constructor for the live profile or chairman collection later rooted at `0x006ceb9c`. The helper seeds the indexed collection base through `0x00517ce0/0x00518570` with grounded parameters `(record_size=0xcab, initial_slots=4, growth=2, id_base=1)`, installs vtable `0x005ce828`, and returns `this`. Current grounded caller is the world-load allocation strip inside `0x00438c70`, where the resulting collection is stored into global `0x006ceb9c`.","objdump + world-load correlation + local disassembly + constructor-parameter reconstruction"
0x00477770,11,profile_collection_release_collection_storage,simulation,thiscall,inferred,objdump + world-shutdown correlation + local disassembly,2,"Release-side companion to `profile_collection_construct` `0x00477740`. The helper reinstalls vtable `0x005ce828` and tails into the common collection teardown `0x00518bd0`. Current grounded caller is the ordered world-root shutdown strip `0x00434300`.","objdump + world-shutdown correlation + local disassembly + companion correlation"
0x00477780,92,profile_collection_refresh_tagged_header_counts_from_bundle,map,thiscall,inferred,objdump + world-load correlation + local disassembly + tag correlation,3,"Bundle-load sibling for the live profile collection `0x006ceb9c`. The helper reads the three tagged header dwords `0x5209/0x520a/0x520b` through repeated `0x00531360` calls around the collection refresh `0x00518680`, accumulating the returned byte counts. Current grounded caller is the world-entry bring-up strip, which re-enters this helper to refresh the profile collection's tagged header state during runtime load.","objdump + world-load correlation + local disassembly + tag correlation + collection-refresh correlation"
0x004777e0,92,profile_collection_serialize_tagged_header_counts_into_bundle,map,thiscall,inferred,objdump + package-save correlation + local disassembly + tag correlation,3,"Package-save sibling for the live profile collection `0x006ceb9c`. The helper opens the same three tagged header dwords `0x5209/0x520a/0x520b` through repeated `0x00531340` calls around the collection serializer `0x00517d90`, accumulating the returned byte counts before closing the final tag. Current grounded caller is the package-save strip, which mirrors the profile collection's tagged header state back into the runtime bundle during world save.","objdump + package-save correlation + local disassembly + tag correlation + collection-save correlation"
0x00477820,59,profile_collection_count_active_chairman_records,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Counts the currently active chairman-profile records in the live profile collection `0x006ceb9c`. The helper walks every live record through `0x00517cf0/0x00518380/0x00518140`, tests dword `[profile+0x04]`, and increments the result only when that field is nonzero. Current grounded callers include the re-entrant chairman refresh owner `0x00433850` and neighboring chairman-company branches, so this is the safest current read for the active-chairman count helper rather than a generic slot-count query.","objdump + local disassembly + caller correlation + active-chairman correlation"
0x00477860,92,profile_collection_get_nth_active_chairman_record,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Resolves the caller-selected nth active chairman-profile record in the live profile collection `0x006ceb9c`. The helper walks every live record through `0x00517cf0/0x00518380/0x00518140`, tests dword `[profile+0x04]`, decrements the caller-supplied ordinal only on active rows, and returns the first record reached when that active-only ordinal hits zero. Current grounded callers include `scenario_state_refresh_active_chairman_profiles_with_reentrancy_guard` `0x00433850`, where it feeds the per-record refresh loop over the active chairman family. This is the safest current read for the nth-active-chairman resolver rather than a plain nth-live-entry wrapper.","objdump + local disassembly + caller correlation + active-chairman correlation"
0x004778c0,107,profile_collection_get_nth_active_chairman_id,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Sibling helper in the same active-chairman strip over the live profile collection `0x006ceb9c`. The function walks every live record through `0x00517cf0/0x00518380`, treats only rows whose resolved record has nonzero dword `[profile+0x04]` as active, decrements the caller-supplied ordinal on those active rows, and returns the live entry id when that active-row ordinal hits zero, or `0` when the walk exhausts first. Current local evidence keeps this bounded as the id-returning companion beside `profile_collection_count_active_chairman_records` `0x00477820` and `profile_collection_get_nth_active_chairman_record` `0x00477860`.","objdump + local disassembly + caller correlation + active-chairman correlation"
0x0047e9a0,315,placed_structure_query_candidate_route_or_local_service_comparison_score,map,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite inspection,2,"Bridges the heavier directional-route overlay summary path and the simpler local-service comparison lane. When the requested candidate carries a grouped routing class at `0x0062ba8c+0x9a`, the helper forwards the full query to `placed_structure_query_candidate_directional_route_overlay_summary` `0x0047e690` with the final flag forced to `0`. Otherwise it resolves the current placed structure's linked instance through `0x00455f60`, samples the current site's local float table at `[cell+0x103]` for the requested candidate lane, optionally re-enters `0x0042c080` on each local sample record at `[this+0x34/+0x38]`, and writes the bounded result back into the same comparison-cache bands rooted at `[this+0x1e6]`, `[this+0x2ba]`, and `[this+0x38e]`. Current grounded caller is the candidate-side score branch at `0x0041bbe2`, so this is the safest current read for the route-or-local comparison wrapper above `0x0047e690` rather than another route-list helper.","objdump + caller xrefs + local disassembly + callsite inspection + cache-band correlation"
0x0047d440,845,world_conditionally_seed_named_starting_railroad_companies,map,cdecl,inferred,objdump + caller xrefs + global-state inspection,4,"Conditional company-side setup helper adjacent to the `Setting up Players and Companies...` lane. Current grounded callers are the neighboring bring-up flow after world_seed_default_chairman_profile_slots at `0x004377a0` and a second setup-side branch around `0x00438300`, both under the same sandbox or non-editor shell-state conditions: it runs only when the Multiplayer preview dataset owner at `0x006cd8d8` is absent and either sandbox flag `[0x006cec7c+0x82]` is set or shell-state flag `[0x006cec74+0x14c]` is set while editor-map mode `[0x006cec74+0x68]` is clear. The helper first realigns the selected company from the chosen chairman profile when the current summary pair points at a missing company, then iterates exactly three fixed localized railroad-name ids through `0x00428420`: `0x23f` `Missouri Pacific`, `0x240` `New York Central`, and `0x241` `Grand Trunk Railroad` from `RT3.lng` ids `575..577`. That makes the branch look like a seeded trio of named starting railroad companies rather than a generic company refresh. The first seeded company is tied to the selected chairman-profile summary from `0x006cec78`, tuned from that selected chairman's per-profile fields `[profile+0x154]` and `[profile+0x158]`, and then written back as the selected company id through `0x00433790`. The second company is narrower now too: it only binds when `profile_collection_count_active_chairman_records` at `0x00477820` reports at least two live chairman records, and it then links through `profile_collection_get_nth_active_chairman_record` at `0x00477860` with ordinal `1`, so the second railroad is specifically the second active chairman-owned company rather than an arbitrary extra bind. The third railroad currently gets no matching chairman-link branch in the grounded code and therefore remains an unchaired named company in the live roster. All three records are constructed or refreshed from the live company collection at `0x0062be10` through `0x00428420`, while chairman-to-company ownership links are applied through `0x00427c70` and neighboring writes to `[profile+0x1dd]`. The tail is tighter now too: once at least three startup companies have been considered, the branch at `0x0047d6de` re-enters `scenario_event_collection_service_runtime_effect_records_for_trigger_kind` `0x00432f40` with trigger kind `7`.","objdump + caller xrefs + global-state inspection + state-accessor correlation + RT3.lng strings + company-constructor inspection + profile-helper inspection + runtime-effect trigger-kind correlation"
0x0047efe0,28,placed_structure_query_linked_company_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Returns the owning company id for one placed structure when a linked placed-instance record is present. The helper resolves `[this+0x04]` through the live placed-instance collection at `0x0062b26c` and then returns the company-like field at `[instance+0x276]`; when no linked instance is present it falls back to `0`. Current grounded callers include the station candidate-service overlay at `0x0043fff7`, where the returned company id is compared against the active company selector before the overlay chooses whether a scanned site should carry the `Already Connected by Another Company` note.","objdump + caller xrefs + callsite inspection + overlay-owner correlation"
0x0047f010,195,placed_structure_append_unique_route_entry,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Appends one unique six-byte route-entry record onto the placed-structure route list rooted at `[this+0x462]` and `[this+0x466]`. The helper first scans the existing list for the incoming leading `u16` key and returns early on duplicates; otherwise it allocates a new `(count*6)+6` byte buffer, copies the existing records, writes the new `u16` key at offset `+0x0` and the caller-supplied `u32` payload at `+0x2`, frees the previous buffer, and increments the route-entry count. Current grounded callers include the placed-structure side at `0x0042c554`, which walks the linked instance chain through `[site+0x0d6]` and `[instance+0x2a2]` while appending entries, and the world-side branch at `0x0040db7d`, which appends one selected placed-structure id plus a companion payload from a route-like table. One tighter negative boundary now matters for the station-detail overlay too: `placed_structure_query_candidate_directional_route_overlay_summary` `0x0047e690` only consumes the leading `u16` key when it walks this list and does not currently read the trailing `u32` payload at all. So this helper still owns one real six-byte `(peer-site-id, companion-payload)` list, but the overlay-side route summary depends only on the peer-site key half.","objdump + caller xrefs + callsite inspection + buffer-layout correlation + overlay-consumer boundary correlation"
0x0047f0e0,131,placed_structure_resolve_linked_instance_secondary_raster_class_record,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Resolves one secondary-raster class record for the current placed structure's linked instance coordinates. The helper resolves `[this+0x04]` through the live placed-instance collection `0x0062b26c`, reads the linked instance's normalized coordinate pair through `0x00455800` and `0x00455810`, indexes the active secondary-raster byte plane at `[0x0062c120+0x2131]`, shifts the selected byte right by three, and resolves the resulting class token through collection `0x006cfc9c`. Current grounded callers are the world-side station or site branches at `0x004ac0bd` and `0x004ac11b`, so this is the safest current read for the direct linked-instance secondary-raster class-record wrapper rather than a generic terrain query.","objdump + caller xrefs + local disassembly + linked-instance-coordinate correlation + secondary-raster-class correlation"
0x0047f170,119,placed_structure_query_linked_instance_secondary_raster_class_id,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Returns the raw secondary-raster class id for the current placed structure's linked instance coordinates. The helper resolves `[this+0x04]` through `0x0062b26c`, reads the same linked-instance coordinate pair through `0x00455800` and `0x00455810`, indexes the live secondary-raster byte plane at `[0x0062c120+0x2131]`, and returns the selected byte shifted right by three without resolving it through `0x006cfc9c`. Current grounded callers at `0x004816dd` and `0x00487aa6` use it as the raw class gate beneath the station-or-transit and linked-company filters, so this is the safest current read for the linked-instance secondary-raster class-id query rather than a route-anchor helper.","objdump + caller xrefs + local disassembly + linked-instance-coordinate correlation + secondary-raster-class correlation"
0x0047f1f0,95,placed_structure_resolve_linked_instance_secondary_raster_class_record_via_world_query,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Thin linked-instance wrapper over the world-side secondary-raster class lookup `0x0044e270`. The helper resolves `[this+0x04]` through `0x0062b26c`, samples the linked instance's normalized coordinate pair through `0x00455800` and `0x00455810`, and then forwards those coordinates into the live world root at `0x0062c120`. Current grounded callers at `0x00487af1` and `0x00487b2c` use the returned class record as the companion object-side discriminator beside the raw class-id gate `0x0047f170`, so this is the safest current read for the record-returning linked-instance terrain wrapper.","objdump + caller xrefs + local disassembly + linked-instance-coordinate correlation + world-query correlation"
0x0047f250,60,placed_structure_route_anchor_matches_or_reaches_route_entry_id,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Boolean route-entry-anchor gate over one placed structure. The helper first compares the caller-supplied route-entry id against the current site's cached route-entry anchor at `[this+0x08]`; on a direct match it returns true immediately. Otherwise it resolves that cached anchor through the live route-entry collection `0x006cfca8` and re-enters `0x0048e050` with mode `2` and fallback `-1`, then normalizes the result to a strict boolean. Current grounded callers include the world-side branches at `0x0042ff29` and `0x0044bc0e`, where it gates later linked-instance or route-style work, so this is the safest current read for the placed-structure route-anchor match-or-reachability gate rather than a plain id compare.","objdump + caller xrefs + local disassembly + route-entry-anchor correlation + reachability-helper correlation"
0x0047f290,59,placed_structure_set_overlay_mark_byte_and_refresh_linked_peer_overlay_if_changed,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small setter over placed-structure byte `[this+0x5bc]`. When the caller-supplied byte differs from the current value, the helper stores the new byte and then resolves the linked instance at `[this+0x04]` through `0x0062b26c` before re-entering `placed_structure_refresh_linked_peer_overlay_when_linked_peer_flagged` `0x0040d2d0`. Current grounded callers include the world-side branches at `0x004ae424` and `0x004b2260`, which use it while toggling selected-site or route-preview state, so this is the safest current read for the shared overlay-mark setter rather than a route-entry mutation helper.","objdump + caller xrefs + local disassembly + linked-peer-overlay correlation"
0x0047f2d0,47,route_link_route_entry_reaches_peer_site_route_group,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Boolean route-group compatibility gate over one route-link record. The helper resolves the caller-supplied peer site id through the live placed-structure collection `0x006cec20`, reads that site's cached route-entry anchor from `[site+0x08]`, resolves the current route-link record's own anchor from `[this+0x08]` through the live route-entry collection `0x006cfca8`, and then re-enters `0x0048e3c0` to test whether the two anchors belong to the same reachable route-side family. Current grounded caller is `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`, so this is the safest current read for the route-link-side peer reachability check beneath the endpoint-pair state reconciler.","objdump + caller xrefs + local disassembly + route-link correlation + route-group correlation"
0x0047f310,15,placed_structure_resolve_route_entry_anchor_record,map,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Tiny cached-record resolver over the placed structure's route-entry anchor id at `[this+0x08]`. The helper resolves that id directly through the live route-entry collection `0x006cfca8` and returns the resulting route-entry record. Current grounded callers include the linked-peer status and action branches `0x0040e54f` and `0x0040e907`, the city bonus filter at `0x004201aa`, and the later peer-route scan at `0x00487b6a`, so this is the safest current read for the direct route-entry-anchor resolver rather than a route-builder owner.","objdump + caller xrefs + local disassembly + route-entry-anchor correlation"
0x0048a090,65,route_entry_has_any_bound_anchor_slot_pair_or_triplet,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Small boolean gate over one route-entry record. With caller flag `0`, the helper returns true when either route-entry dword `[this+0x206]` or `[this+0x20a]` is not `-1`; with caller flag nonzero, it only returns false when all three dwords `[this+0x206]`, `[this+0x20a]`, and `[this+0x20e]` equal `-1`. Current grounded callers include the linked-peer route-entry dispatcher `0x0047dda0`, the placed-structure rebuild lane inside `0x0040ef10`, several linked-site route-anchor refresh branches around `0x00480603/0x00480927/0x00480993/0x00480be5`, the route builder family near `0x0049bbf2/0x0049d5a8/0x0049dc50/0x0049ded9`, and one later shell-side branch at `0x0050de1a`. This is therefore the safest current read for a route-entry anchor-slot occupancy gate rather than a placement or cargo predicate.","objdump + caller xrefs + local disassembly + route-entry-anchor-slot correlation"
0x00483f70,352,shell_service_pump_iteration,shell,thiscall,inferred,objdump + analysis-context,4,Executes one outer shell-service iteration on the shell state rooted at 0x006cec74. The helper can queue service event 0xcc through the shell bundle at 0x006d4018 polls that bundle through 0x00483ea0 refreshes active-mode or shell-state flags ensures the controller work pointer [0x006d4024+0x28] defaults to 0x0062be68 runs several global maintenance helpers and auxiliary cleanup then dispatches shell_state_service_active_mode_frame; when shell-state flag [this+0x501] is set it also marks the controller layout dirty through 0x0051f070 before returning the loop-continue result. bootstrap_init_shell_window_services calls it in the repeating shell loop that appears to own the observed shell lifetime before teardown.,objdump + analysis-context + caller xrefs
0x00485750,14,shell_has_tiger_tank_viewer,shell,cdecl,inferred,ghidra-headless,4,Returns whether the dedicated TigerTank shell viewer object at 0x006cfc8c is currently active. The 0x7533 open and 0x7534 close commands both gate on this global before showing status text or mutating viewer state.,ghidra + rizin + llvm-objdump + strings
0x004840e0,863,bootstrap_init_shell_window_services,bootstrap,cdecl,inferred,ghidra-headless,4,Consumes the early bootstrap object then allocates and installs the shell service bundle rooted at 0x006d4024 seeds a 640x480 fallback and enters the bootstrap-owned shell loop around shell_service_pump_iteration at 0x00483f70 until shell state [this+0x10] changes; after each break it drives the next shell mode transition through 0x00482ec0 and when the shell lifetime finally ends it tears the shell bundle back down through 0x00521390 before returning to app_bootstrap_main.,ghidra + rizin + llvm-objdump
0x00484440,323,app_bootstrap_main,bootstrap,cdecl,inferred,ghidra-headless,4,Primary post-CRT bootstrap coordinator; initializes COM and branding strings probes host state allocates the shell state at 0x006cec74 and then hands shell execution into bootstrap_init_shell_window_services. After that helper returns it releases the shell globals and finishes the remaining process-tail cleanup before exiting back through the CRT.,ghidra + rizin + llvm-objdump
0x00484590,887,shell_init_graphics_preset_state,shell,cdecl,inferred,ghidra-headless,3,Initializes the shell graphics-preset state block rooted at [this+0x70]. It clears a large option buffer seeds many default fields and applies one of three coarse mode layouts from its integer argument before later preset application or config-save helpers continue.,ghidra + rizin + llvm-objdump
0x00484910,105,shell_save_graphics_config,shell,cdecl,inferred,ghidra-headless,4,Persistently writes the current shell graphics configuration to data\\configuration\\game.cfg. It optionally syncs the global display runtime through 0x0051eea0 then writes config keys 0x429 and 0x48d from the shell state block before closing the file.,ghidra + rizin + llvm-objdump + strings
0x00484980,212,shell_load_graphics_config_or_init_defaults,shell,cdecl,inferred,ghidra-headless,4,Loads the shell graphics configuration from data\\configuration\\game.cfg during early shell setup. It optionally pulls the larger display-runtime blob through 0x0051ef20 validates key 0x429 reads key 0x48d into the shell state block at [this+0x70] and falls back to 0x00484590 plus 0x00484910 when the file is missing or invalid.,ghidra + rizin + llvm-objdump + strings
0x00484a60,125,shell_match_legacy_gpu_profile_token,shell,cdecl,inferred,ghidra-headless,4,Collects the current display-adapter descriptor string then scans the legacy GPU-profile table at 0x0062142c for the first matching token. The table contains vendor and chipset strings such as geforce radeon Voodoo matrox i810 sis savage and 3dfx; the returned index or -1 then drives the preset-tier tables in 0x004853c0.,ghidra + rizin + llvm-objdump + strings
0x00484d70,700,shell_apply_graphics_option_runtime_effects,shell,thiscall,inferred,ghidra-headless,3,Walks the pending graphics-option array rooted at [this+0x1c] and applies runtime side effects for the dirty entries selected by the caller mask. The cases fan into the active engine object at 0x0062c120 and shell globals under 0x006d4024 and 0x006d4030 updating several float scaled thresholds integer quality values and display capability bytes before clearing the dirty array and notifying the active shell object at 0x0062be68.,ghidra + rizin + llvm-objdump
0x004852e0,210,shell_apply_default_graphics_master_profile,shell,thiscall,inferred,ghidra-headless,4,Reads the default master graphics profile value from 0x006211dc currently 6 and broadcasts it across option ids 1 through 16 in the shell settings block. Special option ids 10 11 12 and 13 are remapped through the preset tables at 0x00621250 through 0x00621358 before the function refreshes runtime side effects through 0x00484d70 updates shell display-profile flags under 0x006d4024 and persists game.cfg through 0x00484910.,ghidra + rizin + llvm-objdump
0x004853c0,740,shell_apply_graphics_preset_bundle,shell,cdecl,inferred,ghidra-headless,4,Applies one table-driven graphics preset bundle to the shell settings object. It derives a preset tier from shell state and runtime capability probes then writes per-setting values through repeated 0x00485060 calls refreshes dependent runtime state through 0x00484d70 optionally saves game.cfg through 0x00484910 and updates several display capability flags under 0x006d4024.,ghidra + rizin + llvm-objdump
0x00485060,635,shell_set_graphics_option_with_fanout,shell,thiscall,inferred,ghidra-headless,4,Writes one graphics option value into the shell settings arrays at [this+0xac] and coordinates grouped fanout updates. Primary preset selectors recursively expand into dependent option ids 1 through 16 using preset remap tables at 0x00621250 through 0x00621358. The function compares the new normalized value against the previous setting invokes 0x00484d70 when a runtime refresh is needed and persists game.cfg through 0x00484910 once the update batch completes.,ghidra + rizin + llvm-objdump
0x00485760,2746,vehicle_visual_init_running_gear_and_smoke_effects,bootstrap,thiscall,inferred,ghidra-headless,4,Builds a larger vehicle visual bundle covering running-gear assets smoke effects and attachment-audio objects. The routine fills indexed road-wheel visual arrays from RoadWheelR and RoadWheelL asset strings creates direct MuzzleSmoke and ExhaustSmoke sprite emitters at [this+0x216] and [this+0x21a] and then creates five fixed attachment objects at [this+0x3cc] through [this+0x3dc] for diesel1 tracks german88 turret and mantlet audio assets before registering them on the owner.,ghidra + rizin + llvm-objdump + strings
0x004858e0,1677,vehicle_visual_build_exhaust_running_gear_track_and_mantlet_attachment_children,bootstrap,thiscall,inferred,objdump + local disassembly + rdata literal inspection,2,"Broader vehicle-side child-builder under `vehicle_visual_init_running_gear_and_smoke_effects` `0x00485760`. The helper formats and allocates one attachment child for `%1_ExhaustSmoke.3dp`, one payload record for `%1_MuzzleFlash.3dp`, then builds and registers a larger running-gear strip including `%1_RoadWheelL%2.3dp`, `%1_RoadWheelR%2.3dp`, `%1_IdlerWheelL.3dp`, `%1_IdlerWheelR.3dp`, `%1_DriveWheelL.3dp`, `%1_DriveWheelR.3dp`, `%1_TrackL.3dp`, `%1_TrackR.3dp`, and `%1_MantletLight1.3dp`. Along that path it publishes child handles through `0x0052d8a0/0x0052d9a0`, derives local triplet bands through `0x0052e780`, and uses `0x0052db10/0x0052dc00` to materialize and threshold-bucket grouped packet rows on the two running-gear child roots at `[this+0x232]` and `[this+0x236]`. Current evidence is strongest for the exhaust, wheel, track, and mantlet attachment-child builder rather than the top-level vehicle visual constructor itself.","objdump + local disassembly + rdata literal inspection + vehicle-visual correlation + grouped-subrecord correlation"
0x004883f0,325,scenario_text_export_append_numbered_entry,scenario,cdecl,inferred,ghidra-headless,4,Formats and appends one numbered translation entry into the scenario-text export buffer. It duplicates the source text applies the export wrapper template through helper formatters and appends the finished block through 0x531030 while updating the running non-comment word count at 0x006cfca0.,ghidra + rizin + llvm-objdump + strings
0x004886e0,3796,scenario_text_export_build_language_file,scenario,cdecl,inferred,ghidra-headless,4,Builds one MAPS\\%s.lng scenario-text export for the active map and returns the non-comment word count. It writes translator guidance and section headers then walks map briefing territory city geographic-label station company and event collections appending numbered entries through 0x004883f0 before finalizing the output buffer.,ghidra + rizin + llvm-objdump + strings
0x00487450,153,shell_open_tiger_tank_viewer,shell,cdecl,inferred,ghidra-headless,3,Allocates and shows the dedicated TigerTank shell viewer object when no viewer is active. It samples shell-owned placement data allocates a 0x434-byte object initializes it through 0x00485760 with the TigerTank title and stores the resulting viewer pointer in 0x006cfc8c.,ghidra + rizin + llvm-objdump + strings
0x004874f0,70,shell_close_tiger_tank_viewer,shell,cdecl,inferred,ghidra-headless,4,Closes and frees the dedicated TigerTank shell viewer rooted at 0x006cfc8c. It detaches the viewer if currently selected in the shell owner at 0x0062be68 destroys its internal resources through 0x00530680 frees the object and clears the global viewer slot.,ghidra + rizin + llvm-objdump + strings
0x00489830,496,scenario_text_export_report_language_file,scenario,cdecl,inferred,ghidra-headless,3,Opens one existing MAPS\\%s.lng file for the selected map and reports on its parsed contents without rebuilding it. The routine loads the file into memory iterates numbered entries through 0x00488540 formats summary strings through 0x004895c0 and presents success or failure dialogs when interactive mode is enabled.,ghidra + rizin + llvm-objdump + strings
0x00489a20,1085,scenario_text_export_batch_process_maps,scenario,cdecl,inferred,ghidra-headless,4,Enumerates maps\\*.gmp and batch-processes every scenario through the scenario-text export branch. Command 0x7542 runs the build path through 0x004886e0 while command 0x7543 runs the report path through 0x00489830; the wrapper tracks progress formats per-map status strings and emits a final summary dialog.,ghidra + rizin + llvm-objdump + strings
0x004a7030,113,train_serialize_tagged_route_list_payload_into_bundle,simulation,thiscall,inferred,objdump + local disassembly + train-save correlation,3,"Per-train save-side tagged payload owner beneath the live train collection package-save strip. The helper writes opening tag `0x5dc1`, writes one `(count*0x33)` byte route-list payload from buffer `[this+0x00]` using count `[this+0x04]`, and then writes closing tag `0x5dc2`. Current grounded caller is `train_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle` `0x004b27a0`, so this is the safest current read for the live train route-list serializer rather than a broader collection walk.","objdump + local disassembly + train-save correlation + route-list-buffer correlation"
0x004a8310,80,train_forward_rgb_triplet_to_linked_owner_chain,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Shared train-side RGB publish helper. The helper resolves the linked owner chain from train field `[this+0x41]` through collection `0x0062ba84`, then repeatedly dispatches the caller-supplied RGB triplet through each resolved owner's vtable slot `+0x58` following the linked sibling chain at `[owner+0x352]` until the chain terminates at `-1`. Current grounded callers are the collection-wide train color passes `0x004b28e0` and `0x004b29e0`, so this is the safest current read for the train-linked RGB forwarder rather than a train metric query.","objdump + local disassembly + caller correlation + linked-owner-chain correlation"
0x004a7350,1,train_runtime_service_noop_placeholder,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,1,"Single-instruction `ret` placeholder in the train runtime strip. Current grounded caller is the shell-gated collection sweep `0x004b2a90`, which iterates all live train entries and dispatches here only when shell-state latch `[0x006cec74+0x1cf]` is nonzero. This is therefore the safest current read for a no-op train-runtime service placeholder rather than a hidden train mutation owner.","objdump + local disassembly + caller correlation + collection-sweep correlation"
0x004a84b0,195,train_refresh_tagged_route_list_payload_from_bundle,simulation,thiscall,inferred,objdump + local disassembly + train-load correlation,3,"Per-train load-side tagged payload owner beneath the live train collection bundle refresh. The helper reads opening tag `0x5dc1`, allocates or fills the `0x33`-stride route-list payload buffer at `[this+0x00]` using count `[this+0x04]`, clears runtime dwords `[this+0x1c6]` and `[this+0x0c8]`, conditionally re-enters `0x004a8220(1,1)` when byte `[this+0x0f4]` is set, and then reads closing tag `0x5dc2`. Current grounded caller is `train_collection_load_tagged_header_counts_and_refresh_live_records_from_bundle` `0x004b2700`, so this is the safest current read for the live train route-list payload refresh rather than a route-builder owner.","objdump + local disassembly + train-load correlation + route-list-buffer correlation + runtime-clear correlation"
0x004b2340,42,train_collection_construct,simulation,thiscall,inferred,objdump + world-load correlation + local disassembly,3,"World-load constructor for the live train collection later rooted at `0x006cfcbc`. The helper seeds the indexed collection base through `0x00517ce0/0x00518570` with grounded parameters `(record_size=0x1d5, initial_slots=0x32, growth=0x14, id_base=1)`, installs vtable `0x005d00c8`, and returns `this`. Current grounded caller is the world-load allocation strip inside `0x00438c70`, where the resulting collection is stored into global `0x006cfcbc`.","objdump + world-load correlation + local disassembly + constructor-parameter reconstruction"
0x004b2370,55,train_collection_release_live_entries,simulation,thiscall,inferred,objdump + local disassembly + companion correlation,2,"Release-side live-entry sweep beneath the train collection family. The helper repeatedly resolves the first live entry id through `0x00517cf0/0x00518380`, dispatches each entry through collection vtable slot `+0x08`, and then tails into `0x00518600` when no live entries remain. Current grounded direct caller is the top-level release wrapper `0x004b23b0`.","objdump + local disassembly + companion correlation + live-entry-release sweep"
0x004b23b0,18,train_collection_release_entries_and_collection_storage,simulation,thiscall,inferred,objdump + world-shutdown correlation + local disassembly,2,"Release-side companion to `train_collection_construct` `0x004b2340`. The helper reinstalls vtable `0x005d00c8`, re-enters `train_collection_release_live_entries` `0x004b2370`, and then tails into the common collection teardown `0x00518bd0`. Current grounded caller is the ordered world-root shutdown strip `0x00434300`.","objdump + world-shutdown correlation + local disassembly + companion correlation"
0x004b23d0,83,train_collection_allocate_and_construct_entry_from_stack_seed_and_owner_id,simulation,thiscall,inferred,objdump + local disassembly + constructor-chain inspection,3,"Shared train-collection allocator wrapper immediately above the broader train family. The helper first seeds one stack-local temporary through `0x004a7400`, allocates a fresh collection entry id through `0x00518900`, resolves the new record through `0x00518140`, and then forwards the new id plus one caller-supplied owner or company id into `0x004a7410` to initialize the live train record before clearing the stack temporary through `0x004a6e50`. The row is therefore kept at that allocation-and-constructor-chain level with the caller seed payload bounded structurally.","objdump + local disassembly + constructor-chain inspection + collection-allocation correlation"
0x004b2700,143,train_collection_load_tagged_header_counts_and_refresh_live_records_from_bundle,simulation,thiscall,inferred,objdump + world-load correlation + local disassembly + tag correlation,3,"Bundle-load sibling for the live train collection `0x006cfcbc`. The helper reads tagged sections `0x5209/0x520a/0x520b` through repeated `0x00531360` calls, refreshes the indexed-collection header through `0x00518680`, and then walks every live train entry, dispatching each one through `0x004a84b0` with the active bundle handle before closing the final tag. Current grounded caller is the world-entry bring-up family, where this helper refreshes the live train records from the tagged bundle after collection construction.","objdump + world-load correlation + local disassembly + tag correlation + per-entry-load correlation"
0x004b27a0,118,train_collection_serialize_tagged_header_counts_and_save_live_records_into_bundle,simulation,thiscall,inferred,objdump + package-save correlation + local disassembly + tag correlation,3,"Package-save owner for the live train collection `0x006cfcbc`. The helper opens tagged sections `0x5209/0x520a/0x520b` through repeated `0x00531340` calls, serializes the indexed-collection header through `0x00517d90`, and then walks every live train entry, dispatching each record through `0x004a7030` with the active bundle handle before closing the final tag. Current grounded caller is the package-save path that persists the live runtime collections beside the other world roots.","objdump + package-save correlation + local disassembly + tag correlation + per-entry-save correlation"
0x004b2820,62,train_collection_remove_nonnegative_route_list_rows_matching_peer_site_id,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide cleanup pass over the live train collection. The helper walks every live train entry and re-enters `0x004af610` with one caller-supplied peer-site id. That per-train worker removes route-list rows whose sign byte `[row+0x28]` is nonnegative and whose peer-site `u16` at `[row+0x29]` matches the requested id, then refreshes the train's runtime state when its route list becomes empty. Current grounded caller is the linked-site refresh strip at `0x004805d4`, so this is the safest current read for the collection-wide train route-list cleanup by peer-site id rather than a generic route reset.","objdump + local disassembly + caller correlation + per-train-worker correlation"
0x004b2860,62,train_collection_remove_negative_route_list_rows_matching_dword_key,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide companion cleanup pass over the live train collection. The helper walks every live train entry and re-enters `0x004af760` with one caller-supplied dword key. That per-train worker removes route-list rows whose sign byte `[row+0x28]` is negative and whose trailing dword `[row+0x2b]` matches the requested key, then refreshes the train's runtime state when its route list becomes empty. Current grounded caller is the route-entry mutation strip at `0x00490f5b`, so this is the safest current read for the collection-wide train route-list cleanup by alternate negative-entry key rather than a site-id pass.","objdump + local disassembly + caller correlation + per-train-worker correlation"
0x004b28a0,56,train_collection_clear_runtime_dword_0x1a3_for_all_live_entries,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Collection-wide clear pass over train runtime dword `[train+0x1a3]`. The helper walks every live train entry and re-enters the tiny per-train store `0x004a7020`, which zeroes that dword. Current grounded callers include the route-mode branch at `0x0048b859` and neighboring route-style refresh strips, so this is the safest current read for the all-trains clear of the unresolved runtime field at `0x1a3` rather than a broader route rebuild.","objdump + local disassembly + caller correlation + per-train-clear correlation"
0x004b28e0,243,train_collection_publish_metric_derived_rgb_triplets_to_linked_owner_chain,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide train-side color or presentation refresh owner. The helper walks every live train entry, queries one per-train scalar through `0x004a9630`, converts that scalar into two bounded float lanes around the constants at `0x005c8770` and `0x005c8628`, rounds the resulting values through `0x005a10d0`, fixes the third channel at `0x33`, and forwards the final RGB triplet through `0x004a8310` into the linked owner chain rooted from `[train+0x41]`. Current grounded caller is the broader runtime branch at `0x004f4a75`, so this is the safest current read for the collection-wide train metric-derived RGB publish pass rather than a route-list cleanup helper.","objdump + local disassembly + caller correlation + per-train-scalar correlation + rgb-publish correlation"
0x004b29e0,108,train_collection_publish_boolean_match_color_triplets_by_train_field_0x51,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide train-side color publish companion over train field `[train+0x51]`. The helper walks every live train entry, compares that field against one caller-supplied dword, converts the resulting boolean `0/1` through `0x0051dfc0` into a packed preview color, splits the packed result into RGB bytes, and forwards the final triplet through `0x004a8310` into the linked owner chain. Current grounded caller is the broader runtime branch at `0x004f4a99`, so this is the safest current read for the all-trains boolean-match color publish pass rather than a route-list cleanup or world-load owner.","objdump + local disassembly + caller correlation + field-match correlation + rgb-publish correlation"
0x004b2a50,62,train_collection_publish_zero_rgb_triplets_to_linked_owner_chain,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Collection-wide train-side clear companion over the same linked owner chain. The helper walks every live train entry and forwards the fixed RGB triplet `(0,0,0)` through `0x004a8310`. Current grounded caller context is the adjacent train runtime strip, so this is the safest current read for the all-trains RGB clear pass rather than a route-list helper.","objdump + local disassembly + caller correlation + rgb-publish correlation"
0x004b2a90,72,train_collection_run_shell_gated_noop_refresh_placeholder,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Shell-gated collection-wide train refresh placeholder. The helper only runs when shell-state latch `[0x006cec74+0x1cf]` is nonzero, then walks every live train entry and dispatches the per-train placeholder `0x004a7350`, which currently returns immediately. Current grounded caller is the zero-depth optional collection-refresh dispatcher `0x00433b80`, so this is the safest current read for the train-side shell-gated no-op refresh pass rather than a hidden runtime mutation owner.","objdump + local disassembly + caller correlation + shell-gate correlation + zero-depth-dispatch correlation"
0x004b2ae0,76,train_collection_service_flagged_runtime_entries_via_0x4a8220,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Collection-wide flagged-train runtime service pass. The helper walks every live train entry and, only when byte `[train+0x0f4]` is nonzero, re-enters `0x004a8220(1,1)` on that train. Current grounded caller is the zero-depth optional collection-refresh dispatcher `0x00433b80`, so this is the safest current read for the all-trains flagged runtime service pass rather than another load/save helper.","objdump + local disassembly + caller correlation + flagged-train correlation + zero-depth-dispatch correlation"
0x004b2b30,38,train_route_list_reset_descriptor_and_trailing_scalar_band,simulation,thiscall,inferred,objdump + local disassembly + field-layout correlation,2,"Resets one local train route-list descriptor or adjunct block in place. The helper clears the two leading dwords, sets dword `+0x08` to `-1`, clears byte `+0x0c` and dword `+0x0d`, then clears the trailing five dwords rooted at `+0x11`. This is the safest current read for the in-place route-list descriptor reset helper rather than a train-record constructor.","objdump + local disassembly + field-layout correlation"
0x004b2b60,12,train_route_list_get_row_ptr_by_index,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Returns one `0x33`-stride route-list row pointer by index from the train route-list buffer rooted at `[this+0x00]`. Current grounded callers include the cleanup helpers `0x004af610/0x004af760` and several shell-side adjunct families, so this is the narrow indexed route-row accessor rather than a train collection helper.","objdump + local disassembly + caller correlation + route-list-buffer correlation"
0x004b2b70,2,train_route_adjunct_identity_passthrough,simulation,thiscall,inferred,objdump + local disassembly + caller correlation,1,"Single-instruction identity helper that returns the caller train pointer unchanged. Current grounded callers are the selector-`0x42` multiplayer train-adjunct branch and the shell overlay owner that already resolved a live train collection entry before re-entering this helper, so this is best read as a structural train-adjunct passthrough placeholder.","objdump + local disassembly + caller correlation"
0x004b2b80,29,train_route_list_count_rows_with_nonnegative_sign_byte,simulation,thiscall,inferred,objdump + local disassembly + route-list-row correlation,2,"Counts how many `0x33`-stride route-list rows carry a nonnegative sign byte at offset `+0x28`. The helper walks the live route-list buffer and increments the result only when that byte is not negative. This is the safest current read for the positive-sign row counter beside the route-row accessors.","objdump + local disassembly + route-list-row correlation"
0x004b2ba0,40,train_route_list_reset_descriptor_and_trailing_scalar_band_alt,simulation,thiscall,inferred,objdump + local disassembly + field-layout correlation,1,"Register-allocation variant of `train_route_list_reset_descriptor_and_trailing_scalar_band` `0x004b2b30`. The helper performs the same in-place reset over the leading descriptor band and trailing five-dword scalar band. This is the safest current read for the duplicate reset sibling rather than a separate train-record owner.","objdump + local disassembly + field-layout correlation + duplicate-reset correlation"
0x004b2bd0,18,train_route_list_get_current_row_ptr_or_null,simulation,thiscall,inferred,objdump + local disassembly + route-list-row correlation,2,"Returns the current `0x33`-stride route-list row pointer selected by descriptor dword `+0x08`, or null when that selector is negative. This is the safest current read for the current-row accessor beside the route-list helper strip.","objdump + local disassembly + route-list-row correlation"
0x004b2bf0,24,train_route_list_get_current_or_last_row_ptr_or_null,simulation,thiscall,inferred,objdump + local disassembly + route-list-row correlation,2,"Returns one `0x33`-stride route-list row pointer from the same helper descriptor: a negative selector yields null, selector `0` maps to the last live row, and any other positive selector maps to the immediately preceding row. This is the safest current read for the current-or-last route-row accessor beside `0x004b2bd0`.","objdump + local disassembly + route-list-row correlation"
0x004bfb30,956,shell_format_company_financial_summary_card,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Reusable shell company financial-summary formatter shared by `CompanyDetail.win` and the company-list row lane. The helper resolves the linked chairman and current selected profile through `0x006cec78` and `0x006ceb9c`, highlights the card when the company belongs to the selected chairman, formats the visible company header text, and then renders a compact three-row finance block under localized ids `633` `Cash:`, `607` `Revenue:`, and `925` `Profits:`. The grounded metric mapping is now tighter too: `Cash:` comes from `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` with slot `0x0d` and stat-family selector `0x2329`, `Revenue:` comes from the same reader with slot `0x2c`, and `Profits:` comes from slot `0x2b`; the revenue and profit rows also switch color when the readback is negative. Grounded callers are `shell_company_detail_render_company_summary_card` at `0x004c1ab0` and `shell_company_list_format_company_or_start_row` at `0x004c6b40`.","objdump + RT3.lng strings + caller inspection + shared shell formatter correlation + compact-metric-row correlation"
0x004c5540,347,shell_company_detail_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `CompanyDetail.win` panel later published at `0x006cfe4c`. The constructor installs vtable `0x005d0858`, binds `CompanyDetail.imb` and `CompanyDetail.win` through `0x0053d110` and `0x0053fa50`, seeds the primary action controls `0x9470`, `0x9471`, `0x947d`, `0x947e`, `0x948c`, `0x948d`, and `0x948e` through callbacks `0x004c1730`, `0x004c1ab0`, `0x004c1ec0`, `0x004c22e0`, `0x004c1d70`, and `0x004c1d30`, stores the singleton resources at `0x006cfe50..0x006cfe58`, and then immediately repopulates the visible state through `shell_company_detail_window_refresh_controls` at `0x004c2ca0`. One negative boundary is useful too: current constructor-time binding still does not install dedicated per-row callbacks for the broader section-0 governance bands `0x94d4..0x9537` and `0x9538..0x959b`, which keeps those rows looking more like resource-defined display bands gated and restyled by the refresh pass than like individually code-rendered widgets. A grounded shell detail-manager caller reaches this constructor at `0x004dde24`, which corrects the earlier assumption that the post-roster company branch still had no recovered detail-window owner.","objdump + strings + detail-manager correlation + caller inspection + constructor-binding absence correlation"
0x004c0160,2214,shell_format_company_stock_data_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Shared shell stock-data formatter used by `LoadScreen.win` page `6`. The helper resolves the selected company through the live collection at `0x0062be10`, builds the section headers `928` `Largest Shareholders`, `929` `Shares`, and `930` `Per Share Data`, ranks the top positive active-chairman holdings for that company through the profile collection at `0x006ceb9c`, and renders up to four shareholder rows with the current share counts from `[profile + company_id*4 + 0x15d]`. It then formats the full six-row per-share block: help texts `931..936` and labels `937..942`, with `Share Price` from stat-family `0x2329/0x1c`, `Book Value Per Share` from `0x2329/0x1d`, `Revenue Per Share` from `0x2329/0x1e`, `Earnings Per Share` from `0x2329/0x1f`, `Dividend Per Share` from `0x2329/0x20`, and `5 Year Weighted Return` from `0x2329/0x21` via `company_compute_five_year_weighted_shareholder_return` `0x004246b0`. Current grounded caller is `shell_load_screen_render_company_stock_data_panel` at `0x004e5130`.","objdump + RT3.lng strings + caller inspection + shareholder-ranking correlation + stock-data-label correlation + per-share-metric correlation + weighted-return correlation"
0x004c1610,48,shell_company_detail_bind_bond_row_band_for_active_panel,shell,cdecl,inferred,objdump + caller inspection,4,"Tiny CompanyDetail helper that binds one contiguous debt-row control band to whichever bond panel is active. When the source control id is `0x947e` it enables the upper row band `0x94e8..0x950f`; otherwise it enables the sibling row band `0x9510..0x9537`. Current grounded owner is the CompanyDetail refresh path at `0x004c2ca0`, where this helper sits beside the shared bond readout callback for controls `0x947d` and `0x947e` and makes those two controls read as twin bond-slot list owners rather than as one-off buttons.","objdump + caller inspection + bond-row-band correlation"
0x004c16b0,35,shell_company_detail_copy_selected_company_debt_slot_triplet,shell,cdecl,inferred,objdump + caller inspection,3,"Small CompanyDetail helper that copies one 12-byte triplet from the currently selected company's debt-record band near `[company+0x5f + slot*0xc]` into a caller-supplied output buffer. Current grounded callers use it while building the bond maturity and repay readout lane and the adjacent action-message debt checks.","objdump + caller inspection + debt-slot correlation"
0x004c16f0,59,shell_company_detail_resolve_selected_company,shell,cdecl,inferred,objdump + caller inspection,4,"Resolves the current `CompanyDetail.win` company into the live company collection and returns the validated company record pointer or null. The helper reads the selected company id from shell detail owner `0x006d0818+0x90`, rejects nonpositive ids, verifies existence through company collection `0x0062be10`, and then returns the concrete record through `0x00518140`. It is the common shared accessor beneath the CompanyDetail read-side panels, finance actions, territory-access lane, and company-governance flows.","objdump + caller inspection + shared CompanyDetail accessor correlation"
0x004c1730,546,shell_company_detail_render_financial_history_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"CompanyDetail-specific widget callback for control `0x9470`. The helper resolves the currently selected company through the shell detail owner at `0x006d0818`, lays out a five-step history strip, and renders localized labels `607` `Revenue:`, `944` `Expenses:`, `945` `Interest:`, `610` `Profit:`, and `611` `Lifetime`. Current grounded metric reads come from the same wider company history family through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0`, notably slots `0x2c`, `0x2e`, `0x2f`, and `0x2b`. Current grounded owner is the CompanyDetail constructor `0x004c5540`, which binds this callback onto the finance-history panel rather than onto a generic company-list row.","objdump + RT3.lng strings + caller inspection + CompanyDetail panel correlation"
0x004c1ab0,169,shell_company_detail_render_company_summary_card,shell,cdecl,inferred,objdump + caller inspection + shared formatter correlation,4,"Thin `CompanyDetail.win` widget callback for control `0x9471`. The helper resolves the current selected company through the shell detail owner at `0x006d0818` and forwards the draw to `shell_format_company_financial_summary_card` at `0x004bfb30` using the widget rectangle supplied by the current control tree. Current grounded owner is the CompanyDetail constructor `0x004c5540`, which binds this callback beside the separate financial-history panel callback at `0x004c1730`.","objdump + caller inspection + shared formatter correlation"
0x004c1d30,48,shell_company_detail_select_territory_access_row,shell,cdecl,inferred,objdump + caller inspection,4,"Small `CompanyDetail.win` territory-picker selection callback bound to the adjacent control pair `0x948d` and `0x948e`. When the incoming row ordinal is nonnegative, the helper resolves the current picker widget under `0x948c`, reads the chosen territory id from the row field at `[widget+0x117]`, and then forwards that territory id into `shell_company_detail_refresh_selected_territory_access_summary` at `0x004c1b60`. A negative row ordinal falls back to territory id zero before the same summary refresh.","objdump + caller inspection + picker-field correlation"
0x004c1d70,323,shell_company_detail_render_territory_access_row,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Territory-row renderer for the `CompanyDetail.win` access-rights lane. The callback resolves the currently selected company through `0x006d0818`, resolves the supplied territory id through the territory collection at `0x006cfc9c`, and then renders the territory row through the shell text widgets rooted at `0x006cfe50` and `0x006cfe58`. Current grounded logic also checks access rights through `company_has_territory_access_rights` at `0x00424010`, varies the row styling accordingly, and triggers the focused-row highlight path through `0x0054f710` when the rendered territory matches the globally selected territory id at `0x006cfe5c`. The CompanyDetail constructor binds this callback onto the paired territory-row controls `0x948d` and `0x948e`.","objdump + RT3.lng strings + caller inspection + territory-row correlation"
0x004c1b60,462,shell_company_detail_refresh_selected_territory_access_summary,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Refreshes the selected-territory status summary in `CompanyDetail.win`. The helper caches the active territory id in `0x006cfe5c`, resolves the territory through `0x006cfc9c`, and formats one of three localized status texts for the current selected company: id `946` when the company already has access rights, id `947` when rights are unavailable but purchasable, or id `948` when the company cannot purchase rights at all. It also republishes the selected-territory control rooted at `0x948c`. Current grounded callers are the territory-summary callbacks at `0x004c1d30`, `0x004c1d70`, and `0x004c22e0`.","objdump + RT3.lng strings + caller inspection + territory-status correlation"
0x004c1ec0,587,shell_company_detail_render_bond_maturity_and_repay_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"CompanyDetail-specific bond readout callback bound to controls `0x947d` and `0x947e`. The helper resolves the currently selected company through `0x006d0818`, indexes one 12-byte debt-record slot from the selected company near `[company+0x5f + slot*0xc]`, formats the maturity caption through localized id `949` `Due %1`, formats the current bond amount or value through the shared numeric formatter family at `0x0051c000`, and then renders the repay affordance through localized id `950` `Repay this bond.`. In the surrounding refresh path this panel is paired with `shell_company_detail_bind_bond_row_band_for_active_panel` at `0x004c1610`, so the two controls now read as the owners of twin repayable bond-slot row bands `0x94e8..0x950f` and `0x9510..0x9537` rather than as isolated text widgets. Current grounded owner is the CompanyDetail constructor `0x004c5540`, which binds this callback onto the adjacent debt-panel controls rather than onto the territory or finance-history lanes.","objdump + RT3.lng strings + caller inspection + debt-panel correlation + bond-row-band correlation"
0x004c22e0,56,shell_company_detail_sync_selected_territory_from_picker,shell,cdecl,inferred,objdump + caller inspection,4,"Small `CompanyDetail.win` territory-sync callback for control `0x948c`. The helper resolves the current territory-picker widget through the live CompanyDetail window at `0x006cfe4c`, reads the currently focused territory id from `[widget+0x117]` when a picker row is present, and then forwards that territory id into `shell_company_detail_refresh_selected_territory_access_summary` at `0x004c1b60`. When no picker row is active it falls back to territory id zero before refreshing the same summary.","objdump + caller inspection + picker-sync correlation"
0x004c23a0,1259,shell_company_detail_render_debt_credit_and_rate_summary_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"CompanyDetail-specific summary callback bound to control `0x9488`. The helper resolves the currently selected company through `0x006d0818` and renders the player-facing debt and rate block under localized ids `951` `Total Debt:`, `952` `Credit Rating:`, `953` `Average Interest Rate:`, and `954` `Prime Rate:`. Current grounded logic now has concrete helper ownership for the rate rows: `company_compute_weighted_average_bond_interest_rate` `0x00423e40` feeds `Average Interest Rate`, `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580` feeds `Prime Rate`, the credit-rating text table at `0x00620d00..0x00620d14` is chosen from the rounded company credit-rating score at `0x00425320`, and the leading debt total comes from the current metric family through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0` using stat-family `0x2329` and slot `0x12`. The CompanyDetail refresh path wires this callback onto the same read-side tab family as the bond and stock-summary panels.","objdump + RT3.lng strings + caller inspection + finance-summary correlation + average-interest correlation + prime-rate correlation + debt-total correlation"
0x004c2720,1394,shell_company_detail_render_share_value_and_dividend_summary_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"CompanyDetail-specific stock-summary callback bound to control `0x948a`. The helper resolves the currently selected company through `0x006d0818` and renders the player-facing share-value and payout block under localized ids `937` `Share Price:`, `724` `Shares Outstanding:`, `955` `Market Cap:`, `956` `Annual Dividend:`, and `957` `Annual Dividend Payments:`. Current grounded helper ownership is tighter now too: `company_query_cached_share_price_scalar` `0x00423eb0` feeds `Share Price`, the outstanding-share count comes from `[company+0x47]`, `Market Cap` multiplies those two lanes together, `Annual Dividend` comes from the current-year stat-family read `0x2329/0x20`, and `Annual Dividend Payments` multiplies that dividend-per-share lane by the outstanding-share count. The broader six-row per-share data family `938..942` instead sits in the shared stock-data formatter `shell_format_company_stock_data_panel` at `0x004c0160`. Current grounded owner is the CompanyDetail refresh path, which binds this panel beside the debt or credit or rate summary block rather than inside the action-message dispatcher.","objdump + RT3.lng strings + caller inspection + stock-summary correlation + share-price correlation + dividend-payout correlation"
0x004c3470,621,shell_company_detail_step_selected_active_company_delta,shell,cdecl,inferred,objdump + caller inspection,4,"CompanyDetail-specific company-navigation helper. The routine resolves the currently selected company id through the detail owner at `0x006d0818`, converts it to an active-company ordinal through `company_collection_count_active_companies_before_company_id` `0x004299f0`, wraps `ordinal + delta` modulo the active-company count from `company_collection_count_active_companies` `0x00429a50`, resolves the replacement company id through `company_collection_get_nth_active_company_id` `0x00429990`, writes it back through detail-manager setter `0x004dd8a0`, refreshes the visible panel through `shell_company_detail_window_refresh_controls` `0x004c2ca0`, notifies the detail manager through `0x004dd410`, and resets territory picker control `0x948c` through `0x00538e00`. Current grounded wrappers are the next and previous company selectors at `0x004c3540` and `0x004c3550`.","objdump + caller inspection + CompanyDetail navigation correlation"
0x004c3540,5,shell_company_detail_select_next_active_company,shell,cdecl,inferred,objdump + caller inspection,4,"Trivial CompanyDetail wrapper that seeds delta `+1` in `ecx` and tail-calls `shell_company_detail_step_selected_active_company_delta` `0x004c3470`. Current grounded callers include shell-side world and company-detail navigation paths.","objdump + caller inspection + wrapper correlation"
0x004c3550,5,shell_company_detail_select_previous_active_company,shell,cdecl,inferred,objdump + caller inspection,4,"Trivial CompanyDetail wrapper that seeds delta `-1` in `ecx` and tail-calls `shell_company_detail_step_selected_active_company_delta` `0x004c3470`. Current grounded callers include shell-side world and company-detail navigation paths.","objdump + caller inspection + wrapper correlation"
0x004c3560,816,shell_company_detail_render_issue_bond_offer_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Dedicated shell renderer for the `CompanyDetail.win` bond-offer dialog. The helper resolves the currently selected company from the live collection at `0x0062be10`, derives the staged offer terms from the same local bond-offer state later committed by `shell_company_detail_issue_bond_offer_flow`, and then lays out the localized underwriter lines `968..972`: `Underwriters offer to issue bonds as follows:`, `Amount:`, `Interest Rate:`, `Underwriting Fees:`, and `Go ahead and issue the bond?`. Current grounded caller is the issue-bond flow at `0x004c3890`, which passes this helper as the custom dialog renderer into the shared shell finance modal path at `0x004c98a0`.","objdump + RT3.lng strings + caller inspection + finance-dialog correlation"
0x004c3890,693,shell_company_detail_issue_bond_offer_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` bond-issue action flow. The helper resolves the currently selected company through the shell detail owner at `0x006d0818`, rejects requests when the company already has too many outstanding bonds through localized id `973`, rejects weak credit through localized id `974` plus the credit-rating tables at `0x00620d00..0x00620d14`, and otherwise opens the underwriter offer dialog for localized ids `968` through `972` using the dedicated renderer `shell_company_detail_render_issue_bond_offer_dialog` at `0x004c3560`. On acceptance it issues the bond through the selected-company method at `0x004275c0`; when the multiplayer-side shell owner is active it instead packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded caller is `shell_company_detail_window_handle_message` at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + bond-dialog correlation"
0x004c3b50,992,shell_company_detail_render_issue_stock_offer_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Dedicated shell renderer for the `CompanyDetail.win` stock-issue offer dialog. The helper resolves the currently selected company from the live collection at `0x0062be10`, reads the staged offer state from `0x006cfe64` and `0x006cfe68`, and lays out the localized stock-offer lines `975..978`: `Underwriters offer to issue stock as follows:`, `Shares:`, `Total Proceeds:`, and `Go ahead and issue the stock?`. Current grounded caller is `shell_company_detail_issue_stock_offer_flow` at `0x004c3f30`, which passes this helper as the custom dialog renderer into the shared shell finance modal path at `0x004c98a0`.","objdump + RT3.lng strings + caller inspection + finance-dialog correlation"
0x004c3f30,968,shell_company_detail_issue_stock_offer_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` stock-issue action flow. The helper derives a proposed share count and proceeds from the selected company into the local globals `0x006cfe64` and `0x006cfe68`, rejects weak offerings through localized id `979`, rejects oversaturated issuance through localized id `980`, and otherwise opens the underwriter offer dialog for localized ids `975` through `978`. On acceptance it issues the stock through the selected-company method at `0x00427450`; when the multiplayer-side shell owner is active it routes the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded caller is `shell_company_detail_window_handle_message` at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + stock-issue correlation"
0x004c4300,976,shell_company_detail_render_stock_buyback_offer_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Dedicated shell renderer for the `CompanyDetail.win` stock-buyback offer dialog. The helper resolves the currently selected company from the live collection at `0x0062be10`, reads the staged buyback state from `0x006cfe64` and `0x006cfe68`, and lays out the localized broker-offer lines `981..984`: `Brokers are able to locate the following shares on the market:`, `Brokerage Fees:`, `Total Cost:`, and `Go ahead and buy back the stock?`. Current grounded caller is `shell_company_detail_buyback_stock_flow` at `0x004c46d0`, which passes this helper as the custom dialog renderer into the shared shell finance modal path at `0x004c98a0`.","objdump + RT3.lng strings + caller inspection + finance-dialog correlation"
0x004c46d0,1420,shell_company_detail_buyback_stock_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` stock-buyback action flow. The helper computes a proposed repurchase quantity and total cash cost into `0x006cfe64` and `0x006cfe68`, rejects cases with no public float through localized id `985`, rejects requests that would retire the final protected share band through id `986`, rejects insufficient company cash through id `987`, and otherwise opens the broker buyback dialog for localized ids `981` through `984` using the dedicated renderer `shell_company_detail_render_stock_buyback_offer_dialog` at `0x004c4300`. On acceptance it repurchases the shares through the selected-company method at `0x004273c0`; when the multiplayer-side shell owner is active it routes the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded caller is `shell_company_detail_window_handle_message` at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + stock-buyback correlation"
0x004c4c70,448,shell_company_detail_setup_dividend_rate_adjust_controls,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Custom setup callback for the `CompanyDetail.win` dividend-rate dialog opened by `shell_company_detail_change_dividend_rate_flow` at `0x004c5360`. The helper resolves the currently selected company, stages two small shell control descriptors, and binds the paired dividend-adjust controls with ids `0x99e8` and `0xc0f9` back into the shared finance modal through the shell control-registration path rooted at `0x0053f9c0`. Current grounded behavior makes this the control-setup half of the dividend modal beside the text renderer at `0x004c4e30` and the message handler at `0x004c5140`.","objdump + RT3.lng strings + caller inspection + dividend-dialog control-setup correlation"
0x004c4e30,784,shell_company_detail_render_change_dividend_rate_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Dedicated shell renderer for the `CompanyDetail.win` change-dividend dialog. The helper resolves the currently selected company from the live collection at `0x0062be10`, renders the localized prompt and value lines `988..990`: `Change Dividend Rate`, `Dividend Rate:`, and `Total Annual Dividends:`, formats the staged per-share dividend from `0x006cfe48`, and derives the annual total from that same staged rate times the current outstanding-share count at `[company+0x47]`. Current grounded caller is `shell_company_detail_change_dividend_rate_flow` at `0x004c5360`, which passes this helper into the shared shell finance modal path at `0x004c98a0`.","objdump + RT3.lng strings + caller inspection + dividend-dialog renderer correlation"
0x004c5140,544,shell_company_detail_handle_change_dividend_rate_dialog_message,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Custom message callback for the `CompanyDetail.win` change-dividend dialog. The helper handles shell message `0xcb` from the paired adjust controls `0x99e8` and `0xc0f9`, raises or lowers the staged dividend-per-share value in `0x006cfe48`, clamps decrements at zero, and clamps increments against the board-approved per-share ceiling from `company_compute_board_approved_dividend_rate_ceiling` at `0x00426260`. When the player tries to raise the dividend beyond that ceiling it opens localized id `991` `Your board of directors feels that the company is not financially strong enough for a higher dividend...` through the shared modal path instead of accepting the increase. Current grounded caller is `shell_company_detail_change_dividend_rate_flow` at `0x004c5360`, which passes this helper as the dialog message owner into `0x004c98a0`.","objdump + RT3.lng strings + caller inspection + dividend-dialog message correlation + dividend-ceiling correlation"
0x004c5360,472,shell_company_detail_change_dividend_rate_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` dividend-rate action flow. The helper seeds the current dividend-per-share value from `[company+0x4b]` into `0x006cfe48`, opens the shared finance dialog rooted at callbacks `0x004c4c70`, `0x004c4e30`, and `0x004c5140` under localized ids `988` through `990`, and then commits the accepted new dividend rate through the selected-company method at `0x00423fb0`. When the multiplayer-side shell owner is active the same request is packaged through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded caller is `shell_company_detail_window_handle_message` at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + dividend-dialog correlation"
0x004c2ca0,1964,shell_company_detail_window_refresh_controls,shell,thiscall,inferred,objdump + strings + caller inspection,4,"Shared refresh pass for the shell-side `CompanyDetail.win` family rooted at `0x006cfe4c`. The helper first requires a live shell detail-panel owner at `0x006d0818` with a selected company id in `[detail+0x90]`, resolves that company through the live collection at `0x0062be10`, and then repopulates the section strip and section-specific control bands rooted at `0x9472..0x9490`. Current grounded state is keyed by section index `0x006cfe60`: section `0` is the chairman/governance slice around `0x9480` and the dynamic multi-line overview widget `0x947f`, section `1` is the debt-and-capital slice around `0x947d`, `0x947e`, and `0x9488`, section `2` is the per-share slice around `0x948a`, and section `3` is the territory-access slice around `0x948c`, `0x948d`, and `0x948e`. The same refresh now cleanly splits the four visible section selectors `0x9472..0x9475` from their companion visual controls `0x9476..0x9479`, keeps the adjacent section-navigation or decoration bands around `0x947b..0x947c` and `0x948f..0x9490` synchronized with the current section, and formats the current chairman summary through localized ids `958` `Chairman: %1` and `959` `Chairman: None` together with the portrait-backed chairman band on `0x9480`. The section-0-only bind for `0x947f` is tighter now too: the refresh passes a dedicated stack-built dynamic-text payload through the special `0x6f` control path instead of using the normal callback-widget lane, and the shared helpers `shell_control_refresh_matching_dynamic_text_payload` at `0x00540a47` plus `shell_control_release_dynamic_text_payload` at `0x005639d2` now show that type `0x6f` frees or swaps one heap-backed text payload and then short-circuits as a special case. That keeps `shell_format_company_governance_and_economy_status_panel` at `0x004e5cf0` as the strongest current semantic match for `0x947f` while making the widget itself look more clearly like a display-only dynamic-text control rather than a normal callback widget. One wider action-row split is tighter now that the range loops are explicit: the helper walks `0x94d4..0x9537` as the selected-company-owned governance/action band and applies style `0x65` when the selected company matches the scenario-selected company at `0x00434870`, otherwise `0x87`; it then walks `0x9538..0x959b` as the linked-chairman-owned band and applies style `0x87` when the selected company's linked chairman id `[company+0x3b]` matches the scenario-selected chairman at `0x004337b0`, otherwise `0x65`. The selected-company side is no longer one vague gated block either: scenario-state toggle `[0x006cec78+0x4a8f]` re-enables bankruptcy row `0x94d6` together with passive companion row `0x94d4`, `[0x006cec78+0x4a8b]` re-enables issue-bond row `0x94d7` together with passive companion row `0x94d5`, `[0x006cec78+0x4a87]` re-enables stock issue and stock buyback rows `0x94d8..0x94d9`, `[0x006cec78+0x4a93]` re-enables dividend row `0x94da` together with the same passive companion row `0x94d5`, `[0x006cec78+0x4adb]` re-enables merger row `0x94db`, `[0x006cec78+0x4acb]` re-enables resign row `0x94dc`, and `[0x006cec78+0x4acf]` re-enables takeover row `0x9538`; `0x9493` only re-enables when editor-map mode `[0x006cec74+0x68]` is clear. That makes `0x94d4/0x94d5` read more like passive companion or heading widgets than hidden verbs. The constructor at `0x004c5540` and many message-side branches at `0x004c56a0` converge back into this helper, which makes it the current owner-side refresh pass for the CompanyDetail window rather than a generic company-list helper.","objdump + strings + caller inspection + section-switch correlation + chairman-band correlation + governance-band gating correlation + selected-company styling correlation + dynamic-overview-widget correlation + passive-companion-row gating correlation + scenario-toggle correlation + explicit-row-loop correlation + type-0x6f control correlation"
0x004c56a0,4228,shell_company_detail_window_handle_message,shell,thiscall,inferred,objdump + strings + caller inspection,4,"Primary message dispatcher for the shell-side `CompanyDetail.win` family rooted at vtable `0x005d0858`. The helper switches on the incoming shell message id and now has a grounded section-selector lane too: message `0xca` on controls `0x9472..0x9475` writes `control-0x9472` into section index `0x006cfe60` before re-entering `shell_company_detail_window_refresh_controls` `0x004c2ca0`. Its broader action band is now tighter as well. Under message `0xcb`, control `0x94b5` routes into `shell_company_detail_buy_territory_access_rights_flow` `0x004c5fc9`, `0x94b6` routes into `shell_company_detail_bankruptcy_flow` `0x004c5b99`, `0x94cf` routes into `shell_company_detail_issue_bond_offer_flow` `0x004c3890`, `0x94d0` routes into `shell_company_detail_issue_stock_offer_flow` `0x004c3f30`, `0x94d1` routes into `shell_company_detail_buyback_stock_flow` `0x004c46d0`, `0x94d2` routes into `shell_company_detail_change_dividend_rate_flow` `0x004c5360`, `0x9493` routes into the destructive company-clear helper `company_deactivate_and_clear_chairman_share_links` `0x00426d60`, `0x94d6` routes into `shell_company_detail_bankruptcy_flow` `0x004c5b99`, `0x94d7` routes into `shell_company_detail_issue_bond_offer_flow` `0x004c3890`, `0x94d8` routes into `shell_company_detail_issue_stock_offer_flow` `0x004c3f30`, `0x94d9` routes into `shell_company_detail_buyback_stock_flow` `0x004c46d0`, `0x94da` routes into `shell_company_detail_change_dividend_rate_flow` `0x004c5360`, `0x94db` routes into `shell_company_detail_attempt_merger_flow` `0x004ec640`, `0x94dc` routes into `shell_company_detail_resign_chairmanship_flow` `0x004c5a0e`, and `0x9538` routes into `shell_company_detail_attempt_chairmanship_takeover_flow` `0x0050ccc0`. The same `0xcb` jump table now makes the passive/action split explicit rather than inferred: in the dispatch byte map rooted at `0x004c6640`, offsets `0x4b..0x51` for controls `0x94d6..0x94dc` map to cases `0x06..0x0c`, offset `0xad` for control `0x9538` maps to case `0x0d`, and the neighboring companion rows `0x94d4` and `0x94d5` stay on the default `0x0e` path. The debt-side row bands are narrower now too: under the same `0xcb` path, controls `0x94e8..0x950f` and `0x9510..0x9537` resolve a selected debt-slot index beneath the two bond panels `0x947d` and `0x947e`, reject repayment when the selected slot's principal exceeds the current cash-side metric through localized id `2990`, otherwise open the localized early-repayment confirmation rooted at id `2991`, and on acceptance either commit through `company_repay_bond_slot_and_compact_debt_table` `0x00423d70` or package the same request through the multiplayer shell transport. The same dispatcher also now bounds most of the section-0 control cluster: control `0x948b` is a tutorial-guarded escape or back control that either shows localized id `3724` `This option is disabled in the tutorial.` or falls back to `0x004ddbd0`, controls `0x9491` and `0x9492` only restyle the paired visual controls `0x948f` and `0x9490`, and control `0x9494` opens localized id `3635` `Enter the amount that your company's cash should be` through the shell numeric-entry dialog family and then writes the accepted value into the selected company cash pair at `[company+0x11f7]` and `[company+0x11fb]`. Current `0xcb` dispatch does not treat `0x948f`, `0x9490`, `0x94d4`, or `0x94d5` as standalone action cases, and the refresh-side gates now sharpen that split further: `0x94d4` is the passive companion row that comes back beside bankruptcy `0x94d6`, while `0x94d5` is the passive companion row that comes back with the issue-bond/dividend side of the finance cluster `0x94d7` and `0x94da`. The remaining open section-0 control is therefore mainly `0x947f`, plus the still-unsplit render-side text rows inside the broader governance bands `0x94d4..0x9537` and `0x9538..0x959b`. It repeatedly converges back into `shell_company_detail_window_refresh_controls` after state changes. Current ground
0x004c5a0e,268,shell_company_detail_resign_chairmanship_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` resignation confirmation flow. The branch opens localized confirmation id `964` `Are you sure you want to resign the chairman's position?` and on acceptance commits the change through `company_clear_selected_chairman_if_current_profile` at `0x00428a10`. When the multiplayer-side shell owner is active it packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8` instead of mutating the company immediately. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + dialog correlation"
0x004c5b99,428,shell_company_detail_bankruptcy_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` bankruptcy action flow. The branch checks the localized cooldown and eligibility strings `965` through `967`, rejects requests when the selected company is not yet bankruptable, and on acceptance commits the change through `company_declare_bankruptcy_and_halve_bond_debt` at `0x00425a90`. When the multiplayer-side shell owner is active it packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8` instead of mutating the company immediately. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + bankruptcy-dialog correlation"
0x004c5fc9,659,shell_company_detail_buy_territory_access_rights_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` territory-access purchase flow for the currently selected territory. The branch first resolves the selected territory from the territory-summary controls rooted at `0x948c..0x948e`, requires that the detail panel is still showing the current chairman-owned company, then splits cleanly by access state. When the company lacks rights but the territory is purchasable, it computes the access-rights price through `0x004879f0`, shows localized id `961` when purchase is possible, id `962` when cash is insufficient, and id `963` when rights cannot be purchased at all. Accepting id `961` commits the change through `company_set_territory_access_rights_byte` at `0x00424030` and the cash-side mutation at `0x0042a040`; when the multiplayer-side shell owner is active it instead packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + territory-access branch correlation"
0x004c98a0,880,shell_open_custom_modal_dialog_with_callbacks,shell,cdecl,inferred,objdump + caller inspection,4,"Generic shell modal opener for callback-driven custom dialogs. The helper snapshots the current detail-owner context, stores one caller-supplied mode or prompt token at `0x00621f40`, stores one optional custom control callback or row-owner token at `0x006cfeb0`, allocates a shared `0xa0`-byte modal object with vtable `0x005d0a04`, and seeds it through the lower constructor at `0x004c86c0` using the caller's custom message, setup, and render callbacks plus the surrounding button or style parameters. When the optional callback slot is present it also binds that callback onto control `0x03ed`. The same helper temporarily pushes shell modal state through `0x0053f000`, enters the visible modal loop through `0x00538f10`, and then tears the object back down while restoring the surrounding shell or world presentation state. Current grounded callers include the CompanyDetail finance dialogs for bond issue, stock issue, stock buyback, and dividend changes, plus `multiplayer_open_staged_text_entry_dialog` at `0x004ee0e0`.","objdump + caller inspection + modal-lifecycle correlation"
0x004d57c0,540,shell_event_conditions_window_construct,shell,thiscall,inferred,objdump + EventConditions.win string xref + control-binding inspection,3,"Constructs the shell-side `EventConditions.win` window. The constructor installs vtable `0x005d0cd4`, binds `EventConditions.win` through `0x0053fa50`, stores the incoming live event record pointer at `[this+0x84]`, seeds the selected condition row id at `[this+0x78]` plus the adjacent subselector at `[this+0x7c]`, binds the condition-row action callbacks at `0x004d5790` and `0x004d57b0`, and then populates the visible controls and status rows through the same window-local refresh path. Current grounded string xref is direct at `0x004d5803`, which makes this the clean owner for the conditions window rather than just another anonymous scenario dialog.","objdump + EventConditions.win string xref + control-binding inspection + state-field correlation"
0x004d59e0,166,shell_event_conditions_window_handle_message,shell,thiscall,inferred,objdump + EventConditions.win vtable slot + local disassembly,3,"Primary shell-message dispatcher bound in vtable slot `0x005d0cd8` for `EventConditions.win`. The handler switches on incoming shell messages `0xc9`, `0xca`, and the callback-style `0x04` path, remaps the constructor-bound callback controls at `0x4f73` and `0x4fd1` into the `0xc9` branch after validation through `0x004d54d0`, and dispatches the window-local command strip rooted at ids such as `0x4fb4..0x509c` through helpers like `0x004d4560`, `0x004d4838`, and `0x004d4d10`. Current direct evidence is the `EventConditions.win` vtable at `0x005d0cd4`, whose second slot points to `0x004d59e0`, so this is the clean message owner for the conditions window rather than just another small callback helper.","objdump + EventConditions.win vtable slot + local disassembly + callback-remap correlation"
0x004d5d00,605,shell_event_effects_window_refresh_effect_type_selector,shell,thiscall,inferred,objdump + EventEffects.win constructor and handler correlation + local disassembly,3,"Selector refresh beneath `EventEffects.win`. The helper rebuilds the effect-type list control rooted at `0x4fb2` from the static descriptor family starting near `0x006103e7`, filters entries by the current availability or permission state from control `0x5033`, selects the best current row by the descriptor float lane, and republishes the chosen effect-type index through `[this+0x7c]` plus the visible selector control state. Current grounded callers are the effects-window constructor `0x004d6d60`, the message dispatcher `0x004d7060`, and the selected-editor refresh family under `0x004d6090`, so this is now the safest current owner for the effect-type selector rather than an anonymous table walk.","objdump + EventEffects.win constructor and handler correlation + local disassembly + selector-table correlation"
0x004d5f50,320,shell_event_effects_window_refresh_selected_effect_parameter_rows,shell,thiscall,inferred,objdump + EventEffects.win constructor and handler correlation + local disassembly,3,"Parameter-row refresh beneath `EventEffects.win`. The helper reads the current effect-type index at `[this+0x7c]`, consults the compact descriptor tables rooted at `0x004d5fde` and `0x004d600a`, and then repaints the grouped parameter-label or parameter-enable rows through the generic control path under control family `0x4ff6` plus the smaller row-style helper `0x004d5f83`. Current grounded callers are the effects-window constructor `0x004d6d60`, the message dispatcher `0x004d7060`, and the heavier editor refresh at `0x004d6090`, so this is the safest current read for the selected-effect parameter-row repaint rather than another anonymous row helper.","objdump + EventEffects.win constructor and handler correlation + local disassembly + parameter-table correlation"
0x004d6090,1752,shell_event_effects_window_refresh_selected_staged_effect_editor_panels,shell,thiscall,inferred,objdump + EventEffects.win constructor and handler correlation + local disassembly,3,"Heavier editor refresh beneath `EventEffects.win`. The helper first resets the smaller grouped parameter rows through `0x004d5f83`, then interprets the currently staged effect row at `[this+0x78]` by reading opcode byte `+0x08`, scalar dword `+0x04`, grouped value lanes `+0x09` and `+0x0d`, and the bounded numeric fields `+0x11`, `+0x12`, `+0x14`, and `+0x16`. It uses that staged row plus the current effect-type descriptor state at `[this+0x7c]` to repaint the main effect-editor controls rooted at ids such as `0x4fc7`, `0x4fce`, `0x4ff6`, `0x4ff9`, `0x4ffc`, `0x5041`, `0x5044`, `0x5046`, and `0x5047`, including the numeric-entry affordances, sign or comparator toggles, and the type-specific parameter bands. Current grounded callers are the effects-window constructor `0x004d6d60` and message dispatcher `0x004d7060`, which keeps this as the clearest current owner for staged effect-editor repaint rather than a generic event formatter.","objdump + EventEffects.win constructor and handler correlation + local disassembly + staged-row-field correlation"
0x004d77b0,251,shell_event_conditions_window_refresh_grouped_effect_summary_band_affordances,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Refreshes the grouped-effect summary band affordances beneath `EventConditions.win`. The helper checks whether selected-event mode control `0x4e8f` is active and whether the current selector rooted at `0x5000` resolves to control `0x5002`; only on that branch does it enable the grouped summary-band controls `0x4fed..0x4ff0`, otherwise it disables that four-control band with style `0x87`. Current grounded callers include the mode-dependent detail-row switch `0x004d9390` and nearby condition-window refresh tails around `0x004d9970` and `0x004daf40`, so this is the safest current read for grouped summary-band affordance refresh rather than another anonymous style helper.","objdump + caller xrefs + local disassembly + grouped-band-control correlation + selector-gate correlation"
0x004d7ef0,301,shell_event_effects_window_refresh_event_selector_list_and_selected_event_id,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Event-selector refresh beneath the broader event editor family. The helper clears the current selected event id at `[this+0x84]`, the visible row count at `[this+0x90]`, and the adjacent selection latches at `[this+0x88]` and `[this+0x8c]`, then iterates the live event collection `0x0062be18` to populate the visible selector control rooted at `0x4e84` with each event name from `+0x18` plus the paired count field at `+0x14`. When at least one live event exists it republishes the chosen event id through `[this+0x84]` and enables the list-selection affordance on control `0x4e84`. Current grounded caller is the effects-side command family near `0x004dbb35`, which makes this the safest current owner for event-list selector refresh rather than a generic event walk.","objdump + caller correlation + local disassembly + event-collection iteration correlation"
0x004d8120,1968,shell_event_conditions_window_refresh_condition_row_list_panel,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Heavier row-list refresh beneath `EventConditions.win`. The helper resolves the currently selected live event through `[this+0x84]`, walks the standalone condition-row list rooted at `[event+0x00]`, and repaints the condition-row panel rooted at `0x4eaf` by formatting special sentinel rows `-1` and `-2` through fixed localized ids `0x47e` and `0x47f` while ordinary rows derive their caption and comparator text from the condition tables rooted near `0x005f3de3` and `0x004d88cc`. The same pass also rebuilds the current selected-row index at `[this+0x94]`, maintains the per-row seen bitmap on the stack, and republishes the current selection row list through the generic control path before the surrounding condition-window refresh continues. Current grounded callers are the add, edit, and remove condition-row verbs `0x004da640`, `0x004da700`, and `0x004d9ed0`, so this is the safest current owner for condition-row list repaint rather than a generic formatter.","objdump + caller correlation + local disassembly + condition-row-list correlation"
0x004d88f0,1115,shell_event_conditions_window_refresh_selected_grouped_effect_row_list_panel,shell,thiscall,inferred,objdump + local disassembly + RT3.lng correlation + grouped-effect-descriptor correlation,3,"Grouped effect-row list refresh beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, uses current grouped selector `[this+0x9c]` to walk the grouped `0x28`-byte row list anchored at `[event + group*4 + 0x04]`, clears list control `0x4ed5`, and resets selected grouped row index `[this+0x98] = -1` before rebuilding the visible row band. Formatting is now tighter than a generic list repaint: ordinary grouped rows flow through the effect descriptor table at `0x006103a0` and RT3.lng `1154..1159` to build `Set %1 to FALSE/TRUE`, timed `for %1 months/years`, and scalar assignment lines, while opcode byte `+0x08 == 8` takes the wider multivalue path over fields `+0x11/+0x12/+0x14/+0x16` before publishing the finished text into `0x4ed5`. The helper finishes by re-enabling `0x4ed5` with active style when the selected grouped list is nonempty. Current grounded callers are the selected-event refresh family `0x004db120/0x004d9390/0x004dbf93` plus grouped effect add, edit, and remove verbs `0x004da7c0/0x004da860/0x004da920`, so this is the safest current read for selected grouped-effect row-list repaint rather than an anonymous formatter.","objdump + local disassembly + RT3.lng correlation + grouped-effect-descriptor correlation + grouped-list-anchor correlation"
0x004d8d50,320,shell_event_conditions_window_commit_current_grouped_effect_summary_state_before_group_switch,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation,3,"Small commit helper beneath `EventConditions.win` that snapshots the current grouped-effect summary editor state back into the selected live event before the grouped selector changes. The helper resolves the selected event through `[this+0x84]`, uses current grouped index `[this+0x9c]`, samples control `0x500a` into event byte lane `[event + group*4 + 0x7ff]`, maps the hidden mutually exclusive selector family rooted at `0x5006` into ordinal byte `[event + group + 0x7fb] = 0..8`, and stores current local selector state `[this+0x8c]` into event dword lane `[event + group*4 + 0x80f]`. The ordinal mapping is now explicit in the commit-side jump table: controls `0x5006..0x500e` store values `0..8`, and the refresh side later maps those same ordinals one-to-one onto visible controls `0x5014..0x501c`. Current evidence therefore reads `0x5006..0x500e` as the hidden canonical selector family and `0x5014..0x501c` as its visible display mirror, not as two distinct semantic families. The strongest current RT3.lng fit for the stored scope family is `object being evaluated`, `whole game`, `all/human/AI companies`, `specified territories`, and `all/human/AI players`. Current grounded caller is the grouped-band dispatcher case at `0x004dbf93`, so this is the safest current read for grouped-effect summary-state commit before group switch rather than a generic editor helper.","objdump + caller xrefs + local disassembly + grouped-selector-state correlation + ordinal-mapping correlation + RT3.lng correlation"
0x004d8ea0,1165,shell_event_conditions_window_commit_current_selected_event_text_panels_before_selection_change,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Selected-event commit helper beneath `EventConditions.win` that snapshots the currently visible mode-strip text panels back into the live event record before selection, grouped-action, or grouped-band changes. The helper resolves the selected live event through `[this+0x84]`, samples active controls `0x4e8e`, `0x4e8f`, `0x4ed9`, `0x4edb`, `0x4edd`, and `0x4e91`, and uses those active-state checks to rewrite event mode byte `[event+0x7ee]` plus the fixed text bands at `[event+0x0e0]`, `[event+0x401]`, `[event+0x4ca]`, `[event+0x593]`, `[event+0x65c]`, and `[event+0x725]` from the current shell control payloads. Current grounded callers are selected-event previous and next navigation `0x004db520/0x004db5e0`, the selected-event id setter `0x004db6a0`, and the grouped-action selector case at `0x004dbfca`, so this is the safest current read for committing current selected-event text panels before selection change rather than another repaint helper.","objdump + caller xrefs + local disassembly + event-text-band correlation + selection-change correlation"
0x004d91e0,343,shell_event_conditions_window_commit_selected_event_summary_headers_and_group_mode,shell,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Selected-event summary-header and grouped-mode commit helper beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, snapshots the active modifier bands rooted at `0x4fd7` and `0x4fd8` into event bytes `[event+0x7f9]` and `[event+0x7fa]`, stores the inverted toggle state of control `0x4e93` into event byte `[event+0x800]`, writes summary header control `0x4ead` into event dword `[event+0x7f5]`, mirrors window field `[this+0x88]` into event dword `[event+0x7f0]`, re-enters `shell_event_conditions_window_commit_current_grouped_effect_summary_state_before_group_switch` `0x004d8d50`, and then commits one grouped-mode choice from controls `0x4eca/0x4ecb/0x4ecc` into event byte `[event+0x7f4]`. Current grounded caller is the broader selected-event strip refresh at `0x004db120`, so this is the safest current read for committing selected-event summary headers and grouped mode rather than another grouped-action helper.","objdump + local disassembly + caller correlation + control-band correlation + event-record-field correlation"
0x004d9360,43,shell_event_conditions_window_remove_selected_event_and_refresh_selector,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Delete verb for the selected live event beneath `EventConditions.win`. When `[this+0x84]` holds a valid event id, the helper resolves collection `0x0062be18`, removes that live event through the collection vtable delete slot, and then immediately rebuilds the visible event selector through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`. Current grounded dispatcher caller is control `0x4e8a` through `0x004dbc48`, so this is the safest current read for selected-event deletion and selector refresh rather than a generic collection wrapper.","objdump + local disassembly + dispatcher correlation + collection-delete correlation"
0x004d9390,1504,shell_event_conditions_window_refresh_selected_event_mode_dependent_detail_rows,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Mode-dependent detail-row switch beneath `EventConditions.win`. The helper samples which selected-event mode button is active across controls `0x4e8f`, `0x4e90`, `0x4e91`, and `0x4e92`, then shows or hides the corresponding detail-row families rooted at `0x4ed7..0x4edd` and `0x4fdb..0x4fe6` through the generic shell control path. The same pass also re-enters `shell_event_conditions_window_refresh_grouped_effect_summary_band_affordances` `0x004d77b0`, resets grouped selection field `[this+0x9c]` when the chosen mode does not keep it, refreshes the grouped row list through `0x004d88f0`, and toggles the trailing affordance at `0x4fed`. Current grounded callers are the selected-event strip refresh `0x004d9f50`, the broader condition-window dispatcher `0x004dbb80`, and one nearby secondary dispatcher at `0x004daf40`, so this is the safest current read for selected-event mode-dependent detail rows rather than a generic control-style helper.","objdump + caller xrefs + local disassembly + mode-button correlation + detail-row-band correlation + grouped-band-affordance correlation"
0x004d9970,925,shell_event_conditions_window_refresh_condition_class_summary_and_group_rows,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation,3,"Refreshes the condition-class summary and grouped-row affordance bands beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, queries the standalone condition-row aggregate flags through `scenario_event_query_standalone_condition_row_list_class_and_modifier_flags` `0x0042d700`, and then restyles the summary header or status rows rooted at `0x4eae`, `0x4eb4`, `0x4fd9`, `0x4fda`, `0x4ec0..0x4ec4`, and `0x4eb6..0x4eba`. Current local bit correlation is tighter than a generic status repaint: aggregate bit `0x01` drives the `0x4fd9` / `0x4ec0..0x4ec4` band, aggregate bit `0x02` drives the `0x4fda` / `0x4eb6..0x4eba` band, aggregate bit `0x04` drives the header pair `0x4eae` and `0x4eb4`, and the higher modifier bits `0x10` and `0x20` refine the style of `0x4ec1` and `0x4eb6`. Current RT3.lng adjacency now gives the strongest current player-facing fit for this whole branch too: selector `0x5001` above it reads as the `1573` `Test against...` side, with the grouped company and player target-family rows under `0x4ec0..0x4ec4` and `0x4eb6..0x4eba` aligning to the adjacent `1574..1592` company/player test-scope text family. Event byte `[event+0x7f4]` also gates one special affordance in each grouped band. Current grounded callers include the add, edit, and remove condition-row verbs `0x004da640`, `0x004da700`, and `0x004d9ed0`, plus several surrounding condition-window refresh tails, so this is the safest current owner for the condition-summary and grouped-row repaint rather than a generic style loop.","objdump + caller xrefs + local disassembly + condition-aggregate correlation + grouped-band correlation + RT3.lng correlation"
0x004d9d10,53,shell_event_conditions_window_refresh_selected_grouped_effect_territory_target_affordance,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation,3,"Small territory-target affordance refresh beneath `EventConditions.win` for the current grouped effect selection. The helper resolves the selected live event at `[this+0x84]`, queries grouped effect-row type flags for the current grouped selector `[this+0x9c]` through `scenario_event_query_grouped_effect_row_list_type_flags` `0x0042d740`, and enables control `0x500b` only when the returned flags include bit `0x04` and the neighboring controls `0x5019` plus `0x5002` are already active. Otherwise it disables the same affordance with style `0x87`. The strongest current label fit is that `0x5019/0x500b` are the RT3.lng `1619/1620` `to territories` lane, with `0x500b` carrying the stored territory-target parameter from `[event + group*4 + 0x80f]`. Current grounded callers are the broader condition-window refresh `0x004da0f0` and the main dispatcher `0x004dbb80`, so this is the safest current read for the selected grouped-effect territory-target affordance rather than a generic control-style toggle.","objdump + caller xrefs + local disassembly + grouped-flag correlation + control-enable correlation + RT3.lng correlation"
0x004d67f0,456,shell_event_effects_window_commit_current_editor_state_into_staged_row,shell,thiscall,inferred,objdump + EventEffects.win constructor and handler correlation + local disassembly,3,"Commit helper beneath `EventEffects.win` that normalizes the current editor controls back into the staged effect row at `[this+0x78]`. The helper stores the selected effect-type index from `[this+0x7c]` into row dword `+0x00`, rewrites opcode byte `+0x08` and scalar dword `+0x04` through the descriptor-driven mapper at `0x004d64a0`, preserves or clears the sign bit on the opcode byte as needed, and then refreshes the smaller boolean or numeric side fields before the staged row is ready for the higher-level window logic. Current grounded callers are the constructor `0x004d6d60`, the vtable-bound message dispatcher `0x004d7060`, and the smaller callback remap path around `0x004d70a2`, so this is the safest current read for editor-state commit into the staged effect row rather than another formatter.","objdump + EventEffects.win constructor and handler correlation + local disassembly + staged-row-commit correlation"
0x004d6d60,763,shell_event_effects_window_construct,shell,thiscall,inferred,objdump + EventEffects.win string xref + control-binding inspection,3,"Constructs the shell-side `EventEffects.win` window. The constructor installs vtable `0x005d0cf4`, binds `EventEffects.win` through `0x0053fa50`, stores the incoming staged effect-row record at `[this+0x78]`, mirrors its key fields into the local window state at `[this+0x7c]` and the stack-built numeric caches used by the row editors, binds the grouped effect-row callbacks at `0x004d6d30`, and then repaints the visible controls through the same window-local refresh family. Current grounded string xref is direct at `0x004d6da5`, which makes this the clean owner for the effects window rather than a generic event editor child.","objdump + EventEffects.win string xref + control-binding inspection + staged-row-field correlation"
0x004d7060,166,shell_event_effects_window_handle_message,shell,thiscall,inferred,objdump + EventEffects.win vtable slot + local disassembly,3,"Primary shell-message dispatcher bound in vtable slot `0x005d0cf8` for `EventEffects.win`. The handler switches on incoming shell messages `0xc9`, `0xca`, and the callback-style `0x04` path, remaps the constructor-bound callback controls at `0x4fb1` and `0x4fd4` into the `0xc9` branch, validates staged effect-row state through `0x004d67f0`, and dispatches the effect-window command strip rooted at ids such as `0x4fb3..0x5047` through the grouped-row and detail refresh helpers `0x004d5d00`, `0x004d5f50`, and `0x004d6090`. Current direct evidence is the `EventEffects.win` vtable at `0x005d0cf4`, whose second slot points to `0x004d7060`, so this is the clean message owner for the effects window rather than just the smaller callback lane.","objdump + EventEffects.win vtable slot + local disassembly + callback-remap correlation"
0x004d9dc0,123,shell_open_event_conditions_modal_and_return_result,shell,cdecl,inferred,objdump + constructor call correlation + local disassembly,3,"Shared modal opener for `EventConditions.win`. The helper allocates an `0x88`-byte window object, constructs it through `shell_event_conditions_window_construct` `0x004d57c0` with the caller-supplied live condition row pointer plus the extra boolean argument, enters the common shell modal loop through `0x538f10`, then destroys and frees the modal object before returning the dialog result code. Current grounded callers are the add and edit condition-row verbs around `0x004da640` and `0x004da700`, which makes this the clean owner for condition-row modal launch rather than an anonymous allocator wrapper.","objdump + constructor call correlation + local disassembly + modal-loop correlation"
0x004d9e40,120,shell_open_event_effects_modal_and_return_result,shell,cdecl,inferred,objdump + constructor call correlation + local disassembly,3,"Shared modal opener for `EventEffects.win`. The helper allocates an `0x80`-byte window object, constructs it through `shell_event_effects_window_construct` `0x004d6d60` with the caller-supplied staged effect-row pointer, enters the common shell modal loop through `0x538f10`, then runs the effect-window close tail at `0x004d5b90`, destroys the modal object, and returns the dialog result code. Current grounded callers are the add and edit grouped-effect verbs around `0x004da7c0` and `0x004da860`, which makes this the clean owner for the effect-row modal launch rather than another small wrapper.","objdump + constructor call correlation + local disassembly + modal-loop correlation"
0x004d9ed0,116,shell_event_conditions_window_remove_selected_condition_row,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Remove verb beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, uses the current selected condition-row index at `[this+0x94]` to unlink one node from the standalone condition-row list rooted at `[event+0x00]`, frees the removed `0x1e`-row allocation through `0x53b080`, then refreshes the visible row list through `shell_event_conditions_window_refresh_condition_row_list_panel` `0x004d8120` and re-enters the surrounding condition-window repaint tail at `0x004d9970`. Current grounded caller is the conditions-side command family under `0x004dbcc3`, so this is the safest current read for selected condition-row deletion rather than a generic list unlink helper.","objdump + caller correlation + local disassembly + linked-list-unlink correlation"
0x004d9f50,546,shell_event_conditions_window_refresh_selected_event_mode_strip_and_summary_panels,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Refreshes the selected-event mode strip and summary text panels beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, republishes the boolean toggle on control `0x4e93` from event byte `[event+0x800]`, selects one mode button across `0x4e8f/0x4e90/0x4e91` from event byte `[event+0x7ee]`, and restyles the whole mode strip `0x4e8e..0x4e92` with the current active choice. It then re-enters `shell_event_conditions_window_refresh_selected_event_mode_dependent_detail_rows` `0x004d9390` and republishes several dynamic-text controls from the current event record, including the main summary text at `[event+0x0e0]` into `0x4eac` and the later fixed text bands rooted at offsets `+0x4ca`, `+0x593`, and `+0x65c` into controls such as `0x4fdf`, `0x4fe0`, and `0x4fe1`. Current grounded callers are the broader conditions refresh family `0x004db120` and the main conditions-window dispatcher `0x004dbb80`, so this is the safest current read for the selected-event mode strip and summary-panel refresh rather than a generic text repaint.","objdump + caller xrefs + local disassembly + mode-strip correlation + dynamic-text-panel correlation"
0x004da640,185,shell_event_conditions_window_append_default_condition_row_via_modal,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Add verb beneath `EventConditions.win`. The helper allocates and zero-initializes one default `0x1e`-byte condition row, seeds row dword `+0x00` with default id `0x0e` plus row byte `+0x04` with subtype `4`, then opens the condition-row modal through `shell_open_event_conditions_modal_and_return_result` `0x004d9dc0`. When the modal returns accept code `0x4f73`, the helper either appends the resulting row at the end of the current condition-row list or installs it as the first row on an empty event, then refreshes the visible list through `0x004d8120` and the surrounding condition-window repaint through `0x004d9970`. Current grounded caller is the conditions-side command family at `0x004dbca8`, which makes this the clean current owner for default condition-row creation rather than an anonymous allocator branch.","objdump + caller correlation + local disassembly + modal-return correlation"
0x004da700,182,shell_event_conditions_window_edit_selected_condition_row_via_modal,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Edit verb beneath `EventConditions.win`. The helper resolves the selected live event and selected condition-row index `[this+0x94]`, walks the standalone condition-row list to the chosen row, and opens the current row in the condition modal through `shell_open_event_conditions_modal_and_return_result` `0x004d9dc0`. On accept code `0x4f73`, it writes the edited row back in place; one negative-id branch also duplicates the selected row into a fresh `0x1e` allocation before reinserting it at the head. The helper then refreshes the row list through `0x004d8120` and the surrounding condition-window repaint through `0x004d9970`. Current grounded caller is the conditions-side command family at `0x004dbcb1`, so this is the safest current read for selected condition-row edit rather than another raw list walk.","objdump + caller correlation + local disassembly + modal-return correlation"
0x004da7c0,155,shell_event_effects_window_append_grouped_effect_row_via_modal,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Add verb beneath `EventEffects.win`. The helper allocates and zero-initializes one default `0x28`-byte grouped effect row, seeds row dword `+0x00` with default opcode `2`, opens the effects modal through `shell_open_event_effects_modal_and_return_result` `0x004d9e40`, and on accept code `0x4fb1` appends the resulting row to the currently selected effect-group list anchor `[event + group*4 + 0x04]` using the active group index at `[this+0x9c]`. It then refreshes the grouped effect rows through `0x004d88f0` and re-enters the broader effects-window repaint through `0x004da0f0`. Current grounded caller is the effects-side command family at `0x004dbc84`, which makes this the clean current owner for grouped effect-row creation rather than another allocator stub.","objdump + caller correlation + local disassembly + grouped-list-append correlation"
0x004da860,179,shell_event_effects_window_edit_selected_grouped_effect_row_via_modal,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Edit verb beneath `EventEffects.win`. The helper resolves the selected live event, selected effect group `[this+0x9c]`, and selected row index `[this+0x98]`, copies the chosen `0x28`-byte grouped effect row into a stack staging buffer, and opens the effects modal through `shell_open_event_effects_modal_and_return_result` `0x004d9e40`. On accept code `0x4fb1` it writes the edited row back in place, then refreshes the grouped effect rows through `0x004d88f0` and the broader effects-window repaint through `0x004da0f0`. Current grounded caller is the effects-side command family at `0x004dbd02`, so this is the safest current read for selected grouped effect-row edit rather than another modal wrapper.","objdump + caller correlation + local disassembly + grouped-row-staging correlation"
0x004da920,126,shell_event_effects_window_remove_selected_grouped_effect_row,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Remove verb beneath `EventEffects.win`. The helper resolves the selected live event, selected effect group `[this+0x9c]`, and selected row index `[this+0x98]`, unlinks one node from the chosen grouped effect-row list anchored at `[event + group*4 + 0x04]`, frees the removed `0x28`-byte allocation through `0x53b080`, then refreshes the grouped effect rows through `0x004d88f0` and the broader effects-window repaint through `0x004da0f0`. Current grounded caller is the effects-side command family at `0x004dbd1d`, so this is the safest current read for selected grouped effect-row deletion rather than a generic list helper.","objdump + caller correlation + local disassembly + grouped-list-unlink correlation"
0x004da9a0,400,shell_event_conditions_window_refresh_current_grouped_effect_summary_state_from_selected_event,shell,thiscall,inferred,objdump + local disassembly + RT3.lng correlation,3,"Selected grouped-summary state refresh beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, uses current grouped selector `[this+0x9c]`, republishes checkbox control `0x500a` from event byte lane `[event + group*4 + 0x7ff]`, mirrors event dword lane `[event + group*4 + 0x80f]` into local selector field `[this+0x8c]` and control `0x500b` when that stored value is nonnegative, and then republishes grouped target-scope ordinal byte `[event + group + 0x7fb] = 0..8` through the visible target-scope display family `0x5014..0x501c`. The jump table is now explicit here too: ordinal `0..8` activates visible controls `0x5014..0x501c` one-to-one, which is the strongest current evidence that those visible rows are a display mirror over the hidden canonical selector family `0x5006..0x500e` rather than a second label-distinct mode family. Current strongest label fit for those stored ordinals is `object being evaluated`, `whole game`, `all/human/AI companies`, `specified territories`, and `all/human/AI players`; each ordinal case then tails directly into the broader grouped-effect target-scope refresh at `0x004da0f0`. Current grounded callers are the selected-event strip refresh `0x004db120` and grouped-band selection tail `0x004dbf93`, so this is the safest current read for republishing the currently selected grouped summary state from stored event data rather than a generic control write loop.","objdump + local disassembly + grouped-summary-state correlation + ordinal-mapping correlation + RT3.lng correlation"
0x004dab60,212,shell_event_conditions_window_refresh_selected_grouped_effect_target_scope_strip,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation + grouped-band dispatch-table decode,3,"Refreshes the selected grouped-effect target-scope strip beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, reads current grouped selector `[this+0x9c]`, republishes checkbox control `0x500a` from event byte lane `[event + group*4 + 0x7ff]`, and then republishes grouped target-scope ordinal byte `[event + group + 0x7fb] = 0..8` through the visible display family `0x5014..0x501c`. The surrounding enable logic is tighter too: grouped effect-row type mask bit `0x08` gates `0x5015` (`whole game`), bit `0x01` gates the company-target trio `0x5016..0x5018`, bit `0x02` gates the player-target trio `0x501a..0x501c`, and bit `0x04` gates the paired territory-target lane `0x500b/0x5019`. When the territory lane is absent the helper falls back to local selector state `[this+0x8c]` for `0x500b`; and when any target-scope lane is active it first tries to re-enable one hidden selector from `0x5006..0x500e`, falling back to the persisted control id in `0x00622074` only when no current visible target-scope display row is already active. Current code now makes the hidden/display split firmer too: `0x5006..0x500e` are the canonical hidden selectors stored by `0x004d8d50`, while `0x5014..0x501c` are the visible one-to-one mirror rows republished by `0x004da9a0` and styled here. The grouped-band `0x4dc09c` table keeps the remaining boundary explicit: visible rows `0x5014..0x501c` do not dispatch to the target-scope selector case directly; they only re-enter the smaller `0x004d9d10` territory-target affordance path on the `0xcf` side, so this helper remains the safest current owner for the actual stored target-scope refresh rather than a generic control-style helper.","objdump + caller xrefs + local disassembly + ordinal-mapping correlation + persisted-selection correlation + RT3.lng correlation + grouped-band dispatch-table decode"
0x004daf40,367,shell_event_conditions_window_reset_selected_event_summary_placeholders,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Selection-bootstrap helper beneath `EventConditions.win` that clears and republishes the dynamic-text placeholder band when the selected event changes or no live event is currently active. The helper writes the same fixed placeholder text block rooted at `0x005c87a8` back into controls `0x4eaf`, `0x4eac`, `0x4ed9`, `0x4edb`, and `0x4fdf..0x4fe2`, then repaints those controls through the generic shell path before the broader selected-event refresh continues. Current grounded callers are `shell_event_conditions_window_set_selected_event_id_and_refresh_if_open` `0x004db6a0` and the callback-binding bootstrap `0x004db6f0`, so this is the safest current read for selected-event summary placeholder reset rather than another local dispatcher fragment.","objdump + caller xrefs + local disassembly + placeholder-control correlation"
0x004da0f0,1350,shell_event_conditions_window_refresh_controls,shell,thiscall,inferred,objdump + caller xrefs + EventConditions.win correlation + RT3.lng correlation + grouped-band dispatch-table decode,3,"Shared refresh pass for `EventConditions.win`. The helper resolves the currently selected live event record from collection `0x0062be18`, samples grouped effect-row type flags for the current grouped selector `[this+0x9c]` through `scenario_event_query_grouped_effect_row_list_type_flags` `0x0042d740`, then consults the adjacent runtime-condition helpers `0x0042dff0`, `0x0042df30`, `0x0042df70`, and `0x0042dfb0` to decide which condition rows should be enabled, disabled, or summarized through the condition-side controls rooted at ids such as `0x5005..0x501c`. The selector pair `0x5001/0x5002` now has a tighter split here: `0x5001` gates the standalone condition test-scope side consumed by `0x004d9970`, with RT3.lng `1573` `Test against...` now the strongest current label fit, while `0x5002` gates the grouped-effect target-scope side, with RT3.lng `1606` `Apply effects...` now the strongest current label fit. On that `0x5002` branch, when control `0x4ed5` is active and the current condition aggregates permit it, the helper builds dynamic-text control `0x5014` from RT3.lng `1160..1164`, yielding `to the company/player/player (i.e. chairman)/territory for which the condition is TRUE`; current RT3.lng correlation then gives the strongest current label fit for the remaining visible target-scope display rows as `0x5015 = to the whole game`, `0x5016..0x5018 = to all/human/AI companies`, `0x5019 + 0x500b = to territories` with a stored target parameter, and `0x501a..0x501c = to all/human/AI players`. The same pass now has a tighter mask split too: grouped effect-row type flag bit `0x08` gates `0x5015`, bit `0x01` gates the company-target trio `0x5016..0x5018`, bit `0x04` gates the territory-target lane `0x500b/0x5019`, and bit `0x02` gates the player-target trio `0x501a..0x501c`. The grouped-band `0x4dc09c` table now keeps the interaction boundary honest too: controls `0x5001/0x5002` are the only `0x4fed..0x501c` entries that route into the grouped target-scope selector case `0x004dbfca` on the `0xcf` side, while visible rows `0x5014..0x501c` route only to the smaller `0x004d9d10` affordance path. The same pass also re-enters `shell_event_conditions_window_refresh_condition_class_summary_and_group_rows` `0x004d9970`, `shell_event_conditions_window_refresh_selected_event_mode_strip_and_summary_panels` `0x004d9f50`, and the smaller territory-target affordance helper `0x004d9d10` before finishing the common window-side repaint tail. Current grounded callers sit in the surrounding event-condition message family near `0x004dbce0`, which makes this the safest current owner for condition-window refresh rather than only a one-off formatter.","objdump + caller xrefs + EventConditions.win correlation + condition-helper correlation + grouped-effect-flag correlation + RT3.lng correlation + grouped-band dispatch-table decode"
0x004db120,1024,shell_event_conditions_window_refresh_selected_event_strip_and_navigation,shell,thiscall,inferred,objdump + local disassembly + caller xrefs + event-selector correlation,3,"Broad selected-event repaint beneath `EventConditions.win`. The helper first enables or disables the selected-event strip rooted at `0x4e84..0x5077` depending on whether `[this+0x84]` holds a live event id, seeds grouped selector `[this+0x9c]` to `0`, re-enables the first grouped summary band `0x4fed`, republishes the persisted grouped target-scope selector id from `0x00622074`, and then resolves the selected live event through collection `0x0062be18` before re-entering `0x004dab60`, `shell_event_conditions_window_refresh_selected_event_mode_strip_and_summary_panels` `0x004d9f50`, `shell_event_conditions_window_refresh_condition_class_summary_and_group_rows` `0x004d9970`, `shell_event_conditions_window_refresh_condition_row_list_panel` `0x004d8120`, and the grouped-row refresh tail `0x004d88f0`. The same pass also republishes the fixed selected-event selector band `0x4e98..0x4ea2` from event byte `[event+0x7ef]`, the summary headers `0x4ead/0x4eae` from `[event+0x7f5]` and `[event+0x7f0]`, the modifier bands `0x4ec0..0x4ec4` and `0x4eb6..0x4eb9` from `[event+0x7f9]` and `[event+0x7fa]`, and the grouped-mode trio `0x4eca..0x4ecc` from `[event+0x7f4]`. The closing count check against `0x0062be18` also gates navigation controls `0x4e85` and `0x4e86`, so this is the safest current owner for selected-event strip and navigation refresh rather than a generic repaint tail.","objdump + local disassembly + caller xrefs + event-record-field correlation + grouped-selection-bootstrap correlation + navigation-control correlation"
0x004db520,192,shell_event_conditions_window_select_previous_event_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Backward selected-event stepping verb beneath `EventConditions.win`. When `[this+0x84]` holds a live event id, the helper resolves the current event record, queries the neighboring live event id through collection helper `0x005184f0(..., 2)`, and when a valid predecessor exists it clears staged condition selection through `0x004d8ea0`, copies the stepped event id into `[this+0x84]`, rebuilds the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, and re-enters the broader selected-event repaint `0x004db120`. It finally republishes control `0x4e84` with the new selected row. Current grounded dispatcher caller is the first event-strip navigation case at `0x004dbc5c`, so this is the safest current read for selected-event previous-step and refresh rather than a generic collection walk.","objdump + local disassembly + dispatcher correlation + event-selector-list correlation"
0x004db5e0,192,shell_event_conditions_window_select_next_event_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Forward selected-event stepping verb beneath `EventConditions.win`. The helper mirrors `0x004db520`, but after querying the stepped event id through `0x005184f0(..., 2)` it rejects the end-of-strip sentinel when the returned ordinal reaches current field `[this+0x90]`, then commits the next live event into `[this+0x84]`, rebuilds the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, re-enters `shell_event_conditions_window_refresh_selected_event_strip_and_navigation` `0x004db120`, and republishes control `0x4e84` with the new selected row. Current grounded dispatcher caller is the sibling event-strip navigation case at `0x004dbc70`, so this is the safest current read for selected-event next-step and refresh rather than another generic list walk.","objdump + local disassembly + dispatcher correlation + end-of-strip-sentinel correlation"
0x004db6a0,80,shell_event_conditions_window_set_selected_event_id_and_refresh_if_open,shell,cdecl,inferred,objdump + local disassembly + callback-binder correlation,3,"Shared selected-event setter beneath `EventConditions.win`. The helper accepts one live event id in `edx`, checks whether the global conditions-window singleton at `0x006cff84` is either inactive or ready for refresh through `0x004d8ea0`, and then writes the requested event id into `[window+0x84]`, re-enters `0x004daf40` plus the broader selected-event repaint `0x004db120`, and mirrors the same id into pending field `0x00622070`. Current grounded caller is the event-selector callback bound on control `0x4e84` from `0x004db6f0`, so this is the safest current owner for selected-event id publish and refresh rather than a generic global setter.","objdump + local disassembly + callback-binder correlation + pending-selection-field correlation"
0x004db6f0,1168,shell_event_conditions_window_bind_event_selector_callbacks_and_seed_pending_selection,shell,thiscall,inferred,rizin + local disassembly + callback-binding correlation,3,"Post-construction callback binder and pending-selection bootstrap for `EventConditions.win`. The helper installs callback-style bindings across the selected-event and summary controls, including the event selector `0x4e84` through `shell_event_conditions_window_set_selected_event_id_and_refresh_if_open` `0x004db6a0` and several summary bands through the window-local callback family rooted at `0x004d71b0`, `0x004d78d0`, `0x004d7950`, `0x004d7960`, `0x004d7970`, and `0x004d7980`. It then seeds the current event selection from pending id `0x00622070`, resets grouped selection `[this+0x9c]`, refreshes the smaller summary side through `0x004d7fe0`, rebuilds the event selector list through `0x004d7ef0`, re-enters `0x004daf40`, and finishes with the broader selected-event repaint `0x004db120`. Current grounded caller is the neighboring conditions-window bring-up branch at `0x004ce204`, so this is the safest current read for event-selector callback binding and pending-selection bootstrap rather than a generic constructor fragment.","rizin + local disassembly + callback-binding correlation + pending-selection-bootstrap correlation"
0x004db8b0,718,shell_event_conditions_window_append_blank_or_clone_selected_event_via_name_modal,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + dispatcher correlation,3,"Selected-event add or clone helper beneath `EventConditions.win`. One caller-controlled boolean selects between a blank event path and a clone-selected-event path: boolean `0` seeds the modal text from localized ids `0x47a` and `0x47c`, while boolean `1` uses the current selected event name plus localized ids `0x47b` and `0x47c`. On accept the helper opens the shared custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0`, creates and selects a new live event through `0x00432ea0`, optionally deep-copies the currently selected live event into that new record through `scenario_event_clone_runtime_record_deep_copy` `0x0042e050`, then rebuilds the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, re-enters the broader selected-event repaint `0x004db120`, and republishes control `0x4e84`. Current grounded dispatcher callers are controls `0x4e87` and `0x4e88` through `0x004dbbfd` and `0x004dbc1e`, so this is the safest current read for blank-event append or selected-event clone via name modal rather than an effects-window refresh.","objdump + caller xrefs + local disassembly + dispatcher correlation + modal-name-flow correlation"
0x004dba90,236,shell_event_conditions_window_rename_selected_event_via_name_modal,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Rename verb for the selected live event beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, copies the current name field `[event+0x18]`, opens the shared custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` with localized id `0x47d`, and on accept writes the edited name back into the live event record before rebuilding the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, restoring the selected id, re-entering `shell_event_conditions_window_refresh_selected_event_strip_and_navigation` `0x004db120`, and republishing control `0x4e84`. Current grounded dispatcher caller is control `0x4e89` through `0x004dbd6e`, so this is the safest current read for selected-event rename via name modal rather than another selector refresh tail.","objdump + local disassembly + dispatcher correlation + modal-rename correlation"
0x004dbe7a,100,shell_event_conditions_window_open_choice_event_single_player_only_warning_modal,shell,thiscall,inferred,objdump + local disassembly + switch-table decode + RT3.lng string correlation,3,"Small warning-modal branch beneath `EventConditions.win` reached from the `0x4ec6/0x4ec7` control pair. The helper first checks whether selected-event mode control `0x4e8f` is active, and only on that branch forces grouped-mode control `0x4eca` active before opening the shared custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` with localized id `0x0f2f` `3887`, whose grounded RT3.lng text warns that `Choice` events are single-player only and not allowed in multiplayer games. The branch does not otherwise mutate persistent event state, so this is the safest current read for a choice-event single-player-only warning modal rather than a grouped-action commit path.","objdump + local disassembly + switch-table decode + RT3.lng string correlation + mode-control correlation"
0x004dbeeb,116,shell_event_conditions_window_publish_pending_shared_summary_text_triplet,shell,thiscall,inferred,objdump + local disassembly + switch-table decode,3,"Pending dynamic-text publish helper beneath `EventConditions.win` reached from control `0x4ed9` when global latch `0x006d07d8` is clear. The helper copies one current shell text payload into a local `0x7d0` buffer, republishes that same text into controls `0x4eac`, `0x4ed9`, and `0x4edb` through the generic type-`0x6f` dynamic-text path, and then clears `0x006d07d8`. This is therefore the safest current read for publishing one pending shared summary-text triplet rather than a generic selection refresh.","objdump + local disassembly + switch-table decode + dynamic-text-control correlation"
0x004dbb80,1074,shell_event_conditions_window_dispatch_selected_event_strip_and_grouped_band_actions,shell,thiscall,inferred,objdump + local disassembly + switch-table decode + control-id correlation + grouped-band dispatch-table decode,3,"Broader `EventConditions.win` command dispatcher above the selected-event strip and grouped-band controls. The helper switches on shell messages `0xca`, `0xcb`, and `0xcf`, then uses the decoded `0x4dc000`, `0x4dc018`, `0x4dc050`, and `0x4dc08c` tables to route control families rooted at `0x4e84..0x4ea1`, `0x4eac..0x4ed9`, and `0x4fed..0x501c`. The selected-event strip is now explicit on the `0xcb` side: controls `0x4e85/0x4e86` step previous or next events through `0x004db520/0x004db5e0`, `0x4e87/0x4e88` add a blank event or clone the selected event through `0x004db8b0(0/1)`, `0x4e89` renames the selected event through `0x004dba90`, and `0x4e8a` deletes it through `0x004d9360`. The `0xca` side also owns the selected-event mode strip rooted at `0x4e98..0x4ea1`, where the baseline band writes event byte `[event+0x7ee] = 0` before re-entering `0x004d9f50`, while control `0x4ea1` writes special mode `4` and then refreshes the same strip. The later grouped-band `0xcf` cases are now bounded more tightly by the `0x4dc09c` byte map: grouped summary controls `0x4fed..0x4ff0` route to `0x004dbf93`, selector pair `0x5001/0x5002` route to `0x004dbfca`, visible target-scope display rows `0x5014..0x501c` route only to `0x004dbf7f -> 0x004d9d10`, and the remaining `0x4ff1..0x5013` span falls through the default no-op case. This is therefore the safest current owner for selected-event strip and grouped-band action dispatch rather than leaving those bands distributed across unnamed case blocks.","objdump + local disassembly + switch-table decode + control-id correlation + grouped-band correlation + grouped-band dispatch-table decode"
0x004dbfca,32,shell_event_conditions_window_select_grouped_effect_target_scope_mode_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation + grouped-band dispatch-table decode + RT3.lng correlation,3,"Grouped target-scope mode selector case beneath `EventConditions.win` on the `0xcf` grouped-band path. The helper first commits the currently visible selected-event text panels through `shell_event_conditions_window_commit_current_selected_event_text_panels_before_selection_change` `0x004d8ea0`, then refreshes the grouped-effect target-scope strip through `shell_event_conditions_window_refresh_selected_grouped_effect_target_scope_strip` `0x004dab60`, and finally stores the clicked control id into global `0x00622074` so the same target-scope selector can be re-enabled during later selected-event bring-up at `0x004db120`. The `0x4dc09c` dispatch table now keeps the control family honest: this case is only reached by controls `0x5001` and `0x5002`, not by visible rows `0x5014..0x501c`. Current RT3.lng adjacency gives those two controls their strongest current player-facing fit too: `0x5001` is the condition-side `Test against...` mode and `0x5002` is the grouped-effect-side `Apply effects...` mode. This is therefore the safest current read for grouped target-scope mode selection and refresh rather than for the whole visible target-scope display family.","objdump + local disassembly + dispatcher correlation + grouped-band dispatch-table decode + persisted-selection correlation + RT3.lng correlation"
0x004dbf93,55,shell_event_conditions_window_select_grouped_effect_summary_band_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Grouped-band selector verb beneath `EventConditions.win`. The helper first commits the current grouped-effect summary editor state through `shell_event_conditions_window_commit_current_grouped_effect_summary_state_before_group_switch` `0x004d8d50`, stores the newly chosen grouped selector ordinal `control_id - 0x4fed` into `[this+0x9c]`, refreshes the visible grouped rows through `0x004d88f0`, re-enters the surrounding condition-window repaint through `0x004da0f0`, and then finishes with the smaller grouped summary tail at `0x004da9a0`. Current grounded dispatcher caller is the `0x4fed..0x4ff0` case family under `0x004dbb80`, so this is the safest current read for grouped-effect summary band selection and refresh rather than a generic selector write.","objdump + local disassembly + dispatcher correlation + grouped-band-selector correlation"
0x004c8670,11,shell_mark_custom_modal_dialog_dirty,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny dirty-latch setter paired with the shared callback-driven custom modal family rooted at `0x006cfeb4`. The helper stores `1` into `0x006cfeac`, which current nearby call patterns treat as the custom-modal refresh or service request latch after the lower constructor at `0x004c86c0` and opener `shell_open_custom_modal_dialog_with_callbacks` have published a live modal object. Current grounded caller is the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + nearby-constructor correlation + frame-caller inspection + custom-modal correlation"
0x004c7520,190,shell_open_region_focus_modal_and_center_world_on_confirmed_region,shell,cdecl,inferred,objdump + local disassembly + caller correlation + modal-callback correlation,4,"Opens the region-focused custom modal used by queued runtime-effect kind `7` under `simulation_dispatch_runtime_effect_queue_record_by_kind_into_shell_or_world_handlers` `0x00437c00`. The helper first requires scenario latch `[0x006cec74+0x277]`, stores the incoming region id in global `0x006cfe80`, allocates one helper object through `0x0053c6f0(2)` and stores that handle in `0x006cfe88`, then opens the callback-driven custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` with localized root `0x005c87a8`, callbacks `0x004c72f0` and `0x004c73c0`, mode `0x0a`, and scalar `0.5f`. On teardown it releases the helper through `0x0053c000`, and when the modal returns `0x3f2` it resolves the selected region id back through collection `0x0062bae0` and recenters the live world through `0x00433900`. Callback `0x004c72f0` formats one region-specific callout from the selected region name at `[region+0x356]`, the rounded region scalar `[region+0x276]`, and the helper root in `0x006cfe88`; callback `0x004c73c0` builds one interactive control payload strip from the supplied float pair. So the current strongest read is a region-focus or region-confirm modal owner, not a generic one-arg message path.","objdump + local disassembly + caller correlation + modal-callback correlation + region-collection correlation + world-center correlation"
0x004c8680,14,shell_has_live_custom_modal_dialog,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny presence probe for the shared callback-driven custom modal family. The helper reads the live modal singleton at `0x006cfeb4`, returns `1` when that pointer is positive or nonnull, and returns `0` otherwise. Current grounded caller is the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where this branch now sits beside the `LoadScreen`, file-options, and other shell-window probes rather than any detached gameplay-only UI owner.","objdump + nearby-constructor correlation + frame-caller inspection + custom-modal correlation"
0x004e1d60,1169,shell_load_screen_refresh_page_strip_and_page_kind_controls,shell,thiscall,inferred,objdump + descriptor-table decode + caller inspection,4,"Shared refresh helper beneath the shell-side `LoadScreen.win` family. The helper reads the active 13-byte page descriptor record at `0x006220a0 + page*0x0d` using current page id `[this+0x78]`, where the record now grounds as `{ page_kind_dword, title_string_id, back_link_page_dword, selected_company_header_flag_byte }`. It copies the descriptor kind into `[this+0x80]`, refreshes the page-strip and companion controls `0x3e80`, `0x3e81`, `0x3eee..0x3ef7`, `0x3ef8`, `0x3efb`, `0x3efc`, `0x3f0a`, `0x3f0b`, and `0x3f0e` through the generic shell control path at `0x00540120`, and applies page-specific row-band styling from current page-local row state `[this+0x7c]`, row count `[this+0x84]`, and stacked selection history `[this+0x0a0..0x118]`. The descriptor decode now also bounds control `0x3ef8` as the table-driven backlink affordance: page `0` keeps backlink `0`, page `1` backlinks to page `2`, page `8` backlinks to page `7`, page `0x0b` backlinks to page `0x0a`, and page `0x0d` backlinks to page `0x0c`. Current descriptor decode therefore keeps page `0` as kind `0`, title id `1200` `XXX`, backlink `0`, and header flag `0`; page `1` as company-overview kind `1` with backlink page `2`; page `8` as player-detail kind `3` with backlink page `7`; page `0x0b` as dormant train-detail title with backlink page `0x0a`; and page `0x0d` as dormant station-detail title with backlink page `0x0c`. Current grounded caller is `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10`, which uses this helper after storing a new page or subject selection.","objdump + descriptor-table decode + caller inspection + control-style correlation + backlink-control correlation"
0x004e2c10,3472,shell_load_screen_select_page_subject_and_refresh,shell,thiscall,inferred,objdump + caller inspection + state-flow correlation,4,"Shared page or subject selector beneath the shell-side `LoadScreen.win` family rooted at `0x006d10b0`. The helper accepts a page id, a page-local subselector, and an optional subject id; defaults of `-1` reuse the current fields at `[this+0x78]`, `[this+0x7c]`, and caller-selected company or profile state. It stores the chosen page in `[this+0x78]`, the subselector in `[this+0x7c]`, resets several page-local fields including `[this+0x84]` and the report-row latch at `[this+0x75c]`, updates the current company id `[this+0x88]` or profile id `[this+0x8c]` depending on page ownership, and then repaints the active page controls through `0x00563250` and `0x0053fe00`. Several page-specific branches also recompute bounded row-count state for the report lists on pages `0x0a`, `0x0c`, `0x0f`, and `0x0e`, including row styling over control band `0x3f48..`. The surrounding descriptor table now makes one narrower part of this family explicit too: when control `0x3ef8` is used as a backlink affordance, the selected page target comes from the current descriptor backlink dword rather than from a separate hardcoded detail-page branch. Current grounded callers include the broad `LoadScreen.win` dispatcher at `0x004e3a80`, the page-specific stock-holdings branch at `0x004e45d0`, and the selected-company or selected-profile step helpers at `0x004e3a00` plus `0x004e45d0`, so this now reads as the family-wide page or subject refresh owner rather than a CompanyDetail helper.","objdump + caller inspection + state-flow correlation + page-refresh correlation + backlink-target correlation"
0x004e3a00,112,shell_load_screen_step_selected_company_delta,shell,thiscall,inferred,objdump + caller inspection + company-collection correlation,4,"Steps the current `LoadScreen.win` selected company forward or backward across the active company roster. The helper wraps `selected_company + delta` through `company_collection_count_active_companies` at `0x00429a50`, resolves the replacement id through `company_collection_get_nth_active_company_id` at `0x00429990`, stores it into `[this+0x88]`, and then re-enters `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10` with the current page id in `[this+0x78]`. Current grounded callers are the `0x3efd/0x3efe` year or company navigation lane inside `LoadScreen.win`.","objdump + caller inspection + company-collection correlation + page-refresh correlation"
0x004e3a80,2900,shell_load_screen_window_handle_message,shell,thiscall,inferred,objdump + caller inspection + resource correlation,4,"Primary message dispatcher for the shell-side `LoadScreen.win` family rooted at singleton `0x006d10b0`. The handler switches on the incoming shell message id and owns page state `[this+0x78]`, page-local substate `[this+0x7c]`, page-kind byte `[this+0x80]`, current company `[this+0x88]`, current chairman profile `[this+0x8c]`, display year `[this+0x9c]`, and the page-local report-row latch `[this+0x118]`. Message `0xcb` on the page-strip controls routes through the page-kind dispatch rooted at `[this+0x80]`, where several cases re-enter `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10`, the company-step helper at `0x004e3a00`, or narrower page handlers such as `0x004e45d0`. One separate control band `0x3fd4..0x4073` selects report or list pages by updating `[this+0x75c]` and a boolean accent latch `[this+0x760]` before refreshing control `0x3fac`. The row band `0x3f48..0x3f51` is tighter now too: on page `7` it promotes one selected player row into page `8` through `shell_load_screen_select_page_subject_and_refresh`; on page `0x0a` it routes the chosen train through the shell detail-panel manager `0x004ddbd0` in mode `2` and then centers via `0x00437a90`; on page `0x0c` it routes the chosen station through the same manager in mode `5` and then centers via `0x00437a90`; and on page `0x0f` it routes the chosen industry or building through the same manager in mode `0x0a` before the same centering path. Current grounded ownership therefore includes the company or profile page routes for ids `0`, `2`, `7`, `8`, `9`, `0x0a`, `0x0c`, `0x0e`, and `0x0f`, while the title-table detail ids `0x0b` and `0x0d` still do not appear on the live row-click path or any recovered page-strip action lane. This makes `0x004e3a80` the real outer `LoadScreen.win` message owner above the sibling renderers at `0x004e5300`, `0x004e5a80`, and `0x004e5cf0` rather than a loose shared helper.","objdump + caller inspection + resource correlation + page-dispatch correlation + report-tab correlation + row-click-route correlation"
0x004e39e0,19,company_query_display_year_or_current_year,simulation,thiscall,inferred,objdump + caller inspection,4,"Tiny company-side helper that returns the optional display year cached at `[this+0x9c]` when nonzero, otherwise falls back to the current scenario year at `[0x006cec78+0x0d]`. Current grounded callers include the shared governance or economy shell formatter at `0x004e5cf0` and several nearby company-readout helpers in the same shell display family.","objdump + caller inspection + year-fallback correlation"
0x004e1f50,14,shell_has_live_load_screen_window,shell,cdecl,inferred,objdump + global-state inspection + frame-caller inspection,4,"Tiny shell-side presence probe for `LoadScreen.win`. The helper reads the live ledger singleton at `0x006d10a8`, returns `1` when that pointer is nonnull, and returns `0` otherwise. Current grounded callers include the frame-owned cadence at `simulation_frame_accumulate_and_step_world` `0x00439140`, where this branch now sits beside other shell-window service probes rather than any detached gameplay-only input owner.","objdump + global-state inspection + frame-caller inspection + LoadScreen singleton correlation"
0x004e1f60,11,shell_mark_load_screen_window_dirty,shell,cdecl,inferred,objdump + global-state inspection + frame-caller inspection,4,"Tiny shell-side dirty-flag setter paired with `shell_has_live_load_screen_window`. The helper stores `1` into `0x006d10a4`, which current nearby call patterns treat as the `LoadScreen.win` refresh or service request latch once the live ledger singleton at `0x006d10a8` exists. Current grounded caller is the post-step shell-window service ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + global-state inspection + frame-caller inspection + LoadScreen singleton correlation"
0x004e45d0,757,shell_load_screen_profile_stock_holdings_page_handle_message,shell,thiscall,inferred,objdump + RT3.lng strings + control-id inspection,4,"Page-specific message handler for the `LoadScreen.win` stock-holdings slice. The handler owns controls `0x3ef6..0x3f1d` while page-kind `[this+0x80]` selects this branch from the outer dispatcher at `0x004e3a80`. Current grounded state includes the selected profile id `[this+0x8c]`, selected company id `[this+0x88]`, optional display year `[this+0x9c]`, and a local row index `[this+0x118]`. Controls `0x3ef6` and `0x3ef7` step `[this+0x118]` backward or forward within a bounded `0..10` band before re-entering `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10`; `0x3ef8`, `0x3efb`, and `0x3efc` reuse that same helper to activate or step the current company row and page-local selector state. The later jump-table lane rooted at `0x3f07` also cycles the selected profile through the active-chairman collection at `0x006ceb9c` using `profile_collection_count_active_chairman_records` at `0x00477820`, `0x005184f0`, and `0x00518380`, then refreshes the current page through `0x004e2c10`. The same page branch adjusts the display year `[this+0x9c]` through the company-step helper `0x004e3a00` and the fallback reader `company_query_display_year_or_current_year` at `0x004e39e0`. Current grounded meaning is the stock-holdings page handler beneath `LoadScreen.win`, not the outer window dispatcher.","objdump + RT3.lng strings + control-id inspection + active-profile-cycle correlation + year-step correlation + row-selection correlation"
0x004e4b10,720,shell_load_screen_reset_runtime_state_and_seed_selection,shell,thiscall,inferred,objdump + caller inspection + state-flow correlation,3,"Lower reset or seed helper used by the `LoadScreen.win` opener before the visible ledger loop begins. The helper clears page state `[this+0x78]`, page-local substate `[this+0x7c]`, display year `[this+0x9c]`, selected company `[this+0x88]`, selected chairman profile `[this+0x8c]`, the page-kind cache `[this+0x80]`, the page-strip history stack rooted at `[this+0x0a0]`, and several presentation-side pointers including `[this+0x0b2d]` and `[this+0x0b31]`. It then seeds the selected company and chairman from the current scenario state through `0x004337a0` and `0x004337b0`, allocates the main text surface at `[this+0x0e55]`, builds several descriptor or name caches under `[this+0x0b25]`, `[this+0x0b29]`, `[this+0x0761..]`, `[this+0x0995..]`, and `[this+0x0b35..]`, binds three callback-style controls `0x3ee4`, `0x3ef4`, and `0x3ee5` through the generic shell control path at `0x00540120`, and stores the caller-selected display year into `[this+0x9c]`. Current grounded caller is the higher `LoadScreen` opener at `0x004e4ee0`, which later enters the page-selection refresh path. This now reads as the runtime reset and cache-seed helper beneath ledger opening rather than as a page renderer.","objdump + caller inspection + state-flow correlation + cache-seed correlation"
0x004e4ee0,406,shell_open_or_focus_load_screen_page,shell,thiscall,inferred,objdump + caller inspection + RT3.lng strings + launch-flow correlation,4,"Shared higher-level opener for the shell-side `LoadScreen.win` ledger family. The caller supplies one requested page id in `ECX`. When sandbox flag byte `[0x006cec7c+0x82]` is set the helper does not open the ledger; instead it raises a simple shell modal through `shell_open_custom_modal_dialog_with_callbacks` using localized id `3899` `The ledger is not available in sandbox mode.`. Outside sandbox it first checks for an existing live ledger runtime at `0x006d10a8`: when one is already open and the requested page id is nonzero it simply re-enters `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10` with that page; when the live runtime exists and the requested page id is zero it leaves the current page unchanged. When no live runtime exists it allocates the transient ledger object into `0x006d10a8`, resets and seeds it through `shell_load_screen_reset_runtime_state_and_seed_selection` at `0x004e4b10`, enters the visible shell modal loop through `0x00538f10`, and then tears the object back down while restoring the surrounding shell presentation state. Current grounded callers include the world-frame command path at `0x0043970f`, the grouped shell command stubs at `0x0044070e..0x0044086e` for pages `1`, `2`, `3`, `4`, `5`, `6`, `7`, `9`, `0x0a`, `0x0c`, `0x0e`, and `0x0f`, and the shell detail-side launcher at `0x004de82b`; no current recovered opener in that family requests page `0x0b` or `0x0d`. This now reads as the shared open-or-focus ledger-page owner rather than an unnamed helper beside the page family.","objdump + caller inspection + RT3.lng strings + launch-flow correlation + sandbox-guard correlation"
0x004e5130,186,shell_load_screen_render_company_stock_data_panel,shell,thiscall,inferred,objdump + RT3.lng strings + helper correlation,4,"Selected-company stock-data page renderer inside `LoadScreen.win`. The helper first validates the current company id at `[this+0x88]` through the live company collection at `0x0062be10`. When no company is active it emits localized id `1299` `No stocks to view at this time...` through the shell text presenter and restyles control `0x3efd` inactive. On the populated path it falls through into the shared stock-data builder at `0x004c0160` using the temporary holdings buffer at `[this+0x995]`, current row or subselector state at `[this+0x0b25]` and `[this+0x0b29]`, and the stock-data descriptor table rooted at `0x00622098`. That lower helper iterates the active chairman roster, ranks the largest positive holders for the selected company, and formats the `Largest Shareholders`, `Shares`, and `Per Share Data` family under localized ids `928..930`, with the first three per-share rows now bounded as `Share Price`, `Book Value Per Share`, and `Revenue Per Share` from stat-family slots `0x1c..0x1e`. Current grounded caller is page `7` of `shell_load_screen_render_active_page_panel` at `0x004ea060`, so current best page meaning is the `Stock Data` slice rather than another generic company list.","objdump + RT3.lng strings + helper correlation + shareholder-ranking correlation + stock-data fallback correlation + per-share-label correlation"
0x004e51ea,246,shell_load_screen_render_game_status_briefing_panel,shell,thiscall,inferred,objdump + RT3.lng strings + helper correlation,4,"Game-status-side briefing renderer inside `LoadScreen.win`. The helper uses page-local subselector `[this+0x7c]` to build one packed key and then queries the live scenario text store at `0x0062be18` through `0x00432f40` with kind `9`, writing the returned briefing text into a stack buffer before presenting it through the shell text surface rooted at `[this+0x0e55]`. It then appends the localized title or help pair `1772` `Briefing` and `1773` `View the scenario briefing.` through the smaller shell text-widget writer at `0x00563290`. Current grounded caller is page `3` of `shell_load_screen_render_active_page_panel` at `0x004ea060`, so current best meaning is the `Game Status` briefing page or panel rather than a company-owned report list.","objdump + RT3.lng strings + helper correlation + scenario-text-store correlation + briefing-string correlation"
0x004e5300,1899,shell_load_screen_render_player_detail_stock_holdings_panel,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection + page-title-table decode,4,"Renders the selected-profile stock-holdings summary panel inside the shell-side `LoadScreen.win` family. The helper resolves the selected profile id at `[this+0x8c]` through the live chairman collection at `0x006ceb9c`, builds the top summary rows under localized ids `1204` `Stock Value:`, `1205` `Total Assets:`, and `1206` `Stock Holdings:`, then walks the active company roster through `company_collection_count_active_companies` at `0x00429a50` plus `company_collection_get_nth_active_company_id` at `0x00429a90`. For each active company with positive profile holdings in `[profile + company_id*4 + 0x15d]`, it formats one company row under ids `1201` `Click to view details on %1.`, `1207` `%1 Shares`, and `1208` `%1 Value`; when no positive holdings survive the sweep it emits fallback id `1209` `None`. The panel also checks the scenario-selected chairman through `0x004348c0`, and only for that currently selected profile does it append localized id `3029` `Click to change player name and portrait.` together with the adjacent `1941` `Change` affordance through the shell text-widget writer at `0x00563290`. The `LoadScreen.win` page-title descriptor table rooted at `0x006220a4` now ties current grounded caller page `8` to localized title id `1192` `PLAYER DETAIL`, so this renderer is no longer just a generic holdings page.","objdump + RT3.lng strings + caller inspection + active-company-iteration correlation + holdings-slot correlation + selected-profile affordance correlation + page-title-table decode"
0x004e5a80,2368,shell_render_company_overview_panel_header_and_optional_change_affordance,shell,thiscall,inferred,objdump + RT3.lng strings + helper correlation,4,"Broader company-side overview-panel renderer above the shared text-formatting entry later mapped at `0x004e5cf0`. The wrapper first checks the selected company id at `[this+0x88]`. When that id is absent or no longer resolves through the live company collection at `0x0062be10`, it chooses one of three fallback text families `1210` `You haven't started a company yet...`, `3043` `You don't control a company at the moment...`, or `3888` `You don't control a company at the moment.` from current chairman/company state, paints that fallback into the current shell text surface, and styles controls `0x3f06` and `0x3f07` inactive through the generic control path at `0x00540120`. When a valid company is present, it styles those same controls active, falls through into the shared metric/governance body later labeled at `0x004e5cf0`, and on the narrower branch where the selected company matches the scenario-selected company at `0x00434870` it also appends localized id `3044` `Click to change company name and logo.` and publishes the adjacent `1941` `Change` affordance through the shell text-widget writer at `0x00563290`. Current evidence therefore keeps the name/logo affordance outside the normal `CompanyDetail.win` callback dispatcher and makes `0x004e5cf0` read more like the shared text-formatting subentry within this wider overview-panel renderer than like a full standalone owner by itself.","objdump + RT3.lng strings + helper correlation + fallback-text correlation + overview-wrapper correlation"
0x004e5cf0,1844,shell_format_company_governance_and_economy_status_panel,shell,cdecl,inferred,objdump + RT3.lng strings + helper correlation,4,"Shared shell text formatter for one company-side overview panel. The helper first renders a five-line company-metric preamble from the generic stat reader `0x0042a5d0` using display-year-aware company slots `0x2c`, `0x2b`, `0x17`, and `0x26` plus one derived ratio branch. That preamble is now grounded through localized ids `1211..1215`: `Revenues` from slot `0x2c`, `Profits` from slot `0x2b`, `Load miles hauled` from slot `0x17`, `Revenue per load mile` from the derived `slot 0x2c / slot 0x17` branch with a safe `1.0` fallback when the load-mile value is nonpositive, and `Average speed` from slot `0x26` rendered through localized value formatter `1216` `%1 m.p.h.`. Its governance branch is now tighter too: when the selected company has no linked chairman it emits localized id `3045` `This company is controlled by the shareholder's committee...`; when the company is wholly owned it emits `3046` `You have complete ownership...` for the scenario-selected chairman or `3047` `This company is wholly owned by %1` for another linked chairman; otherwise it emits the investor-attitude lines `3048` `Investors are %1 your performance.` or `3049` `Investors are %1 the chairman's performance.` using the adjective table at `0x00622170`. The salary branch is bounded now too: it computes a signed salary delta from the company fields at `[company+0x14f]` and `[company+0x0d59]`, formats the absolute change and current salary value through the numeric helpers at `0x0051bfe0`, and then chooses `3050..3052` when the linked chairman is the scenario-selected chairman or `3053..3055` for another linked chairman depending on whether the delta is negative, positive, or zero. The bonus branch is narrower as well: only when the display year from `company_query_display_year_or_current_year` `0x004e39e0` matches the recorded bonus year at `[company+0x34f]` does it append `3056` `You have been awarded a bonus of %1.` or `3057` `The chairman has been awarded a bonus of %1.` using the bonus amount at `[company+0x353]`. The same formatter then appends the localized economy tail caption `1218` `Economy status - %1.` from the current scenario economy state at `[0x006cec78+0x2d]` and continues by staging the adjacent selected-company report or list help-title pairs `1219/1220` `Income Statement`, `1221/1222` `Balance Sheet`, `1223/1224` `Haulage Report`, `1225/1226` `Stock Report`, `1227/1228` `Train List`, `1229/1230` `Station List`, `1231/1232` `Industry List`, and `1233/1234` `Cargo List`. Current evidence now carries this strip conservatively as staged overview text or help content rather than as a dispatcher-owned launcher family. It uses the linked-chairman accessor `0x00426ef0`, the company-ownership test at `0x004768c0`, the display-year bucket helper `0x004240c0`, and the economy-status table at `0x00620cc0`. The row is therefore kept at that overview-widget formatter level, with the direct shell binding bounded by the section-0 refresh path for `CompanyDetail.win` control `0x947f`.","objdump + RT3.lng strings + helper correlation + governance-status string correlation + CompanyDetail overview correlation + metric-preamble correlation + report-launch-strip correlation + ownership-branch correlation + salary-bonus branch correlation + negative-dispatch-boundary correlation + preamble-label-table correlation"
0x004e68e0,1521,shell_load_screen_render_company_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection + page-title-table decode,4,"Renders the active-company comparison page inside `LoadScreen.win`. The helper first rejects the empty-company case with one fallback text branch rooted at localized ids `1210`, `3043`, or `3888`, then clears the shared row buffer at `[this+0x11c]`, stages the visible company-comparison column family `1235..1242`, and iterates the active company roster through `company_collection_count_active_companies` at `0x00429a50` plus `company_collection_get_nth_active_company_id` at `0x00429a90`. The caller-supplied page-local selector chooses which company metric to rank on: revenue through slot `0x2c`, profit through slot `0x2b`, cash through slot `0x0d`, or track mileage through slot `0x25`, all read through the generic company stat reader at `0x0042a5d0`. The emitted row lane also stages the adjacent company-report affordances `1243` `Click to view %1's income statement.`, `1244` `Click to view %1's balance sheet.`, and `1245` `Click to view %1's haulage reports.` on top of the ranked company rows, while applying the stronger highlight path when the row company matches the scenario-selected chairman's current company. The `LoadScreen.win` page-title descriptor table rooted at `0x006220a4` now ties current grounded caller page `2` to localized title id `1186` `COMPANY LIST`, so this renderer is now bounded as the company-list page rather than only a generic financial ranking helper.","objdump + RT3.lng strings + caller inspection + active-company-iteration correlation + company-stat-slot correlation + report-affordance correlation + page-title-table decode"
0x004e6ef0,1879,shell_load_screen_render_player_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection + page-title-table decode,4,"Renders the active-chairman comparison page inside `LoadScreen.win`. The helper clears the shared row buffer at `[this+0x11c]`, stages the visible chairman-comparison headers from the localized family `1237`, `1241`, `1246`, `1247`, `1248`, `1249`, and `1250`, then iterates the active chairman profile collection at `0x006ceb9c` through `profile_collection_count_active_chairman_records` and the `nth active` accessors rooted at `0x00477820`, `0x00477860`, and `0x004778c0`. The caller-supplied selector chooses which chairman-side metric drives the ranking: cash, one direct profile-held total, one direct-total-plus-cash lane, one threshold-adjusted-total-plus-cash lane, or the active-rank lane read through `0x00476320`, `0x00476780`, `0x00476c20`, and `0x004778c0`. The row builder also uses the profile-side name and portrait-family tables around `0x00622192..0x006221a4`, with special-cased current-player text on the zero-th row and the stronger highlight path when one ranked profile matches the scenario-selected chairman. The `LoadScreen.win` page-title descriptor table rooted at `0x006220a4` now ties current grounded caller page `7` to localized title id `1191` `PLAYER LIST`, so this renderer is now bounded as the player-list page rather than only a chairman-wealth ranking helper.","objdump + RT3.lng strings + caller inspection + active-profile-iteration correlation + profile-metric correlation + wealth-ranking-string correlation + page-title-table decode"
0x004e7670,3033,shell_load_screen_render_company_train_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Renders the company-owned train list page inside `LoadScreen.win`. The helper first rejects missing selected-company state through localized id `1210` and then rejects companies with no trains through id `1251` `This company does not have any trains.` after querying the current company through the live company collection at `0x0062be10` and the train-count helper at `0x004264c0`. On the populated path it clears the `0x190`-dword row buffer at `[this+0x11c]`, reads the optional display year through `company_query_display_year_or_current_year` at `0x004e39e0`, stages the visible column headers and sort-help family `1235..1242`, and then iterates the selected company's live train roster through the company-side train accessors around `0x004264c0`, `0x00426520`, `0x004a7270`, `0x004a77b0`, and `0x0041adb0`. The emitted row family matches the player-facing train-list strip: revenue, profit, cash, track mileage, engine type, age, oil, water, sand, speed, and profit rows from `1252..1266`, plus the per-row camera-centering affordance `1267` `Click to center the camera on %1`. Current grounded caller is the wider `LoadScreen.win` render family around `0x004ea499`, which keeps this as one company-list page sibling beside the holdings, building, station, and cargo pages rather than a `CompanyDetail.win` subpanel.","objdump + RT3.lng strings + caller inspection + company-train-roster correlation + train-list-string correlation"
0x004e8270,2336,shell_load_screen_render_company_industry_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection + page-title-table decode,4,"Renders the selected-company industry list page inside `LoadScreen.win`. The helper rejects missing selected-company state through localized id `1210` and rejects companies with no owned buildings through id `1268` `This company does not own any buildings.` after resolving the current company through `0x0062be10` and the building-count helper at `0x004266c0`. On the populated path it clears the shared row buffer at `[this+0x11c]`, stages the visible header and sort-help family `1269..1278`, and then walks the selected company's owned placed-structure set through the building-side accessors around `0x004266c0`, `0x004267f0`, `0x0062b26c`, `0x0047de00`, `0x0040cac0`, `0x0040ca70`, `0x0040ca80`, and `0x0040d360`. The rendered rows align with the player-facing industry list strip: industry or building type, year built, profitability, loads consumed, loads generated, and the surrounding sort hints. The `LoadScreen.win` page-title descriptor table rooted at `0x006220a4` now ties current grounded caller page `15` to localized title id `1199` `INDUSTRY LIST`, which makes this the industry-list page rather than a generic building-list sibling.","objdump + RT3.lng strings + caller inspection + company-building iteration correlation + building-list-string correlation + page-title-table decode"
0x004e8bb0,2198,shell_load_screen_render_company_station_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Renders the company-owned station list page inside `LoadScreen.win`. The helper rejects missing selected-company state through localized id `1210` and rejects companies with no stations through id `1279` `This company does not have any stations.` after resolving the selected company and probing the company-owned station count through `0x00426590`. On the populated path it clears the shared row buffer at `[this+0x11c]`, stages the station-list header and sort-help family `1280..1288`, and then walks the selected company's owned station or placed-structure set through the station-side accessors around `0x00426620`, `0x006cec20`, `0x0047d7d0`, `0x0047d7c0`, `0x0047d7f0`, `0x0047d7e0`, and `0x0047de00`. The emitted rows match the visible station-list strip: cargo out, cargo in, revenue out, revenue in, and the adjacent sort affordances. Current grounded caller is the wider `LoadScreen.win` render family around `0x004ea499`, which keeps this as the company-station page sibling beside the train, building, and cargo pages.","objdump + RT3.lng strings + caller inspection + company-station iteration correlation + station-list-string correlation"
0x004e9460,1694,shell_load_screen_render_map_cargo_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Renders the map-wide cargo list page inside `LoadScreen.win`. The helper clears the shared row buffer at `[this+0x11c]`, stages the cargo-list header and sort-help family `1289..1298`, and then iterates the live structure-candidate collection at `0x0062ba8c` rather than one selected company roster. It filters candidates through `structure_candidate_is_enabled_for_current_year` at `0x0041e220`, then derives one sortable per-cargo metric from `structure_candidate_query_route_style_or_local_availability_metric` at `0x0041e650` plus the direct candidate fields at `+0x5e`, `+0x62`, `+0x6a`, and route-style flag `+0x46`. That keeps the same candidate split visible on this page too: route-style rows use the normalized route-side availability metric from `0x0041e650`, while ordinary rows can still surface the direct local float at `[candidate+0x5a]`. The resulting rows align with the player-facing cargo page: cargo name, number of loads, new loads, loads used, price, and the surrounding sort hints. Current grounded caller is the wider `LoadScreen.win` render family around `0x004ea499`, which keeps this as the cargo-list page sibling beside the selected-profile holdings page and the selected-company train, building, and station lists.","objdump + RT3.lng strings + caller inspection + cargo-candidate iteration correlation + cargo-list-string correlation + route-style-metric correlation"
0x004e9b20,1330,shell_load_screen_render_company_report_history_panel,shell,cdecl,inferred,objdump + caller inspection + page-jump-table correlation + RT3.lng correlation,4,"Shared multi-year company report-table renderer inside `LoadScreen.win`. The helper validates the selected company through the live company collection at `0x0062be10`, derives a bounded display-year window from current display year `[this+0x9c]` and company founding year `[company+0x157]`, clears and repopulates the shared row buffer at `[this+0x11c]`, and then renders one of three page-local report modes selected by its caller-supplied mode argument. The descriptor table rooted at `0x00622192..0x006221a4` now grounds those modes as page `4` `Income Statement`, page `5` `Balance Sheet`, and page `6` `Haulage Report`: mode `0` walks the revenue and expense family `1301..1315`, mode `1` walks the asset and liability family `2816`, `1317..1322`, and mode `2` walks the haulage and operating-stat family `1323..1335`. Ordinary rows read yearly values through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0`. The two special row families are tighter now too: they feed the `%1/%2` rate inserts for localized strings `2815` and `2816` through `company_compute_negative_cash_balance_interest_rate` at `0x00425880` and `company_compute_positive_cash_balance_interest_rate` at `0x004258c0`. Current grounded callers are the page `4`, `5`, and `6` arms of `shell_load_screen_render_active_page_panel` at `0x004ea060`, so ownership and page semantics are now both bounded.","objdump + caller inspection + page-jump-table correlation + selected-company validation correlation + report-table mode correlation + RT3.lng row-family correlation + descriptor-table decode + special-rate-row correlation"
0x004ea060,1403,shell_load_screen_render_active_page_panel,shell,thiscall,inferred,objdump + caller inspection + page-jump-table correlation + page-title-table decode,4,"Family-wide render dispatcher beneath the shell-side `LoadScreen.win` singleton `0x006d10b0`. The helper first formats the active page heading from the 13-byte page descriptor table rooted at `0x006220a0` using current page id `[this+0x78]`, specifically the title-string dword at record offset `+0x04`. It then lays out the common panel containers through the shell control family rooted at `[this+0x0b31]`, and conditionally exposes the selected-company header affordance on control `0x3f13` when the descriptor header-flag byte at record offset `+0x0c` is set and the current company `[this+0x88]` still resolves through the live company collection at `0x0062be10`. It then switches on the same page id `[this+0x78]` and dispatches into the active page body. Current grounded routes include page `0` through the localized fallback `1203` `Unable to display page`, page `1` through the broader company-overview wrapper around `0x004e5a70/0x004e5a80`, page `2` through `shell_load_screen_render_company_list_panel` at `0x004e68e0`, page `3` through `shell_load_screen_render_company_report_history_panel` at `0x004e9b20` in `Income Statement` mode, page `4` through the same renderer in `Balance Sheet` mode, page `5` through the same renderer in `Haulage Report` mode, page `6` through `shell_load_screen_render_company_stock_data_panel` at `0x004e5130`, page `7` through `shell_load_screen_render_player_list_panel` at `0x004e6ef0`, page `8` through `shell_load_screen_render_player_detail_stock_holdings_panel` at `0x004e5300`, page `9` through `shell_load_screen_render_game_status_briefing_panel` at `0x004e51ea`, page `0x0a` through `shell_load_screen_render_company_train_list_panel` at `0x004e7670`, page `0x0b` through the same localized `1203` fallback, page `0x0c` through `shell_load_screen_render_company_station_list_panel` at `0x004e8bb0`, page `0x0d` through the same localized `1203` fallback, page `0x0e` through `shell_load_screen_render_map_cargo_list_panel` at `0x004e9460`, and page `0x0f` through `shell_load_screen_render_company_industry_list_panel` at `0x004e8270`. That now makes the rendered title order concrete too: `XXX`, `COMPANY OVERVIEW`, `COMPANY LIST`, `INCOME STATEMENT`, `BALANCE SHEET`, `HAULAGE REPORT`, `STOCK DATA`, `PLAYER LIST`, `PLAYER DETAIL`, `GAME STATUS`, `TRAIN LIST`, `TRAIN DETAIL`, `STATION LIST`, `STATION DETAIL`, `CARGO LIST`, and `INDUSTRY LIST`. Current grounded click flow is narrower than that title table: list-page row activation now re-enters page `8` for player detail, but train, station, and industry rows jump out through the shell detail-panel manager instead of switching to page `0x0b` or `0x0d`; no current recovered opener targets `0x0b` or `0x0d`; and no current post-constructor selector path has been recovered for page `0`, whose descriptor remains kind `0`, title `1200` `XXX`, backlink `0`, and header flag `0`. The outer ownership is now clear: this is the shared active-page body renderer above the individual `LoadScreen.win` pages rather than just one more page-local helper.","objdump + caller inspection + page-jump-table correlation + page-table correlation + selected-company header correlation + page-mode decode + page-title-table decode + row-click-route correlation"
0x004ea620,219,shell_load_screen_window_construct,shell,thiscall,inferred,objdump + resource strings + constructor inspection,4,"Constructs the shell-side `LoadScreen.win` family later stored at singleton `0x006d10b0`. The constructor installs vtable `0x005d1194`, binds the random background image `LoadScreen%d.imb` through the format string at `0x005d1180`, binds `LoadScreen.win` through `0x0053fa50`, initializes current page `[this+0x78]` to `0`, stores the singleton at `0x006d10b0`, and seeds the first three visible page-strip controls starting at `0x84d3` through the generic control path at `0x00540120`. It also randomizes one background index into shell state byte `[0x006cec74+0x2c7]` while avoiding the immediately previous choice. Current neighboring helpers at `0x004ea720` and `0x004ea730` provide the live-singleton query and destructor for the same family, which makes this the broad owner-side constructor above the page dispatcher at `0x004e3a80` and the sibling renderers at `0x004e5300`, `0x004e5a80`, and `0x004e5cf0`.","objdump + resource strings + constructor inspection + singleton-state correlation + page-strip correlation"
0x004ea710,7,shell_load_screen_window_set_active_page,shell,thiscall,inferred,objdump + caller inspection + local disassembly,4,"Tiny scalar setter inside the `LoadScreen.win` family. It copies the caller-supplied page id directly into `[this+0x78]` and returns. The mode-`4` startup branch in `shell_transition_mode` `0x00482e50` now makes its ownership concrete: after constructing `LoadScreen.win` it pushes `5.0f`, `110.0f`, or `236.0f` according to the startup selector and shell editor-mode latch, calls this setter, then immediately allocates the `0x46c40` startup-runtime object, resets it through `world_runtime_reset_startup_dispatch_state_bands` `0x004336d0`, stores it into `0x006cec78`, and enters `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`. So this is the page-selection setter directly on the startup transition seam rather than an isolated UI scalar helper.","objdump + caller inspection + local disassembly + startup-transition correlation"
0x004ea720,14,shell_load_screen_window_is_open,shell,cdecl,inferred,objdump + singleton inspection,4,"Tiny singleton-presence probe for `LoadScreen.win`. It returns `1` when global `0x006d10b0` is non-null and `0` otherwise, which matches the constructor and destructor pair at `0x004ea620` and `0x004ea730`.","objdump + singleton inspection + sibling correlation"
0x004ea730,53,shell_load_screen_window_destroy,shell,thiscall,inferred,objdump + singleton inspection,4,"Destructor for the `LoadScreen.win` singleton rooted at `0x006d10b0`. It restores the vtable header `0x005d1194`, clears the singleton global, releases the shared shell object rooted at `0x006cfd34` when present, and then tails into the common shell object destructor path. This is the destructor sibling of `shell_load_screen_window_construct` `0x004ea620` and is one of the explicit old-mode teardown branches reached from `shell_transition_mode`.","objdump + singleton inspection + destructor correlation"
0x004eb0b0,101,shell_open_grayscale_map_tga_picker_and_stage_selection,shell,cdecl,inferred,objdump + literal inspection + caller correlation,3,"Opens the small shell picker used by `Setup.win` to choose one grayscale source map from `TGA Files (*.tga)` rooted at `.\Data\GrayscaleMaps`. The helper forwards the caller-supplied output pointers in `ECX` and `EDX`, constructs the modal shell object family at `0x004ea940`, and on return copies the staged globals at `0x006d10b4` and `0x006d10b8` back into those outputs. It reports success only when the modal result equals control id `0x3f2`. Current grounded caller is the `Setup.win` branch at `0x0050394c`, which then writes startup selector `4` before shell request `0x0cc` continues. This makes the branch a grayscale-map/new-world picker rather than another saved-profile validator.","objdump + literal inspection + caller correlation + modal-result correlation"
0x004eb890,381,shell_present_merger_vote_outcome_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Single-player merger-vote outcome presenter used by the merger result path. The helper resolves the two merger companies from `0x006d10dc` and `0x006d10de`, chooses localized title id `729` `Merger Succeeds!!!` or `730` `Merger Fails!!!`, formats the vote tally labels `731` `Votes In Favor:` and `732` `Votes Against:`, and renders the final result dialog through the shell presentation callback rooted at `0x006d111c`. Current grounded caller is `shell_resolve_merger_vote_and_commit_outcome` at `0x004ebd10` on the single-player branch.","objdump + RT3.lng strings + caller inspection + merger-result dialog correlation"
0x004ebd10,1202,shell_resolve_merger_vote_and_commit_outcome,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Resolves the single merger vote, commits the outcome, and records cooldown state. The helper walks the active chairman profile collection at `0x006ceb9c`, computes weighted votes for and against the proposed merger between companies `0x006d10dc` and `0x006d10de`, accumulates the affirmative share count into `0x006d110c`, compares that total against half the target-company value, and then splits by single-player versus multiplayer. In single-player it presents the result through `shell_present_merger_vote_outcome_dialog` at `0x004eb890`; in multiplayer it formats localized id `3059` `Merger between '%1' and '%2' has %3.` with result strings `3060` or `3061` and routes the payload through the shell transport. On success it commits the merger through `0x00427e20`; on failure it stamps the current year into `[company+0x15f]` as the grounded merger-cooldown field.","objdump + RT3.lng strings + caller inspection + merger-vote resolution correlation"
0x004ec640,732,shell_company_detail_attempt_merger_flow,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` merger-attempt flow. The helper rejects empty worlds through localized id `727`, rejects recent failed merger cooldown cases through id `728`, and then opens the merger offer or vote dialog family rooted at the local globals `0x006d10cc..0x006d1120`. The grounded single-player path checks the proposed premium against company cash through localized id `3889`, can open a premium-confirmation prompt through id `4067`, and on acceptance commits through the company merger helper at `0x00427e20` or the broader vote-resolution path at `0x004ebd10`. When the multiplayer-side shell owner is active it packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8` instead of mutating company state immediately. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + merger-dialog correlation"
0x005042c0,170,shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Small dirty-clear helper beneath `StationDetail.win`. When global dirty latch `0x006d16f0` is set and the live station-detail singleton `0x006d16d8` exists, the helper clears the candidate-service and nearby-structure row bands through `0x0053fe00` over control ranges `0xb414..0xb4db`, `0xb4dc..0xb5a3`, `0xb40a..0xb413`, and `0xb400..0xb409`, disables the paired haul-summary widgets `0xb3f6` and `0xb3f7`, and then resets `0x006d16f0` back to `0`. Current grounded caller is `shell_station_detail_window_refresh_controls` `0x00506610`, so this is the safest current read for the dirty-clear owner beneath the broader station-detail refresh family.","objdump + local disassembly + caller inspection + StationDetail dirty-clear correlation"
0x00504370,24,shell_station_detail_has_valid_selected_station,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny validity probe for the currently selected station id in detail-manager state `[0x006d0818+0x90]`. The helper checks that id against the live placed-structure collection `0x006cec20` through `0x00517d40` and returns the boolean result. Current grounded callers are the neighboring StationDetail helper strip beneath `0x00506610`, where this is the narrow selected-station presence gate rather than a general collection query.","objdump + local disassembly + caller inspection + selected-station correlation"
0x00504390,96,shell_station_detail_selected_station_belongs_to_selected_company,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Small selected-station ownership predicate for `StationDetail.win`. The helper validates the current station id from detail-manager state, resolves the live station from collection `0x006cec20`, compares its owner through `0x0047efe0` against the currently selected company id from `0x004337a0`, and returns `1` only when they match. Current grounded callers are the neighboring station-detail action helpers, so this is the safest current read for the selected-company ownership gate beneath the broader station-detail refresh family.","objdump + local disassembly + caller inspection + StationDetail ownership correlation"
0x005043f0,179,shell_station_detail_present_selected_station_not_controlled_notice,shell,cdecl,inferred,objdump + RT3.lng strings + local disassembly,3,"Ownership-blocked notice helper beneath the `StationDetail.win` action family. After validating the current selected station id, the helper resolves the station owner through `0x0047efb0`; if that owner resolves it formats localized id `3595` `You can't take that action, because this station is owned by a railroad (%1) that you do not control.` with the owner's display name, otherwise it falls back to the empty-string root `0x005c87a8`. It then presents the result through the shell message-box path at `0x004c98a0`. Current grounded callers are the neighboring station-detail action branches that first test `shell_station_detail_selected_station_belongs_to_selected_company` `0x00504390`, so this is the safest current read for the not-controlled notice rather than a general station popup helper.","objdump + RT3.lng strings + local disassembly + ownership-block correlation"
0x005044b0,221,shell_station_detail_refresh_class_partitioned_action_controls_0xb3bb_to_0xb3bf,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Refreshes the lower class-partitioned action controls inside `StationDetail.win`. After validating the current selected station id, the helper resolves the linked candidate class byte `[candidate+0x8c]` and then restyles two distinct control families through repeated `0x00540120` calls: controls `0xb3bb`, `0xb3bd`, and `0xb3be` stay in affordance state `0x65` only when the linked candidate class is `0`, otherwise `0x87`; controls `0xb3bc` and `0xb3bf` stay in affordance state `0x65` only when the linked candidate class is exactly `1`, otherwise `0x87`. Current grounded callers are the `StationDetail.win` constructor `0x005068c0` and the message-side dirty refresh branch in `0x00505e50`, so this is the strongest current read for the lower action-strip class partition rather than a generic class-gated refresh.","objdump + local disassembly + caller inspection + StationDetail lower-action correlation + class-partition correlation"
0x00504590,468,shell_station_detail_present_scenario_station_connection_triplet_popup,shell,cdecl,inferred,objdump + local disassembly + caller inspection + format-string correlation,3,"Formats and presents the scenario-latched `StationDetail.win` popup beneath action controls `0xb3b7` and `0xb3b8`. After validating the current station from detail-manager state `0x006d0818+0x90`, the helper walks the selected station's per-destination table rooted at `[station+0x30]` in `0x24`-byte steps, skips invalid or self station ids, copies each other station name into the local text buffer, and then appends three per-destination scalar lanes from the current station's five-byte-stepped metric arrays. Each active lane divides the stored float by `100.0`, formats through the local `%1 : ` and ` %5.2f` helpers at `0x005d16f0` and `0x005d16e8`, and advances one five-byte metric offset; missing lanes fall back to `N/C` at `0x005d16e0`. The stacked result is then published through `shell_publish_text_callout_presentation` `0x005519f0` using helper root `0x006d16e8` with the caller-supplied popup selector, so the current strongest read is a per-destination station-connection triplet popup rather than an ordinary haul or candidate-service branch. Current grounded caller is `shell_station_detail_window_refresh_controls` `0x00506610` when scenario latch `[0x006cec74+0x1db]` is set.","objdump + local disassembly + caller inspection + format-string correlation + scenario-latch correlation + per-destination-table correlation"
0x00504770,786,shell_station_detail_present_to_from_haul_stats_popup,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats and presents the `StationDetail.win` hauled-traffic popup for one of the two `To` or `From` summary widgets. The helper validates the current station from detail-manager state `0x006d0818+0x90`, resolves the selected station record through `0x006cec20`, and then chooses the localized direction strings `676` `...hauled TO this station.` or `679` `...hauled FROM this station.` plus the singular or plural `load` and `loads` labels `677/678` based on the triggering control id `0xb3f6` versus `0xb3f7`. It formats the current-year and lifetime load and value totals through the station haul-stat helpers at `0x0047d7e0` or `0x0047d7f0`, then presents the final popup text through the shell message-box path at `0x00538c70`. Current grounded owner is the neighboring `To` or `From` summary-widget builder at `0x00505150`.","objdump + RT3.lng strings + caller inspection + hauled-traffic popup correlation"
0x00504a90,70,shell_station_detail_clear_active_candidate_service_preview,shell,thiscall,inferred,objdump + caller inspection + state correlation,4,"Clears the active candidate-service preview owned by `StationDetail.win`. The helper first resets the shared `(placed-structure id, candidate id)` pair at `0x005ee4fc` and `0x005ee500` through `0x0043f610`, then tears down the local station-detail preview latch at `[this+0x7c]` and decrements the sibling global refcount `0x0062be84` when that preview was armed. When the live world owner at `0x0062c120` is in the matching preview-capable mode gate rooted at `[+0x2171]` and `[+0x2175]`, it tails into the neighboring world-side clear path at `0x00452d30`. Current grounded callers are the station-detail selection reset branches around `0x00504bca`, `0x00504bda`, and the later cleanup family at `0x00505bff` and `0x00505c0a`.","objdump + caller inspection + world-preview correlation"
0x00504ae0,174,shell_station_detail_set_active_candidate_service_preview,shell,thiscall,inferred,objdump + caller inspection + state correlation,4,"Arms the active candidate-service preview for `StationDetail.win`. The helper begins by clearing the old preview through `shell_station_detail_clear_active_candidate_service_preview` at `0x00504a90`, then when the supplied candidate id is nonzero and the live world owner at `0x0062c120` is in the matching preview-capable mode gate it routes the current detail-panel station id through the world-side preview family at `world_store_preview_primary_id_0x2179_dispatch_mode3_collection_and_refresh_if_active` `0x00452f60`, `world_store_preview_scalar_0x217d_and_refresh_active_mode_if_nonzero` `0x00452d80`, `world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active` `0x00452db0`, and `world_set_aux_preview_mode_0x2171_and_reseed_overlay_companion_grid` `0x00452ca0`. On success it latches the preview-active bit at `[this+0x7c]`, increments the sibling global refcount `0x0062be84`, and stores the active `(station id, candidate id)` pair into `0x005ee4fc` and `0x005ee500` through `0x0043f620`. This is the shell-side owner that feeds the broader world scanner rooted at `0x0043f640` with the currently inspected station-detail candidate pair.","objdump + caller inspection + world-preview correlation + global-pair correlation"
0x00504ba0,796,shell_station_detail_update_candidate_service_entry,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Updates one candidate-service entry inside `StationDetail.win`. With zero in the first stack slot the helper either re-arms the globally remembered candidate through `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` or clears the current preview through `shell_station_detail_clear_active_candidate_service_preview` at `0x00504a90`. On the ordinary nonzero path it validates the current station from detail-manager state `0x006d0818+0x90`, rejects disallowed modifier combinations from `0x006d4018+0xa8c`, resolves the candidate from `0x0062ba8c`, and then either updates the hover anchor at `0x006d16fc/0x006d1700` or re-enters `placed_structure_query_candidate_local_service_metrics` at `0x0047e240` to format the visible entry text. Current grounded text lanes use localized ids `681`, `682`, and `2813` for the loads-available, current-price, and average-profit explanation strings, plus ids `688` and `689` for the nearby-structure jump text. This is the clearest shell-side owner above the active candidate-service preview pair and the station-detail candidate service readout.","objdump + RT3.lng strings + caller inspection + service-preview correlation"
0x00504bea,722,shell_station_detail_format_candidate_local_service_summary,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the candidate-local-service summary lane inside `StationDetail.win`. The helper validates the current station id from the detail manager through collection `0x006cec20`, resolves the candidate record through `0x0062ba8c`, and when the ordinary station-detail path is active it re-enters `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` before querying `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`. It then formats the visible candidate text using localized ids `681` `%1: Loads available: %2`, `682` `Current Price: %1`, and the explanatory text `2813` `Prices shown are the average profit per load for delivering %1 from %2 to that station...`; neighboring branches also use localized ids `688` and `689` for the nearby-structure jump affordance. This now looks like the shell-side candidate-service readout above the same local service metric lane used by the station freight and express summaries.","objdump + RT3.lng strings + caller inspection + service-query correlation"
0x00505150,796,shell_station_detail_build_to_from_haul_summary_widget,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection + local disassembly,4,"Builds one of the two `To` or `From` hauled-traffic summary widgets inside `StationDetail.win`. After validating the current station from detail-manager state `0x006d0818+0x90`, the helper chooses localized heading `686` `To` when its first argument is nonzero and `687` `From` otherwise, then publishes that heading through `shell_publish_text_callout_presentation` `0x005519f0` using helper root `0x006d16ec`. The supplied float lane is normalized by dividing by `100.0`, clamped to `[0,100]`, converted through `0x005a10d0`, and inverted into a bounded ten-step fill count; the widget then emits one repeated ten-cell strip by resolving per-step styles through `0x0053de00/0x00552560` and remembering the first highlighted cell for the outer summary position. When the detail view is not yet live it also builds the click-through payload at `0x53b070 -> 0x563210`, pushes that payload into the window through `0x53f9c0`, and registers the matching control id `0xb3f6` or `0xb3f7` through callback `shell_station_detail_present_to_from_haul_stats_popup` `0x00504770` via `0x540120`. So the same helper owns the visible ten-step `To` or `From` strip, the heading lane, and the first-build popup callback wiring. Current grounded caller is the larger station-detail refresh pass at `0x00506610`, which constructs the `To` and `From` widgets back to back from the paired haul-stat queries `0x0047d7e0` and `0x0047d7f0`.","objdump + RT3.lng strings + caller inspection + local disassembly + control registration correlation + ten-step-strip correlation"
0x00505470,738,shell_station_detail_refresh_nearby_structure_jump_rows,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection + local disassembly,3,"Refreshes the five-row nearby-structure jump lane inside `StationDetail.win`. The helper validates the current station, iterates the fixed five nearby-structure categories, and for each category counts matching nearby entries through `0x0047dc90`. When at least one entry exists it formats the player-facing jump text from localized ids `688` `This station has %1 %2(s) nearby...`, `689` `first `, and the per-category name table rooted at `0x00620dc4`; then it emits the descriptive text block through `0x51b700 -> 0x53f9c0` and builds the paired jump control payload through `0x53b070 -> 0x55a040 -> 0x53f9c0`. The control ids are partitioned as text rows `0xb40a..0xb40e` and paired jump buttons `0xb410..0xb414`, which matches the later message-`0xca` handler in `shell_station_detail_window_handle_message` `0x00505e50`. The first row also uses the singular fallback string root `0x005c87a8` when only one nearby entry exists; otherwise it switches to the localized count banner. This is the shell-side owner of the nearby-structure jump lane that sits beside the later candidate-service preview rows.","objdump + RT3.lng strings + caller inspection + local disassembly + nearby-structure correlation + control-band correlation"
0x00505760,1159,shell_station_detail_refresh_candidate_service_rows,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Refreshes the visible candidate-service row lane inside `StationDetail.win`. The helper counts currently active candidate-service entries through `placed_structure_count_candidates_with_local_service_metrics` at `0x0047e330`, resolves each visible row candidate through the neighboring ordinal helper at `0x0047e620`, and then colors and formats the row from the candidate-local-service metrics, the candidate display name, and the same localized strings `681`, `682`, and `2813` used by `shell_station_detail_update_candidate_service_entry`. It registers the per-row click path through callback `shell_station_detail_update_candidate_service_entry` at `0x00504ba0`, keeps the selected and hovered candidate ids in the globals `0x006d16f8` and `0x006d16f4`, and toggles the current preview highlight as rows are rebuilt. Current grounded caller is the broader station-detail refresh pass at `0x00506610`.","objdump + RT3.lng strings + caller inspection + candidate-service row correlation"
0x00504ec0,644,shell_station_detail_refresh_class_3_or_4_train_service_matrix,shell,thiscall,inferred,objdump + local disassembly + caller inspection + RT3.lng string-id correlation,3,"Alternate `StationDetail.win` refresh branch for selected station classes `3` and `4`. After validating the current station and republishing the station name through helper root `0x006d16e4`, the helper rebuilds a five-row by two-column train-service matrix: the column headers come from localized ids `684` `Trains Serviced` and `685` `Trains Maintained`, the per-row category labels resolve through the world-side lookup table at `0x006cec78+0x46a84` plus `0x0053de00/0x00552560`, and the underlying counts come from the station-side integer lanes at `0x0047d800`. When the detail view is not already marked live it also rebuilds the shared popup-capable haul widget lane and reuses `shell_station_detail_present_to_from_haul_stats_popup` `0x00504770` as the click-through callback. Current grounded caller is `shell_station_detail_window_refresh_controls` `0x00506610`, which routes class-`3/4` stations into this helper instead of the ordinary nearby-structure, haul-summary, and candidate-service strip.","objdump + local disassembly + caller inspection + RT3.lng string-id correlation + class-3-4-branch correlation"
0x00506610,688,shell_station_detail_window_refresh_controls,shell,cdecl,inferred,objdump + local disassembly + caller inspection + child-helper correlation,4,"Broad refresh owner for the shell-side `StationDetail.win` family. The helper first validates the currently selected station id from detail-manager state `[0x006d0818+0x90]`, resolves the live station from collection `0x006cec20`, and publishes the upper summary lane through `shell_publish_text_callout_presentation` `0x005519f0` using helper root `0x006d16ec`. When scenario-side latch `[0x006cec74+0x1db]` is set it re-enters `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` and `shell_station_detail_present_scenario_station_connection_triplet_popup` `0x00504590` for the paired action controls `0xb3b7` and `0xb3b8`; otherwise it checks the resolved candidate class byte `[candidate+0x8c]`, routes classes `3` and `4` into `shell_station_detail_refresh_class_3_or_4_train_service_matrix` `0x00504ec0`, and for the ordinary branch it publishes the station name, rebuilds the nearby-structure jump lane through `shell_station_detail_refresh_nearby_structure_jump_rows` `0x00505470`, rebuilds the `To` and `From` hauled-traffic widgets through `shell_station_detail_build_to_from_haul_summary_widget` `0x00505150`, rebuilds the candidate-service rows through `shell_station_detail_refresh_candidate_service_rows` `0x00505760`, and finally marks the detail view live through `0x006d16f0 = 1`. Current grounded callers are the constructor-side control wiring under `shell_station_detail_window_construct` `0x005068c0` and the paired action-control callbacks on `0xb3b7/0xb3b8`, so this is the safest current read for the main StationDetail refresh owner rather than a narrower popup callback.","objdump + local disassembly + caller inspection + child-helper correlation + StationDetail control correlation"
0x00505e50,766,shell_station_detail_window_handle_message,shell,thiscall,inferred,objdump + local disassembly + caller inspection + control-range correlation,4,"Primary message dispatcher for the shell-side `StationDetail.win` panel rooted at singleton `0x006d16d8`. The helper validates the current selected station from the detail-manager state under `0x006d0818+0x90`, mirrors that station into live world latch `[0x006cec78+0x4cba]` on the message-`0` setup branch, clears or preserves the active candidate-service preview state under `0x006d16f8/0x006d16fc/0x006d1700`, and can leave the panel through `shell_detail_panel_transition_manager` `0x004ddbd0` when the selected station is no longer valid. The message-`0xca` branch owns two concrete row families: candidate-service controls `0xb4dc..0xb5a3`, which either hand off into the `Overview.win` lane through `0x004ddbd0(..., 9, ...)` plus `0x004f4970` when Ctrl is held or else re-arm or clear the world preview through `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0` and `0x00504a90`; and nearby-structure controls `0xb40a..0xb413`, which resolve site ids through `0x0047dc90/0x0047dcb0`, transition the detail manager with mode `0x0a`, and optionally recenter the world view through `0x00433900` plus the target object's vtable `+0x5c` callback when no modal overlay is active. The message-`0x3ea` branch refreshes the dirty dynamic rows through `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` and `shell_station_detail_refresh_class_partitioned_action_controls_0xb3bb_to_0xb3bf` `0x005044b0`, then restyles control `0xb3f8` from selected-station byte `[station+0x5c9]` and re-arms the active preview if one is selected. The message-`0xcb` action band owns the paired navigation or selector toggles on `0xb3b3/0xb3b4`, the tutorial-gated back or escape branch beneath localized id `0xe8c`, and the lower `0xb3b5..0xb3bf` class-gated action dispatch that first checks selected-company ownership through `0x00504390/0x005043f0`, then resolves linked site and candidate class state through `0x0047de00`, `0x0040cec0`, and `0x0047fd50`. That lower dispatch is tighter now too: control `0xb3bd` selects action family `1` while the sibling controls select family `2`, the linked-site flag byte `[entry+0xc3]` is reduced to one action index `0..5`, and the resulting `(action_index, family)` pair is resolved into one auxiliary candidate id through `aux_candidate_collection_find_entry_id_by_station_detail_action_index_and_family` `0x00419590` before the deeper world-side validation and the two confirmation-modal branches rooted at localized ids `0x0bfe` and `0x0bff`. This is the current grounded owner above the already-mapped refresh helper `shell_station_detail_window_refresh_controls` `0x00506610`, not just one narrow control callback.","objdump + local disassembly + caller inspection + control-range correlation + StationDetail message-branch correlation + lower-action-selector correlation"
0x0050c500,426,shell_present_chairmanship_takeover_vote_outcome_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Single-player chairmanship-takeover outcome presenter used by the special election path. The helper resolves the target company from `0x006d1a0c`, chooses localized title id `626` `New Chairman Takes Over!!!` or `627` `Chairmanship Takeover Fails!!!`, formats the tally labels `628` `Votes in favor` and `629` `Votes Against`, and renders the final result dialog through the shell presentation callback rooted at `0x006d1a34`. Current grounded caller is `shell_resolve_chairmanship_takeover_vote_and_commit_outcome` at `0x0050c940` on the single-player branch.","objdump + RT3.lng strings + caller inspection + takeover-result dialog correlation"
0x0050c940,880,shell_resolve_chairmanship_takeover_vote_and_commit_outcome,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Resolves the special chairman's election, commits the outcome, and records cooldown state. The helper walks the active chairman profile collection at `0x006ceb9c`, computes weighted votes for and against the takeover of company `0x006d1a0c` by chairman profile `0x006d1a0e`, accumulates the affirmative share count into `0x006d1a30`, compares that total against half the target-company value, and then splits by single-player versus multiplayer. In single-player it presents the result through `shell_present_chairmanship_takeover_vote_outcome_dialog` at `0x0050c500`; in multiplayer it formats localized id `3082` `Takeover attempt of '%1' by '%2' has %3.` with result strings `3060` or `3061` and routes the payload through the shell transport. On success it transfers chairmanship through `0x00428a30`; on failure it stamps the current year into `[company+0x289]` as the grounded takeover-cooldown field.","objdump + RT3.lng strings + caller inspection + takeover-vote resolution correlation"
0x0050ccc0,709,shell_company_detail_attempt_chairmanship_takeover_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` chairmanship-takeover flow against the currently selected company. The helper reads the caller's current share ownership in the target company, rejects insufficient holdings through localized id `623`, rejects recent failed takeover cooldown cases through id `624`, and otherwise opens the special chairman's election confirmation under id `625`. The grounded single-player path seeds the local takeover-election state at `0x006d1a08..0x006d1a38` and launches the follow-on election helper at `0x0050c940`; when the multiplayer-side shell owner is active it instead packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + takeover-election correlation"
0x004c6b40,105,shell_company_list_format_company_or_start_row,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats one row in the shell-side company list. When the incoming row id is the synthetic sentinel `0x7fff`, the helper formats localized id `266` `<<Start New Company>>` and stores it through the current row widget at `0x006cfe78`. Otherwise it resolves the live company id through the company collection at `0x0062be10` and delegates the richer row text to `0x004bfb30`. Current grounded caller is `shell_company_list_window_refresh_rows` at `0x004c6c30`.","objdump + RT3.lng strings + caller inspection"
0x004c6bb0,123,shell_company_list_activate_or_shift_center_company,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Handles activation on one live company row in the shell company list. The helper first verifies that the company id exists in the live company collection at `0x0062be10`, then notifies the shell detail-panel family at `0x006d0818`. If Shift is held through shell-input bits `[0x006d4018+0xa8c]&0x3` and the row is not the currently selected chairman company, it resolves the company's primary station or anchor through `0x00427260`, translates that station into a world-view target through `0x0047de00`, and centers the active world view through `0x0043c9a0`. That matches localized help string `2992` `Shift-Click to center on this company's primary station.`","objdump + RT3.lng strings + caller inspection + shell-input correlation"
0x004c6c30,765,shell_company_list_window_refresh_rows,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Rebuilds the shell company-list window rows. The helper clears the two mirrored list controls under ids `0x2ee1` and `0x2ee2`, iterates the live company collection at `0x0062be10`, and formats each company row with one of three localized status strings: id `267` `You are the chairman of the %1!` for the currently selected chairman company from `0x00434870`, id `268` `The %1 has no chairman at the moment.` when `[company+0x3b]` is zero, or id `269` `%1 is the chairman of the %2.` plus suffix id `270` `Double-click for details.` when another chairman profile is attached. When the row also has a primary station, the helper appends localized help id `2992` `Shift-Click to center on this company's primary station.` After the live-company rows are rebuilt, it conditionally appends the synthetic row id `0x7fff` through `shell_company_list_format_company_or_start_row` so `<<Start New Company>>` appears as a separate affordance rather than as part of the seeded trio itself. It also refreshes the currently selected list index at `[this+0x78]`.","objdump + RT3.lng strings + caller inspection + company-list iteration"
0x004c6f30,704,shell_company_list_window_handle_message,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Message dispatcher for the shell company-list window. Selection changes on controls `0x2ee1` and `0x2ee2` toggle the mirrored list selection state and the local start-company affordance latch at `0x006cfe7c`. Activating one live company row routes through `shell_company_list_activate_or_shift_center_company` at `0x004c6bb0` or opens its detail path through the shell detail-panel manager `0x004ddbd0`. Activating the synthetic row id `0x7fff` instead checks whether the current chairman can start a new company, optionally shows localized confirmation id `272` `You're currently chairman of the %1... Proceed?`, and then opens the dedicated `Start New Company...` dialog through `start_new_company_dialog_open` at `0x0047d080`. When that dialog closes while the company-list window remains active, the handler rebuilds the rows through `shell_company_list_window_refresh_rows` at `0x004c6c30`.","objdump + RT3.lng strings + caller inspection + dialog correlation"
0x004c7200,212,shell_company_list_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings,4,"Constructs the shell company-list window rooted at globals `0x006cfe70..0x006cfe7c`. The helper allocates two mirrored list widgets under ids `0x2ee1` and `0x2ee2`, attaches the row formatter `shell_company_list_format_company_or_start_row` at `0x004c6b40`, the live-row activation handler `shell_company_list_activate_or_shift_center_company` at `0x004c6bb0`, publishes the current selected-index storage at `[this+0x78]`, and then calls `shell_company_list_window_refresh_rows` at `0x004c6c30`. It also toggles the start-company affordance controls `0x2ee3` and `0x2ee4` from the global latch `0x006cfe7c`, which matches the handler-side selection logic for the synthetic `<<Start New Company>>` row.","objdump + caller inspection + control wiring"
0x005068c0,443,shell_station_detail_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `StationDetail.win` panel owned by detail-manager mode `8`. The constructor installs the singleton at `0x006d16d8`, binds `StationDetail.imb` and `StationDetail.win` through `0x0053d110` and `0x0053fa50`, seeds helper roots `0x006d16dc..0x006d16ec`, wires the paired action controls `0xb3b7` and `0xb3b8` through callback `0x00506610`, and toggles the adjacent navigation controls `0xb3b3` and `0xb3b4`. The special action control `0xb3f8` is tighter now too: when editor-map latch `[0x006cec74+0x68]` is clear it is forced to style `0x87`; when that latch is set and scenario slot `[0x006cec78+0x4af7]` is nonzero it switches to style `0x74` if selected-station byte `[station+0x5c9]` is nonzero and style `0x65` otherwise. The constructor then refreshes the lower class-gated action strip `0xb3bb..0xb3bf` through `0x005044b0`. This corrects the older company-browser reading: current grounded resource names and control wiring put mode `8` on a station-detail lane rather than on a company-detail browser.","objdump + strings + detail-manager correlation + caller inspection + special-action-control correlation + lower-action-strip correlation + helper-root correlation"
0x00506a80,64,shell_station_list_window_destruct_release_helpers_and_clear_singleton,shell,thiscall,inferred,objdump + vtable scan + local disassembly,2,"Primary `StationList.win` destructor. The helper restores vtable `0x005d177c`, releases the two helper handles rooted at `0x006d1704` and `0x006d170c` through the shared owner `0x006d4020 -> 0x0053c000`, clears singleton `0x006d1708`, and then tail-jumps into the common shell-window teardown at `0x0053f7d0`. Current evidence comes from the StationList constructor or vtable pair, so this is the safest current read for the concrete list-window destroy path rather than another shared shell stub.","objdump + vtable scan + local disassembly + StationList destructor correlation"
0x00506ac0,656,shell_station_list_row_callback_publish_station_callout_card,shell,cdecl,inferred,objdump + local disassembly + caller inspection + callout correlation,3,"Row-side callout publisher beneath the visible `StationList.win` controls `0x61a9` and `0x61aa`. Given one selected station id and one caller-supplied screen anchor tuple, the helper resolves the live station from collection `0x006cec20`, derives one category or type label through the linked record path `0x0062b26c -> 0x0040cec0`, builds one localized header through `0x0053de00` and `0x00552560`, copies the station display name from `[station+0x46b]`, queries the weighted freight lane through `0x005519f0`, queries the cached express or freight class totals through `placed_structure_query_cached_express_service_class_score` `0x0047e390` for ids `0x0386` and `0x0385`, and then publishes the resulting stacked text card through repeated `shell_publish_text_callout_presentation` `0x005519f0` calls using the helper payload roots at `0x006d1704` and `0x006d170c`. Current grounded caller is `shell_station_list_window_refresh_rows_selection_and_status` `0x00506f30`, which wires this callback onto both station row controls with event `0x7a`.","objdump + local disassembly + caller inspection + callout correlation + StationList row-callback correlation"
0x00506be0,360,shell_station_detail_format_freight_and_express_summary,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Formats the visible freight and express summary lines on the shell-side `StationDetail.win` panel. The helper resolves the selected placed-structure record, builds the weighted freight total through the neighboring cargo-summary helper at `0x005519f0`, queries the cached express-side service totals through `placed_structure_query_cached_express_service_class_score` at `0x0047e390` for class ids `0x0385` and `0x0386`, and then writes the localized lines `Freight: %1` and `Express: %1` through string ids `239` and `240`. This is the first grounded shell-detail consumer of the local service bundle rebuilt beneath `0x0042d580`.","objdump + strings + caller inspection + service-query correlation"
0x00506d50,252,shell_station_list_handle_center_or_rename_action,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Handles the station-list row modifier actions after the active station row is resolved from collection `0x006cec20`. The helper reads the packed shell input modifier bits from `0x006d4018+0xa8c`; with Shift it recenters the world view on the selected station through `0x0047de00` and `0x00433900`, and with Control it opens the station rename prompt through localized id `3732` `Enter station name:`. This helper is the modifier-aware side-action lane paired with the visible freight or express station-row summaries.","objdump + strings + caller inspection + input-state correlation"
0x00506e50,221,shell_station_list_format_freight_and_express_availability_summary,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Formats the visible `StationList.win` row summary for one selected station. The helper resolves the placed-structure record from collection `0x006cec20`, queries the cached express-side service totals through `placed_structure_query_cached_express_service_class_score` at `0x0047e390` for class ids `0x0385` and `0x0386`, and then emits the localized composite summary `3890` `%1 has %2 freight loads and %3 express loads available for hauling...`. This is the first grounded shell-list consumer of the same service-score lane used by `shell_station_detail_format_freight_and_express_summary`.","objdump + strings + caller inspection + service-query correlation"
0x00506f30,672,shell_station_list_window_refresh_rows_selection_and_status,shell,thiscall,inferred,objdump + caller inspection + local disassembly + collection scan,4,"Broad row and status refresh owner for the shell-side `StationList.win` panel. The helper clears the two visible row controls `0x61a9` and `0x61aa`, scans collection `0x006cec20`, filters candidate rows through `placed_structure_is_station_or_transit_site_class` `0x0047fd50`, the linked-site class check at `0x0040c990`, and the current selected-company gate `0x004337a0 == 0x0047efe0`, then republishes matching station ids into both row controls. It also wires the visible summary callback `shell_station_list_format_freight_and_express_availability_summary` `0x00506e50`, the row-activation callback `0x00506ac0`, and the modifier-action callback `shell_station_list_handle_center_or_rename_action` `0x00506d50`, restores the highlighted row from `0x00622ae4`, mirrors the shared selected station latch `0x006cec78+0x4cba` when it still belongs to the current company, and refreshes the two status labels `0x61af` and `0x61b0`. The current local write boundary is tighter too: this refresh owner only reselects the already-latched station id, while the later writes at `0x0050727a` and `0x005072cd` sit in the paired message owner below it. Current grounded caller is `shell_station_list_window_construct` `0x005074c0`, and the same body is re-entered from the later message owner.","objdump + caller inspection + local disassembly + collection scan + row-refresh correlation + selected-station-latch boundary correlation"
0x005071e0,494,shell_station_list_window_handle_message,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Primary message dispatcher for the shell-side `StationList.win` family rooted at vtable `0x005d177c`. The helper owns the paired station-row controls `0x61a9` and `0x61aa`, the side selector controls `0x61ab` and `0x61ac`, and the two status labels `0x61af` and `0x61b0`. It periodically updates the currently highlighted station id through `0x00622ae4`; on message `0xce` it mirrors externally supplied row payloads on controls `0x61a9/0x61aa` directly into the shared selected-station latch `0x006cec78+0x4cba`; and on the activation path it validates the chosen station id through collection `0x006cec20`, mirrors that same id into `[world+0x4cba]`, optionally recenters the world view through `0x00433900`, and then re-enters the shell detail-panel manager with mode `5` and that station id. The `0x61ab` and `0x61ac` controls toggle the active side bit at `0x006d1710`, refresh the side-selector affordances, reopen the modal station-pick helper through `shell_station_pick_window_open_modal_and_return_selected_station_id` `0x005078c0`, and on success mirror that returned station id into `[world+0x4cba]` before republishing world focus through `0x00433900`.","objdump + strings + detail-manager correlation + UI dispatch inspection + station-pick-modal correlation + selected-station-latch correlation"
0x005074c0,235,shell_station_list_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `StationList.win` panel later published at `0x006d1708`. The constructor binds the paired station-row controls `0x61a9` and `0x61aa`, seeds the side-selector controls `0x61ab` and `0x61ac` from the current active-side bit at `0x006d1710`, stores the selected-entry latch at `[this+0x78]`, and then calls `shell_station_list_window_refresh_rows_selection_and_status` `0x00506f30`. Current grounded evidence places this panel on a station-oriented shell lane below the company roster rather than on a direct company-detail or chairmanship-claim path.","objdump + strings + detail-manager correlation + caller inspection + row-refresh correlation"
0x005075b0,16,shell_station_pick_window_noop_list_aux_callback,shell,cdecl,inferred,objdump + constructor wiring,1,"Tiny no-op callback that immediately returns. Current grounded caller is `shell_station_pick_window_construct` `0x00507620`, which wires it onto list control `0x80ea` with event `0x79`, so this is best read as the inert auxiliary callback slot for the StationPick list rather than as a meaningful command owner.","objdump + constructor wiring + no-op correlation"
0x005075c0,96,shell_station_pick_window_rewrite_list_and_scroll_messages_to_primary_select_event,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tiny `StationPick.win` message normalizer over one incoming shell message record. The helper recognizes the helper's list and scroll messages `0xc9`, `0xca`, and `0xcb`; rewrites list control `0x80ea` and scroll controls `0x80e8/0x80e9` onto the primary select message `0xc9`; and when the rewritten branch comes from control `0x80e9` it also clears the staged station-id latch `0x00622ae8` back to `-1`. This is the safest current read for the StationPick list-or-scroll normalization helper rather than an independent command owner.","objdump + caller inspection + local disassembly + StationPick message normalization"
0x00507620,656,shell_station_pick_window_construct,shell,thiscall,inferred,objdump + strings + caller inspection,4,"Constructs the shell-side `StationPick.win` helper window. The constructor binds the list control `0x80ea`, the scroll or selector controls `0x80e8` and `0x80e9`, publishes the helper at `0x006d1718`, and then populates the visible station rows from collection `0x006cec20`. The same family feeds the selected station id through `0x00622ae8`, normalizes list and scroll messages through `shell_station_pick_window_rewrite_list_and_scroll_messages_to_primary_select_event` `0x005075c0`, and returns the chosen id to the caller when the modal opener closes. Current grounded callers put this helper under the `StationList.win` selector branch rather than under the startup-company flow.","objdump + strings + caller inspection + helper correlation + StationPick normalization correlation"
0x005076c0,501,shell_station_pick_window_populate_station_rows,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Populates the visible row set for the shell-side `StationPick.win` helper. The helper iterates collection `0x006cec20`, filters entries through `0x0047fd50`, sorts them by the display-name field at `[entry+0x46b]`, and publishes the resulting station names through the helper list control `0x80ea`. It also mirrors the chosen station ids back into the helper-local scratch arrays, updates one status lane through control event `0xaf`, and refreshes the visible row count through control event `0x66`. Current grounded caller is `shell_station_pick_window_construct` at `0x00507620`.","objdump + strings + caller inspection + collection iteration"
0x005078c0,192,shell_station_pick_window_open_modal_and_return_selected_station_id,shell,fastcall,inferred,objdump + caller inspection + local disassembly,3,"Modal StationPick helper opener above `shell_station_pick_window_construct` `0x00507620`. If the live station collection `0x006cec20` is empty the helper returns `-1` immediately. Otherwise it allocates one `0x78`-byte helper object through `0x0053b070`, constructs the `StationPick.win` window, stores the live helper at `0x006d1718`, optionally nudges one presentation float at `[helper+0x05]` when caller flag `CL` is nonzero, brackets the modal show path through `0x00483450`, `0x00538f10`, `0x004834a0`, and `0x005389c0`, then destroys the helper, clears `0x006d1718`, and returns the selected station id from `0x00622ae8`. Current grounded caller is the side-selector branch inside `shell_station_list_window_handle_message` `0x005071e0`.","objdump + caller inspection + local disassembly + modal-helper correlation"
0x00505bf0,188,shell_station_detail_window_destruct_release_preview_helpers_and_clear_singleton,shell,thiscall,inferred,objdump + vtable scan + local disassembly + helper-root correlation,3,"Primary `StationDetail.win` destructor rooted at vtable `0x005d1748`. The helper first restores that same vtable, clears the active candidate-service preview pair through two calls into the world-side reset helper `0x0043f610`, drops the local preview latch `[this+0x7c]` together with sibling refcount `0x0062be84`, optionally re-enters the world-side preview clear path `0x00452d30` when the live world owner at `0x0062c120` is still in the matching preview-capable mode gate, releases the five shell helper handles at `0x006d16dc`, `0x006d16e0`, `0x006d16e4`, `0x006d16e8`, and `0x006d16ec` through the shared owner `0x006d4020 -> 0x0053c000`, clears singleton `0x006d16d8`, and then tail-jumps into the common shell-window teardown at `0x0053f7d0`. Current grounded caller is the shell detail-panel teardown side at `0x004dd9fa`.","objdump + vtable scan + local disassembly + helper-root correlation + preview-teardown correlation"
0x00505cb0,382,shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class,shell,fastcall,inferred,objdump + local disassembly + caller inspection + collection-walk correlation,3,"Direction-driven station-selection helper beneath the `StationDetail.win` family. The first register argument in `ECX` is a signed step direction, and the helper first validates the current selected station from detail-manager state `0x006d0818+0x90`, resolves that station's owner through `0x0047efe0`, and gets its current live-slot position in collection `0x006cec20`. It then walks the live station collection circularly by the requested direction until it finds another entry that passes the same station-or-transit-site class allowlist `0x0047fd50` and shares the same linked company id. When a match is found it releases the current global iteration root through `record_collection_release_global_iteration_root_0x6acd40_if_present` `0x004557b0`, republishes the selected station into the shell detail-panel family through `0x004dd8a0`, and, when no modal overlay is active under `[0x0062be68+0x60]`, recenters the world view through `shell_world_view_center_on_object_with_mode_specific_zoom_policy` `0x00433900` before tail-calling the target object's vtable `+0x5c` callback. This is the current grounded owner for StationDetail next-or-previous station stepping rather than a generic collection iterator.","objdump + local disassembly + caller inspection + collection-walk correlation + owner-filter correlation"
0x00505e30,10,shell_station_detail_cycle_to_next_station_preserving_owner_and_station_site_class,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper that seeds direction `+1` into `shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class` `0x00505cb0`. Current grounded caller is the broader shell command branch at `0x00440e0f` when `StationDetail.win` is live.","objdump + local disassembly + caller inspection + wrapper correlation"
0x00505e40,8,shell_station_detail_cycle_to_previous_station_preserving_owner_and_station_site_class,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper that seeds direction `-1` into `shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class` `0x00505cb0`. Current grounded caller is the paired shell command branch at `0x00440f2f` when `StationDetail.win` is live.","objdump + local disassembly + caller inspection + wrapper correlation"
0x004d4500,88,shell_ensure_editor_panel_window,shell,cdecl,inferred,objdump + analysis-context,4,Ensures the shell-side EditorPanel.win helper window rooted at 0x006d07b4 exists. When the panel is absent it allocates a 0x7c-byte window object seeds the vtable at 0x005d0cb8 binds the EditorPanel.win resource through 0x0053fa50 publishes the object to the shell runtime through 0x00538e50 event 0x1e and then runs the shared panel-open helper at 0x004d4160.,objdump + analysis-context + strings
0x004dc670,368,shell_file_options_dialog_construct,shell,thiscall,inferred,objdump + strings,4,Constructs the shared shell file-options dialog rooted at fileopt.win. The helper clears the three downstream branch flags at 0x006d07f8 0x006d07ec and 0x006d07f0 binds the fileopt.win resource through 0x0053fa50 publishes the object to the shell runtime and populates several mode-dependent labels and status text before user input is handled.,objdump + strings
0x004dc7d0,14,shell_has_file_options_dialog,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny presence probe for the shared shell file-options dialog rooted at `0x006d0800`. The helper returns `1` when the live `fileopt.win` object is present and `0` otherwise. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where this check now sits beside the `LoadScreen` and custom-modal probes.","objdump + nearby-constructor correlation + frame-caller inspection + fileopt correlation"
0x004dc7e0,11,shell_mark_file_options_dialog_dirty,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny dirty-latch setter paired with `shell_has_file_options_dialog`. The helper stores `1` into `0x006d07fc`, which current nearby call patterns treat as the `fileopt.win` refresh or service request latch once the shared file-options dialog exists. Current grounded caller is the same post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + nearby-constructor correlation + frame-caller inspection + fileopt correlation"
0x004dc7f0,477,shell_file_options_dialog_handle_message,shell,thiscall,inferred,objdump + strings,4,Handles the fileopt.win command flow and selects exactly one downstream branch before the shared detail-panel completion dispatcher runs. Successful commands dismiss the dialog then set 0x006d07f8 for the load or restore side 0x006d07ec for the save or package side or 0x006d07f0 for the sibling settings-window escape. The settings branch gates on shell_has_settings_window at 0x004fe120 and lazily opens the shared SettingsWindow.win object through 0x00501e50 while sibling branches show prerequisite dialogs when the requested file operation is not currently allowed.,objdump + strings + caller xrefs
0x004dd010,890,shell_file_request_dialog_collect_target_path,shell,cdecl,inferred,objdump + strings,4,"Builds the modal filerqst.win request dialog and resolves one chosen target path back into the caller buffer. The helper treats dialog modes 0 1 2 3 and 11 as save-side requests and the paired modes 4 8 9 and 10 as load-side requests then swaps the button and prompt text between localized ids 249 250 and 251 252. On success it appends one extension from the static mode table at 0x005f3d58 where 0 or 8=.gms 1 or 9=.gmc 2 or 10=.gmx 3 or 4=.gmp and 11=.gmt. Current neighboring callers tighten that last mode too: the normal shell map coordinators use the `.gms/.gmc/.gmx/.gmp` families for scenario and editor flows, while save mode 11 is only consumed by the auxiliary `.gmt` preview-surface branch shared with the side owner at 0x006cd8d8. When a live runtime world is already active through 0x004839b0 the helper overrides that non-runtime table and appends .smp instead, which makes it the shared bridge between the broad shell coordinators and the runtime-state serializer or restore path rather than only a generic filename prompt.",objdump + strings + mode-table inspection + caller correlation
0x004dd630,144,shell_detail_panel_publish_mode_group_selector_event,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small post-switch helper beneath the shell detail-panel controller at `0x006d0818`. The helper reads current mode dword `[this+0x8c]`, classifies modes `6..0x1a` through the local byte table at `0x004dd6ec`, and then publishes one grouped selector event id `0x09`, `0x16`, `0x0c`, `0x15`, `0x02`, `0x08`, or fallback `0x01` through `0x0053f000` on the shared shell presenter rooted at `0x00ccbb20`. Current grounded caller is the detail-panel transition manager tail at `0x004ddfec`, where it runs after the old child has been torn down, the new child has been published, and the selector/status refresh helpers have already run. This is therefore the safest current read for the detail-panel mode-group publisher rather than a standalone control callback.","objdump + caller inspection + local disassembly + mode-group correlation + shell-presenter correlation"
0x004ddbd0,1096,shell_detail_panel_transition_manager,shell,thiscall,inferred,objdump + strings + caller inspection + case-table correlation,4,"Primary transition owner for the shell detail-panel controller rooted at `0x006d0818`. The helper tracks current mode in `[this+0x8c]`, current child at `[this+0x88]`, and optional selection ids cached in `[this+0x78]` through `[this+0x90]`. On every mode or subject change it first special-cases current mode `0x19`, updates or preserves cached selection ids, tears down the old child through `0x004dd950`, releases one shared global iteration root through `0x004557b0`, publishes the replacement child through the shell runtime at `0x006d401c`, refreshes selector or status UI through `0x004dd410`, re-enters the shared shell follow-on `0x004d44f0`, and finally pushes one grouped selector event through `0x004dd630`. The case table is now tighter too: current grounded constructor branches include `CompanyDetail.win` `0x004c5540`, `CompanyList.win` `0x004c7200`, `LoadScreen.win` `0x004e3a80` side-family siblings, `BuildingDetail.win` `0x004b81d0`, `Bulldoze.win` `0x004b8720`, `ChangeHeight.win` `0x004bcb50`, `ChangeTrees.win` `0x004bcdd0`, `Overview.win` `0x004f5020`, `PaintRegion.win` `0x004f54d0`, `PaintSound.win` `0x004f5670`, `PaintTerrain.win` `0x004f7ce0`, `PaintTerritory.win` `0x004fcf30`, `StockBuy.win` `0x0050c290`, `TrackLay.win` `0x0050e400`, `TrainDetail.win` `0x00514420`, and `StationDetail.win` `0x005068c0`, together with the helper-window ensure path for `EditorPanel.win` `0x004d4500`. The same-mode refresh branch is bounded now too: when the requested mode matches the current mode, the helper still reruns `0x004dd410` and `0x004d44f0`, keeps the mode-`8` company-side refresh special case through `0x004c2ca0`, keeps the mode-`9` `Overview.win` side refresh through `0x004f4970`, and preserves the mode-`2` branch that re-enters `0x00514410`. Current direct callers now include the world-surface brush mode buttons at `0x004bc87a..0x004bc918`, the `LoadScreen.win` row-click detail handoff lanes, and the broader shell state transition side around `0x00482ec0`, so this is the current safest read for the real shell detail-window and tool-window transition owner rather than a generic mode switch wrapper.","objdump + strings + caller inspection + case-table correlation + same-mode refresh correlation"
0x004dfbe0,393,shell_game_window_construct,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Constructs the shell-side `Game.win` detail window published at `0x006d0818`. The constructor seeds vtable `0x005d0eb8`, binds the `Game.win` resource through `0x0053fa50`, stores the singleton, creates the primary control strip rooted at ids `0x74`, `0x7d1`, `0x7d2`, `0x7d7`, `0x7f9`, `0x804`, `0x833`, and `0x837`, mirrors runtime booleans from `0x006cec7c+0x82`, `0x006cec74+0x2c3/+0x283`, and the active mode object at `0x006cec78`, and serves as the broad world-facing shell panel above the sibling `GameMessage.win` helper. `shell_transition_mode` now grounds this as its mode-`1` constructor family, while `0x004dfd70` is the paired old-mode teardown path and `0x004dfdf0` ensures the standalone `GameMessage.win` overlay on entry.","objdump + strings + caller xrefs + branch correlation"
0x004f5020,96,shell_overview_window_construct_and_seed_selection,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `Overview.win` window. The constructor installs vtable `0x005d13b4`, binds `Overview.win` through `0x0053fa50`, seeds live singleton `0x006d12f0`, initializes selection fields `[this+0x78/+0x7c]` to `-1`, clears companion global `0x006d12d4`, and then immediately re-enters `0x004f4970` with the current overview selection id from `0x006d12d8`. Current grounded caller is the detail-panel manager branch at `0x004dde47`, which keeps this on the shell detail-window side rather than the later world-side overview consumers that only test the singleton's presence.","objdump + strings + detail-manager correlation + singleton correlation + selection-seed correlation"
0x004f5080,67,shell_paint_region_window_select_ordinal_and_refresh_caption,shell,thiscall,inferred,objdump + message-owner inspection + caption-table correlation,4,"Small setter beneath the shell-side `PaintRegion.win` family. The helper stores the requested ordinal in `[this+0x78]`, reads one float caption value through table `0x006226e8`, formats that caption through `0x0051f070` and `0x00527de0` on presenter `0x006d4024`, and returns without touching the broader control strips. Current grounded caller is the message owner `0x004f52c0`, where control band `0x4651..0x4657` forwards through this helper before the main refresh pass.","objdump + message-owner inspection + caption-table correlation + shell-presenter correlation"
0x004f50d0,55,shell_paint_region_window_destroy,shell,thiscall,inferred,objdump + detail-manager teardown correlation,4,"Destructor-side wrapper for the shell-side `PaintRegion.win` family. The helper restores vtable `0x005d13f8`, re-enters the shared presenter-side destroy tail through `0x00523e20`, and when live world mode already equals `0x10` it also replays `0x00453510` before tail-calling the common shell-object teardown `0x0053f7d0`. Current grounded caller is the detail-panel transition manager teardown branch at `0x004ddbd0`, which keeps this on the shell tool-window side rather than the later region-service helpers.","objdump + detail-manager teardown correlation + world-mode branch correlation"
0x004f5110,432,shell_paint_region_window_refresh_control_bands,shell,thiscall,inferred,objdump + constructor correlation + message-owner inspection,4,"Owner-side refresh pass for the shell-side `PaintRegion.win` family. The helper first restyles the seven ordinal controls `0x4651..0x4657` from `[this+0x78]` and the 24-entry region row band `0x4664..0x467b` from `[this+0x80]`, then resolves the live region collection at `0x0062bae0` and repopulates the dynamic-text rows `0x46c8..0x46df`. Each row uses the special type-`0x6f` control path through `0x00540120`, derives its label from the region entry at `0x00518140`, and formats the paired summary metrics through localized ids `0x00e6` and the numeric formatter family `0x0051b700/0x005193f0`. Current grounded callers are the constructor `0x004f54d0` and the message owner `0x004f52c0`, which makes this the current `PaintRegion.win` refresh owner rather than a world-region rebuild helper.","objdump + constructor correlation + message-owner inspection + dynamic-text control correlation + region-collection correlation"
0x004f52c0,512,shell_paint_region_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary message dispatcher for the shell-side `PaintRegion.win` tool window. Under message `0xc8`, controls `0x4664..0x467b` update the current region row in `[this+0x80]` and global `0x006226e0`, then immediately route the world-side tool state through `0x00450520` when live world mode is `0x10` or through `0x00452fa0` with mode id `0x10` otherwise before re-entering `shell_paint_region_window_refresh_control_bands` `0x004f5110`. Controls `0x4651..0x4657` update the ordinal lane through `shell_paint_region_window_select_ordinal_and_refresh_caption` `0x004f5080`, then store the ordinal in global `0x006226e4` and refresh. Control `0x07d6` owns the shared world-surface latch `[this+0x7c]`; while that latch is live, the helper hit-tests through `0x00448ac0`, resolves the current ordinal value through table `0x006226e8`, and forwards the staged world coordinates plus the current region row through `0x0044a320` before mirroring the row pointer back through `0x00450520` or `0x00452fa0`. Current grounded owner correlation is the constructor `0x004f54d0` and the live shell message flow, which keeps this on the `PaintRegion.win` tool-window side of the shared world-surface family.","objdump + constructor correlation + caller inspection + world-surface latch correlation + tool-state dispatch correlation"
0x004f54d0,224,shell_paint_region_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `PaintRegion.win` tool window. The constructor installs vtable `0x005d13f8`, binds `PaintRegion.win` through `0x0053fa50`, seeds the live singleton from globals `0x006226e0..0x006226e8`, refreshes the visible selection band through `0x004f5110`, and then routes the initial world-side tool state through `0x00450520` or `0x00452fa0` depending on current world mode `0x10`. Current grounded caller is the detail-panel manager branch at `0x004ddf6a`, which keeps this on the shell tool-window side rather than the later world-side region or route families.","objdump + strings + detail-manager correlation + singleton correlation + tool-state dispatch correlation"
0x004f55b0,67,shell_paint_sound_window_select_family_and_refresh_caption,shell,thiscall,inferred,objdump + message-owner inspection + caption-table correlation,4,"Small setter beneath the shell-side `PaintSound.win` family. The helper stores the requested sound-family ordinal in `[this+0x78]`, reads one caption value through table `0x0062270c`, and formats that caption through `0x0051f070` and `0x00527de0` on presenter `0x006d4024`. Current grounded caller is the message owner `0x004f57a0`, where control band `0x1195..0x119b` forwards through this helper before the main refresh pass.","objdump + message-owner inspection + caption-table correlation + shell-presenter correlation"
0x004f5600,102,shell_paint_sound_window_refresh_control_bands,shell,thiscall,inferred,objdump + constructor correlation + message-owner inspection,4,"Small owner-side refresh pass for the shell-side `PaintSound.win` family. The helper restyles the seven family controls `0x1195..0x119b` from `[this+0x78]` and the five subordinal controls `0x119e..0x11a2` from `[this+0x7c]`, republishing each row through `0x00540120` with the selected-vs-unselected style split `0x87/0x65`. Current grounded callers are the constructor `0x004f5670` and the message owner `0x004f57a0`, which keeps this as a shell-side control refresh rather than a world ambient-service helper.","objdump + constructor correlation + message-owner inspection + control-band correlation"
0x004f5670,224,shell_paint_sound_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `PaintSound.win` tool window. The constructor installs vtable `0x005d1424`, binds `PaintSound.win` through `0x0053fa50`, seeds the current sound-family ordinal and subordinal from globals `0x00622704..0x0062270c`, stores the live singleton at `0x006d12fc`, refreshes the visible row bands through `0x004f5600`, and then routes the initial world-side tool state through `0x00450520` or `0x00452fa0` depending on current world mode `0x11`. Current grounded caller is the detail-panel manager branch at `0x004ddfa2`, which keeps this on the shell tool-window side rather than the later world-side sound or ambient subsystems.","objdump + strings + detail-manager correlation + singleton correlation + tool-state dispatch correlation"
0x004f5750,65,shell_paint_sound_window_destroy,shell,thiscall,inferred,objdump + detail-manager teardown correlation,4,"Destructor-side wrapper for the shell-side `PaintSound.win` family. The helper restores vtable `0x005d1424`, re-enters the shared presenter-side destroy tail through `0x00523e20`, clears the companion global latch `0x006cfe18`, and when live world mode already equals `0x11` it also replays `0x00453510` before tail-calling the common shell-object teardown `0x0053f7d0`. Current grounded caller is the detail-panel transition manager teardown branch at `0x004ddbd0`, which keeps this on the shell tool-window side rather than the later sound-preview consumers.","objdump + detail-manager teardown correlation + companion-global clear correlation + world-mode branch correlation"
0x004f57a0,426,shell_paint_sound_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary message dispatcher for the shell-side `PaintSound.win` tool window. Under message `0xc8`, controls `0x1195..0x119b` update the family ordinal through `shell_paint_sound_window_select_family_and_refresh_caption` `0x004f55b0`, store the ordinal in global `0x00622704`, and then refresh through `0x004f5600`. Controls `0x119e..0x11a2` update the paired subordinal in `[this+0x7c]` and global `0x00622708`, then either dispatch immediately through `0x00452fa0` with mode id `0x11` or mirror back through `0x00450520` when the live world mode already equals `0x11`. Control `0x07d6` owns the shared world-surface latch `[this+0x80]`; while that latch is live, the helper hit-tests through `0x00448ac0`, resolves the current family caption value through `0x0062270c`, and forwards the staged world coordinates plus the current subordinal through `0x0044a0e0` before refreshing the live world-side tool state. Current grounded owner correlation is the constructor `0x004f5670` and the active shell message loop, which keeps this on the `PaintSound.win` side of the shared world-surface family rather than the later sound-preview callback band.","objdump + constructor correlation + caller inspection + world-surface latch correlation + tool-state dispatch correlation"
0x004f5960,138,shell_paint_terrain_window_set_primary_scalar_slot_and_refresh_label,shell,cdecl,inferred,objdump + constructor correlation + callback registration correlation,4,"Numeric callback beneath the shell-side `PaintTerrain.win` family for the first four-scalar strip rooted at controls `0x2922..0x2925`. The helper converts the incoming integer payload into a normalized float, stores the result into global lane table `0x00622728`, formats the corresponding label text through `0x0051b700`, and republishes the text into the paired dynamic-text controls `0x292c..0x292f` through type `0x6f` on callback root `0x006d1334`. Current grounded owner is the terrain-window constructor `0x004f7ce0`, which registers this callback directly through `0x00540120`.","objdump + constructor correlation + callback registration correlation + scalar-table correlation"
0x004f59f0,138,shell_paint_terrain_window_set_secondary_scalar_slot_and_refresh_label,shell,cdecl,inferred,objdump + constructor correlation + callback registration correlation,4,"Numeric callback beneath the shell-side `PaintTerrain.win` family for the second four-scalar strip rooted at controls `0x2936..0x2939`. The helper mirrors `0x004f5960`: it converts the incoming integer payload into a normalized float, stores the result into global lane table `0x00622738`, formats the corresponding label text through `0x0051b700`, and republishes that text into the paired dynamic-text controls `0x2940..0x2943` through type `0x6f` on callback root `0x006d1334`. Current grounded owner is the terrain-window constructor `0x004f7ce0`, which registers this callback directly through `0x00540120`.","objdump + constructor correlation + callback registration correlation + scalar-table correlation"
0x004f5a80,423,shell_paint_terrain_window_push_undo_snapshot,shell,thiscall,inferred,objdump + constructor correlation + message-owner caller correlation,4,"Terrain-window local undo or snapshot push helper. The routine copies the current primary raster from `[this+0x114]` into the next snapshot slot under `[this+0x11c]`, captures four sibling render-target buffers from the live render root `0x0062c120` into the parallel snapshot band `[this+0x144]`, and increments the local stack depth `[this+0x1e4]` up to a bounded ten-entry ring. When the stack is already full it rotates the stored snapshot pointers and then copies the current buffers into the last slot instead. Current grounded callers are the terrain-window constructor `0x004f7ce0` and the larger terrain message owner `0x004f6f50`, which keeps this on the shell-side preview or undo family rather than the world-side raster mutation path.","objdump + constructor correlation + message-owner caller correlation + snapshot-ring correlation"
0x004f5c30,188,shell_paint_terrain_window_pop_undo_snapshot,shell,thiscall,inferred,objdump + message-owner caller correlation + snapshot-ring correlation,4,"Terrain-window local undo or snapshot pop helper. When the bounded snapshot depth `[this+0x1e4]` is positive, the routine decrements that depth, restores the saved primary raster back into `[this+0x114]`, resizes the live render root through `0x0051f090/0x00534730`, and then restores the four sibling render-target buffers from the parallel snapshot band `[this+0x144]`. Current grounded callers are the terrain-side dispatcher `0x004f6a60` and the larger terrain message owner `0x004f6f50`, where control `0x2775` routes into this helper as the current explicit undo affordance.","objdump + message-owner caller correlation + snapshot-ring correlation + undo-control correlation"
0x004f5cf0,224,shell_paint_terrain_window_publish_active_scalar_caption,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Shared terrain-window caption publisher for the currently active scalar lane. The helper latches the requested scalar index into `[this+0x98]`, selects one current source value either from the fixed scalar global `0x006227b4` or from one of the per-mode float tables `0x006227ac`, `0x006227c8`, `0x006227e4`, `0x00622800`, and `0x0062281c`, and then formats the resulting caption through `0x0051f070/0x00527de0` on presenter `0x006d4024`. Current grounded callers are the terrain-window constructor `0x004f7ce0`, the terrain mode setter `0x004f6b50`, and the larger terrain message-owner refresh tail near `0x004f6f20`.","objdump + constructor correlation + caller inspection + scalar-caption correlation"
0x004f5dd0,25,shell_paint_terrain_window_select_active_scalar_group_and_refresh_caption,shell,thiscall,inferred,objdump + direct body inspection + message-owner caller correlation,4,"Tiny selector helper beneath the shell-side `PaintTerrain.win` family. The helper stores the caller-supplied scalar-group ordinal into `[this+0x8c]`, swaps the current active caption index `[this+0x98]` into the stack argument slot, and then tail-calls `shell_paint_terrain_window_publish_active_scalar_caption` `0x004f5cf0`. Current grounded caller is the direct terrain message-owner branch at `0x004f7500`, which keeps this on the shell-side selector and caption family rather than the world-side raster brush path.","objdump + direct body inspection + message-owner caller correlation + caption-selector correlation"
0x004f5ea0,27,shell_paint_terrain_window_is_mode5_variant2,shell,thiscall,inferred,objdump + direct body inspection + caller correlation,4,"Tiny predicate beneath the shell-side `PaintTerrain.win` family. The helper returns true only when current terrain mode `[this+0x90]` equals `5` and the paired variant lane `[this+0x94]` equals `2`; otherwise it returns false. Current grounded callers are the mode-dispatch bridge `0x004f6250` and the larger path-preview compositor `0x004f8bb0`, which keeps this on the terrain special-mode gating family rather than any direct world-side raster mutation path.","objdump + direct body inspection + caller correlation + special-mode predicate correlation"
0x004f5ec0,27,shell_paint_terrain_window_is_mode4_variant2,shell,thiscall,inferred,objdump + direct body inspection + caller correlation,4,"Tiny predicate beneath the shell-side `PaintTerrain.win` family. The helper returns true only when current terrain mode `[this+0x90]` equals `4` and the paired variant lane `[this+0xb4]` equals `2`; otherwise it returns false. Current grounded caller is the message-owner branch at `0x004f784b`, which uses this as one narrow terrain special-mode gate before entering the heavier preview path.","objdump + direct body inspection + caller correlation + special-mode predicate correlation"
0x004f5df0,675,shell_paint_terrain_window_refresh_control_bands,shell,thiscall,inferred,objdump + constructor correlation + message-owner caller correlation,4,"Broad owner-side refresh pass for the shell-side `PaintTerrain.win` family. The helper republishes the active terrain mode strip `0x28dd..0x28e6`, several adjacent selector bands rooted at `0x27d9`, `0x283d`, `0x28a1`, `0x28d3`, `0x290d`, `0x2913`, `0x2915`, `0x2917`, `0x291f`, and `0x2954`, the current mode-dependent summary labels around `0x291a`, `0x296a`, and `0x296b`, and the three paired scalar rows `0x2a38..0x2a3d` plus the four dynamic rows rooted at `0x292c`. The same pass also propagates the current color preview from `[this+0x80]`, the current mode selector from `[this+0x90]`, and the cached mode-specific scalar lanes `[this+0x94]..[this+0xc8]`. Current grounded callers are the constructor `0x004f7ce0`, the terrain-side dispatcher `0x004f6a60`, the terrain mode setter `0x004f6b50`, and the larger message owner `0x004f6f50`, which keeps this on the shell-side control-band family rather than the world raster brush path.","objdump + constructor correlation + message-owner caller correlation + control-band correlation"
0x004f6070,326,shell_paint_terrain_window_set_rgb_component_and_refresh_preview,shell,cdecl,inferred,objdump + constructor correlation + callback registration correlation,4,"Numeric callback beneath the shell-side `PaintTerrain.win` family for the three RGB-style component controls rooted at `0x294c`, `0x294e`, and `0x2950`. The helper formats the incoming integer payload through localized ids `0x00df`, `0x00e0`, or `0x00e1` depending on the triggering control id, writes the resulting component byte back into global byte strip `0x006d1300..0x006d1302`, composes the preview color dword at `[0x006d1334+0x80]`, and republishes both the dynamic text row and the color preview control `0x296a`. Current grounded owner is the terrain-window constructor `0x004f7ce0`, which registers this callback directly through `0x00540120`.","objdump + constructor correlation + callback registration correlation + color-preview correlation"
0x004f61c0,144,shell_paint_terrain_window_increment_generation_count_and_refresh_caption,shell,cdecl,inferred,objdump + callback registration correlation + counter-caption correlation,3,"Small terrain-window callback that increments the current generation or count lane at `[0x006d1334+0xc4]`, mirrors that same value into global `0x0062275c`, formats the new 1-based count through `0x0051b700/0x005193f0` with localized id `0x00e2`, and republishes the result into dynamic-text control `0x290c`. This helper sits on the same callback-root family as the other `PaintTerrain.win` numeric updaters, and the row is therefore kept at that numeric-updater callback level.","objdump + callback registration correlation + counter-caption correlation"
0x004f6250,309,shell_paint_terrain_window_dispatch_current_mode_to_world,shell,thiscall,inferred,objdump + caller inspection + mode-constant correlation,4,"Mode-dependent world-dispatch helper beneath the shell-side `PaintTerrain.win` family. The helper reads current terrain mode `[this+0x90]` and forwards one matching world-mode request through `0x00452fa0`, currently including constants `0x18`, `0x19`, `0x1a`, `0x1c`, `0x1d`, and `0x2c`, with one fallback path gated through `0x004f5ea0`. When no explicit dispatch is needed it optionally replays the current world-side refresh through `0x00453510` if the caller requested it. Current grounded callers are the terrain mode setter `0x004f6b50`, the larger terrain message owner `0x004f6f50`, and the current brush-state refresh tails that need to mirror the selected shell mode back into world state.","objdump + caller inspection + mode-constant correlation + world-dispatch correlation"
0x004f6390,920,shell_paint_terrain_window_refresh_mode_panels,shell,thiscall,inferred,objdump + constructor correlation + repeated caller correlation,4,"Broad terrain-window mode-panel refresh owner. The helper repaints the current grouped mode selectors and availability strips rooted at `0x2711`, `0x27d9`, `0x283d`, `0x28a1`, `0x28d3`, `0x290d`, `0x2913`, `0x2915`, `0x2917`, `0x291f`, and `0x29cd`, toggles the mode families `0x28ab..0x28b4` and `0x28ae..0x28b0`, refreshes current scalar or color readouts under `0x291a`, `0x296a`, and `0x296b`, and repositions three callback-backed rows `0x2a3b..0x2a3d` from the paired coordinate band `[this+0xd8..+0xec]`. It also gates several row styles through the current mode state `[this+0x8c/+0x90/+0x94..+0xc0]`, the helper predicates `0x005586c0` and `0x004f5ea0`, and the live world mode at `0x0062c120+0x2175`. Current grounded callers are the terrain constructor `0x004f7ce0`, the terrain mode setter `0x004f6b50`, the terrain-side dispatcher `0x004f6a60`, and many direct message-owner subbranches under `0x004f6f50`.","objdump + constructor correlation + repeated caller correlation + control-band correlation + mode-panel correlation"
0x004f6930,161,shell_paint_terrain_window_sample_primary_raster_at_world_coords,shell,thiscall,inferred,objdump + caller inspection + field-layout correlation,4,"World-coordinate sample helper beneath the shell-side `PaintTerrain.win` family. The routine converts the caller-supplied world-space float pair into integer sample coordinates by scaling against live world dimensions `[0x0062c120+0x2155/+0x2159]` and the current preview-raster dimensions `[this+0xfc/+0x100]`, clamps those indices against the current primary preview buffer, and on success returns the sampled dword from `[this+0x114]`; otherwise it returns `0`. Current grounded callers are the direct terrain message-owner color-preview branch at `0x004f7186` and the neighboring shell-side setup branch at `0x004deb7b`, so the safest current read is the current preview-raster sampler rather than a direct world-cell query.","objdump + caller inspection + field-layout correlation + preview-raster correlation"
0x004f69e0,148,shell_paint_terrain_window_set_triplet_scalar_and_refresh_label,shell,cdecl,inferred,objdump + constructor correlation + callback registration correlation,4,"Numeric callback beneath the shell-side `PaintTerrain.win` family for the three-entry scalar strip rooted at controls `0x2a32..0x2a34`. The helper formats the incoming integer payload through the shared terrain template at `0x005d0b18`, republishes the resulting label through the dynamic-text control immediately above the triggering control id, stores the raw integer into the paired triplet state under callback root `0x006d1334`, and then refreshes the live mode panels through `0x004f5df0` when the constructor-side bulk-update latch `0x006d1330` is clear. Current grounded owner is the terrain-window constructor `0x004f7ce0`, which registers this callback directly through `0x00540120`.","objdump + constructor correlation + callback registration correlation + bulk-update-latch correlation"
0x004f6b50,991,shell_paint_terrain_window_select_mode_and_refresh,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary mode-selector setter for the shell-side `PaintTerrain.win` family. The helper writes the requested terrain mode into `[this+0x90]`, repaints the ten-entry mode strip rooted at `0x28dd`, normalizes paired selector state under `[this+0x8c]` for modes `3` and `8`, toggles several mode-specific row bands, refreshes the grouped terrain panels through `0x004f6390`, dispatches the selected mode back into world state through `0x004f6250(1)`, and finally republishes the active scalar caption through `0x004f5cf0([this+0x98])`. Current grounded callers are the terrain constructor `0x004f7ce0`, the direct message-owner subbranch at `0x004f7525`, and several later message-owner update paths, which keeps this on the shell-side terrain mode family rather than the later world brush implementation itself.","objdump + constructor correlation + caller inspection + mode-strip correlation + world-dispatch correlation"
0x004f6f50,3075,shell_paint_terrain_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + local disassembly + control-family correlation,4,"Primary message owner for the shell-side `PaintTerrain.win` family. The function grounds three top-level message lanes directly from the body: message `2` owns live world-surface control `0x07d6`, message `0xca` owns the bulk selector and callback-backed control strips, and message `0xcb` currently routes explicit undo control `0x2775` into `shell_paint_terrain_window_pop_undo_snapshot` `0x004f5c30`. Under the main `0xca` lane, the grounded control families are tighter now: `0x2711..0x2730` update the current grouped selector and cached mode ordinal, `0x27d9..0x27df` update the paired terrain-family row, `0x283d..0x2843` select the active scalar caption through `0x004f5cf0`, `0x28a1..0x28e6` fan into the cached mode or scalar lanes rooted at `0x006d1308..0x006d1328` and `0x00622748..0x0062276c`, `0x2915..0x291e` toggle several mode-dependent booleans and dispatch one world-mode subset, `0x2964..0x2967` dispatch world modes `0x20..0x23`, and `0x29cd..` updates the current brush-radius family in `[this+0xa8]` and global `0x00622758`. The live drag branch under control `0x07d6` is tighter too: after hit-testing through `0x00448ac0`, it updates the current preview color through `shell_paint_terrain_window_sample_primary_raster_at_world_coords` `0x004f6930`, routes the staged coordinates into the heavier preview workers `0x004fb5e0`, `0x004fc280`, `0x004fc4d0`, or `0x004fc630` depending on current terrain mode, and then mirrors the resulting preview or world update back through `0x00452f20`, `0x00452fa0`, `0x00453510`, and the shell-surface publish path. Current grounded owner correlation is the constructor `0x004f7ce0` plus the active shell message loop, which keeps this on the `PaintTerrain.win` side of the shared brush family rather than the later world raster mutation owners themselves.","objdump + constructor correlation + local disassembly + control-family correlation + drag-latch correlation + preview-worker correlation"
0x004f7ce0,304,shell_paint_terrain_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `PaintTerrain.win` tool window. The constructor installs vtable `0x005d1430`, binds `PaintTerrain.win` through `0x0053fa50`, carries the adjacent `GroundTerrain.tga` resource in the same family, seeds live shell singleton `0x006d1304`, seeds the callback-side root `0x006d1334`, marks tool bytes `0x006d1330/0x006d1331`, snapshots the current terrain mode, selector, scalar, and color lanes from globals `0x00622748..0x00622788` and `0x006d1308..0x006d1324`, builds the local undo or snapshot ring through `0x004f5a80`, seeds the current mode through `0x004f6b50`, and registers the numeric callback family `0x004f5960`, `0x004f59f0`, `0x004f6070`, and `0x004f69e0` through `0x00540120`. Current grounded caller is the detail-panel manager branch at `0x004ddf4e`, and the later world-side secondary-raster owner still only consumes `[0x006d1304+0x78/+0x7c]` as one pending component-seed pair, so the safest current read remains the shell paint-terrain window constructor rather than a direct world raster owner.","objdump + strings + detail-manager correlation + singleton correlation + tool-state snapshot correlation + callback-registration correlation"
0x004f81e0,400,shell_paint_terrain_window_blend_descriptor_palette_sample_into_preview_pixel,shell,thiscall,inferred,objdump + caller inspection + local disassembly + descriptor-blend correlation,4,"Late preview helper beneath the shell-side `PaintTerrain.win` family. The helper resolves one live preview pixel at `[this+0x114]` from the caller-supplied preview-space `(x,y)` coordinate, resolves one matching descriptor-raster pixel from the current terrain descriptor surface `[this+0x1fc]` by re-quantizing the caller-supplied world-grid coordinate through `[this+0x1e8/+0x1f0/+0x1f4]`, and then linearly blends the two BGRA pixels channel-by-channel with the caller-supplied float weight before writing the result back into the live preview raster. Current grounded caller is the late path-preview phase at `0x004fb081` inside `shell_paint_terrain_window_rasterize_drag_path_preview_into_preview_surface` `0x004f8bb0`, which keeps this on the descriptor-overlay preview family rather than the direct world raster mutation path.","objdump + caller inspection + local disassembly + descriptor-blend correlation + preview-pixel correlation"
0x004f8370,1024,shell_paint_terrain_window_smooth_interior_preview_pixel_from_neighbor_samples,shell,thiscall,inferred,objdump + caller inspection + local disassembly + smoothing correlation,4,"Late preview smoothing helper beneath the shell-side `PaintTerrain.win` family. The helper requires one interior preview-space `(x,y)` cell, gathers the surrounding preview-raster bytes from `[this+0x114]` in the local 3x3 neighborhood, repeatedly averages paired channel bytes through the fixed `0.5` weight at `0x005c8d48`, and then writes the resulting smoothed BGRA pixel back into the live preview raster. Current grounded caller is the final interior sweep at `0x004fb0f4` inside `shell_paint_terrain_window_rasterize_drag_path_preview_into_preview_surface` `0x004f8bb0`, which keeps this on the shell-side preview-smoothing family rather than the world-side terrain raster path.","objdump + caller inspection + local disassembly + smoothing correlation + preview-raster correlation"
0x004f8770,570,shell_paint_terrain_window_sample_weighted_average_rgb_from_preview_raster,shell,thiscall,inferred,objdump + caller inspection + local disassembly + color-sampling correlation,4,"Local color-sampling helper beneath the shell-side `PaintTerrain.win` family. The helper selects one source raster from the current path-preview buffer `[this+0x118]`, the top undo snapshot under `[this+0x118 + depth*4]`, or the live preview raster `[this+0x114]`, derives one bounded square neighborhood around the caller-supplied preview-space coordinates from scalar lane `[this+0xc4]`, and then accumulates distance-weighted red, green, and blue byte sums across every sampled pixel in that neighborhood. When the accumulated weight stays positive it normalizes those sums through `0x005a10d0` and returns the averaged RGB bytes through three caller-supplied output pointers. Current grounded callers are the two later mode-`9` preview branches at `0x004f9fde` and `0x004fc097`, which keeps this on the shell-side terrain color-sampling family rather than the world-side raster mutation path.","objdump + caller inspection + local disassembly + color-sampling correlation + preview-buffer correlation"
0x004f89b0,512,shell_paint_terrain_window_grow_component_on_byte_grid_from_seed,shell,cdecl,inferred,objdump + caller inspection + local disassembly + flood-fill correlation,4,"Local byte-grid component grower beneath the shell-side `PaintTerrain.win` family. The helper seeds the caller-supplied byte grid with state `2` at the requested `(x,y)` cell, repeatedly promotes reachable `2` cells to `3`, expands that frontier through the eight-neighbor offset tables `0x00624b28/0x00624b48`, and marks any newly reached byte-`1` cells as `2` while tracking the surviving min/max rectangle of the connected component. After the frontier exhausts it clears every remaining byte-`1` cell back to `0`, leaving only the grown component marked. Current grounded caller is the preview-raster rebuild worker `0x004fb76c`, which invokes this helper after quantizing one float seed point into preview-grid coordinates, so the safest current read is a local connected-component grower for the terrain preview mask rather than a generic world flood fill.","objdump + caller inspection + local disassembly + flood-fill correlation + byte-grid correlation"
0x004f8bb0,10800,shell_paint_terrain_window_rasterize_drag_path_preview_into_preview_surface,shell,thiscall,inferred,objdump + caller inspection + local disassembly + preview-raster correlation,4,"Primary path-preview compositor beneath the shell-side `PaintTerrain.win` family. The helper consumes the drag-sample strip rooted at `[this+0xf0/+0xf4/+0xf8]`, the current scalar or mode lanes `[this+0x8c/+0x90/+0x94/+0x98/+0xa0/+0xb4/+0xb8/+0xc0/+0xc4/+0xd8..+0xec]`, and several caller-supplied preview buffers, then derives one bounded preview-space rectangle, quantizes the current brush span into preview-space radii, and allocates several temporary float and byte grids for path blending. Within that bounded rectangle it evaluates multiple per-mode preview branches: some modes reuse the current terrain descriptor tables rooted at `0x005f3500`, later mode `9` branches call `shell_paint_terrain_window_sample_weighted_average_rgb_from_preview_raster` `0x004f8770`, one path grows connected regions through `shell_paint_terrain_window_grow_component_on_byte_grid_from_seed` `0x004f89b0`, and other branches sample the live world raster through `0x00448cb0`, `0x00448d40`, `0x00449ab0`, `0x0044a9a0`, and companion helpers before writing final RGBA pixels back into the caller preview surface. The late world-raster tail is tighter now too: the mode-`4`, variant-`2` branch toggles secondary-raster byte-2 bit `0x20` by comparing the current and previous cell records through `0x00534f40`; the broader mode-`4/5` branch samples class set `2/4/5` through `0x00534ec0`, re-enters `0x0044de30` and `0x0044df10`, latches pending world coordinates into `[0x006d1304+0x78/+0x7c]`, and updates the low nibble plus the signed overlay-vector planes through `0x00448df0`, `0x00448e20`, `0x00448ec0`, `0x00448ee0`, `0x00448e60`, and `0x00448e90`. After the optional mode-`5` smoothing sweep through `0x004f8370`, the publish tail either materializes one shell preview surface through `0x0051f090 -> 0x00534730` or, for the mode-`4/5` world-facing variants, converts the surviving preview rectangle back into world-space bounds and re-enters `0x0044e940`, `0x00452f20`, and `0x0044d410`. Current grounded caller is the fallback drag-path worker `0x004fcace` inside `shell_paint_terrain_window_append_drag_sample_and_rebuild_path_preview` `0x004fc630`, so the safest current read is the main drag-path preview rasterizer and compositor rather than a direct world brush.","objdump + caller inspection + local disassembly + preview-raster correlation + drag-path correlation + temporary-grid correlation + late-tail world-raster correlation"
0x004fb5e0,1603,shell_paint_terrain_window_rebuild_preview_raster_from_world_coords_and_settings,shell,thiscall,inferred,objdump + caller inspection + local disassembly + preview-surface correlation,4,"Large terrain-preview raster rebuild worker beneath the shell-side `PaintTerrain.win` family. The helper derives one temporary occupancy mask over the live world grid from the caller-supplied world coordinates, current brush or scalar settings, and the current terrain-mode family rooted at `[this+0x90/+0x94/+0x98/+0x9c/+0xac/+0xb0/+0xbc/+0xc0/+0xcc]`; depending on those settings it fills that mask through the live world samplers `0x00448c00`, `0x00448c20`, `0x00448cb0`, `0x00448d40`, `0x00448f30`, and the companion-float cell setter `0x0044dca0`, with one later mode-`5` neighborhood branch also forcing corner writes and a final full-rect rebuild through `0x0044e940`. After the mask pass it walks the current preview raster `[this+0x114]`, converts the selected world samples or current preview colors into RGBA pixels through several per-mode blend branches, and then republishes the rebuilt preview surface into the shared shell controller at `0x006d0818` through `0x0047b3d0`. The caller split is tighter now too: `0x004f726c` is the early rebuild branch that first copies the live preview raster into `[this+0x118]` and then immediately snapshots undo state through `0x004f5a80`, while `0x004f7ada` is the later drag-active branch that allocates a temporary occupancy mask before rebuilding and conditionally mirrors that mask into `0x00450520` on the world-mode-`0x17` side path. Current grounded callers are those two direct drag-path branches inside `shell_paint_terrain_window_handle_message` `0x004f6f50`, so the safest current read is the current terrain-preview raster builder rather than a direct world-terrain mutation owner.","objdump + caller inspection + local disassembly + preview-surface correlation + mask-build correlation + shell-surface publish correlation + callsite split correlation"
0x004fc280,592,shell_paint_terrain_window_apply_mode7_secondary_raster_bit0x10_brush_from_world_coords,shell,thiscall,inferred,objdump + caller inspection + local disassembly + secondary-raster correlation,4,"Mode-`7` drag worker beneath the shell-side `PaintTerrain.win` family. The helper derives a bounded radial neighborhood around the caller-supplied world coordinates from the current scalar lane `0x0062281c[index]`, then scans that neighborhood against the live secondary-raster bit-`0x10` predicate `world_secondary_raster_query_cell_byte2_bit0x10_set` `0x00448f30`. The desired state comes from `[this+0xac]`: when the live bit differs, the helper either sets or clears it through `world_secondary_raster_set_cell_byte2_bit0x10` `0x00448d90` or `world_secondary_raster_clear_cell_byte2_bit0x10` `0x00448dc0`. When any cell changed it republishes the surviving rectangle through `0x00452f20`. Current grounded caller is the mode-`7` drag branch at `0x004f797a` inside `shell_paint_terrain_window_handle_message` `0x004f6f50`, so the safest current read is the radius brush over secondary-raster bit `0x10` rather than a generic terrain sample helper.","objdump + caller inspection + local disassembly + secondary-raster correlation + radial-brush correlation"
0x004fc4d0,342,shell_paint_terrain_window_apply_mode6_compact_grid_mode3_brush_from_world_coords,shell,thiscall,inferred,objdump + caller inspection + local disassembly + compact-grid correlation,4,"Mode-`6` drag worker beneath the shell-side `PaintTerrain.win` family. The helper scales the caller-supplied world coordinates by the fixed brush factor at `0x005c8568`, derives one bounded radial neighborhood from the current scalar lane `0x00622800[index]`, and then scans that disk through `math_measure_float_xy_pair_distance` `0x0051dc00` plus compact-grid membership query `world_query_compact_grid_flag_bitset_membership_by_mode` `0x00448af0` with mode `3`. The desired bitset state is derived from `[this+0xb0]`; when the live compact-grid bit mismatches that desired state, the helper stamps the requested value back through `0x004497a0(world, x, y, desired, 3, 1)`. When any cell changed it republishes the surviving rectangle through `0x00452f20`. Current grounded caller is the mode-`6` drag branch at `0x004f799c` inside `shell_paint_terrain_window_handle_message` `0x004f6f50`, so the safest current read is the radius brush over compact-grid bank `3` rather than a direct float-grid painter.","objdump + caller inspection + local disassembly + compact-grid correlation + radial-brush correlation"
0x004fc630,1213,shell_paint_terrain_window_append_drag_sample_and_rebuild_path_preview,shell,thiscall,inferred,objdump + caller inspection + local disassembly + path-preview correlation,4,"Default drag-path worker beneath the shell-side `PaintTerrain.win` family for the terrain modes that do not route into the narrower mode-`6` or mode-`7` world brushes. The helper first measures radial distance from the cached brush center `0x00622844/0x00622848` through `0x0051db80`, rejects when the current point falls outside the active span gates, and then maintains the shell-side drag-path sample arrays rooted at `[this+0xf0..+0x118]`, including one optional whole-world nibble snapshot cached at `0x006d132c` through `world_secondary_raster_query_cell_byte2_low_nibble` `0x00448df0` for the current special mode families. After updating those path arrays it forwards the accumulated sample strip, current scalar and mode lanes, and the current preview buffers into `0x004f8bb0`, then mirrors the last accepted world coordinate back into `0x00622844/0x00622848`. Current grounded caller is the fallback drag branch at `0x004f79bb` inside `shell_paint_terrain_window_handle_message` `0x004f6f50`, so the safest current read is the shell-side drag-sample accumulator plus path-preview rebuild owner rather than a direct world mutation helper.","objdump + caller inspection + local disassembly + path-preview correlation + nibble-snapshot correlation"
0x004fcaf0,67,shell_paint_territory_window_select_ordinal_and_refresh_caption,shell,thiscall,inferred,objdump + message-owner inspection + caption-table correlation,4,"Small setter beneath the shell-side `PaintTerritory.win` family. The helper stores the requested ordinal in `[this+0x78]`, reads one caption value through table `0x00622854`, and formats that caption through `0x0051f070` and `0x00527de0` on presenter `0x006d4024`. Current grounded caller is the message owner `0x004fcd10`, where control band `0xbb81..0xbb87` forwards through this helper before the main refresh pass.","objdump + message-owner inspection + caption-table correlation + shell-presenter correlation"
0x004fcb40,51,shell_paint_territory_window_destroy,shell,thiscall,inferred,objdump + detail-manager teardown correlation,4,"Destructor-side wrapper for the shell-side `PaintTerritory.win` family. The helper restores vtable `0x005d1480`, re-enters the shared presenter-side destroy tail through `0x00523e20`, and when live world mode already equals `0x1e` it also replays `0x00453510` before tail-calling the common shell-object teardown `0x0053f7d0`. Current grounded caller is the detail-panel transition manager teardown branch at `0x004ddbd0`, which keeps this on the shell tool-window side rather than the later territory-access consumers.","objdump + detail-manager teardown correlation + world-mode branch correlation"
0x004fcb80,400,shell_paint_territory_window_refresh_control_bands,shell,thiscall,inferred,objdump + constructor correlation + message-owner inspection,4,"Owner-side refresh pass for the shell-side `PaintTerritory.win` family. The helper first restyles the seven ordinal controls `0xbb81..0xbb87` from `[this+0x78]` and the 24-entry territory row band `0xbb94..0xbbab` from `[this+0x80]`, then resolves the live territory collection at `0x006cfc9c` and republishes the dynamic-text rows `0xbbf8..0xbc0f` through the special type-`0x6f` control path. It derives the row label from territory name bytes near `[entry+0x04]`, derives the paired summary metrics from fields `[entry+0x3d]` and `[entry+0x41]`, and formats those metrics through the same numeric-text family `0x0051b700/0x005193f0` used by sibling tool windows. Current grounded callers are the constructor `0x004fcf30` and the message owner `0x004fcd10`, which makes this the current `PaintTerritory.win` refresh owner rather than a company-access refresh lane.","objdump + constructor correlation + message-owner inspection + dynamic-text control correlation + territory-collection correlation"
0x004fcd10,530,shell_paint_territory_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary message dispatcher for the shell-side `PaintTerritory.win` tool window. Under message `0xc8`, controls `0xbb94..0xbbab` update the current territory row in `[this+0x80]` and global `0x0062284c`, then route the world-side tool state through `0x00450520` when live world mode is `0x1e` or through `0x00452fa0` with mode id `0x1e` otherwise before re-entering `shell_paint_territory_window_refresh_control_bands` `0x004fcb80`. Controls `0xbb81..0xbb87` update the ordinal lane through `shell_paint_territory_window_select_ordinal_and_refresh_caption` `0x004fcaf0`, store the ordinal in global `0x00622850`, and refresh. Control `0x07d6` owns the shared world-surface latch `[this+0x7c]`; while that latch is live, the helper hit-tests through `0x00448ac0`, resolves the current ordinal value through table `0x00622854`, and forwards the staged world coordinates plus the current territory row through `0x0044a560` before mirroring the row pointer back through `0x00450520` or `0x00452fa0`. Current grounded owner correlation is the constructor `0x004fcf30` and the live shell message loop, which keeps this on the `PaintTerritory.win` side of the shared world-surface family rather than the company-detail territory-access dispatcher.","objdump + constructor correlation + caller inspection + world-surface latch correlation + tool-state dispatch correlation"
0x004fcf30,224,shell_paint_territory_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `PaintTerritory.win` tool window. The constructor installs vtable `0x005d1480`, binds `PaintTerritory.win` through `0x0053fa50`, seeds the current ordinal and the paired scalar or selection lane from globals `0x0062284c..0x00622854`, refreshes the visible selection band through `0x004fcb80`, and then routes the initial world-side tool state through `0x00450520` or `0x00452fa0` with world-mode constant `0x1e`. Current grounded caller is the detail-panel manager branch at `0x004ddf86`, which keeps this on the shell tool-window side rather than the later territory-access and company-governance families.","objdump + strings + detail-manager correlation + singleton correlation + tool-state dispatch correlation"
0x0050a570,104,shell_stock_buy_window_render_selected_company_stock_data_panel,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,3,"Control callback beneath the shell-side `StockBuy.win` family that renders the selected-company stock-data panel through the shared formatter `0x004c0160`. The helper first validates current selected company id `0x00622b00` against company-count query `0x00429a50`, then forwards that selected company together with the cached panel roots `0x006d19dc/0x006d19e0`, the holdings-name table `0x006d1748`, and toggle byte band `0x00622b04` into the stock-data formatter using localized token `0x3e4e`. Current grounded owner correlation is the `StockBuy.win` constructor `0x0050c290`, which wires this helper into control `0x3aa0`.","objdump + local disassembly + constructor correlation + stock-data formatter correlation + selected-company correlation"
0x0050a5e0,29,shell_stock_buy_window_invalidate_selected_company_summary_control_unconditionally,shell,cdecl,inferred,objdump + constructor correlation + local disassembly,3,"Tiny invalidation callback under the shell-side `StockBuy.win` family. The helper re-enters the shared shell tick `0x00563250` and then unconditionally republishes the standard shell invalidation triple `(0x3b60, 0x3e7f, 0)` through `0x0053fe00` using the live window singleton at `0x006d19f0`. Current grounded owner correlation is the constructor-side callback wiring at `0x0050ba9f`, which binds this helper to control `0x3a9a` with selector `0x83`, so this is the cleanest current selected-company summary invalidation callback rather than a post-trade helper.","objdump + constructor correlation + local disassembly + control-0x3a9a correlation + summary-invalidation correlation"
0x0050a600,93,shell_stock_buy_window_buy_confirmation_modal_tutorial_gate_callback,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Small callback-driven tutorial gate beneath the shell-side `StockBuy.win` buy-confirmation modal. The helper only intercepts shell message `0xcb` on control `0x03f4`; when that exact button path fires while tutorial flag `0x006d3b4c` is live, it opens one sibling shell modal rooted at localized id `0x0e8c` through `0x005193f0 -> 0x004c98a0` and returns `0`. All other message or control combinations return `1` immediately. Current grounded owner correlation is the local stock-buy dispatcher `0x0050bbe0`, which pushes this helper as the callback argument when it opens the buy-side confirmation modal rooted at localized id `0x0292`.","objdump + caller inspection + local disassembly + modal-callback correlation + tutorial-flag correlation"
0x0050a660,10,shell_stock_buy_window_set_selected_chairman_row_index,shell,cdecl,inferred,objdump + caller inspection,3,"Tiny setter under the shell-side `StockBuy.win` family. The helper stores the caller-supplied row index directly into global `0x006d19f4`, which the window constructor `0x0050c290` and later refresh paths use as the current selected chairman-row lane. Current grounded caller `0x004e017e` derives that row index through `0x00477920` from one player-list profile id before publishing it here, so this is the cleanest current raw selected-row setter for `StockBuy.win`.","objdump + caller inspection + selected-row correlation"
0x0050a670,33,shell_stock_buy_window_refresh_if_live,shell,cdecl,inferred,objdump + caller inspection,3,"Small refresh-if-live wrapper for the shell-side `StockBuy.win` singleton rooted at `0x006d19f0`. The helper first re-enters the shared shell state tick `0x00563250`, then when the window object is live it republishes the standard shell invalidation triple `(0x3b60, 0x3e7f, 0)` through `0x0053fe00`. Current grounded callers are the buy and sell chairman-profile mutation helpers `0x00477110` and `0x00476460`, so this is the clearest current post-trade refresh hook for the live stock-buy window rather than a general finance-panel redraw.","objdump + caller inspection + singleton correlation + post-trade refresh correlation"
0x0050a6a0,33,shell_stock_buy_window_invalidate_after_local_trade_message_branch,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Unconditional invalidation sibling beneath the shell-side `StockBuy.win` family. The helper mirrors the same shell tick `0x00563250` and standard invalidation triple `(0x3b60, 0x3e7f, 0)` used by `0x0050a670`, but it does not first guard on the live-window singleton. Current grounded callers are the two local trade message branches at `0x0050bddf` and `0x0050bf8b`, immediately after they commit rounded buy or sell blocks through `0x00477110` and `0x00476460`, so this is the clearest current unconditional refresh hook for the in-window trade path.","objdump + caller inspection + local disassembly + local-trade correlation + summary-invalidation correlation"
0x0050a6d0,86,shell_stock_buy_window_publish_selected_company_or_none_and_refresh_affordance,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Publishes one selected company id into the shell-side `StockBuy.win` family and refreshes the paired availability affordance. The helper compares the caller-supplied company id against current company-count query `0x00429a50`; valid ids are stored into global `0x00622b00`, while out-of-range ids collapse to `-1`. It then maps that validity test onto control-style selector `0x6d/0x86`, republishes control `0x3a9b` through `0x00540120`, and invalidates the same `StockBuy.win` shell triple through `0x0053fe00`. Current grounded callers are the player-list handoff at `0x004e01a0`, the stock-buy window bring-up tail at `0x0050ba0a`, and the local buy/sell selection branches at `0x0050c013/0x0050c037`, so this is the clearest current selected-company publisher beneath `StockBuy.win`.","objdump + caller inspection + local disassembly + selected-company correlation + affordance refresh correlation"
0x0050a730,757,shell_stock_buy_window_refresh_profile_rows_and_metric_cards,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,3,"Broad refresh owner for the shell-side `StockBuy.win` profile-row and metric-card surface. The helper iterates the active chairman-profile collection through `0x00477820/0x00477860`, lays out the selected row and the remaining visible row cards using the cached widget roots at `0x006d19d8`, `0x006d19dc`, `0x006d19e8`, and `0x006d19ec`, formats persona or name labels through `0x00476bb0` and `0x0053de00`, and pulls the currently grounded chairman metric lanes through `0x00476320`, `0x00476780`, and `0x00476c20`. The same pass also formats selected-company ownership text and several numeric card values before publishing them into the live `StockBuy.win` widget tree. Current grounded owner correlation is the `StockBuy.win` constructor `0x0050c290`, which wires this function into the control family as one of the primary refresh callbacks.","objdump + local disassembly + constructor correlation + active-profile correlation + metric-card correlation"
0x0050ae50,1810,shell_stock_buy_window_render_selected_company_summary_panel,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,3,"Broad renderer for the selected-company summary panel beneath the shell-side `StockBuy.win` family. The helper resolves the current selected company through `0x00518140(0x0062be10, company_id)`, resolves the currently selected chairman row through `0x00477860(0x006ceb9c, 0x006d19f4)`, chooses one of the cached panel roots at `0x006d19e8/0x006d19ec`, and then formats a large mixed text-plus-metric surface using company-side share and stock helpers such as `0x00423eb0`, `0x00426b10`, and `0x00426ef0` together with localized ownership-status ids `0x0e0d/0x0e0e/0x0e0f`. Current grounded owner correlation is the `StockBuy.win` constructor `0x0050c290`, which binds this body to control `0x3a9a` with selector `0x7a`, so the safest current read is the main selected-company summary renderer rather than another narrow status-line helper.","objdump + local disassembly + constructor correlation + selected-company correlation + summary-panel correlation"
0x0050b910,216,shell_stock_buy_window_publish_selected_company_ownership_status_line,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,3,"Publishes one selected-company ownership or status line for the shell-side `StockBuy.win` family. The helper first validates current selected company id `0x00622b00` against company-count query `0x00429a50`, resolves the live company record through `0x00429a90`, and then formats one of three localized text records `0x0e10`, `0x0e11`, or `0x0e12` depending on company owner field `[company+0x3b]` relative to the currently selected chairman id `[0x006cec78+0x25]`. When the company has an owning profile it also queries that owner label through `0x00426ef0` and appends the company display name from `[company+0x04]` before publishing the final line through shell presenter `0x00538c70`. Current grounded owner correlation is the `StockBuy.win` constructor `0x0050c290`, which wires this helper into the live control family.","objdump + local disassembly + constructor correlation + selected-company correlation + ownership-status correlation"
0x0050ba00,57,shell_stock_buy_window_refresh_selected_company_summary_tail,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Internal summary-refresh tail beneath the shell-side `StockBuy.win` family. The helper republishes current selected company id `0x00622b00` through `shell_stock_buy_window_publish_selected_company_or_none_and_refresh_affordance` `0x0050a6d0`, invalidates the standard `StockBuy.win` shell triple through `0x0053fe00`, and then republishes companion control `0x3a9a` through `0x00540120` with fixed selector `0x8b`. Current grounded callers are the mode-`0x0b` stock-buy refresh wrapper `0x0050c130` and the broader company-selection setter `0x0050c470`, so this is the clearest current shared refresh tail for the selected-company summary pane.","objdump + caller inspection + local disassembly + selected-company correlation + summary-pane correlation"
0x0050bac0,293,shell_stock_buy_window_destroy,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,4,"Destructor for the shell-side `StockBuy.win` family rooted at `0x006d19f0`. The helper restores vtable `0x005d18f0`, releases the cached widget or selector roots at `0x006d19d8..0x006d19ec` through `0x0053c000`, walks the live company collection under `0x006d4020+0x429b4` to release the per-company stock-data handles cached in `0x006d1748`, invalidates the standard shell triple `(0x3b60, 0x3e7f, 0)` plus the stock-data control `0x3e4e`, clears singleton `0x006d19f0`, and then tails into the common shell-object teardown `0x0053f7d0`. This is the clear destructor-side counterpart to `shell_stock_buy_window_construct` `0x0050c290`.","objdump + local disassembly + constructor correlation + singleton correlation + destructor correlation"
0x0050bbe0,1357,shell_stock_buy_window_handle_message,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,4,"Primary message dispatcher for the shell-side `StockBuy.win` family. Under message `0xcb`, controls `0x3aa1..0x3aa3` wrap the selected company id in `0x00622b00` across the live company count, controls `0x3d54..0x3db7` select one company row through `0x004299f0` and then re-enter `shell_stock_buy_window_publish_selected_company_or_none_and_refresh_affordance` `0x0050a6d0`, controls `0x3afc..0x3b5f` select one chairman row into `0x006d19f4` and mirror that chosen profile back into the live scenario-selected chairman path when world-mode gates allow it, and controls `0x3aad..0x3ab2` write one incoming byte straight into the toggle band `0x00622b04..0x00622b09`. Under message `0xca`, the buy row band `0x3c8c..0x3cef` resolves one company slot, optionally raises tutorial or confirmation modals, and on success commits the rounded buy through `0x00477110` before re-entering `0x0050a6a0`; the sell row band `0x3cf0..0x3d53` mirrors the same pattern through `0x00476460`; and control `0x3a9a` routes into the same shared summary family beside `0x0050ba00`. Current grounded owner correlation is the constructor `0x0050c290`, which wires the surrounding control family onto this dispatcher.","objdump + local disassembly + constructor correlation + control-band correlation + buy-sell row correlation + selected-company correlation"
0x0050c130,21,shell_stock_buy_window_refresh_if_detail_panel_mode_0x0b_is_active,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Small shell-side refresh wrapper for the live `StockBuy.win` detail-panel mode `0x0b`. The helper re-enters the shared shell state tick `0x00563250`, and when singleton `0x006d19f0` is live it jumps into the broader stock-buy refresh tail at `0x0050ba00` instead of returning directly. Current grounded callers are the two mode-sensitive shell refresh wrappers at `0x0043609f` and `0x00436139`, both of which first verify that the detail-panel manager `0x006d0818` is currently in mode `0x0b`.","objdump + caller inspection + local disassembly + detail-panel-mode correlation + stock-buy refresh correlation"
0x0050c150,155,shell_stock_buy_window_apply_payload_buy_rounded_company_block,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Applies one payload-driven buy transaction beneath the shell-side `StockBuy.win` family. The helper treats payload dwords `[this+0x00]` and `[this+0x04]` as chairman-profile id and company id, resolves the live chairman record through `0x00518140`, derives the rounded buy block through `0x00476e50(company_id,1)`, optionally emits the local selected-chairman shell cue through `0x0045ea20(0x36,1.0)` plus `0x0053f000(1,0,0)`, and then commits the transaction through `0x00477110(company_id, block, 1, 0)`. The tail re-enters the shared shell tick `0x00563250` and refresh path through `0x0053fe00` when the `StockBuy.win` singleton at `0x006d19f0` is still live. Current grounded callers are the multiplayer selector wrapper `0x0046c9f0` and the local stock-buy message family, so this is the clearest current payload-side rounded buy-block commit owner.","objdump + local disassembly + caller inspection + rounded-trade correlation + shell-cue correlation"
0x0050c1f0,155,shell_stock_buy_window_apply_payload_sell_rounded_company_block,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Applies one payload-driven sell transaction beneath the shell-side `StockBuy.win` family. The helper treats payload dwords `[this+0x00]` and `[this+0x04]` as chairman-profile id and company id, resolves the live chairman record through `0x00518140`, derives the rounded sell block through `0x00476e50(company_id,0)`, optionally emits the local selected-chairman shell cue through `0x0045ea20(0x37,1.0)` plus `0x0053f000(1,0,0)`, and then commits the transaction through `0x00476460(company_id, block, 1, 0)`. The tail mirrors the same shared shell tick `0x00563250` and refresh path through `0x0053fe00` used by the buy-side sibling `0x0050c150`. Current grounded callers are the multiplayer selector wrapper `0x0046ca10` and the local stock-buy message family, so this is the clearest current payload-side rounded sell-block commit owner.","objdump + local disassembly + caller inspection + rounded-trade correlation + shell-cue correlation"
0x0050c290,624,shell_stock_buy_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `StockBuy.win` family. The constructor installs vtable `0x005d18f0`, binds `StockBuy.win` plus the companion `GameWindow.imb` resource through `0x0053d110` and `0x0053fa50`, seeds live singleton `0x006d19f0`, scans the chairman-profile collection at `0x006ceb9c` to identify the currently selected chairman index in `0x006d19f4`, seeds several cached list or selector handles at `0x006d19d8..0x006d19ec`, and wires the control family through callbacks such as `0x0050a730`, `0x0050a570`, and `0x0050b910`. Current grounded caller is the detail-panel manager branch at `0x004ddeaa`, which keeps this on the shell finance/detail side rather than the company-detail action dispatcher itself.","objdump + strings + detail-manager correlation + collection-scan correlation + control-wiring correlation + singleton correlation"
0x0050c470,103,shell_stock_buy_window_clamp_selected_company_and_rebuild_summary,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Clamps the current selected company id for the shell-side `StockBuy.win` family and rebuilds the selected-company summary pane. The helper validates global company id `0x00622b00` against company-count query `0x00429a50`, stores the clamped id back into that same global, republishes control `0x3a9b` through `0x00540120`, invalidates the standard shell triple through `0x0053fe00`, and then re-enters the shared summary-refresh tail `0x0050ba00`. Current grounded owner correlation is the same local stock-buy refresh family rooted at `0x0050c290`; the helper is also the strongest current direct caller of `0x0050ba00`.","objdump + local disassembly + caller inspection + selected-company correlation + summary-refresh correlation"
0x0050c4e0,19,shell_store_ten_dword_chairmanship_takeover_vote_bitmap_state,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Tiny cache setter for local chairmanship-takeover vote bitmap state rooted at `0x006d1a08`. The helper copies exactly ten dwords from the caller-supplied buffer into that global block. Current grounded caller is multiplayer selector body `0x00471fd0`, which builds two ten-slot bitmap arrays from selector-`0x4b` payload bytes `[+0x04]`, `[+0x05]`, and bitmask dword `[+0x06]` before forwarding the resulting block here immediately ahead of `shell_resolve_chairmanship_takeover_vote_and_commit_outcome` `0x0050c940`.","objdump + caller inspection + local disassembly + selector-0x4b correlation + takeover-vote-state correlation"
0x004dfd70,57,shell_game_window_destroy,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Destructor for the shell-side `Game.win` detail window rooted at `0x006d0818`. It restores vtable `0x005d0eb8`, clears the singleton global, releases the child panel or selector object stored at `[this+0x8c]` through `0x004dd950`, and then tails into the common shell object destructor path. `shell_transition_mode` now uses this as the old-mode teardown branch when leaving mode `1`.","objdump + strings + caller xrefs + destructor correlation"
0x004dfdf0,84,shell_ensure_game_message_window,shell,cdecl,inferred,objdump + strings,4,Ensures the standalone GameMessage.win shell object rooted at 0x006d081c exists. When absent it allocates a 0x94-byte window object seeds the vtable at 0x005d0ed0 binds the GameMessage.win resource through 0x0053fa50 stores the result in 0x006d081c and publishes the object to the shell runtime through 0x00538e50.,objdump + strings + caller xrefs
0x004e0210,1217,game_message_window_service_frame,shell,thiscall,inferred,objdump + strings,4,Per-frame service pass for the GameMessage.win object rooted at 0x006d081c. It walks up to seven active message or notification records from the collection at 0x006acd34 populates the window slots around ids 0x8ca8 and neighboring controls chooses icon and portrait assets such as Portrait.imb note.imb smiley.imb and smalleye.imb maps selected message records into shell and world collections including 0x006ceb9c 0x0062be10 0x0062b26c and 0x0062bae0 and updates the visible action entries through repeated 0x00540120 calls. Current grounded caller is the simulation frame path through 0x004e0720.,objdump + strings + caller xrefs
0x004e0720,15,game_message_window_service_if_present,shell,cdecl,inferred,objdump + caller xrefs,4,Services the GameMessage.win branch only when the global object at 0x006d081c is live by tail-calling game_message_window_service_frame. The current grounded caller is simulation_frame_accumulate_and_step_world which keeps this world-facing message overlay inside the shell-owned recurring frame cadence.,objdump + caller xrefs
0x004e0780,468,game_uppermost_window_service_world_hotspot_band,shell,thiscall,inferred,objdump + strings + caller xrefs,4,Per-frame world-facing hotspot service for the GameUppermost.win overlay rooted at 0x006d0820. The helper clears the previously latched hotspot id at [this+0x78] when the shell runtime selection changes then requires an active world-mode branch at [0x006cec74+0x114] a live shell runtime node at [0x006d401c+0xc6d] an unobscured controller view through 0x00543e20 and 0x00543e40 and one selected control id in the narrow band 0x7918 through 0x7921. It rate-limits repeats through the runtime timestamp at [selected+0xd2] remaps the two rightmost ids onto the sibling left-side base actions 0x791c and 0x791e rechecks shell_input_cursor_inside_active_view at 0x0054f540 scales one table-driven coordinate pair from 0x006066c8 and 0x006066e8 and finally pushes that world-relative offset into the live world owner at 0x0062be68 through 0x0043d130. Current grounded caller is game_uppermost_window_handle_message at 0x004e0ba0.,objdump + strings + caller xrefs
0x004e0960,432,game_uppermost_window_refresh_controls,shell,thiscall,inferred,objdump + strings + caller xrefs,4,Refreshes the visible control state for the GameUppermost.win overlay at 0x006d0820. The helper repopulates the hotspot control band 0x7918 through 0x7921 through repeated 0x00540120 calls chooses one of two layout or visibility selectors based on the active world-mode state under 0x006cec74 and resolves the localized label `Hide Bottom Interface (Toggle)` for control 0x7923 before publishing it back into the window tree. Grounded callers include the overlay constructor at 0x004e0b20 the overlay message handler at 0x004e0ba0 and a later world-mode state-change branch at 0x004ff3f5.,objdump + strings + caller xrefs
0x004e0b20,118,game_uppermost_window_construct,shell,thiscall,inferred,objdump + strings + caller xrefs,4,Constructs the GameUppermost.win overlay object later stored at 0x006d0820. The helper seeds the vtable at 0x005d0f3c binds the GameUppermost.win resource through 0x0053fa50 registers the shared control callback at 0x004e0a70 for ids 0x7918 through 0x7921 refreshes the initial control state through game_uppermost_window_refresh_controls and initializes sibling control 0x7922 before returning the live overlay object. The ensure helper at 0x004e0e40 is the current grounded caller.,objdump + strings + caller xrefs
0x004e0ba0,95,game_uppermost_window_handle_message,shell,thiscall,inferred,objdump + strings + caller xrefs,4,Message dispatcher for the GameUppermost.win overlay object. It seeds one visual-speed field on the command object returned by 0x0053f830 then switches on the incoming message id through the local jump table at 0x004e0d04. The current grounded cases call game_uppermost_window_service_world_hotspot_band during the recurring service path refresh the overlay controls through game_uppermost_window_refresh_controls on a sibling state-change path and route control 0x7922 into the world-mode toggle helper at 0x004349f0 which also updates the same overlay object at 0x006d0820.,objdump + strings + caller xrefs
0x004e0e40,75,shell_ensure_game_uppermost_window,shell,cdecl,inferred,objdump + strings + caller xrefs,4,Ensures the world-facing GameUppermost.win overlay rooted at 0x006d0820 exists. When absent it allocates a 0xae-byte window object constructs it through game_uppermost_window_construct at 0x004e0b20 stores the result globally and publishes it through the shell runtime at 0x006d401c via 0x00538e50. A grounded caller sits in the shell_transition_mode path near 0x004831c0 immediately after the GameMessage.win bring-up branch which ties this overlay to world-mode entry rather than generic shell UI.,objdump + strings + caller xrefs
0x004fe120,14,shell_has_settings_window,shell,cdecl,inferred,objdump,4,Returns whether the shared settings window object rooted at 0x006d1350 is currently live. The fileopt settings escape branch and direct shell command wrappers both gate on this before opening SettingsWindow.win again.,objdump + caller xrefs
0x004fe130,11,shell_mark_settings_window_dirty,shell,cdecl,inferred,objdump + global-state inspection + frame-caller inspection,4,"Tiny dirty-latch setter paired with `shell_has_settings_window`. The helper stores `1` into `0x006d1360`, which current nearby call patterns treat as the `SettingsWindow.win` refresh or service request latch once the live settings singleton at `0x006d1350` exists. Current grounded callers include the post-step shell-window service ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, and the same latch is also cleared during settings-window open or rebuild paths near `0x00501e50`.","objdump + global-state inspection + frame-caller inspection + settings-window open-path correlation"
0x004fd730,415,shell_settings_window_refresh_miscellaneous_input_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation,3,"Refreshes the later `Miscellaneous` page selected by page index `11` in the `SettingsWindow.win` category table. The helper first republishes container controls `0x7546`, `0x7547`, `0x7593`, `0x7594`, `0x759f`, and `0x75a0`, installs four option labels from the paired localized-id table `0x006228d8/0x006228dc` into control `0x7546`, clamps shell field `[0x006cec74+0x10c]` into the visible selector slot for that same control, then mirrors additional shell and world fields through controls `0x7547`, `0x7593`, `0x7594`, `0x759f`, and `0x75a0` using the current values at `[0x006d4024+0x1146d7]`, `[0x006cec74+0x283]`, `[0x006cec74+0x28b]`, `[0x006cec74+0x311]`, and `[0x006cec74+0x315]`. The row is therefore carried as the page-owned control strip over those shell/world fields.","objdump + local disassembly + settings-window page correlation + control-strip correlation"
0x004fd8d0,104,shell_settings_window_refresh_sandbox_options_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Sandbox Options` page selected by page index `12` in the `SettingsWindow.win` category table. The helper republishes container control `0x759e`, installs five localized option labels from `0x00622a08` into that control, and mirrors the current world-side selector from `[0x006d4024+0x11474e]` back into the visible selection slot. This is the current direct page-refresh owner for the page rooted at localized id `0x55d` `Sandbox Options`, with the selector values carried conservatively at that page-owned level.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + selector-mirror correlation"
0x004fd940,223,shell_settings_window_refresh_dialogs_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Dialogs` page selected by page index `10` in the `SettingsWindow.win` category table. The helper republishes controls `0x7545` and `0x758c..0x7590`, mirrors one shell scalar from `[0x006cec74+0xf8]` into control `0x7545`, and then writes the five dialog-toggle booleans derived from shell fields `[0x006cec74+0x26b]`, `[+0x26f]`, `[+0x273]`, `[+0x277]`, and `[+0x27b]` into controls `0x758c` through `0x7590`. This is therefore the direct dialogs-page refresh owner rather than a generic checkbox helper.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + toggle-band correlation"
0x004fda20,368,shell_settings_window_refresh_gameplay_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,3,"Refreshes the `Gameplay` page selected by page index `0` in the `SettingsWindow.win` category table. The helper republishes container controls `0x7548`, `0x7591`, `0x7592`, `0x7599`, `0x759c`, and `0x7544`, installs six option labels from `0x006228f8` into control `0x7548` and three paired labels from `0x00622910/0x00622914` into control `0x7591`, then mirrors several current shell or world values through those controls from `[0x006cec74+0xf4]`, `[+0x22f]`, `[+0x263]`, `[+0x2cc]`, `[+0x309]`, `[+0x0a8]`, and `[0x006d4024+0x114742]`. The row is therefore carried as the page-owned control strip over those gameplay-page shell/world fields.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + control-strip correlation"
0x004fdb90,480,shell_settings_window_refresh_sound_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Sound` page selected by page index `1` in the `SettingsWindow.win` category table. The helper first queries the active sound backend through `0x005314b0`; when no backend is available it disables the main controls `0x7534` and `0x753f`. On the live-backend path it republishes control families `0x7551` and `0x754f`, enumerates six backend labels from `0x006229e4`, mirrors one backend selection through `0x00531640/0x005316d0`, installs the localized sample-rate or quality label rooted at id `0x584`, and then writes the derived backend scalar or enable state back into the visible controls. This is now the direct sound-page refresh owner rather than an unnamed backend probe loop.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + audio-backend correlation"
0x004fd550,250,shell_settings_window_refresh_draw_distance_companion_controls,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + localized-label correlation,4,"Refreshes the companion selector strip beneath the main `Draw Distance` page choice. The helper republishes controls `0x7566`, `0x7596`, `0x7560`, `0x7562`, and `0x7564`, then mirrors the current shell graphics-option slots selected through `0x00484ae0(8)`, `0x00484ae0(0x0d)`, `0x00484ae0(7)`, and `0x00484ae0(9)` back into those controls. The `0x7566` label family uses the localized quality table rooted at ids `0x578..0x57d` plus `0x269`, and control `0x7596` shows the inverted small scalar `4 - option(0x0d)`. Current grounded caller is `shell_settings_window_refresh_draw_distance_page` `0x004feb20`, and the local graphics-selector callback strip also re-enters this helper, so the safest current read is the draw-distance companion-control refresh owner rather than a generic selector helper.","objdump + local disassembly + settings-window page correlation + localized-label correlation + selector-mirror correlation"
0x004fd650,211,shell_settings_window_refresh_textures_companion_controls,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + selector-mirror correlation,4,"Refreshes the companion selector strip beneath the main `Textures` page choice. The helper republishes controls `0x756e`, `0x756a`, `0x756c`, and `0x7570`, then mirrors the current shell graphics-option slots selected through `0x00484ae0(6)`, `0x00484ae0(4)`, `0x00484ae0(5)`, and `0x00484ae0(3)` into those visible controls. Current grounded caller is the textures-side selector callback path immediately below the settings dispatcher, so this is the strongest current read for the textures companion-control refresh helper rather than a generic selector mirror.","objdump + local disassembly + settings-window page correlation + selector-mirror correlation"
0x004fe770,490,shell_settings_window_refresh_graphics_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the top-level `Graphics` page selected by page index `2` in the `SettingsWindow.win` category table. The helper mirrors world byte `[0x006d4024+0x114226]` into control `0x7554`, probes the graphics backend rooted at `0x00ccbb20` through `0x0053ef60` and `0x0053ef70` to derive the availability state for controls `0x757c` and `0x759a`, mirrors shell field `[0x006cec74+0x2c3]` into control `0x7595`, mirrors world dword `[0x006d4024+0x114206]` into control `0x7556`, conditionally formats the graphics-range fields through `0x0051fd40` and `0x0051fd60` into controls `0x7555` and `0x7578` when graphics mode byte `[0x006d4024+0x114226]` is nonzero, and then installs six localized labels from `0x00622964` into control `0x7557` plus the current selector derived from `0x00484ae0(0)`. This is therefore the direct graphics-page refresh owner rather than a generic backend capability probe.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + graphics-backend correlation"
0x004fe960,446,shell_settings_window_refresh_model_detail_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Model Detail` page selected by page index `3` in the `SettingsWindow.win` category table. The helper installs five localized labels from `0x00622940` into control `0x755a` and mirrors the current selector derived from `0x00484ae0(0x0a)` into that control, installs four localized labels from `0x00622954` into control `0x755b` and mirrors the selector from `0x00484ae0(0x0b)`, conditionally republishes control `0x7558` from world float `[0x006d4024+0x1146b9]` when the graphics-mode byte `[0x006d4024+0x114226]` is nonzero, mirrors world byte `[0x006d4024+0x1146eb]` into control `0x755c`, mirrors world byte `[0x006d4024+0x1146e9]` into control `0x755d`, mirrors world dword `[0x006d4024+0x114697]` into control `0x755e`, and republishes the shared six-label family at `0x7557` through the local companion helper `0x004fe4c0`. This is therefore the direct model-detail-page refresh owner rather than another generic graphics helper.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + selector-family correlation"
0x004fe4c0,560,shell_settings_window_rebuild_custom_resolution_list_control,shell,thiscall,inferred,objdump + local disassembly + settings-window callback correlation + string-format inspection,4,"Rebuilds the custom-resolution list control `0x7553` used by the graphics-side settings family. The helper clears the list, walks the live display-mode table rooted at `[0x006d4024+0x34]` with count `[+0x30]` through `0x0051f830`, filters modes to the bounded range `640x480 .. 1600x1200`, deduplicates repeated width-height pairs unless the earlier retained mode uses a non-`0x20` third lane, formats the surviving entries through the literal `%1x%2` at `0x005d14b0`, appends them to control `0x7553`, and finally mirrors the selected row index back into field `0x66`. Current grounded dispatcher-side caller is the graphics/custom-resolution settings branch at `0x004ffbdc`, which first persists the display-runtime block through `0x0051eea0` and then re-enters this helper. This is therefore the custom-resolution list rebuild owner rather than a generic mode-enumerator.","objdump + local disassembly + settings-window callback correlation + string-format inspection + display-mode-table correlation"
0x004fe6f0,53,shell_settings_window_refresh_draw_distance_primary_selector,shell,thiscall,inferred,objdump + local disassembly + settings-window callback correlation,4,"Small selector-mirror helper for the main `Draw Distance` control `0x755f`. The helper reads shell graphics option slot `1` through `0x00484ae0`, remaps non-`-1` selections through the compact table at `0x00622990`, and republishes the resulting visible selector index into field `0x66` on control `0x755f`. Current grounded caller is the graphics-settings callback branch at `0x004ff1f3` immediately after `shell_set_graphics_option_with_fanout` stores option `9`, so this is the draw-distance primary-selector refresh sibling rather than a generic table lookup.","objdump + local disassembly + settings-window callback correlation + selector-remap correlation"
0x004fe730,53,shell_settings_window_refresh_textures_primary_selector,shell,thiscall,inferred,objdump + local disassembly + settings-window callback correlation,4,"Small selector-mirror helper for the main `Textures` control `0x7569`. The helper reads shell graphics option slot `2` through `0x00484ae0`, remaps non-`-1` selections through the same compact table at `0x00622990`, and republishes the resulting visible selector index into field `0x66` on control `0x7569`. Current grounded caller is the neighboring graphics-settings callback branch at `0x004ff30c` immediately after `shell_set_graphics_option_with_fanout` stores option `3`, so this is the textures primary-selector refresh sibling rather than a generic table lookup.","objdump + local disassembly + settings-window callback correlation + selector-remap correlation"
0x004feb20,176,shell_settings_window_refresh_draw_distance_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Draw Distance` page selected by page index `4` in the `SettingsWindow.win` category table. The helper installs the shared six-label selector family from `0x00622964` into control `0x755f`, mirrors the current selector derived from `0x00484ae0(1)` into that control, re-enters `0x004fd550` for the paired companion refresh, and mirrors world byte `[0x006d4024+0x1146b8]` into control `0x7568`. This is now the direct draw-distance-page refresh owner rather than a generic selector helper.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + selector-family correlation"
0x004febd0,112,shell_settings_window_refresh_textures_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Textures` page selected by page index `5` in the `SettingsWindow.win` category table. The helper installs the shared six-label selector family from `0x00622964` into control `0x7569`, mirrors the current selector derived from `0x00484ae0(2)` into that control, and re-enters `0x004fe730` to republish the compact visible selector state. This is now the direct textures-page refresh owner rather than another generic selector helper.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + selector-family correlation"
0x004fdd70,432,shell_settings_window_refresh_graphics_misc_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation,3,"Refreshes the first `Miscellaneous` page selected by page index `6` in the `SettingsWindow.win` category table. The helper republishes control families `0x7573` and `0x7574`, installs three paired localized option rows from ids `0xe18..0xe1d`, mirrors one world selector from `[0x006d4024+0x114736]`, mirrors another from `[0x006d4024+0x1146b3]`, compares world float `[0x006d4024+0x1146af]` against the fixed threshold at `0x005c8628`, mirrors world byte `[0x006d4024+0x1146a8]`, mirrors world byte `[0x006d4024+0x1146e3]`, and finally mirrors one shell-side gate derived through `0x00484af0(0x0c)` into control `0x7586`. The row is therefore carried as the page-owned world-field strip over those graphics-misc toggles.","objdump + local disassembly + settings-window page correlation + control-strip correlation + world-field correlation"
0x004fdf20,164,shell_settings_window_refresh_scrolling_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Scrolling` page selected by page index `8` in the `SettingsWindow.win` category table. The helper mirrors four shell-side scalar settings from `[0x006cec74+0x114]`, `[+0x118]`, `[+0x11c]`, and `[+0x120]` into controls `0x757d`, `0x757f`, `0x7581`, and `0x7584`, and then mirrors the boolean companion derived from `[0x006cec74+0x120]` into control `0x7585`. This is therefore the direct scrolling-page refresh owner rather than a generic slider helper.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + shell-scalar correlation"
0x004fdfd0,421,shell_settings_window_refresh_camera_controls_page,shell,thiscall,inferred,objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation,4,"Refreshes the `Camera Controls` page selected by page index `9` in the `SettingsWindow.win` category table. The helper republishes control families `0x7587` and `0x7588`, installs twenty-five localized labels from `0x00620dd8` into control `0x7587`, mirrors the current shell-side selector from `[0x006cec74+0x233]` plus companion `[+0x237]` back into that control, then installs ten localized labels `0x0a9f..0x0aa8` from `0x00620e3c` into control `0x7588` and mirrors the paired shell-side selector from `[0x006cec74+0x23b]` plus companion `[+0x23f]`. The current label tables now ground `0x7587` as the day-night cycling selector rooted at `Normal day/night cycling` through `Frozen at 11pm`, and `0x7588` as the weather-cycling selector rooted at `Normal weather cycling` through `Frozen at storms`. This is therefore the direct camera-controls page refresh owner rather than a partially anonymous page helper.","objdump + local disassembly + settings-window page correlation + RT3.lng page-label correlation + label-table correlation + selector-family correlation"
0x004fec60,383,shell_settings_window_rebuild_hotkeys_list_control_from_sorted_binding_report,shell,thiscall,inferred,objdump + local disassembly + settings-window correlation,4,"Rebuilds one `SettingsWindow.win` list control from the current sorted hotkey report. The helper first resolves the live settings window shell object through control id `0x757a`, caches the current selection dword from `[control+0x1e2]`, destroys and reallocates the temporary list owner at `0x006d1354`, and seeds that owner as an `0x88`-stride list model through `0x00518b90`. It then iterates the current binding report through `shell_input_binding_report_iterate_next_entry_in_sorted_priority_order` `0x0045f250`, formats the action-stem column and the display-label column into local strings, appends each row through the list-model vtable at `[0x006d1354]+0x04`, and republishes the finished row into the live window through `0x00540120(control_id=0x757a, field_id=0x88, ...)`. After the rebuild it restores the saved selection through `0x00561840`. Current grounded caller is the `SettingsWindow.win` hotkeys side around `0x004fed16`, so the safest current read is the hotkeys-list rebuild body rather than a generic shell list refresher.","objdump + local disassembly + settings-window correlation + list-model correlation + hotkey-report correlation"
0x004fede0,5680,shell_settings_window_handle_message,shell,thiscall,inferred,objdump + local disassembly + settings-window correlation,3,"Primary message or command dispatcher for the shared `SettingsWindow.win` singleton at `0x006d1350`. The handler normalizes incoming control ids into the `0x8ab7..` band and switches through the local jump tables at `0x004ff47c` and `0x004ff4c0`. The fully grounded hotkeys side now does three concrete things: one branch at `0x00500147` hard-resets the live binding registry through `shell_input_binding_registry_initialize_roots_seed_defaults_and_optionally_import_hotkeys_file` `0x00461120(0)`, immediately rewrites `hotkeys\\hotkeys.txt` through `shell_input_write_hotkeys_report_file` `0x0045f550`, and rebuilds the hotkeys list through `shell_settings_window_rebuild_hotkeys_list_control_from_sorted_binding_report` `0x004fec60`; another branch at `0x00500186..0x0050022b` resolves the selected hotkeys row from control `0x757a` and model `0x006d1354`, validates the requested action bucket through `shell_input_binding_descriptor_query_bucket_key_for_action_id_when_mode_mask_is_singular` `0x0045ed90`, skips the Enter and Escape keys, expands the compact modifier code through `shell_input_binding_expand_compact_mode_code_to_registry_mask` `0x0045ed70`, commits the rebucket through `shell_input_binding_registry_rebucket_entry_by_stem_to_action_id_and_mode_mask` `0x0045ef00`, and then rewrites the report file plus rebuilds the same list; and the surrounding settings cases toggle several persisted shell or world flags such as `[0x006cec74+0x247]`, `[0x006cec74+0x24b]`, `[0x006cec74+0x243]`, `[0x006cec74+0x120]`, and world byte `[0x006d4024+0x1146e3]`, forwarding their persistence or refresh tails through `0x00484910`, `0x0051eea0`, `0x00531560`, and `0x0051f510`. The full switch table is still broader than the current annotation, but this is now safely the `SettingsWindow.win` message owner rather than an unplaced UI body.","objdump + local disassembly + settings-window correlation + hotkeys-branch correlation + toggle-branch correlation"
0x004fe140,32,shell_graphics_backend_query_primary_or_fallback_status_nonzero,shell,thiscall,inferred,objdump + settings-window caller correlation,3,"Composite predicate over the graphics backend. The helper returns true when either `graphics_backend_query_primary_status_dword_18` `0x0053ef60` is nonzero or `graphics_backend_query_both_status_slots_clear` `0x0053ef70` returns true; otherwise it returns false. Current grounded caller is the timer-gated graphics settings service branch near `0x004ffb1d`, which uses this predicate to choose between the paired backend follow-on calls `0x0053f170` and `0x0053f2c0` before republishing the graphics page.","objdump + settings-window caller correlation + backend-branch correlation"
0x004fe160,76,shell_audio_backend_change_follow_on_refresh,shell,cdecl,inferred,objdump + sound-settings caller correlation,3,"Follow-on refresh path used after the sound-backend selector changes. The helper first re-enters two subordinate runtime owners rooted at `0x006cec78` through `0x0040b7d0` and `0x0040b830` when that global is live, then re-enters shell object `[0x006cec74+0x14]` through `0x004686d0`, and finally resolves one shell controller subobject through `0x0051f070` before conditionally tail-calling `0x00563ed0`. Current grounded caller is `shell_settings_window_handle_sound_backend_selection_change` `0x004fefb0`, so the safest current read is the sound-backend follow-on refresh owner rather than a general shell service helper.","objdump + sound-settings caller correlation + global-owner correlation"
0x004fe270,84,shell_apply_custom_resolution_tuple_if_changed_and_persist,shell,cdecl,inferred,objdump + graphics-settings callback correlation,4,"Helper beneath the custom-resolution selector path. The function rejects re-entrant refreshes, compares the requested packed width-height tuple in `EDX` against the current live display-mode tuple at `[0x006d4024+0x34 + mode_index*0x15]`, and when they differ re-enters `shell_apply_display_mode_tuple_and_optional_graphics_mode` `0x005206b0` with the new width and height before persisting the larger display-runtime block through `0x0051eea0`. Current grounded caller is `shell_settings_window_handle_custom_resolution_selection_change` `0x004ff070`.","objdump + graphics-settings callback correlation + display-mode-apply correlation + persistence correlation"
0x004fe2d0,220,shell_apply_graphics_primary_selector_and_republish_backend_controls,shell,cdecl,inferred,objdump + graphics-settings callback correlation,4,"Helper beneath the top-level graphics selector callback. The function rejects re-entrant refreshes, remaps the chosen visible selector through the compact table `0x006211d0`, stores it through `shell_set_graphics_option_with_fanout` `0x00485060`, re-arms the graphics service through `0x00484910(1)`, and then repopulates the backend-dependent controls `0x757c` and `0x759a` using the live graphics backend via `0x0053ef60` and `0x0053ef70`. Current grounded caller is `shell_settings_window_handle_graphics_primary_selector_change` `0x004ff0d0`.","objdump + graphics-settings callback correlation + backend-control republish correlation"
0x004fe3b0,75,shell_apply_draw_distance_selector_and_refresh_companion_controls,shell,cdecl,inferred,objdump + graphics-settings callback correlation,4,"Helper beneath the draw-distance selector callback. The function rejects re-entrant refreshes, remaps the chosen visible selector through table `0x006211d0`, stores it through `shell_set_graphics_option_with_fanout` `0x00485060` as option family `1`, raises the local refresh latch `0x006d135c`, refreshes the draw-distance companion strip through `0x004fd550`, clears the latch again, and then re-arms the graphics service through `0x00484910(1)`. Current grounded caller is `shell_settings_window_handle_draw_distance_selector_change` `0x004ff1b0`.","objdump + graphics-settings callback correlation + companion-refresh correlation"
0x004fe400,75,shell_apply_textures_selector_and_refresh_companion_controls,shell,cdecl,inferred,objdump + graphics-settings callback correlation,4,"Helper beneath the textures selector callback. The function rejects re-entrant refreshes, remaps the chosen visible selector through table `0x006211d0`, stores it through `shell_set_graphics_option_with_fanout` `0x00485060` as option family `2`, raises the local refresh latch `0x006d135c`, refreshes the textures companion strip through `0x004fd650`, clears the latch again, and then re-arms the graphics service through `0x00484910(1)`. Current grounded caller is the textures-selector change path adjacent to `0x004ff2e0`.","objdump + graphics-settings callback correlation + companion-refresh correlation"
0x004fefb0,179,shell_settings_window_handle_sound_backend_selection_change,shell,thiscall,inferred,objdump + local disassembly + settings-window callback correlation,4,"Settings-window callback for the sound-backend selector family. The helper rejects `-1` selections and re-entrant refreshes, updates the active sound-backend selection on shell service `0x006d402c` through `0x00532230`, republishes the visible selector on control `0x7551` when the backend normalizes differently through `0x00531640`, mirrors the derived availability flag from `0x005316d0` into control `0x7550`, stores the resolved backend index into world field `[0x006d4024+0x114706]`, triggers the sound-runtime follow-on through `0x004fe160`, and then persists the larger display-runtime block through `0x0051eea0` plus the adjacent save tail `0x00484910`. Current grounded control family is the `Sound` page row rooted at `0x7551/0x7550`, which makes this the backend-selection change owner rather than a generic shell list callback.","objdump + local disassembly + settings-window callback correlation + sound-backend correlation + persistence-tail correlation"
0x004ff070,85,shell_settings_window_handle_custom_resolution_selection_change,shell,cdecl,inferred,objdump + local disassembly + settings-window callback correlation,4,"Settings-window callback for the custom-resolution list under control `0x7553`. The helper rejects `-1` selections and re-entrant refreshes, decodes the packed width-height pair from the incoming selector payload, compares it against the current live display-mode tuple at `[0x006d4024+0x34 + mode_index*0x15]`, and when the pair changed re-enters `shell_apply_display_mode_tuple_and_optional_graphics_mode` `0x005206b0` with the new width and height. This is therefore the compact custom-resolution selection owner rather than another generic selector wrapper.","objdump + local disassembly + settings-window callback correlation + display-mode-apply correlation"
0x004ff0d0,220,shell_settings_window_handle_graphics_primary_selector_change,shell,cdecl,inferred,objdump + local disassembly + settings-window callback correlation,4,"Settings-window callback for the top-level `Graphics` page selector family rooted at the compact remap table `0x006211d0`. The helper rejects `-1` selections and re-entrant refreshes, remaps the chosen visible selector through `shell_set_graphics_option_with_fanout` `0x00485060`, re-arms the graphics service through `0x00484910(1)`, and then republishes the backend-dependent controls `0x757c` and `0x759a` using `0x0053ef60` and `0x0053ef70` before returning. This is now the clearest owner for the graphics primary-selector change branch rather than an anonymous settings callback.","objdump + local disassembly + settings-window callback correlation + graphics-backend republish correlation"
0x004ff1b0,115,shell_settings_window_handle_draw_distance_selector_change,shell,cdecl,inferred,objdump + local disassembly + settings-window callback correlation,4,"Settings-window callback for the main `Draw Distance` selector. The helper packages the chosen visible selector through `shell_set_graphics_option_with_fanout` `0x00485060` as option slot `9`, skips further work when the local refresh latch `0x006d135c` is armed, and otherwise re-enters `shell_settings_window_refresh_draw_distance_primary_selector` `0x004fe6f0`. Current grounded dispatcher-side callsite sits at `0x004ff1f3`, which makes this the draw-distance selector-change owner rather than a generic option setter.","objdump + local disassembly + settings-window callback correlation + selector-refresh correlation"
0x004ff2e0,52,shell_settings_window_handle_textures_selector_change,shell,cdecl,inferred,objdump + local disassembly + settings-window callback correlation,4,"Settings-window callback for the main `Textures` selector. The helper packages the chosen visible selector through `shell_set_graphics_option_with_fanout` `0x00485060` as option slot `3`, skips the follow-on when local latch `0x006d135c` is armed, and otherwise re-enters `shell_settings_window_refresh_textures_primary_selector` `0x004fe730`. Current grounded dispatcher-side callsite sits at `0x004ff30c`, which makes this the textures selector-change owner rather than another compact remap stub.","objdump + local disassembly + settings-window callback correlation + selector-refresh correlation"
0x004ff58a,33,shell_settings_window_toggle_misc_input_page_display_runtime_byte_1146d7,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for the later `Miscellaneous` input page field mirrored from display-runtime byte `[0x006d4024+0x1146d7]` into control `0x7547`. The helper flips the byte and persists the display-runtime block through `0x0051eea0`. This is therefore the direct toggle owner for that page-owned byte rather than an anonymous dispatcher leaf.","objdump + local disassembly + settings-window page correlation + persistence correlation"
0x004ff5b6,37,shell_settings_window_toggle_misc_input_page_shell_flag_28b,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for the later `Miscellaneous` input page field `[0x006cec74+0x28b]`, currently mirrored into control `0x7594`. The helper flips the dword between `0` and `1`, raises the shared shell config-save tail through `0x00484910(1)`, and returns. The row is therefore kept at that field-based settings caption level.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x004ff5e6,70,shell_settings_window_toggle_misc_input_page_shell_flag_283_and_refresh_game_window_affordance,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,4,"Toggle branch for the later `Miscellaneous` input page field `[0x006cec74+0x283]`, currently mirrored into control `0x7593`. The helper flips the dword, persists shell config through `0x00484910(1)`, and when the live `Game.win` singleton at `0x006d0818` exists it republishes one page-local affordance through `0x004dd8d0` using the new boolean value. This is therefore the direct owner for the `+0x283` settings toggle plus its `Game.win` follow-on refresh.","objdump + local disassembly + settings-window page correlation + config-save correlation + Game.win follow-on correlation"
0x004ff637,37,shell_settings_window_toggle_dialogs_page_shell_scalar_f8,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for the `Dialogs` page scalar `[0x006cec74+0xf8]`, mirrored into control `0x7545`. The helper flips the dword between `0` and `1`, persists shell config through `0x00484910(1)`, and returns. The row is therefore kept at that structural settings-caption level.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x004ff667,37,shell_settings_window_toggle_dialogs_page_flag_26b,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for `Dialogs` page field `[0x006cec74+0x26b]`, currently mirrored into the checkbox strip rooted at control `0x758c`. The helper flips the dword and persists shell config through `0x00484910(1)`.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x004ff697,37,shell_settings_window_toggle_dialogs_page_flag_26f,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for `Dialogs` page field `[0x006cec74+0x26f]`, currently mirrored into the checkbox strip rooted at control `0x758d`. The helper flips the dword and persists shell config through `0x00484910(1)`.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x004ff6c7,37,shell_settings_window_toggle_dialogs_page_flag_273,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for `Dialogs` page field `[0x006cec74+0x273]`, currently mirrored into the checkbox strip rooted at control `0x758e`. The helper flips the dword and persists shell config through `0x00484910(1)`.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x004ff6f7,37,shell_settings_window_toggle_dialogs_page_flag_277,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for `Dialogs` page field `[0x006cec74+0x277]`, currently mirrored into the checkbox strip rooted at control `0x758f`. The helper flips the dword and persists shell config through `0x00484910(1)`.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x004ff727,37,shell_settings_window_toggle_dialogs_page_flag_27b,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for `Dialogs` page field `[0x006cec74+0x27b]`, currently mirrored into the checkbox strip rooted at control `0x7590`. The helper flips the dword and persists shell config through `0x00484910(1)`.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x004ff757,52,shell_settings_window_toggle_gameplay_page_display_runtime_dword_114742_and_refresh_building_detail_if_live,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,4,"Toggle branch for the `Gameplay` page display-runtime dword `[0x006d4024+0x114742]`, one of the fields mirrored by `shell_settings_window_refresh_gameplay_page` `0x004fda20`. The helper flips the dword, re-enters `0x004b2ae0` when the live `BuildingDetail.win` singleton at `0x006cfcbc` is present, and then persists shell config through `0x00484910(1)`. This is therefore the direct toggle owner for that gameplay-page display-runtime field plus its building-detail follow-on refresh.","objdump + local disassembly + settings-window page correlation + building-detail follow-on correlation + config-save correlation"
0x004ff796,37,shell_settings_window_toggle_gameplay_page_shell_flag_a8,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,3,"Toggle branch for the `Gameplay` page shell field `[0x006cec74+0x0a8]`, one of the values mirrored by `shell_settings_window_refresh_gameplay_page` `0x004fda20`. The helper flips the dword and persists shell config through `0x00484910(1)`.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x004ff7c6,113,shell_settings_window_toggle_gameplay_page_shell_flag_263_and_refresh_live_world_tool_sidecar,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,4,"Toggle branch for the `Gameplay` page shell field `[0x006cec74+0x263]`, mirrored by `shell_settings_window_refresh_gameplay_page` `0x004fda20`. The helper flips the dword and, when the live shell detail manager at `0x006d0818` is on page `0x0c`, updates one world-tool sidecar rooted at `0x0062c120+0x1689/0x168d` before persisting shell config through `0x00484910(1)`. This is therefore the direct owner for the `+0x263` gameplay toggle plus its narrow live-tool follow-on.","objdump + local disassembly + settings-window page correlation + live-tool follow-on correlation + config-save correlation"
0x004ff84e,109,shell_settings_window_toggle_gameplay_page_shell_flag_309_and_refresh_live_tool_counters,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,4,"Toggle branch for the `Gameplay` page shell field `[0x006cec74+0x309]`, mirrored by `shell_settings_window_refresh_gameplay_page` `0x004fda20`. The helper flips the dword and, when the live tool at `0x006d1a8c` plus world-side owner `0x006cfca8` are present, chooses between the small follow-on decrements `0x00491880` and `0x004932a0` before persisting shell config through `0x00484910(1)`. This is therefore the direct owner for the `+0x309` gameplay toggle plus its live-tool counter refresh side effect.","objdump + local disassembly + settings-window page correlation + live-tool follow-on correlation + config-save correlation"
0x004ffafb,102,shell_settings_window_service_graphics_backend_status_and_repaint_page,shell,cdecl,inferred,objdump + local disassembly + settings-window service correlation,4,"Timer-gated graphics-page service branch beneath `SettingsWindow.win`. The helper samples elapsed wall-clock time through `shell_get_elapsed_tick_count_since_bootstrap_seed` `0x0051d890` against the global deadline `0x006d136c`, rearms that deadline by `1000` ms, chooses between graphics-backend follow-on calls `0x0053f170` and `0x0053f2c0` from the composite predicate `shell_graphics_backend_query_primary_or_fallback_status_nonzero` `0x004fe140`, raises the shared shell refresh latch through `0x00484910(1)`, repaints the live graphics page through `shell_settings_window_refresh_graphics_page` `0x004fe770`, and then shortens the next service deadline to `60` ms. This is therefore the active graphics-backend service-and-repaint owner rather than just another generic timer callback.","objdump + local disassembly + settings-window service correlation + graphics-page refresh correlation"
0x004ffb64,96,shell_settings_window_service_graphics_backend_status_without_page_repaint,shell,cdecl,inferred,objdump + local disassembly + settings-window service correlation,4,"Sibling timer-gated graphics-backend service branch beneath `SettingsWindow.win`. The helper uses the same elapsed-tick gate at `0x006d136c`, rearms the `1000` ms coarse deadline through `shell_get_elapsed_tick_count_since_bootstrap_seed` `0x0051d890`, chooses between `0x0053f0f0` and `0x0053f210` from `graphics_backend_query_both_status_slots_clear` `0x0053ef70`, raises the shared shell refresh latch through `0x00484910(1)`, and then shortens the next service deadline to `60` ms without directly repainting the graphics page. Current local evidence keeps this as the no-page-repaint companion to `0x004ffafb` rather than a detached backend poller.","objdump + local disassembly + settings-window service correlation + backend-follow-on correlation"
0x004ffbc0,244,shell_settings_window_handle_custom_resolution_or_graphics_range_refresh,shell,cdecl,inferred,objdump + local disassembly + settings-window callback correlation + persistence correlation,3,"Settings-window callback branch that persists the display-runtime block through `0x0051eea0`, rebuilds the custom-resolution list through `0x004fe4c0`, and then republishes the graphics-range controls `0x7555` and `0x7578` depending on whether graphics mode byte `[0x006d4024+0x114226]` is nonzero. The branch is timer or service gated through `0x006d136c` and the surrounding settings dispatcher. This is still somewhat structural, but it is now clearly the graphics custom-resolution or range-refresh owner rather than an unrelated timer path.","objdump + local disassembly + settings-window callback correlation + persistence correlation + graphics-range-control correlation"
0x004ffd10,351,shell_settings_window_handle_graphics_range_custom_mode_toggle,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,4,"Settings-window callback branch for the graphics-range custom-mode affordance rooted at control `0x7555`. When the custom-mode flag from `shell_query_graphics_range_custom_mode_flag` `0x0051fd40` is already set it disables that flag through `shell_set_graphics_range_custom_mode_flag_and_reapply_if_needed` `0x00520fd0(0)` and persists the display-runtime block through `0x0051eea0`. Otherwise it first checks `shell_query_graphics_range_has_live_custom_payload` `0x0051fd00`; when no live custom payload exists it clears the control and presents one small localized notice through `0x005193f0(0x0e17) -> 0x004c98a0(mode=1)`. When a live payload does exist it uses shell byte `[0x006cec74+0x2d1]` as a one-shot warning gate, raises the shared shell refresh latch through `0x00484910(1)`, presents the confirmation dialog `0x005193f0(0x0e16) -> 0x004c98a0(mode=3)`, and only on the affirmative path re-enters `shell_set_graphics_range_custom_mode_flag_and_reapply_if_needed` `0x00520fd0(1)`, persists the display runtime, and republishes the same control. If the setter immediately clears the flag again it falls back to the localized notice path `0x005193f0(0x0e93) -> 0x004c98a0(mode=1)`. This is therefore the user-facing graphics-range custom-mode toggle owner rather than a generic dialog wrapper.","objdump + local disassembly + settings-window dispatcher correlation + graphics-range-control correlation + dialog-path correlation"
0x004ffe72,48,shell_settings_window_handle_graphics_range_scalar_zero_nonzero_toggle,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,4,"Small graphics-range scalar toggle beneath `SettingsWindow.win`. The helper reads the current scalar through `shell_query_graphics_range_scalar` `0x0051fd60`, collapses that to a zero-vs-nonzero boolean, inverts it, forwards the requested replacement through `shell_set_graphics_range_scalar_and_reapply_if_needed` `0x00521030`, and then persists the display-runtime block through `0x0051eea0`. Current grounded location is the same graphics-side callback strip as `0x004ffd10`, so this is the safest current read for the zero/nonzero graphics-range scalar toggle rather than a generic integer setter.","objdump + local disassembly + settings-window dispatcher correlation + graphics-range-scalar correlation"
0x004ffea4,91,shell_settings_window_toggle_display_runtime_preview_rect_notify_flag,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime byte `[0x006d4024+0x1146eb]` beneath `SettingsWindow.win`. The helper flips the byte, and when the global world-root at `0x0062c120` is live and the new value becomes zero it emits one large world-space rect notification through `0x0044e940(0,0,0x270f,0x270f,0)` before persisting the display-runtime block through `0x0051eea0`. Current evidence safely bounds this as one preview-rect notify toggle in the graphics-side settings family rather than a fully named presentation option.","objdump + local disassembly + settings-window dispatcher correlation + world-rect-notify correlation"
0x004ffeff,46,shell_settings_window_toggle_display_runtime_dword_114697,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime dword `[0x006d4024+0x114697]` beneath `SettingsWindow.win`. The helper flips the dword between `0` and `1` and immediately persists the display-runtime block through `0x0051eea0`. The row is therefore kept at that conservative field-owned level.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation"
0x004fff2d,37,shell_settings_window_toggle_display_runtime_byte_1146e9,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime byte `[0x006d4024+0x1146e9]` beneath `SettingsWindow.win`. The helper flips the byte and immediately persists the display-runtime block through `0x0051eea0`. Current evidence keeps the label structural because the exact player-facing option name is still ungrounded.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation"
0x004fff59,41,shell_settings_window_toggle_display_runtime_byte_1146b8,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime byte `[0x006d4024+0x1146b8]` beneath `SettingsWindow.win`. The helper flips the byte and persists the display-runtime block through `0x0051eea0`. Current adjacent disassembly keeps this on the graphics or model-detail side of the settings dispatcher, but the exact player-facing caption is still ungrounded.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation"
0x004fff85,86,shell_settings_window_toggle_display_runtime_scalar_1146af_between_0_and_0_5,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,4,"Small scalar toggle branch for display-runtime float `[0x006d4024+0x1146af]` beneath `SettingsWindow.win`. The helper compares the current scalar against `0.5`, stores `0.0` when the current value is already at or below that threshold, otherwise stores `0.5`, and then persists the display-runtime block through `0x0051eea0`. This is therefore the clearest current owner for a binary `0.0` vs `0.5` display scalar toggle inside the settings dispatcher.","objdump + local disassembly + settings-window dispatcher correlation + scalar-threshold correlation"
0x004fffde,46,shell_settings_window_toggle_display_runtime_byte_1146a8,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime byte `[0x006d4024+0x1146a8]` beneath `SettingsWindow.win`. The helper flips the byte and persists the display-runtime block through `0x0051eea0`. The row is therefore kept at that structural field-owned level.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation"
0x0050000a,46,shell_settings_window_toggle_display_runtime_byte_1146e3,shell,cdecl,inferred,objdump + local disassembly + settings-window dispatcher correlation,3,"Toggle branch for display-runtime byte `[0x006d4024+0x1146e3]` beneath `SettingsWindow.win`. The helper flips the byte and persists the display-runtime block through `0x0051eea0`. This is the direct byte-toggle owner mentioned more broadly in the settings dispatcher note, kept at that field-owned caption level.","objdump + local disassembly + settings-window dispatcher correlation + persistence correlation"
0x00500036,51,shell_settings_window_apply_graphics_misc_option_family12_from_checkbox_state,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,4,"Settings-window callback leaf for the first `Miscellaneous` graphics page option family derived through `0x00484af0(0x0c)`, currently mirrored into control `0x7586` by `shell_settings_window_refresh_graphics_misc_page` `0x004fdd70`. The helper reads the incoming checkbox-state bit from `[msg+0x2c]+0xcc`, forwards that boolean into `shell_set_graphics_option_with_fanout` `0x00485060(option_family=0x0c)`, and then persists the display-runtime block through `0x0051eea0`. This is therefore the direct apply leaf for that graphics-misc option family rather than another anonymous message stub.","objdump + local disassembly + settings-window page correlation + graphics-option-family correlation + persistence correlation"
0x0050006c,46,shell_settings_window_toggle_shared_setup_config_flag_247,shell,cdecl,inferred,objdump + local disassembly + settings-window and setup correlation,3,"Toggle branch for shared shell config flag `[0x006cec74+0x247]`. The helper flips the dword and persists shell config through `0x00484910(1)`. This is one of the same three persisted booleans later mirrored by `Setup.win` controls `0x0e88/0x0e89/0x0e8a`, so the safest current read is the shared setup-config toggle rather than a page-local-only setting.","objdump + local disassembly + settings-window and setup correlation + config-save correlation"
0x0050009c,46,shell_settings_window_toggle_shared_setup_config_flag_24b,shell,cdecl,inferred,objdump + local disassembly + settings-window and setup correlation,3,"Toggle branch for shared shell config flag `[0x006cec74+0x24b]`. The helper flips the dword and persists shell config through `0x00484910(1)`. This is one of the three persisted booleans also mirrored by `Setup.win` controls `0x0e88/0x0e89/0x0e8a`.","objdump + local disassembly + settings-window and setup correlation + config-save correlation"
0x005000cc,46,shell_settings_window_toggle_shared_setup_config_flag_243,shell,cdecl,inferred,objdump + local disassembly + settings-window and setup correlation,3,"Toggle branch for shared shell config flag `[0x006cec74+0x243]`. The helper flips the dword and persists shell config through `0x00484910(1)`. This is the third member of the persisted setup-config toggle trio also mirrored by `Setup.win` controls `0x0e88/0x0e89/0x0e8a`.","objdump + local disassembly + settings-window and setup correlation + config-save correlation"
0x005000fc,45,shell_settings_window_toggle_scrolling_page_boolean_companion_flag_120,shell,cdecl,inferred,objdump + local disassembly + settings-window page correlation,4,"Toggle branch for the `Scrolling` page boolean companion derived from shell field `[0x006cec74+0x120]`, mirrored into control `0x7585` by `shell_settings_window_refresh_scrolling_page` `0x004fdf20`. The helper maps the incoming control id to a zero-or-one dword, stores that at `[0x006cec74+0x120]`, and persists shell config through `0x00484910(1)`. This is therefore the direct owner for the scrolling-page boolean companion rather than a generic shell-field setter.","objdump + local disassembly + settings-window page correlation + config-save correlation"
0x00500410,528,shell_settings_window_refresh_selected_page_controls,shell,thiscall,inferred,objdump + local disassembly + settings-window correlation + RT3.lng page-label correlation,4,"Refreshes the visible category-strip state and the active page body for the shared `SettingsWindow.win` singleton. The helper raises the local in-refresh guard byte `0x006d135d`, normalizes caller page `0x0c` to `0x0b` and `0x0b` to `0x0d`, republishes the left category-strip control family `0x7533..0x753f` plus the trailing companion controls `0x7540` and `0x753f` through repeated `0x00540120` calls with mode `3` and style values `0x86/0xa6`, and then dispatches the selected page through the local table at `0x005005e0`. The category table rooted at `0x00622870` now grounds those page indices as `Gameplay`, `Sound`, `Graphics`, `Model Detail`, `Draw Distance`, `Textures`, `Miscellaneous`, `Hot Keys`, `Scrolling`, `Camera Controls`, `Dialogs`, `Miscellaneous`, and `Sandbox Options`; page `7` is directly confirmed as the hotkeys page because it dispatches into `shell_settings_window_rebuild_hotkeys_list_control_from_sorted_binding_report` `0x004fec60`. The currently grounded page-refresh callees are `0x004fda20`, `0x004fdb90`, `0x004fe770`, `0x004fe960`, `0x004feb20`, `0x004febd0`, `0x004fdd70`, `0x004fec60`, `0x004fdf20`, `0x004fdfd0`, `0x004fd940`, `0x004fd730`, and `0x004fd8d0`. The helper clears `0x006d135d` on every exit path, so the safest current read is the selected-page refresh owner rather than a generic settings redraw wrapper.","objdump + local disassembly + settings-window correlation + category-strip correlation + page-dispatch correlation + RT3.lng page-label correlation"
0x00500620,32,shell_refresh_settings_window_page_if_live_and_not_in_internal_refresh,shell,cdecl,inferred,objdump + local disassembly + settings-window correlation,4,"Small guarded wrapper above `shell_settings_window_refresh_selected_page_controls` `0x00500410`. The helper ignores page selector `-1`, ignores requests while the internal refresh guard byte `0x006d135d` is set, and otherwise re-enters the live settings singleton at `0x006d1350` when present. Current grounded callers are the surrounding settings-message and page-selection paths, where this acts as the nonreentrant page-refresh gate rather than a general shell-window service helper.","objdump + local disassembly + settings-window correlation + refresh-guard correlation"
0x00500640,487,shell_settings_window_construct,shell,thiscall,inferred,objdump + strings + RT3.lng page-label correlation,4,"Constructs the shared SettingsWindow.win object later stored at `0x006d1350`. The helper binds the `SettingsWindow.win` resource through `0x0053fa50`, allocates a page-selection helper at `0x006d1358`, walks the 13-entry category table rooted at `0x00622870`, and populates the resulting shell control tree with the ordered page labels `Gameplay`, `Sound`, `Graphics`, `Model Detail`, `Draw Distance`, `Textures`, `Miscellaneous`, `Hot Keys`, `Scrolling`, `Camera Controls`, `Dialogs`, `Miscellaneous`, and `Sandbox Options` before the window is shown. The second dword in that table is now only bounded as one small subgroup or style flag; it is set on `Model Detail`, `Draw Distance`, `Textures`, and the first `Miscellaneous` entry and clear on the rest. This is therefore the safest current read for the shared settings-window constructor rather than a generic page-list allocator.","objdump + strings + RT3.lng page-label correlation + category-table correlation"
0x00501e50,201,shell_open_settings_window,shell,cdecl,inferred,objdump + strings,4,Lazily allocates and shows the shared SettingsWindow.win shell object at 0x006d1350. When no settings window is live it allocates a 0x78-byte object constructs it through shell_settings_window_construct publishes it to the shell runtime through 0x00538f10 and then notifies the active shell owner at 0x0062be68. Current grounded callers are the direct shell command wrapper at 0x00482b00 the fileopt settings escape branch and one larger shell UI dispatcher branch near 0x0050366a.,objdump + strings + caller xrefs
0x00501f20,270,shell_query_registry_open_command_for_http_or_rtf_target,shell,cdecl,inferred,objdump + literal inspection,3,"Queries one shell-open command string from the registry and formats it into the shared command buffer at `0x006d14d8`. Selector `0` uses the literal `http\\shell\\open` and validates the returned command against the substrings `netsc` and the quoted percent-one placeholder; selector `1` uses `rtffile\\shell\\open`, truncates at the percent-one placeholder, and appends the literal `readme.rtf` through the format `%s %s`. The helper returns `0x006d14d8` on success or `0` on failure. Current grounded callers are the early `Setup.win` dispatcher buttons at `0x00503585/0x0050359f/0x005035c7/0x005035ce`, which then forward the formatted command through import `0x005c8088` instead of re-entering the normal setup launch-mode family.","objdump + literal inspection + caller correlation"
0x00468b00,10,multiplayer_toggle_preview_dataset_service_gate,shell,cdecl,inferred,objdump + local disassembly + global-state inspection,2,Tiny helper that flips the preview-dataset frame-service gate at `0x006cd910` by XORing it with `1` and then returns `0`. Current evidence only grounds the store itself so this row stays structural for now.,objdump + local disassembly + global-state inspection
0x00468b10,58,multiplayer_preview_dataset_register_selector_callback_if_absent,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-callback registration helper over the keyed descriptor owner at `[this+0x04]`. It first probes the keyed store through `0x0053daa0(selector)` and, when no existing entry is present, inserts the caller-supplied callback pointer through `0x0053d960(selector, callback)` before returning success. Current grounded caller is the broader preview-dataset callback seeding pass `0x00473280`, which uses this helper to populate selector handlers `1..0x83`, so this is the clean local registration primitive beneath that callback-registry owner rather than a generic keyed insert.","objdump + local disassembly + registration-pass correlation + keyed-store correlation"
0x00468b50,7,multiplayer_preview_dataset_set_default_callback_root,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,Tiny setter that stores one caller-supplied callback root into `[this+0x08]`. Current grounded caller is the broader preview-dataset callback registration pass `0x00473280`, which seeds this slot with `0x0046f4a0` before populating the keyed selector table.,objdump + local disassembly + caller inspection + callback-root correlation
0x00468d00,222,multiplayer_update_semicolon_name_list,shell,cdecl,inferred,ghidra-headless,4,Adds or removes one player-name token in the semicolon-delimited moderation list rooted at `[ecx+0x905c]`. With mode `1` it appends the supplied token only when not already present writing `;` as the delimiter; with mode `0` it removes the matched token collapses the remainder left and skips an adjacent delimiter when present.,ghidra + rizin + llvm-objdump + strings
0x00468de0,14,multiplayer_session_event_forward_action1_request,shell,unknown,inferred,ghidra-headless,2,Session-event callback wrapper that always forwards request id `1` through multiplayer_set_pending_session_substate with a zero auxiliary payload. The callback clears EDX before the shared setter call and currently lands on a request id whose visible pending-substate label is not surfaced locally, so the row remains at that structural request-forwarding level.,ghidra + rizin + llvm-objdump
0x00468e00,188,multiplayer_session_event_publish_pair_chat_template,shell,unknown,inferred,ghidra-headless,3,Session-event callback that formats one two-string chat/status line through multiplayer_route_chat_line when the callback status in EDX is zero and the current live session count is not positive. A selector near `[esp+0x214]` chooses the template `%s* %s` `%s %s` or `%s > %s`; the helper length-checks both inputs against the local 0x1f4-byte buffer before formatting and returns without publishing when either string is null or too long.,ghidra + rizin + llvm-objdump + strings
0x00468ec0,144,multiplayer_session_event_publish_action2_single_name,shell,unknown,inferred,ghidra-headless,3,Session-event callback wrapper for the one-name action-2 status path. When the callback status in EDX is zero and the current session count is positive it length-checks the supplied name formats localized text id `0xb73` routes the resulting line through multiplayer_route_chat_line and then forwards request id `2` through multiplayer_set_pending_session_substate with that same name payload. The currently grounded setter does not visibly store a pending substate for id `2` so this row stays partly structural.,ghidra + rizin + llvm-objdump
0x00468f50,192,multiplayer_session_event_publish_action2_pair,shell,unknown,inferred,ghidra-headless,3,Session-event callback wrapper for the two-string action-2 status path. When the callback status in EDX is zero and the supplied name lengths fit within the local buffer it formats localized text id `0xb74` or `0xe34` depending on whether the first string is present routes the resulting line through multiplayer_route_chat_line and then forwards request id `2` through multiplayer_set_pending_session_substate with the second string as the target payload and the first string as the auxiliary payload. The currently grounded setter does not visibly store a pending substate for id `2` so this row stays partly structural.,ghidra + rizin + llvm-objdump
0x00469010,30,multiplayer_session_event_forward_action4_request,shell,unknown,inferred,ghidra-headless,3,Session-event callback wrapper that forwards request id `4` only when both supplied payload pointers are non-null. It passes the second stack argument as the action payload and a zero auxiliary argument through multiplayer_set_pending_session_substate. The currently grounded setter does not visibly store a pending substate for id `4` so this row remains structural.,ghidra + rizin + llvm-objdump
0x00469030,30,multiplayer_session_event_forward_action7_request,shell,unknown,inferred,ghidra-headless,2,Session-event callback wrapper that forwards one payload pointer through multiplayer_set_pending_session_substate with request id `7` when the callback status in EDX is nonzero. The wrapper normalizes its incoming pointer into the second stack slot before tail-calling the shared setter but the currently grounded setter does not map request id `7` to a visible pending substate so this row remains structural.,ghidra + rizin + llvm-objdump
0x00469060,3,multiplayer_session_event_noop_12byte_stub,shell,unknown,inferred,ghidra-headless,4,Three-byte no-op callback stub in the Multiplayer.win session-event registration table. It returns immediately with `ret 0xc` and does not touch any state.,ghidra + rizin + llvm-objdump
0x00469070,87,multiplayer_session_event_publish_status_value,shell,unknown,inferred,ghidra-headless,3,Session-event callback that publishes one status value into the destination text builder passed in the third stack argument. It first compares the supplied index against the live session count from `0x006d40d0`; out-of-range entries publish the fixed fallback text at `0x005c87a8`; in-range entries publish integer `100` through 0x0058cd40 when event code EDX is `0x18`; publish the string at `0x00521d40+0x08` when EDX is `0x15`; and otherwise fall back to the same fixed text token.,ghidra + rizin + llvm-objdump + strings
0x004690d0,15,multiplayer_session_event_publish_fixed_status_text,shell,unknown,inferred,ghidra-headless,3,Session-event callback that appends the fixed status text token at `0x005c87a8` into the destination text builder passed in the second stack argument. This is the smallest text-publisher sibling in the same callback family and shares the same append helper 0x0058bce0 used by 0x00469070.,ghidra + rizin + llvm-objdump
0x004690f0,106,multiplayer_session_event_seed_control_id_list,shell,unknown,inferred,ghidra-headless,3,Session-event callback that seeds a byte-list builder with the fixed control-id set `3 1 8 10 11 19 4 5` when the callback status in EDX is zero. It appends each id through 0x0058bcb0 into the destination builder passed in the first stack argument and returns immediately when the callback status is nonzero.,ghidra + rizin + llvm-objdump
0x00469160,26,multiplayer_session_event_query_session_count,shell,unknown,inferred,ghidra-headless,4,Session-event callback helper that returns the live session count from `0x006d40d0` through 0x00521670 only when the callback mode in EDX equals `1`; all other modes return zero. This is the count-query slot in the same registration table.,ghidra + rizin + llvm-objdump
0x00469180,3,multiplayer_session_event_noop_8byte_stub,shell,unknown,inferred,ghidra-headless,4,Three-byte no-op callback stub in the Multiplayer.win session-event registration table. It returns immediately with `ret 8` and does not touch any state.,ghidra + rizin + llvm-objdump
0x00469190,8,multiplayer_session_event_latch_status_code,shell,unknown,inferred,ghidra-headless,4,Small session-event callback helper that stores the incoming status code from EDX into `0x006cd974` and returns. The registration branch later clears the same global before transport teardown or retry reset.,ghidra + rizin + llvm-objdump
0x004691a0,45,multiplayer_session_event_notify_owner_and_queue_action8,shell,unknown,inferred,ghidra-headless,3,Session-event callback wrapper that first notifies the current Multiplayer.win owner through multiplayer_notify_window_owner. When the callback status in EDX is zero it then queues request id `8` through multiplayer_set_pending_session_substate with the same payload pointer; otherwise it returns after the owner notification only.,ghidra + rizin + llvm-objdump
0x004691d0,39,multiplayer_find_session_event_capacity_entry,shell,unknown,inferred,ghidra-headless,4,Scans the fixed 0x80-entry session-event capacity array for a live record owned by the supplied key pointer in EDX. Each 0x11c-byte record is live when [entry+0x104] is nonzero and a match requires [entry+0x10c] to equal the incoming key. The helper returns the matched entry pointer or null.,ghidra + rizin + llvm-objdump
0x00469200,428,multiplayer_sync_session_event_capacity_entry,shell,unknown,inferred,ghidra-headless,3,Session-event cache-field callback that creates updates or clears one cached capacity record for the supplied owner key. Mode `0` creates the first free 0x11c-byte record when none exists mode `1` updates an existing record and mode `2` clears an existing record by zeroing [entry+0x104]. The create and update paths store the owner key at [entry+0x10c] seed [entry+0x104] with 0x2328 resolve `numplayers` and `maxplayers` handles through 0x0058d6d0 and copy the current display string into [entry+0x84].,ghidra + rizin + llvm-objdump + strings
0x004693b0,80,multiplayer_session_event_cache_line_callback,shell,unknown,inferred,ghidra-headless,4,Transport-side callback that appends one incoming status line into the cached session-event line store at `0x006ae4d8`. When the callback status in EDX is nonzero and the incoming line pointer is valid it copies the string from the third stack argument into slot `0x006cd97c << 8` subject to the `0x1f4` entry cap and a small flag filter on the fourth stack argument then increments `0x006cd97c` for later iteration.,ghidra + rizin + llvm-objdump
0x00469410,56,multiplayer_init_session_event_transport_state,shell,unknown,inferred,ghidra-headless,3,Initializes the Multiplayer.win session-event transport state rooted at `0x006cd970`. The helper latches the incoming mode or state into `0x006cd978`; when that value is nonzero it zeroes the large scratch block at `0x006ae4d8` resets `0x006cd97c` and registers the cached-line callback block rooted at `0x004693b0` through multiplayer_transport_register_selector_callback before returning.,ghidra + rizin + llvm-objdump
0x00469450,97,multiplayer_teardown_session_event_transport,shell,unknown,inferred,ghidra-headless,3,Tears down the active session-event transport object at `0x006cd970`. When the latched mode at `0x006cd978` is nonzero and the multiplayer session object at `0x006cd920` exists it first switches the transport back to status route `0` through multiplayer_transport_select_status_route clears the status pump through multiplayer_transport_clear_status_pump disconnects through multiplayer_transport_disconnect shuts the object down through multiplayer_transport_shutdown and finally clears `0x006cd970`.,ghidra + rizin + llvm-objdump
0x004694c0,57,multiplayer_publish_session_event_fixed_token,shell,unknown,inferred,ghidra-headless,3,Small session-event transport helper that publishes one fixed token through the active transport object when the latched mode and multiplayer session object are both present. It first switches the transport to status route `1` through multiplayer_transport_select_status_route and then sends the fixed token at `0x005c87a8` plus flag `1` through multiplayer_transport_publish_fixed_token_message. The current grounded caller is the Multiplayer.win branch at `0x0046c3c0`.,ghidra + rizin + llvm-objdump + strings
0x00469500,27,multiplayer_flush_session_event_transport,shell,unknown,inferred,ghidra-headless,3,"Lightweight session-event transport flush wrapper. When the active transport object at `0x006cd970` exists it first forces a status flush through multiplayer_transport_force_status_flush and then tail-calls multiplayer_transport_flush_and_maybe_shutdown on that same object. Current grounded callers include the top-level Multiplayer.win service loop and neighboring preview-reset or initializer branches, which makes this the shell-side cadence bridge into the deeper transport pump.",ghidra + rizin + llvm-objdump
0x00469520,94,multiplayer_register_session_event_cache_fields,shell,unknown,inferred,ghidra-headless,3,Registers the session-event cache-field subscription set for the active Multiplayer.win object. When no multiplayer session object is present it marks `[this+0x8f18]` armed and subscribes callback `0x00469200` through multiplayer_transport_subscribe_field_callback_set with the fixed field-id list `3 1 4 8 10 11 19 5` rooted at `[this+0x10]`.,ghidra + rizin + llvm-objdump
0x00469580,65,multiplayer_begin_session_event_line_iteration,shell,unknown,inferred,ghidra-headless,4,Primes iteration over the cached session-event line store at `0x006ae4d8`. When the multiplayer session object at `0x006cd920` is absent it sets `[this+0x9874]` armed clears the cached line slots and line index at `0x006cd97c` and re-registers the line callback `0x004693b0` through multiplayer_transport_register_selector_callback before returning.,ghidra + rizin + llvm-objdump
0x004695d0,66,multiplayer_next_session_event_cached_line,shell,unknown,inferred,ghidra-headless,4,Returns the next non-empty cached session-event line from the fixed store at `0x006ae4d8`. On first use after multiplayer_begin_session_event_line_iteration it resets `0x006cd97c` and clears `[this+0x9874]`; afterwards it returns the current 0x100-byte slot pointer when the first byte is nonzero and advances `0x006cd97c` or returns null when no further cached lines remain.,ghidra + rizin + llvm-objdump
0x00469620,52,multiplayer_submit_owner_notified_session_event_text,shell,unknown,inferred,ghidra-headless,3,Submits one caller-supplied text buffer through the active session-event transport using callback multiplayer_session_event_notify_owner_and_queue_action8. The helper first sanitizes the input string into a local 0x100-byte transport record through multiplayer_transport_sanitize_identifier and then forwards that record through multiplayer_transport_submit_text_record with fixed mode arguments `0` and `1`.,ghidra + rizin + llvm-objdump
0x00469660,27,multiplayer_send_session_event_text_selector0,shell,unknown,inferred,ghidra-headless,3,Thin session-event transport wrapper that sends one caller-supplied text pointer through multiplayer_transport_send_selector_text with selector `0` when the pointer is non-null. The current grounded caller is the Multiplayer.win control dispatcher around `0x00469d30`.,ghidra + rizin + llvm-objdump
0x00469680,14,multiplayer_pump_session_event_status,shell,unknown,inferred,ghidra-headless,3,Thin session-event transport wrapper that immediately requests a status pump through multiplayer_transport_request_status_pump on the active transport object at `0x006cd970` and discards one stack argument. Current grounded callers use it after updating Multiplayer.win status text ids `0xe60` and `0xe61`.,ghidra + rizin + llvm-objdump
0x00469690,52,multiplayer_intrusive_queue_append_node_and_maintain_head_tail_count,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tiny intrusive queue append helper over the singly linked queue layout `[queue+0x00=head]`, `[queue+0x04=tail]`, and `[queue+0x08=count]`. When the caller supplies a predecessor node in the first stack argument it splices the new node after that predecessor and increments the queue count; otherwise it appends at the queue tail or seeds the head when the queue was empty. Current grounded callers include the `0x00469d30` sidecar-dispatch branch and later transport-side queue helpers at `0x00522c90` and `0x00523633`, so this is the common intrusive append primitive beneath the multiplayer preview-owner and session-event transport families rather than a one-off local list splice.","objdump + caller inspection + local disassembly + intrusive-queue-layout correlation"
0x00469700,27,multiplayer_preview_dataset_stage_selected_path,shell,thiscall,inferred,objdump + caller xrefs,3,Small Multiplayer preview-dataset helper that copies one caller-supplied selected path string into the dataset-local staging buffer at `[this+0x8f48]`. Current grounded callers feed it the active session-entry path from the live session list before later preview or launch-side dataset work.,objdump + caller xrefs
0x00469720,221,multiplayer_preview_dataset_service_frame,shell,thiscall,inferred,objdump + caller xrefs,3,"Recurring shell-frame service for the Multiplayer preview dataset rooted at `0x006cd8d8`. When the gating global at `0x006cd910` and the dataset render target at `[this+0x9884]` are live it walks the active session list under `0x006d40d0`, formats one roster or status line per entry through the template at `0x005ce1ac`, and then pushes the accumulated text through the render/update helper at `0x005519f0` with fixed presentation parameters. The current grounded caller is `shell_state_service_active_mode_frame`, which makes this a shell-owned per-frame refresh path for multiplayer preview text rather than a transport I/O loop.",objdump + caller xrefs + strings
0x00469800,144,multiplayer_preview_dataset_acquire_pooled_block_or_heap_fallback,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Preview-dataset allocation helper beneath the request and sidecar-record families. For sizes up to `0x300` it spin-locks the small pool guard at `0x006cd940`, tries to pop one cached block from the dataset-local free-list owner at `[this+0x8f3c]`, and falls back to `0x0053b070(size)` when the pool is empty; larger requests always take the heap path. The companion release branch at `0x00469890` returns owned-span pointers back into the same pool when they fall inside `[this+0x8f40 .. this+0x8f40+0x48000)`. Current grounded callers include the broader transport submitter `0x00469d30`, the named callback-descriptor builders `0x00469930` and `0x00469a50`, and later preview-dataset helpers around `0x0046a31f`, `0x0046a60c`, and `0x0046ae24`, which makes this the local pooled-block owner for the Multiplayer preview dataset rather than a generic allocator.","objdump + caller inspection + local disassembly + pooled-span correlation + preview-dataset free-list correlation"
0x00469930,176,multiplayer_preview_dataset_append_named_callback_descriptor,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Builds one fixed-size named callback descriptor and appends it to the preview-dataset intrusive list at `[this+0x8f28]`. The helper acquires one `0xa4`-byte node from the local pool at `[this+0x8f20]`, zeroes the full record, stores the caller-supplied selector id at `[node+0x14]`, stores the two callback or payload dwords at `[node+0x04/+0x08]`, copies the caller string into `[node+0x18]`, and then appends the node through the standard intrusive-list head, tail, and count layout. The current grounded owner is the fixed registration block `0x00473a60`, which repeatedly seeds selector ids `1..0xa` from fixed name and callback pairs, so this is now best read as the preview-dataset named callback-descriptor append helper rather than an anonymous list insert.","objdump + caller inspection + local disassembly + registration-block correlation + intrusive-list correlation"
0x004699e0,48,multiplayer_preview_dataset_find_named_callback_payload_by_selector,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small lookup helper over the named callback-descriptor list at `[this+0x8f28]`. It walks the intrusive list, matches the caller-supplied selector id against `[node+0x14]`, and returns the payload or callback dword at `[node+0x04]` or `0` when no match is present. Current grounded callers include the preview-dataset service lane at `0x0046b545`, so this is the paired selector lookup beneath the `0x00469930` descriptor-registration family rather than a generic keyed search.","objdump + caller inspection + local disassembly + descriptor-field correlation"
0x00469a50,160,multiplayer_preview_dataset_append_named_ui_request_record,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Builds one variable-size named UI-request record and appends it to the preview-dataset intrusive list at `[this+0x8f2c]`. The helper acquires `strlen(name)+0x21` bytes through `multiplayer_preview_dataset_acquire_pooled_block_or_heap_fallback` `0x00469800`, stores the caller-supplied request dwords at `[node+0x04/+0x08/+0x10/+0x14/+0x18]`, zeroes the transient field `[node+0x1c]`, copies the request label or text into `[node+0x20]`, and then appends the record to the dataset-local list. Current grounded callers package Multiplayer.win text and control updates such as the control-`0x69` mode publish path at `0x004ee4c0`, the selected-map and status branches around `0x0046f560..0x0046f837`, and several later preview-update branches, which keeps this bounded as the preview-dataset named UI-request append helper rather than a transport send.","objdump + caller inspection + local disassembly + UI-request-list correlation + Multiplayer.win control-update correlation"
0x00469d30,1268,multiplayer_preview_dataset_submit_transport_request,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,4,"Broad preview-owner request submitter used by the Multiplayer preview dataset at `0x006cd8d8` and several auxiliary shell-side async branches. The helper accepts an opcode or request id on the first stack slot, a 16-bit selector on the second, payload pointer and length on the next pair, flag dword on the fifth slot, and an optional auxiliary pointer on the sixth. On the selector-`1` fast path, when dataset state `[this+0x985c] == 1` and the live session gate `0x00521670` reports no active sessions, it bypasses the heavier transport packaging and forwards the supplied text directly through `multiplayer_send_session_event_text_selector0` `0x00469660`. Otherwise it spin-locks the global submit guard `0x006cd960`, optionally copies payload bytes into a local `0x1018` scratch block when flag bit `0x10` is set, optionally allocates one sidecar request object through `multiplayer_preview_dataset_acquire_pooled_block_or_heap_fallback` `0x00469800` when flag bit `0x04` is set, tags that sidecar with selector, size, flags, and payload bytes, and enqueues it through the callback queue rooted at `0x00521d40()->[+0x64]->[+0x04]` using `multiplayer_intrusive_queue_append_node_and_maintain_head_tail_count` `0x00469690`. The helper then updates the global payload counters `0x006cd930/0x006cd934` and dispatches either a direct small-payload request or the slower packed path through `0x00553000/0x00552ff0` into `0x00521dc0`, setting the extra high dispatch bit `0x80000000` on the packed branch. Current grounded callers include the `.gmt` save-side branch in `shell_map_file_world_bundle_coordinator` `0x00445de0`, `BuildingDetail.win` auxiliary sync at `0x004b9e10`, `Start New Company...` side-owner submission at `0x0047d120`, `CompanyDetail.win` async multiplayer actions, the multiplayer preview control publisher `0x004ee4c0`, and many preview-dataset-side update branches between `0x0046b431` and `0x00473bc9`, which makes this the shared preview-owner transport submitter rather than a window-local control helper.","objdump + caller xrefs + local disassembly + sidecar-dispatch correlation + transport-submit correlation + multiplayer-preview-owner correlation"
0x0046a030,224,multiplayer_preview_dataset_stage_profile_text_selected_path_and_sync_session_state,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Stages the local profile text and selected-path string into the preview dataset and then synchronizes that state into the session-side helper path when no live multiplayer session object is present at `0x006d40dc`. The helper clears or resolves the small arming latch at `[this+0x8f18]`, copies the caller profile text into `[this+0x8e10]`, copies the caller path into `[this+0x8f48]`, stores one boolean derived from the optional third pointer into global `0x006cd928`, and then forwards the staged strings plus the optional pointer into the lower session helper `0x005238e0`. When the session-event transport rooted at `0x006cd970` is live it also forces the paired status-pump and flush follow-ons through `0x0058d9d0` and `0x0058e1f0`. Current grounded caller is the action-`2` branch inside `multiplayer_dispatch_requested_action` `0x004ef960`, where it seeds the active preview dataset from the staged Multiplayer.win text buffers before the preview-mode refresh path.","objdump + caller inspection + local disassembly + staged-buffer correlation + action-2 correlation"
0x0046a110,131,multiplayer_preview_dataset_match_named_field_slot_copy_profile_text_and_probe_selection,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Action-`3` helper above the preview-dataset field-slot table. The function scans all `0x80` `0x11c`-byte rows rooted at `[this+0x10]`, comparing the caller-supplied key string against the per-row name field at `row+0x80`; on a match it copies the row's primary text field back into dataset buffer `[this+0x8e10]`. It then seeds dataset mode `[this+0x0c] = 1`, forwards the caller's strings into the lower session helper `0x00523af0`, and upgrades that mode to `2` when the helper reports a negative result. Current grounded caller is the action-`3` branch inside `multiplayer_dispatch_requested_action` `0x004ef960`, which uses this helper immediately after promoting the staged text buffers into the active preview dataset.","objdump + caller inspection + local disassembly + field-slot correlation + action-3 correlation"
0x0046a1a0,85,multiplayer_preview_dataset_ensure_field_slot_table_initialized,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Lazy initializer for the fixed `0x80 * 0x11c` field-slot table rooted at `[this+0x10]` inside the preview dataset. On first use it zeroes the full `0x2380`-byte table, clears `[this+0x8f10]`, marks `[this+0x8f18] = 1`, and then takes one of two follow-ons: when dataset state `[this+0x985c]` is zero it primes the session-side helper through `0x005223d0`; otherwise it re-enters `multiplayer_register_session_event_cache_fields` `0x00469520`. The helper always returns the base pointer `[this+0x10]`. Current grounded callers include the staged-text commit and roster-refresh paths at `0x004ee2b2` and `0x004ee765`, which then index `0x11c`-byte rows and copy the embedded strings at row offset `0x84`, so this is the clearest current owner for the preview-dataset field-slot table rather than another generic reset stub.","objdump + caller inspection + local disassembly + field-slot-table correlation + cache-field-registration correlation"
0x0046b6d0,163,multiplayer_preview_dataset_touch_current_session_year_bucket_and_return_staged_tuple,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Session-side helper over the staged tuple at `[this+0x9048]`. When the live world root `0x006cec78`, its companion pointer `[world+0x19]`, and the caller's stack flag are all present, the helper derives one key from the staged tuple through `0x0051d3c0`, resolves the current live session record through `0x005216c0/0x00521d60`, ensures one keyed bucket exists in that session record's hash owner at `[session+0x2580]` through `0x0053dae0` or the local create path `0x0046ab10`, increments that bucket, and then republishes the current-session selector through `0x005216d0`. On any failed precondition it skips the bucket touch and simply returns the staged tuple pointer `[this+0x9048]` or `0`. Current grounded callers include the broad selector-handler family registered by `0x00473280` and the launch-side branches around `0x0046f672/0x0046f7a0`, so this is the safest current structural read beneath the preview-dataset launch/service layer.","objdump + local disassembly + caller inspection + staged-tuple correlation + session-bucket correlation"
0x0046b910,219,multiplayer_preview_dataset_prune_session_buckets_below_current_year_key,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Threshold-prune helper over the keyed session bucket owner at `[arg+0x2580]`. It derives one current key either from the caller's optional second argument or from the active world tuple at `[0x006cec78+0x0d]` through `0x0051d3c0`, then repeatedly asks `0x0053db20` with comparator `0x00468ac0` for the next smaller keyed bucket, resolves that bucket through `0x0053d9e0`, drains every queued node in it, and frees those nodes through `multiplayer_preview_dataset_release_pooled_block_or_heap_span` `0x00469890`. The helper uses scratch global `0x006cd968` as the current selected key during the sweep. Current grounded callers are the broader current-session service body `0x0046b9f0` and the preview handlers around `0x0046f6b9/0x0046f708`, so this is the clearest current bucket-prune owner beneath the dataset launch/session maintenance family rather than a generic hash-table walk.","objdump + local disassembly + caller inspection + keyed-bucket-prune correlation"
0x0046b9f0,592,multiplayer_preview_dataset_service_current_session_buckets_and_publish_selector0x67,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Broader current-session service slice beneath the multiplayer preview dataset. It optionally timestamps its own service cost when `0x006cd900 == 1`, zeros the total-node counter `[this+0x9890]`, resolves the live session owner through `0x00521d40`, copies and normalizes the current world tuple into `[this+0x9048/+0x904c]` through `0x0051d5a0`, prunes older keyed buckets through `0x0046b910`, refreshes neighboring preview state through `0x0046a590` and `0x00473bf0`, and then looks up the current keyed bucket inside `[session+0x2580]`. For each queued node in that current bucket it increments `[this+0x9890]`, counts the subset not marked by byte `+0x09 == 0x67` and flag bit `+0x0b & 0x04`, routes the entry through `0x00522050` and `0x0046ac00`, and frees the node through `0x00469890`. After the loop it accumulates the unmarked subset into `[this+0x987c]`, restores the shared shell status/tool stack through `0x004423a0/0x004423d0`, and when the live session-event transport is active it packages one selector-`0x67` request through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` using the staged key at `[this+0x8f38]`. Current grounded callers include the simulation-side wrapper at `0x0040aa7a` and the broader launch/service family around `0x0046b780`, so this is the safest current owner for current-session bucket service rather than a generic preview refresh.","objdump + local disassembly + caller inspection + keyed-bucket correlation + selector-0x67 publish correlation"
0x0046bc40,563,multiplayer_preview_dataset_release_owned_lists_transients_and_session_side_state,shell,thiscall,inferred,objdump + local disassembly + caller inspection,4,"Primary release-side teardown body for the Multiplayer preview dataset rooted at `0x006cd8d8`. It first runs the narrower internal cleanup at `0x0046d240`, releases the dataset render target `[this+0x9884]` through `0x0053c000`, conditionally notifies the live session object through `0x005217b0/0x005216a0`, and re-enters the local transport-side sweep `0x0046b910` when the current session list is still live. After that it tears down the session-event transport-side helper path through `multiplayer_teardown_session_event_transport` `0x00469450` and `0x00523200`, walks and frees every node in the variable-size request list `[this+0x8f2c]`, releases the keyed callback owner `[this+0x8f20]`, request buffer `[this+0x8f24]`, semicolon-name owner `[this+0x9050]`, pooled free-list owner `[this+0x8f3c]`, backing pool span `[this+0x8f40]`, fixed descriptor list `[this+0x8f28]`, auxiliary keyed owner `[this+0x04]`, and finally the global helper at `0x006cd8e0`. It also clears the core dataset latches `[this+0x00]`, `[this+0x0c]`, `[this+0x8f18]`, `[this+0x8f30]`, and `[this+0x9054]`. Current grounded callers are the broader reset or constructor path `0x0046be80` and the full shutdown wrapper `0x0046c230`, which makes this the concrete dataset release body rather than a transport-only destructor.","objdump + local disassembly + caller inspection + teardown-correlation + owned-list-release correlation"
0x0046be80,938,multiplayer_preview_dataset_construct_reset_globals_and_seed_callback_owners,shell,thiscall,inferred,objdump + local disassembly + caller inspection,4,"Full constructor or reset owner for the Multiplayer preview dataset at `0x006cd8d8`. It begins by re-entering `multiplayer_preview_dataset_release_owned_lists_transients_and_session_side_state` `0x0046bc40`, then clears the surrounding launcher and preview globals (`0x006cd91c`, `0x006cd924..0x006cd92c`, `0x006cd8e4..0x006cd904`, `0x006ae4cc..0x006ae4d4`, and related `0x005f2b38/40` latches), allocates or reuses the small global helper at `0x00d973b4`, installs it into `[this+0x00]`, and requires the helper vtable state at `0x00557bc0 == 1` before proceeding. It then ensures the live session object at `0x006d40d0`, publishes one local version scalar through `0x00521910`, allocates the auxiliary keyed owner `[this+0x04]`, zeroes the fixed field-slot table `[this+0x10]`, allocates the variable request buffer `[this+0x8f24]`, the keyed callback owner `[this+0x8f20]`, the fixed descriptor list owner `[this+0x8f28]`, the UI-request list owner `[this+0x8f2c]`, the pooled backing span `[this+0x8f40]`, the pooled free-list owner `[this+0x8f3c]`, the semicolon-name helper `[this+0x9050]`, and the render target `[this+0x9884]`. Before returning it clears staged strings `[this+0x8f48]` and `[this+0x905c]`, seeds marker words `[this+0x9860]` and `[this+0x9864..+0x9870]` to `-1`, runs the callback seeding pass `0x00473280`, registers the fixed named descriptor block `0x00473a60`, and when the caller asks for the live branch it re-enters `multiplayer_register_session_event_callbacks` `0x0046a900`, storing the resulting mode in `[this+0x985c]`. Current grounded callers are the action-`2` and action-`3` reset branches inside `multiplayer_dispatch_requested_action` `0x004ef960`, so this is now the real preview-dataset constructor/reset owner above those action handlers rather than a loose helper cluster.","objdump + local disassembly + caller inspection + reset-global correlation + callback-owner correlation + action-dispatch correlation"
0x0046b780,368,multiplayer_preview_dataset_service_launch_state_and_warn_out_of_sync,shell,thiscall,inferred,objdump + caller xrefs + strings + callsite inspection,4,"Services one higher-level launch or preview transition slice on the Multiplayer preview dataset rooted at `0x006cd8d8`. At entry it checks global `0x006cd91c` and, when armed, formats localized id `3879` `Out of Sync` through `0x5193f0` and pushes it into the shell status presenter at `0x5386e0` with timeout `0xbb8`; this is the current grounded owner of that string and it is not part of the station-detail overlay. The same helper then gates on preview and launcher globals `0x006cd8dc`, `0x006ce9b8`, `0x006ce9c4`, and shell-state latches under `0x006cec78`, drives one modal shell branch through `0x482150`, timestamps `[this+0x9058]`, chains the internal dataset-side helpers at `0x46af70`, `0x46b0c0`, `0x46ad80`, `0x46aeb0`, `0x469b00`, and `0x46a590`, and now has a tighter launch-side tail: when `0x006ce9c4` is armed the inner branch at `0x0046b8bc` allocates or clears one active-mode object through `0x53b070/0x4336d0`, publishes it into `0x006cec78`, runs `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890` with stack args `(0, 0)`, then clears `[0x006cec74+0x6c]` and only after that re-enters `shell_map_file_entry_coordinator` `0x00445ac0` through staged buffer `0x006ce630` plus flag dword `0x006ce9c0`. Current grounded callers include the multiplayer-side service loop around `0x004373c5` and `0x00437435`, plus later shell-side branches at `0x00483638`, `0x00483d79`, and `0x00484054`.","objdump + caller xrefs + strings + callsite inspection + multiplayer-preview correlation + launch-tail disassembly"
0x0046a6c0,307,multiplayer_session_event_publish_registration_field,shell,unknown,inferred,ghidra-headless + objdump,3,"Switch-driven session-event callback that publishes one Multiplayer.win registration or status field into the destination builder passed on the stack. Depending on selector `EDX` it now clearly includes the local executable version string through `runtime_query_cached_local_exe_version_string` `0x00482d80` on runtime root `0x006cec74`, the profile text at `0x006cd8d8+0x8e10`, the constant `0x2328`, the live session count from `0x006d40d0`, the field at `[0x006d1270+0x3b6]`, the active profile string at `[0x006cec7c+0x44]`, or fixed strings such as `Initializing...`, `openstaging`, and `closedplaying`; unsupported selectors fall back to the fixed token at `0x005c87a8`.","ghidra + rizin + llvm-objdump + strings + registration-field correlation"
0x0046a830,194,multiplayer_session_event_retry_with_random_player_name,shell,unknown,inferred,ghidra-headless,3,Registration-side callback that increments the retry counter at `0x006cd984` and on early retries formats a randomized `RT3Player%d` name into `0x006ae0c0` sanitizes it into a local notification object notifies the current Multiplayer.win owner and forwards that object through multiplayer_transport_set_local_name. On the first retry it also routes request id `5` or `6` through multiplayer_set_pending_session_substate depending on the incoming status flag; after 25 retries it resets `0x006cd984` and `0x006cd974` and calls multiplayer_transport_reset_and_maybe_shutdown instead.,ghidra + rizin + llvm-objdump + strings
0x0046a900,522,multiplayer_register_session_event_callbacks,shell,thiscall,inferred,ghidra-headless,4,Builds and registers the Multiplayer.win session-event callback table rooted at the local block on `[esp+0x28]`. The function seeds slots with multiplayer_session_event_forward_action1_request multiplayer_session_event_publish_pair_chat_template multiplayer_session_event_publish_action2_single_name multiplayer_session_event_publish_action2_pair multiplayer_session_event_forward_action4_request multiplayer_session_event_forward_action7_request multiplayer_session_event_noop_12byte_stub multiplayer_session_event_publish_registration_field multiplayer_session_event_publish_status_value multiplayer_session_event_publish_fixed_status_text multiplayer_session_event_seed_control_id_list multiplayer_session_event_query_session_count multiplayer_session_event_noop_8byte_stub multiplayer_session_event_latch_status_code multiplayer_session_event_notify_owner_and_queue_action8 multiplayer_init_session_event_transport_state and multiplayer_session_event_retry_with_random_player_name. It allocates the transport callback object under `0x006cd970` stages the session name into the local descriptor block and then finishes registration through multiplayer_transport_register_callback_table which in turn routes through multiplayer_transport_attach_callback_table_descriptor multiplayer_transport_enqueue_descriptor_block_record and multiplayer_transport_dispatch_callback_table_binding.,ghidra + rizin + llvm-objdump + strings
0x0046c230,80,multiplayer_shutdown_preview_dataset_session_object_and_global_helper,shell,thiscall,inferred,objdump + local disassembly + caller xrefs,4,"Final multiplayer-side shutdown wrapper above the preview dataset release body. It first re-enters `multiplayer_preview_dataset_release_owned_lists_transients_and_session_side_state` `0x0046bc40`, then releases the live session object at `0x006d40d0` through `0x00521590`, clears that global, releases the small shared helper at `0x00d973b4` through `0x00557b70`, and clears that global too. Current grounded callers include the broader shell shutdown and mode-transition branches at `0x004364e4`, `0x0048364d`, `0x00483d8e`, `0x00484073`, `0x004843dc`, `0x00484556`, `0x004dcc96`, `0x004edc50`, `0x004ef2b1`, `0x004ef31b`, `0x004ef823`, and `0x004f0a62`, which makes this the full multiplayer preview/session shutdown wrapper rather than just another dataset reset.","objdump + local disassembly + caller xrefs + global-helper shutdown correlation"
0x0046c360,32,multiplayer_route_chat_line,shell,cdecl,inferred,ghidra-headless,3,Routes one multiplayer chat line through the active transport object at `0x006cec78` when present or falls back to the local Multiplayer.win chat publisher otherwise. The transport path forwards the supplied text into 0x4554e0 with fixed mode arguments `5 1 0`; the local fallback tail-calls multiplayer_publish_wrapped_chat_message.,ghidra + rizin + llvm-objdump
0x0046c390,42,multiplayer_preview_dataset_publish_control_0x109_from_payload_dword,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Small selector-handler callback beneath the preview-dataset registration table. When the live shell profile at `0x006cec7c` exists, the helper packages the payload dword from `[msg+0x08]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` using fixed request kind `1`, fixed control id `0x0109`, and selector `2`. This is therefore the direct control-`0x109` publish leaf rather than another generic transport wrapper.","objdump + local disassembly + caller inspection + selector-handler correlation + control-0x109 correlation"
0x0046c3c0,96,multiplayer_preview_dataset_arm_launch_latches_publish_fixed_session_token_and_optionally_clear_profile_ready_bit,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback in the preview-dataset table that arms several launch-side latches at once. The helper calls `0x004c8670`, sets globals `0x006cd90c = 1` and `0x006cd8e8 = 1`, publishes the fixed session-event token through `multiplayer_publish_session_event_fixed_token` `0x004694c0`, clears `0x006cd96c`, and when preview-valid latch `0x006ce9bc` is nonzero it also clears profile byte `[0x006cec7c+0x97]` and sets global `0x006ce9c4 = 1`. This is the clearest current owner for the fixed-token plus launch-latch arm path beneath the selector-handler family.","objdump + local disassembly + caller inspection + launch-latch correlation + fixed-token correlation"
0x0046c420,827,multiplayer_apply_session_payload_slab_into_shell_root_and_refresh_dependents,shell,cdecl,inferred,objdump + local disassembly + caller inspection,4,"Large selector-handler callback that copies one incoming payload slab from `[msg+0x08]` into the live shell root at `0x006cec74`. The body performs a long fixed-offset copy into shell fields spanning startup, selection, and session-related lanes, then forces one shell-state refresh through `0x00484910(0)` and, when companion root `0x006ada8c` exists, re-enters `0x00464170` to refresh dependent world-side state. This is therefore the clearest current session-payload apply owner beneath the multiplayer callback table rather than a smaller field toggle.","objdump + local disassembly + caller inspection + slab-copy correlation + shell-refresh correlation"
0x0046c760,3,multiplayer_selector_handler_return_true_stub,shell,cdecl,inferred,objdump + local disassembly,1,"Literal selector-handler stub that returns `1` immediately with no side effects. It currently appears in the preview-dataset callback table seeded by `0x00473280`.","objdump + local disassembly + selector-handler correlation"
0x0046c770,65,multiplayer_preview_dataset_publish_session_field_0x48_with_selector7,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that resolves the live session object at `0x006d40d0`, reads field `[session+0x48]`, and packages that value together with payload pointer `[msg+0x08]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` using selector `7` and request kind `8`. This is the current grounded publish leaf for session field `0x48` beneath the callback table.","objdump + local disassembly + caller inspection + selector-handler correlation + session-field correlation"
0x0046c7c0,71,multiplayer_session_entry_update_elapsed_pair_and_republish,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that resolves one live session entry by key `[msg+0x04]`, rewrites the paired elapsed or timestamp dwords at `[entry+0x54/+0x58]` from the incoming payload, and then republishes the session list through `0x005216d0`. This is the clearest current owner for the per-entry elapsed-pair update beneath the callback table.","objdump + local disassembly + caller inspection + session-entry correlation + elapsed-pair correlation"
0x0046c810,33,multiplayer_forward_payload_dword_into_shell_owner_refresh_pair,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Small selector-handler callback that forwards the payload dword at `[msg+0x08]` into shell-owner helpers `0x0043a070` and `0x0043ca20` when shell root `0x0062be68` is live. Current evidence only grounds the forwarding behavior, so the label stays structural.","objdump + local disassembly + caller inspection + shell-owner correlation"
0x0046c840,53,multiplayer_session_entry_set_flag_0x08_and_republish,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that resolves one live session entry by key `[msg+0x04]`, sets bit `0x08` in entry flags `[entry+0x5c]`, and republishes the session list through `0x005216d0`. This is the current grounded owner for the flag-`0x08` session-entry latch beneath the callback table.","objdump + local disassembly + caller inspection + session-entry-flag correlation"
0x0046c870,71,multiplayer_session_entry_toggle_flag_0x01_from_payload_byte_and_republish,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that resolves one live session entry by key `[msg+0x04]`, reads the first byte of payload `[msg+0x08]`, sets or clears bit `0x01` in `[entry+0x5c]` accordingly, and republishes the session list through `0x005216d0`. This is the current grounded owner for the flag-`0x01` entry-toggle path beneath the callback table.","objdump + local disassembly + caller inspection + session-entry-flag correlation"
0x0046c8c0,201,multiplayer_apply_one_or_many_embedded_session_field_updates_and_republish,shell,cdecl,inferred,objdump + local disassembly + caller inspection,4,"Broader selector-handler callback over the live session-entry table. Guarded by globals `0x006cd8ec` and `0x006cd918`, the helper either treats payload `[msg+0x08]` as one single embedded field-update record or, when the first payload byte is `0xff`, as a small count-prefixed table of such records. It applies each embedded record through local updater `0x00468c10` and then republishes the session list through `0x005216d0`. This is the clearest current owner for batched embedded session-field updates beneath the selector-handler family.","objdump + local disassembly + caller inspection + embedded-record correlation + session-entry correlation"
0x0046c990,63,multiplayer_decrement_session_field_0x74_and_publish_selector0x0f,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that resolves the live session object at `0x006d40d0`, decrements field `[session+0x74]`, and packages the decremented value together with payload `[msg+0x08]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` using selector `0x0f` and request kind `4`. This is the current grounded decrement-and-publish owner for that session-side countdown lane.","objdump + local disassembly + caller inspection + session-field correlation + selector-0x0f correlation"
0x0046c9d0,7,multiplayer_publish_payload_dword0_through_0x518c70,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler leaf that loads dword `[msg+0x08]` and forwards it directly into `0x00518c70`. Current evidence only grounds the forwarding edge, so the label stays structural.","objdump + local disassembly + selector-handler correlation"
0x0046c9e0,3,multiplayer_selector_handler_return_true_stub_2,shell,cdecl,inferred,objdump + local disassembly,1,"Second literal selector-handler stub that returns `1` immediately with no side effects.","objdump + local disassembly + selector-handler correlation"
0x0046c9f0,18,multiplayer_forward_payload_ptr_into_0x50c150_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x0050c150` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046ca10,18,multiplayer_forward_payload_ptr_into_0x50c1f0_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x0050c1f0` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046ca30,18,multiplayer_forward_payload_ptr_into_0x4c66f0_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004c66f0` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046ca50,18,multiplayer_forward_payload_ptr_into_0x4c6760_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004c6760` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046ca70,18,multiplayer_forward_payload_ptr_into_0x4c67d0_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004c67d0` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046ca90,18,multiplayer_forward_payload_ptr_into_0x4c6840_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004c6840` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cab0,18,multiplayer_forward_payload_ptr_into_0x4c68a0_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004c68a0` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cad0,18,multiplayer_forward_payload_ptr_into_0x4c6910_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004c6910` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046caf0,18,multiplayer_forward_payload_ptr_into_0x4c6990_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004c6990` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cb10,18,multiplayer_forward_payload_ptr_into_0x4c6a00_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004c6a00` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cb30,18,multiplayer_forward_payload_ptr_into_0x4b8320_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004b8320` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cb50,18,multiplayer_forward_payload_ptr_into_0x4b8380_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004b8380` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cb70,18,multiplayer_forward_payload_ptr_into_0x4b83e0_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x004b83e0` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cb90,18,multiplayer_forward_payload_ptr_into_0x513050_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x00513050` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cbb0,18,multiplayer_forward_payload_ptr_into_0x511490_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x00511490` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cbd0,18,multiplayer_forward_payload_ptr_into_0x514620_when_length_positive,shell,cdecl,inferred,objdump + local disassembly,2,"Tiny selector-handler wrapper that forwards payload pointer `[msg+0x08]` into `0x00514620` only when payload length `[msg+0x0c]` is positive.","objdump + local disassembly + selector-handler correlation"
0x0046cbf0,101,multiplayer_hash_12byte_payload_queue_selector0x48_request_and_record_match_key,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that copies a 12-byte payload from `[msg+0x08]`, hashes it through `0x0053d870`, inserts the result into local store `0x00468ca0`, and then submits the same payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x48`. This is the clearest current owner for the 12-byte selector-`0x48` hashed request path beneath the callback table.","objdump + local disassembly + caller inspection + selector-0x48 correlation + hashed-payload correlation"
0x0046cc60,97,multiplayer_hash_10byte_payload_queue_selector0x4c_request_and_record_match_key,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback parallel to `0x0046cbf0`. It copies a 10-byte payload from `[msg+0x08]`, hashes it through `0x0053d870`, inserts the result into local store `0x00468ca0`, and submits the payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x4c`. This is the current grounded owner for the 10-byte selector-`0x4c` hashed request path.","objdump + local disassembly + caller inspection + selector-0x4c correlation + hashed-payload correlation"
0x0046ccd0,3,multiplayer_selector_handler_return_true_stub_3,shell,cdecl,inferred,objdump + local disassembly,1,"Third literal selector-handler stub that returns `1` immediately with no side effects.","objdump + local disassembly + selector-handler correlation"
0x0046cce0,46,multiplayer_reset_world_runtime_small_branch_set_launch_warning_latch_and_snapshot_tick,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that, when live world root `0x006cec78` exists, re-enters `0x00434680(0,0,0)`, sets global `0x006cd91c = 1`, and snapshots the current tick from `0x0051d890` into globals `0x006ce990` and `0x006cd8e4`. This is the current grounded owner for one small launch-warning latch and timestamp path beneath the callback table.","objdump + local disassembly + caller inspection + launch-latch correlation + tick-snapshot correlation"
0x0046cd10,28,multiplayer_store_payload_dword0_into_pending_action_value_and_set_state3,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Small selector-handler callback that stores payload dword `[msg+0x08]` into global `0x006d1284` and sets pending state `0x006d1280 = 3`. Current evidence grounds this as one direct pending-action seed beneath the callback table.","objdump + local disassembly + caller inspection + pending-state correlation"
0x0046cd30,218,multiplayer_store_current_session_string_and_scalars_and_publish_selector0x54,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that resolves the current live session entry, copies a NUL string from payload `[msg+0x08]` into entry field `[+0x258c]`, stores one current world-derived scalar into `[+0x268c]`, stores constant `0x006226d0` into `[+0x2690]`, builds one local `0x2c`-byte record, and submits that record through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x54`. This is the current grounded owner for the selector-`0x54` session-string publish path.","objdump + local disassembly + caller inspection + session-entry correlation + selector-0x54 correlation"
0x0046ce10,117,multiplayer_apply_string_and_three_scalars_into_current_session_entry_and_optionally_set_ready_flag,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that copies one payload string plus three following dwords into the current live session entry fields `[+0x258c/+0x268c/+0x2690/+0x2694]`, optionally sets bit `0x01` in entry flags `[+0x5c]`, and republishes the session list through `0x005216d0`. This is the current grounded current-session update companion to the selector-`0x54` submitter at `0x0046cd30`.","objdump + local disassembly + caller inspection + session-entry correlation + current-session correlation"
0x0046ce90,119,multiplayer_advance_pending_action_state_machine_from_payload_byte,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that advances pending-action globals `0x006d127c`, `0x006d1280`, and `0x006d128c` based on the first payload byte at `[msg+0x08]`. The grounded branches switch `0x006d1280` among values `8`, `0xd`, and `9`, which makes this a real pending-state owner beneath the callback table rather than another passive notifier.","objdump + local disassembly + caller inspection + pending-state correlation + state-machine correlation"
0x0046cf10,49,multiplayer_session_entry_set_flag_0x04,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that resolves one live session entry by key `[msg+0x04]` and sets bit `0x04` in entry flags `[entry+0x5c]`. This is the current grounded owner for the flag-`0x04` session-entry latch beneath the callback table.","objdump + local disassembly + caller inspection + session-entry-flag correlation"
0x0046cf40,44,multiplayer_copy_payload_bytes_into_world_late_setup_preview_payload_block_0x66be,shell,cdecl,inferred,objdump + local disassembly + caller inspection + save-load correlation,3,"Selector-handler callback that bulk-copies payload bytes from `[msg+0x08]` with count `[msg+0x0c]` into live world root `0x006cec78+0x66be`. The destination block is tighter now than a generic runtime blob: the same `[world+0x66be]` band is serialized and restored under chunk ids `0x2ee0/0x2ee1` by `world_runtime_serialize_smp_bundle` `0x00446240` and `world_load_saved_runtime_state_bundle` `0x00446d40`, normalized after restore through `shell_setup_payload_seed_unique_row_category_bytes_and_marker_slots` `0x0047bc80`, and exported as the live setup-preview payload record by `shell_export_live_setup_preview_payload_record_and_normalize_pixel_block_0x100x0x100` `0x00442ba0`. So the strongest current read is a selector-handler that mirrors one remote late setup-preview or status payload block into the live world rather than a generic memcpy into anonymous runtime state.","objdump + local disassembly + caller inspection + save-load correlation + setup-preview-payload correlation"
0x0046cf70,56,multiplayer_clear_flag_0x01_on_all_live_session_entries,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that walks the live session list from `0x00521680`, clears bit `0x01` in each entry flags word `[entry+0x5c]`, and then republishes the full list through `0x005216a0`. This is the current grounded global clear path for the entry flag toggled by `0x0046c870` and `0x0046ce10`.","objdump + local disassembly + caller inspection + session-entry-flag correlation"
0x0046cfa0,3,multiplayer_selector_handler_return_true_stub_4,shell,cdecl,inferred,objdump + local disassembly,1,"Fourth literal selector-handler stub that returns `1` immediately with no side effects.","objdump + local disassembly + selector-handler correlation"
0x0046cfb0,37,multiplayer_toggle_selector0x67_batch_build_guard_and_call_0x444dd0,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Small selector-handler callback that sets global guard `0x006ce9b8 = 1`, calls `0x00444dd0` with payload fields `[msg+0x08]+8` and `[msg+0x08]+4`, and then clears that same guard. Current evidence only grounds the guard and dispatch shape, so the label stays structural.","objdump + local disassembly + caller inspection + guard-toggle correlation"
0x0046cfe0,163,multiplayer_allocate_transfer_progress_slot_copy_0x5c_record_and_optionally_format_label,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback over the fixed ten-slot transfer-progress table rooted at `0x006ce2e8` with `0x5c`-byte records. It scans for the first free slot, copies one full `0x5c` record from payload `[msg+0x08]` into that slot, and when payload dword `[+0x4c]` is nonzero it formats one auxiliary string through `0x004839e0` and `0x00518de0`, storing the resulting pointer in the slot side field. This is the current grounded allocate-and-seed owner for the local transfer-progress table.","objdump + local disassembly + caller inspection + transfer-progress-table correlation"
0x0046d090,318,multiplayer_append_transfer_progress_payload_update_and_publish_percent_text,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback over the same ten-slot transfer-progress table. When the incoming count word is nonzero it finds the matching `0x5c` slot record in `0x006ce2e8`, appends the payload body through `0x005a276f`, updates slot counters near `[slot+0x54]`, and, when shell status owner `0x006d401c` is live, computes one percentage string through localized id `0x10f6` and publishes it through `0x005387a0`. This is the current grounded progress-update owner for the local transfer table.","objdump + local disassembly + caller inspection + transfer-progress-table correlation + percent-text correlation"
0x0046d1d0,97,multiplayer_clear_transfer_progress_slot_and_release_optional_label,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler callback that finds the matching transfer-progress slot in the fixed ten-slot table rooted at `0x006ce290/0x006ce2e8`, frees the optional per-slot label string when present, and then zeroes the full `0x17`-dword slot record. This is the current grounded clear path for the local transfer-progress table.","objdump + local disassembly + caller inspection + transfer-progress-table correlation"
0x0046d230,10,multiplayer_set_global_transfer_completion_latch,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny selector-handler callback that sets global latch `0x006ce9c8 = 1` and returns. Current evidence only grounds the latch store itself.","objdump + local disassembly + caller inspection + latch-store correlation"
0x0046d240,29,multiplayer_release_selector0x71_batch_staging_blob,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Small cleanup helper that releases the optional staging blob at `0x006ce994` through `0x005a1740` and clears that global. Current local evidence ties it to the same selector-`0x71` batch-record family rooted at `0x006cd990/0x006ce9a0`, so this is the safest current structural read.","objdump + local disassembly + caller inspection + selector-0x71-batch correlation"
0x0046d260,72,multiplayer_append_selector0x71_accumulated_record,shell,fastcall,inferred,objdump + local disassembly + caller inspection,3,"Appends one fixed-width accumulated record to the selector-`0x71` staging band rooted at `0x006cd990`, bounded by count `0x006ce9a0`. The helper rejects new records once the count reaches `0x80`; otherwise it writes a 16-bit leading key from `ECX`, then four caller-supplied dwords into the `0x12`-byte record body, and increments the live record count. This is the direct local append primitive later packaged by `multiplayer_preview_dataset_publish_accumulated_selector0x71_record_batch` `0x00473bf0`.","objdump + local disassembly + caller inspection + selector-0x71-batch correlation + fixed-record correlation"
0x0046d2b0,70,multiplayer_compare_input_scalar_against_rounded_session_build_threshold,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Small predicate that consults the multiplayer preview dataset at `0x006cd8d8`, queries one session-build-derived threshold through `0x0046a4b0`, rounds the caller float argument through the same `+0.0001 * 100 -> round` pattern, and returns `1` when the caller scalar does not exceed that rounded threshold or when no dataset is live. Current evidence grounds the comparison shape but not the exact gameplay meaning, so the label stays structural.","objdump + local disassembly + caller inspection + rounded-threshold correlation"
0x0046d780,111,multiplayer_apply_train_record_fields_into_live_train_entry_by_id,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Applies one small payload record into the live train collection `0x006cfcbc` when the leading id dword resolves and the target train exposes a valid metrics owner through `0x004a77b0`. The helper copies payload dword `[+0x08]` into owner field `[+0x35a]`, forwards payload pair `[+0x0c/+0x10]` into `0x0041c700`, triggers one local refresh through `0x0041ce80(-1,0,0,0)`, and stores payload dword `[+0x04]` into train field `[+0xcc]`. Current local caller is the selector callback wrapper at `0x00472dc0`, so this is the clearest current train-apply leaf beneath that branch.","objdump + local disassembly + caller inspection + live-train-collection correlation + train-apply correlation"
0x0046d980,89,multiplayer_find_collection_0x6ceb9c_entry_index_by_name_string,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Scans indexed collection `0x006ceb9c` and returns the first entry index whose inline string at `[entry+0x08]` matches the caller string through `0x005a57cf`; when no entry matches it returns `0xff`. Current grounded caller is the first fixed named-descriptor callback family beneath `0x0046f4a0`, where the helper supplies one small collection index from a staged name string.","objdump + local disassembly + caller inspection + indexed-collection correlation + string-match correlation"
0x0046d9e0,135,multiplayer_find_collection_0x6ceb9c_entry_index_matching_live_session_string,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Resolves one live session object from `0x006d40d0` through `0x00521d60`, scans indexed collection `0x006ceb9c` for the first entry whose inline string at `[entry+0x08]` matches the session-side string at `[session+0x08]`, returns that entry index or `0xff` when none match, and then releases the same session object through `0x005216d0`. This is the heavier live-session-backed companion to `0x0046d980` and the direct matcher used by `0x0046f8f0`.","objdump + local disassembly + caller inspection + live-session correlation + indexed-collection correlation + string-match correlation"
0x0046d300,560,multiplayer_service_transfer_progress_slots_and_publish_selector0x80_or_0x81,shell,thiscall,inferred,objdump + local disassembly + caller inspection,4,"Services the fixed ten-slot transfer-progress table rooted at `0x006ce290` with `0x5c`-byte records. For every live slot belonging to the current session owner it probes transport progress through `0x00522990`, repeatedly extracts chunk sizes up to `0xf00`, and, when no payload body has been staged yet, submits those chunks through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` using selector `0x80`; when the slot already carries staged body state it instead submits the four-byte follow-on request through selector `0x81`, frees the slot-owned payload buffer, and clears the full slot. In parallel it publishes localized progress text `0x10f5` through shell status owner `0x006d401c` and caches the active dataset pointer in `0x006ce9cc`. This is therefore the concrete service owner above the local transfer-progress table, not just another selector callback.","objdump + local disassembly + caller inspection + transfer-progress-table correlation + selector-0x80-correlation + selector-0x81-correlation"
0x0046d530,117,multiplayer_count_live_transfer_progress_slots,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Counts the currently occupied slots in the fixed transfer-progress pointer strip rooted at `0x006ce2d8..0x006ce614`. The helper returns the number of non-null slot pointers across that ten-entry band. Current evidence grounds this as a local occupancy counter for the same transfer-progress family serviced by `0x0046d300`.","objdump + local disassembly + caller inspection + transfer-progress-table correlation"
0x0046d610,38,multiplayer_preview_dataset_stage_optional_selected_token_from_source_ptr,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small staging helper that writes one optional derived token into `[this+0x8f38]`. When the caller passes a non-null source pointer, the helper transforms it through `0x0051d3c0` and stores the result; otherwise it clears `[this+0x8f38]` to zero. Current grounded callers are the launch-side branches around `0x0046f67e` and `0x0046f7ac`, which use this immediately after `0x0046b6d0` updates the staged tuple path.","objdump + local disassembly + caller inspection + staging-buffer correlation"
0x0046db10,58,multiplayer_fixed_named_callback_root_build_tag0x0a_world_year_tuple,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"First concrete root in the fixed named-callback block registered by `0x00473a60`. When live world roots `0x006cec78` and `0x0062c120` are present, the helper writes local tag byte `0x0a` plus zero payload into static block `0x006ce9dc`, derives one world-year key from `[world+0x0d]` through `0x0051d3c0`, stores that derived dword into the same block, and returns the block pointer. This is the safest current structural read for the first fixed named-callback root rather than a guessed descriptor caption.","objdump + local disassembly + registration-block correlation + world-year-key correlation"
0x0046db50,60,multiplayer_fixed_named_callback_root_build_tag0x09_from_global_6cd92c_and_world_year_tuple,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"Second concrete root in the fixed named-callback block beneath `0x00473a60`. When the live world roots are present it writes tag byte `0x09` into static block `0x006ce9e8`, copies global dword `0x006cd92c` into that block, derives the world-year key from `[0x006cec78+0x0d]` through `0x0051d3c0`, stores it, and returns the block pointer. Current evidence grounds the tuple shape but not the higher semantic field name.","objdump + local disassembly + registration-block correlation + world-year-key correlation"
0x0046db90,61,multiplayer_fixed_named_callback_root_build_tag0x07_from_0x46da70_and_world_year_tuple,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"Third concrete root in the fixed named-callback block beneath `0x00473a60`. When the live world roots are present it writes tag byte `0x07` into static block `0x006ce9f4`, derives one auxiliary dword through local helper `0x0046da70`, derives the world-year key from `[0x006cec78+0x0d]` through `0x0051d3c0`, stores both values into that block, and returns the block pointer.","objdump + local disassembly + registration-block correlation + world-year-key correlation"
0x0046dbd0,317,multiplayer_fixed_named_callback_root_build_tag0x06_from_collection_0x62be10,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"Concrete root in the fixed named-callback block that builds static record `0x006cea00`. The helper writes tag byte `0x06`, stores the current world-year key from `[0x006cec78+0x0d]`, then walks indexed collection `0x0062be10` and accumulates a weighted total from several per-entry scalar fields together with world-side mode-dependent bonus terms before storing the result and returning the block pointer. This is the current grounded collection-backed fixed named-callback root above the same registration block `0x00473a60`.","objdump + local disassembly + registration-block correlation + indexed-collection correlation"
0x0046dd10,294,multiplayer_fixed_named_callback_root_build_tag0x05_from_collection_0x6ceb9c,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"Concrete root in the fixed named-callback block that builds static record `0x006cea0c`. The helper writes tag byte `0x05`, stores the current world-year key from `[0x006cec78+0x0d]`, then walks indexed collection `0x006ceb9c`, hashes one inline string field through `0x0053d810`, adds several per-entry scalar fields and mode-dependent bonus terms, accumulates the total, and returns the finished record block. Current evidence keeps the field name structural, but the owner is now explicit.","objdump + local disassembly + registration-block correlation + indexed-collection correlation + hashed-string correlation"
0x0046de40,52,multiplayer_fixed_named_callback_root_build_tag0x04_and_cached_counter,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"Small fixed named-callback root that writes tag byte `0x04` into static block `0x006cea18`, stores the current world-year key from `[0x006cec78+0x0d]`, queries one cached counter through `0x00518c60`, stores that dword into the same block, and returns the block pointer. Current grounded owner is the first fixed named-descriptor block registered by `0x00473a60`.","objdump + local disassembly + registration-block correlation + cached-counter correlation"
0x0046de80,425,multiplayer_fixed_named_callback_root_build_tag0x01_from_collection_0x62b26c_and_local_overlay_samples,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"Broader fixed named-callback root that builds static record `0x006cea24`. After writing tag byte `0x01` and the current world-year key from `[0x006cec78+0x0d]`, the helper walks indexed collection `0x0062b26c`, filters entries through local predicate `0x0040c990`, accumulates several per-entry scalar bands including object fields `[+0x246/+0x29e/+0x3cc]`, queries one local bounds tuple through `0x0052e720`, projects that tuple through `0x004142e0`, samples the live world raster through `0x00448aa0`, and stores the final accumulated total into the static record before returning it. This is the clearest current collection-plus-overlay fixed named-callback root beneath `0x00473a60`, though the descriptor caption above it remains open.","objdump + local disassembly + registration-block correlation + indexed-collection correlation + world-raster-sample correlation"
0x0046e030,539,multiplayer_fixed_named_callback_root_build_tag0x02_from_route_entry_collection_and_overlay_geometry_samples,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"Broader fixed named-callback root that builds static record `0x006cea30`. The helper writes tag byte `0x02`, stores the current world-year key from `[0x006cec78+0x0d]`, and then walks the live route-entry collection `0x006cfca8`, keeping only entries whose byte `[entry+0x216]` equals `2`. For each surviving entry it accumulates multiple local scalar bands, projected bounds from `0x0048a170`, auxiliary values from `0x0048a020`, and one geometry-derived magnitude from `0x005394b0` before storing the final total in the static record and returning it. This is the current grounded route-entry-backed member of the fixed named-callback family beneath `0x00473a60`.","objdump + local disassembly + registration-block correlation + route-entry-collection correlation + geometry-sample correlation"
0x0046e250,868,multiplayer_fixed_named_callback_root_build_tag0x03_from_collection_0x6cfcbc_and_object_metric_bands,shell,cdecl,inferred,objdump + local disassembly + registration-block correlation,3,"Broader fixed named-callback root that builds static record `0x006cea3c`. The helper writes tag byte `0x03`, stores the current world-year key from `[0x006cec78+0x0d]`, then walks collection `0x006cfcbc` and accumulates several per-entry metric bands through `0x004a77b0`, `0x0052e720`, `0x004a6e60`, and `0x004a8880`, followed by a long run of inline scalar-field adjustments and a final city-database-derived handle or float term through `0x0041ab80`. The exact descriptor caption remains open, but this is clearly another concrete collection-backed static-record root in the fixed named-callback family registered under `0x00473a60`.","objdump + local disassembly + registration-block correlation + collection-correlation + metric-band correlation"
0x0046e5c0,1754,multiplayer_build_or_apply_dual_collection_metric_blob_by_mode,shell,thiscall,inferred,objdump + local disassembly + registration-block correlation,3,"Broader multiplayer-side blob owner directly adjacent to the fixed named-callback strip. In mode `1` it serializes a dual-collection metric blob through the caller out-pointer: first it walks collection `0x0062be10`, capturing one `0x24`-byte metric row per entry from repeated `0x0042a5d0` probes plus entry field `[+0x47]`; then it walks collection `0x006ceb9c`, capturing one `0x2c`-byte metric row per entry from fields `[+0x154..+0x181]`; it stores the two row counts into local header bytes `[this+0x0d/+0x0e]`, allocates one contiguous blob of size `0x10 + count0*0x24 + count1*0x2c`, copies the local header plus both metric bands into that blob, and returns it through the caller out-slot. The non-`1` branch begins the reverse apply path by validating the stored per-entry metric rows against the live collections and writing back mismatched values into the live entries. This is therefore a real dual-collection metric snapshot/apply owner, not another tiny selector leaf.","objdump + local disassembly + dual-collection correlation + metric-blob correlation + apply-path correlation"
0x0046f4a0,928,multiplayer_preview_dataset_default_selector_callback_dispatch_first_named_descriptor_block,shell,thiscall,inferred,objdump + local disassembly + registration-root correlation,4,"Default callback root seeded into `[0x006cd8d8+0x08]` by `multiplayer_preview_dataset_reset_global_callback_state_and_register_selector_handlers` `0x00473280`. The helper switches on selector id `[this+0x10]` and, for the first fixed named-descriptor family, dispatches a concrete mix of mode writes, staged-path synchronization, chat/status publication, session-identity comparison, tuple staging, selector-`0x58` submission, and keyed-bucket pruning. The simple arms map selector values `1..7` into dataset mode dword `[0x006cd8d8+0x0c]` plus one auxiliary store at `[+0x8f1c]`, while the heavier arms stage the current session path through `multiplayer_preview_dataset_stage_selected_path` `0x00469700`, publish localized status text through either `0x004554e0` or `multiplayer_preview_dataset_append_named_ui_request_record` `0x00469a50`, refresh the staged tuple through `0x0046b6d0` and token lane `0x0046d610`, submit selector `0x58` through `0x00469d30`, and prune old keyed buckets through `0x0046b910`. This is therefore the real default selector-dispatch root for the first named-descriptor block, not just a passive callback pointer.","objdump + local disassembly + registration-root correlation + selector-dispatch correlation + named-descriptor correlation"
0x0046f870,124,multiplayer_apply_rounded_float_delta_to_company_entry_metric_pair_by_index_byte,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Helper beneath the first fixed named-descriptor callback family that treats the caller payload as one float plus one collection byte index. It resolves the indexed company-style entry from `0x0062be10`, validates it through `0x00425b90`, rounds the input float through `0x005a10d0`, then writes the positive rounded value into metric id `0x0f` and the negated rounded value into metric id `0x0d` through `0x0042a040`. Current direct callers build the temporary two-field payload on the stack before calling this leaf, which keeps the helper bounded as a small rounded-delta apply path rather than a broader callback owner.","objdump + local disassembly + caller inspection + indexed-company-entry correlation + rounded-delta correlation"
0x0046f8f0,97,multiplayer_resolve_company_entry_by_index_if_live_session_profile_index_matches,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Resolves one indexed entry from `0x0062be10`, validates it through `0x00425b90`, derives the current live-session-backed name index through `multiplayer_find_collection_0x6ceb9c_entry_index_matching_live_session_string` `0x0046d9e0`, and returns the company entry only when its profile-index field `[entry+0x3b]` matches that derived `0x006ceb9c` index. Otherwise it returns null. Current callers use this as the stricter collection-match gate beneath several first-block fixed descriptor callbacks.","objdump + local disassembly + caller inspection + live-session correlation + indexed-company-entry correlation + profile-index correlation"
0x0046f960,2209,multiplayer_dispatch_chat_command,shell,cdecl,inferred,ghidra-headless,4,Parses and dispatches one slash-prefixed Multiplayer.win chat command line from `[eax+0x08]`. The parser normalizes `/` to `\\` and handles the grounded command family `\\kick` `\\clear` `\\whois` `\\me` `\\unban` `\\ban` `\\snore` `\\sneeze` `\\hurry` `\\trackisfree` `\\loadgame` and `\\sendgame`. The strongest branches are now clear: `\\kick` resolves a typed peer name through the active session tables and forwards the resulting peer object through multiplayer_request_peer_session_control when the target is neither null nor the local player; `\\clear` clears the local chat pane through multiplayer_publish_wrapped_chat_message(null); `\\whois` finds a named peer and emits multi-line `%s Ip = %s` `Cpu` `Game` and `Build Time` diagnostics through multiplayer_route_chat_line; `\\ban` and `\\unban` resolve either a dotted player name or the selected peer name then update the semicolon-delimited moderation list through multiplayer_update_semicolon_name_list with add/remove modes while `\\unban` can also forward a live peer object through multiplayer_request_peer_session_control; `\\snore` `\\sneeze` and `\\hurry` build transient presentation objects then broadcast text ids `0xb79` `0xb7a` and `0xb7b`; `\\loadgame` copies the requested filename into `0x006ce630` and arms flag `0x006ce9bc`; `\\trackisfree` arms flag `0x006ce9b4`; and `\\sendgame` allocates one 0x5c-byte transfer record under `0x006ce290` for the chosen player slot. The parser returns `1` only when a command branch handled the line and otherwise leaves the caller to treat it as ordinary chat text.,ghidra + rizin + llvm-objdump + strings
0x00470290,352,multiplayer_selector0x02_compare_staged_profile_text_sync_shell_profile_block_and_maybe_queue_selector0x53,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that compares the caller string at `[payload+0x11]` against the current shell profile string at `[0x006cec7c+0x11]` through `0x005a57cf`, optionally validates that staged profile text through `0x0046d7f0`, and then branches on requested action id `0x006d127c`. In the action-`3` lane it either advances the requested-action state fields `0x006d1280/0x006d1284` or queues selector `0x53` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30`. On the common success path it syncs the larger shell profile block rooted at `[0x006cec7c+0x44]` from the incoming payload, optionally overrides that block from `0x006ce670`, re-enters `0x004f13e0(1)`, refreshes `[0x006cec7c+0x83]` through `0x00518c70`, and stores one filename-presence flag into `0x006ce9bc` from `0x005c9cf8`. This is the clearest current structural read for the early selector-`0x02` branch beneath the preview-dataset callback table.","objdump + local disassembly + registration-pass correlation + selector-0x02 correlation + staged-profile correlation + requested-action correlation"
0x004703f0,224,multiplayer_selector0x0a_reset_world_session_owner_sync_profile_bytes_and_refresh_local_status,shell,cdecl,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that clears `[world+0x19]`, re-enters `0x0046a390(1)`, seeds world field `[world+0x66ae] = 1`, and refreshes local multiplayer state through `0x0053f000(1,0,1)`. It then walks the live session peer list from `0x006d40d0`, derives each peer's named-profile index through `0x0046d980`, and mirrors peer byte `[peer+0x2690]` into named-profile byte `[entry+0x15c]` for the corresponding `0x006ceb9c` entry. Before returning it refreshes `0x006ce98c` through `0x0051d890`, optionally publishes localized status `0x005c87a8` through `0x00538c70`, and when the session object `0x006d40dc` is live re-enters `0x00434680(3,1,0)`. This is the clearest current structural read for selector `0x0a` beneath the preview-dataset callback table.","objdump + local disassembly + registration-pass correlation + selector-0x0a correlation + world-session correlation + named-profile-byte correlation"
0x004704d0,96,multiplayer_selector0x0b_stage_current_token_and_publish_selector0x0c_when_session_guard_is_set,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that checks session-side guard dword `[EDX+0x50]` and, when that guard is nonzero, stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x0c`. This is the clean local selector-`0x0b` wrapper immediately above the heavier selector-`0x0c` branch.","objdump + local disassembly + registration-pass correlation + selector-0x0b correlation + selector-0x0c correlation + staged-token correlation"
0x00470530,96,multiplayer_selector0x0c_apply_signed_byte_pair_through_0x434680_and_adjust_dataset_counter,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, rejects work when dataset gate `0x006cd91c` is set, and otherwise forwards the signed byte pair at `[payload+0x00/+0x01]` into `0x00434680(leader, 0, follower)`. On success it then adjusts dataset counter `0x006cd8e8` based on whether `[world+0x19]` is currently nonzero and stores scalar `0x3c` into `0x005f2b38`. This is the clearest current structural read for selector `0x0c` above that signed-pair apply lane.","objdump + local disassembly + registration-pass correlation + selector-0x0c correlation + world-helper-0x434680 correlation + dataset-counter correlation"
0x00470590,96,multiplayer_selector0x0f_pop_head_session_queue_node_publish_record_and_release_it,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that resolves the current live-session object through `0x00521d40`, pops the head node from its queue owner at `[session+0x64]`, and when a node is present submits that node's fields through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` using dataset string root `[0x006cd8d8+0x8f48]`, selector id from the leading node word, and the node's stacked scalar fields `[+0x08/+0x0c/+0x10/+0x14]`. It then releases the consumed node through `0x00469890`. This is the clearest current structural read for selector `0x0f` beneath the preview-dataset callback table.","objdump + local disassembly + registration-pass correlation + selector-0x0f correlation + session-queue correlation + record-publish correlation"
0x004705f0,64,multiplayer_selector0x10_lookup_current_session_key_in_store0x60_and_forward_string_root,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that resolves the current live-session object through `0x00521d40`, looks up payload dword `[payload+0x00]` in the session-side keyed owner at `[session+0x60]` through `0x0053dae0`, and when a match exists forwards that resolved entry plus dataset string root `[0x006cd8d8+0x8f48]` into live-session helper `0x00521790`. This is the clearest current structural read for selector `0x10` beneath the preview-dataset callback table.","objdump + local disassembly + registration-pass correlation + selector-0x10 correlation + session-store correlation + string-root forward correlation"
0x004706b0,517,multiplayer_selector0x13_match_company_entry_try_place_payload_and_publish_selector0x6e_hash_fallback,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes a structured payload from `[this+0x08]`, resolves the matching company-style entry through `multiplayer_resolve_company_entry_by_index_if_live_session_profile_index_matches` `0x0046f8f0`, and on the active branch tries to validate and materialize the payload into the placed-structure world through `placed_structure_validate_projected_candidate_placement` `0x004197e0`, `0x0046eec0`, `placed_structure_collection_allocate_and_construct_entry` `0x004134d0`, `0x0040eba0`, and the nearby runtime-object refresh leaves `0x0052eb90` and `0x0040ef10`. When no compatible company entry is live but the multiplayer session object exists, it instead stages the current year-derived token into `[0x006cd8d8+0x8f38]`, hashes the first `0x1c` payload bytes through `0x0053d870`, and submits the compact fallback through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x6e`. Empty-input failure falls back to localized status id `0x0b7c`. This is the safest current structural read for the selector-`0x13` owner above that hashed selector-`0x6e` fallback lane.","objdump + local disassembly + caller inspection + selector-0x13 correlation + selector-0x6e correlation + placed-structure correlation"
0x00470630,126,multiplayer_selector0x12_validate_payload_and_publish_selector0x13_or_error,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes payload pointer `[this+0x08]`, validates that payload through `0x0046ef40(1)`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x13` and fixed payload length `0x1c`. When validation fails it instead forwards the paired error-style selector-`0x13` payload through the `0x21` branch using the caller fallback buffer from `EDX+0x08`. This is the clean local selector-`0x12` wrapper immediately above the heavier selector-`0x13` placement or hash-fallback body.","objdump + local disassembly + caller inspection + selector-0x12 correlation + selector-0x13 correlation + validation-gate correlation"
0x004708c0,141,multiplayer_selector0x14_validate_payload_and_publish_selector0x15_or_error,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes payload pointer `[this+0x08]`, validates that payload against the caller-side session or company context through `0x0046f0a0`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x15`. When the validation path fails it instead forwards the paired error-style selector-`0x15` payload through the `0x21` branch using the caller fallback buffer from `EDX+0x08`. This is the safest current read for the selector-`0x14` owner above the narrower selector-`0x15` delta-apply body rather than another direct local mutation helper.","objdump + local disassembly + caller inspection + selector-0x14 correlation + selector-0x15 correlation + validation-gate correlation"
0x00470950,431,multiplayer_selector0x15_match_company_entry_publish_selector0x6b_metric_delta_and_apply_locally,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes a 5-byte payload `(float delta, company-index byte)` from `[this+0x08]`, resolves the matching company-style entry through `multiplayer_resolve_company_entry_by_index_if_live_session_profile_index_matches` `0x0046f8f0`, temporarily masks world latch `[0x006cec78+0x4aab]` while validating the local session/company relation through `0x0046f0a0`, and on the active branch stages the current year-derived token into `[0x006cd8d8+0x8f38]`, submits the same compact update through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x6b`, updates local counters `[0x006cd8d8+0x987c/+0x9880]`, and immediately re-enters `multiplayer_apply_rounded_float_delta_to_company_entry_metric_pair_by_index_byte` `0x0046f870`. When the required entry match fails it falls back to localized status id `0x0b86`. This is the tightest current read for the selector-`0x15` owner above the smaller selector-`0x6b` apply leaf.","objdump + local disassembly + caller inspection + selector-0x15 correlation + selector-0x6b correlation + company-entry correlation"
0x00470b20,136,multiplayer_selector0x16_validate_payload_and_publish_selector0x17_or_error,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes payload pointer `[this+0x08]`, validates that payload through `0x0046edb0`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x17` and fixed request kind `0x19`. When validation fails it instead forwards the paired error-style selector-`0x17` payload through the `0x21` branch using the caller fallback buffer from `EDX+0x08`. This is the clean local selector-`0x16` wrapper immediately above the heavier selector-`0x17` live-world apply body.","objdump + local disassembly + caller inspection + selector-0x16 correlation + selector-0x17 correlation + validation-gate correlation"
0x00470bb0,428,multiplayer_selector0x17_match_company_entry_apply_0x33_stride_records_and_publish_selector0x6e_fallback,shell,thiscall,inferred,objdump + local disassembly + caller inspection,4,"Heavier selector-handler body that consumes a structured payload from `[this+0x08]`, resolves the matching company-style entry through `multiplayer_resolve_company_entry_by_index_if_live_session_profile_index_matches` `0x0046f8f0` using payload dwords `[+0x0c/+0x10]`, and on the active branch first folds the count-prefixed `0x33`-stride adjunct records from `[payload+0x14]` through local helpers `0x004b2ba0` and `0x004b3160`, then allocates or resolves one live train-side entry through `0x004b2140` against collection `0x006cfcbc`, applies optional subtype field `[payload+0x08]` through `0x004abd70`, resolves the train metrics owner through `0x004a77b0`, and finally re-enters `0x0052e720` plus the nearby refresh leaves under `0x0040eba0`, `0x0052eb90`, and `0x0040ef10`. When that apply path does not land a live entry but the multiplayer session object exists, it stages the current year-derived token into `[0x006cd8d8+0x8f38]`, hashes the first `0x14` payload bytes through `0x0053d870`, and submits the compact fallback through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x6e`. Empty-input failure falls back to localized status id `0x0b7e`. This is the safest current structural read for selector `0x17` above that hashed selector-`0x6e` fallback lane.","objdump + local disassembly + caller inspection + selector-0x17 correlation + selector-0x6e correlation + live-train correlation"
0x00470da0,139,multiplayer_selector0x19_validate_payload_and_publish_selector0x1a_or_error,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes payload pointer `[this+0x08]`, validates that payload through `0x0046ed30`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x1a` and fixed request kind `0x19`. When validation fails it instead forwards the paired error-style selector-`0x1a` payload through the `0x21` branch using the caller fallback buffer from `EDX+0x08`. This is the clean local selector-`0x19` wrapper immediately above the selector-`0x1a` status or apply branch.","objdump + local disassembly + caller inspection + selector-0x19 correlation + selector-0x1a correlation + validation-gate correlation"
0x00470e30,156,multiplayer_selector0x1a_query_or_publish_session_name_match_status,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes payload from `[this+0x08]` and branches on payload length `[this+0x0c]`. When the payload is not exactly four bytes, the helper first queries a local status code through `0x0046ed30`; on zero it forwards the payload into `0x0047d320`, while on nonzero it resolves the named `0x006ceb9c` entry from payload dword `[+0x00]`, compares that entry string against the current live session string, and uses the resulting status code to publish one localized status text `0x0b7f` or `0x0b80` through `0x00469a50` after refreshing `0x0053f000`. When the payload length is exactly four bytes it instead treats payload dword `[+0x00]` as the direct status code. This is the safest current structural read for selector `0x1a` above that session-name-match status branch rather than a broader world mutation owner.","objdump + local disassembly + caller inspection + selector-0x1a correlation + live-session-string correlation + status-text correlation"
0x00470ed0,208,multiplayer_reset_named_profile_activation_and_apply_positive_company_metric0x0d_preset,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Global reset or normalize pass over the two live multiplayer collections that first walks `0x006ceb9c` and, for every entry whose guard dword `[entry+0x1e1]` is nonzero, forwards constant `0x004c4b40` into `0x00476050`; it then walks the live company collection `0x0062be10` and, for every entry accepted by `0x00425b90`, writes preset scalar `0x4a989680` into metric id `0x0d` through `0x0042a040`. Current registration pressure places this helper immediately beside the selector-`0x1c` callback band inside the multiplayer preview-dataset callback table.","objdump + local disassembly + caller inspection + 0x6ceb9c-correlation + company-metric correlation + selector-band adjacency"
0x00470fa0,208,multiplayer_reset_named_profile_activation_and_apply_negative_company_metric0x0d_preset,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Companion global reset or normalize pass parallel to `0x00470ed0`. It walks the same guarded `0x006ceb9c` entry family and forwards constant `0xfffe7960` into `0x00476050`, then walks `0x0062be10` and, for every entry accepted by `0x00425b90`, writes preset scalar `0xc7c35000` into metric id `0x0d` through `0x0042a040`. Current selector-table adjacency keeps this bounded as the alternate preset sibling of `0x00470ed0` beneath the same multiplayer callback band.","objdump + local disassembly + caller inspection + 0x6ceb9c-correlation + company-metric correlation + selector-band adjacency"
0x00471070,96,multiplayer_selector0x1d_stage_current_token_and_publish_selector0x1e,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x1e` and fixed request kind `0x19`. This is the clean local selector-`0x1d` wrapper immediately above the registered selector-`0x1e` branch.","objdump + local disassembly + registration-pass correlation + selector-0x1d correlation + selector-0x1e correlation + staged-token correlation"
0x004710d0,96,multiplayer_selector0x1f_stage_current_token_and_publish_selector0x20,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x20` and fixed request kind `0x19`. This is the clean local selector-`0x1f` wrapper immediately above the registered selector-`0x20` branch.","objdump + local disassembly + registration-pass correlation + selector-0x1f correlation + selector-0x20 correlation + staged-token correlation"
0x00471130,96,multiplayer_selector0x21_stage_current_token_and_publish_selector0x22,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x22` and fixed request kind `0x19`. This is the clean local selector-`0x21` wrapper immediately above the registered selector-`0x22` branch.","objdump + local disassembly + registration-pass correlation + selector-0x21 correlation + selector-0x22 correlation + staged-token correlation"
0x00471190,96,multiplayer_selector0x23_stage_current_token_and_publish_selector0x24,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x24` and fixed request kind `0x19`. This is the clean local selector-`0x23` wrapper immediately above the registered selector-`0x24` branch.","objdump + local disassembly + registration-pass correlation + selector-0x23 correlation + selector-0x24 correlation + staged-token correlation"
0x004711f0,96,multiplayer_selector0x25_stage_current_token_and_publish_selector0x26,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x26` and fixed request kind `0x19`. This is the clean local selector-`0x25` wrapper immediately above the registered selector-`0x26` branch.","objdump + local disassembly + registration-pass correlation + selector-0x25 correlation + selector-0x26 correlation + staged-token correlation"
0x00471250,96,multiplayer_selector0x27_stage_current_token_and_publish_selector0x28,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x28` and fixed request kind `0x19`. This is the clean local selector-`0x27` wrapper immediately above the registered selector-`0x28` branch.","objdump + local disassembly + registration-pass correlation + selector-0x27 correlation + selector-0x28 correlation + staged-token correlation"
0x004712b0,96,multiplayer_selector0x29_stage_current_token_and_publish_selector0x2a,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x2a` and fixed request kind `0x19`. This is the clean local selector-`0x29` wrapper immediately above the registered selector-`0x2a` branch.","objdump + local disassembly + registration-pass correlation + selector-0x29 correlation + selector-0x2a correlation + staged-token correlation"
0x00471310,96,multiplayer_selector0x2b_stage_current_token_and_publish_selector0x2c,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x2c` and fixed request kind `0x19`. This is the clean local selector-`0x2b` wrapper immediately above the registered selector-`0x2c` branch.","objdump + local disassembly + registration-pass correlation + selector-0x2b correlation + selector-0x2c correlation + staged-token correlation"
0x00471370,96,multiplayer_selector0x2d_stage_current_token_and_publish_selector0x2e,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x2e` and fixed request kind `0x19`. This is the clean local selector-`0x2d` wrapper immediately above the registered selector-`0x2e` branch.","objdump + local disassembly + registration-pass correlation + selector-0x2d correlation + selector-0x2e correlation + staged-token correlation"
0x004713d0,96,multiplayer_selector0x2f_stage_current_token_and_publish_selector0x30,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x30` and fixed request kind `0x19`. This is the clean local selector-`0x2f` wrapper immediately above the registered selector-`0x30` branch.","objdump + local disassembly + registration-pass correlation + selector-0x2f correlation + selector-0x30 correlation + staged-token correlation"
0x00471430,96,multiplayer_selector0x31_stage_current_token_and_publish_selector0x32,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x32` and fixed request kind `0x19`. This is the clean local selector-`0x31` wrapper immediately above the registered selector-`0x32` branch.","objdump + local disassembly + registration-pass correlation + selector-0x31 correlation + selector-0x32 correlation + staged-token correlation"
0x00471490,96,multiplayer_selector0x33_stage_current_token_and_publish_selector0x34,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x34` and fixed request kind `0x19`. This is the clean local selector-`0x33` wrapper immediately above the registered selector-`0x34` branch.","objdump + local disassembly + registration-pass correlation + selector-0x33 correlation + selector-0x34 correlation + staged-token correlation"
0x004714f0,96,multiplayer_selector0x35_stage_current_token_and_publish_selector0x36,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x36` and fixed request kind `0x19`. This is the clean local selector-`0x35` wrapper immediately above the registered selector-`0x36` branch.","objdump + local disassembly + registration-pass correlation + selector-0x35 correlation + selector-0x36 correlation + staged-token correlation"
0x00471550,96,multiplayer_selector0x37_stage_current_token_and_publish_selector0x38,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x38` and fixed request kind `0x19`. This is the clean local selector-`0x37` wrapper immediately above the registered selector-`0x38` branch.","objdump + local disassembly + registration-pass correlation + selector-0x37 correlation + selector-0x38 correlation + staged-token correlation"
0x004715b0,96,multiplayer_selector0x39_stage_current_token_and_publish_selector0x3a,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x3a` and fixed request kind `0x19`. This is the clean local selector-`0x39` wrapper immediately above the registered selector-`0x3a` branch.","objdump + local disassembly + registration-pass correlation + selector-0x39 correlation + selector-0x3a correlation + staged-token correlation"
0x00471610,112,multiplayer_selector0x3b_resolve_live_train_id_and_publish_selector0x3c,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside live collection `0x006cfcbc`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x3c`. This is the clean local selector-`0x3b` wrapper immediately above the narrower selector-`0x3c` live-train apply branch.","objdump + local disassembly + registration-pass correlation + selector-0x3b correlation + selector-0x3c correlation + live-train correlation"
0x00471680,64,multiplayer_selector0x3c_resolve_live_train_and_dispatch_local_handler_0x4abd70,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside `0x006cfcbc`, and on success forwards the resolved train entry plus payload dword `[+0x08]` into local handler `0x004abd70`. This is the clearest current structural read for selector `0x3c` above that narrow live-train dispatch lane.","objdump + local disassembly + registration-pass correlation + selector-0x3c correlation + live-train correlation + local-handler correlation"
0x004716c0,112,multiplayer_selector0x3d_resolve_live_train_id_and_publish_selector0x3e,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside live collection `0x006cfcbc`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x3e`. This is the clean local selector-`0x3d` wrapper immediately above the narrower selector-`0x3e` live-train dispatch branch.","objdump + local disassembly + registration-pass correlation + selector-0x3d correlation + selector-0x3e correlation + live-train correlation"
0x00471730,80,multiplayer_selector0x3e_resolve_live_train_and_dispatch_local_handler_0x4b2f00,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside `0x006cfcbc`, and on success forwards the resolved train entry plus payload dword `[+0x08]` and flag `1` into local handler `0x004b2f00`. This is the clearest current structural read for selector `0x3e` above that narrow live-train dispatch lane.","objdump + local disassembly + registration-pass correlation + selector-0x3e correlation + live-train correlation + local-handler correlation"
0x00471780,112,multiplayer_selector0x3f_resolve_live_train_id_and_publish_selector0x40,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside live collection `0x006cfcbc`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x40`. This is the clean local selector-`0x3f` wrapper immediately above the narrower selector-`0x40` live-train dispatch branch.","objdump + local disassembly + registration-pass correlation + selector-0x3f correlation + selector-0x40 correlation + live-train correlation"
0x004717f0,64,multiplayer_selector0x40_resolve_live_train_and_dispatch_local_handler_0x4b3000,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside `0x006cfcbc`, and on success forwards the resolved train entry plus payload dword `[+0x08]` into local handler `0x004b3000`. This is the clearest current structural read for selector `0x40` above that narrow live-train dispatch lane.","objdump + local disassembly + registration-pass correlation + selector-0x40 correlation + live-train correlation + local-handler correlation"
0x00471830,112,multiplayer_selector0x41_resolve_live_train_id_and_publish_selector0x42,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside live collection `0x006cfcbc`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x42`. This is the clean local selector-`0x41` wrapper immediately above the heavier selector-`0x42` live-train interaction branch.","objdump + local disassembly + registration-pass correlation + selector-0x41 correlation + selector-0x42 correlation + live-train correlation"
0x004718a0,176,multiplayer_selector0x42_update_live_train_adjunct_and_dispatch_local_action_code,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside `0x006cfcbc`, and on success re-enters the train-side adjunct family `0x004b2b70`, `0x004b3160`, and `0x004b2c10` using the caller record band at `[payload+0x08]`. When the first `0x004b2c10(-1,0,0,-1)` gate fails it then branches on `0x004a9460`: the positive lane retries `0x004b2c10(-1,1,0,-1)` and dispatches local action code `0x13` through `0x004ab980`, while the fallback lane dispatches local action code `0x0a`. This is the safest current structural read for selector `0x42` above that train-side adjunct and action-code branch.","objdump + local disassembly + registration-pass correlation + selector-0x42 correlation + live-train correlation + local-train-adjunct correlation"
0x00471950,112,multiplayer_selector0x43_resolve_live_train_id_and_publish_selector0x44,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves train id `[payload+0x04]` inside live collection `0x006cfcbc`, and on success stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x44`. This is the clean local selector-`0x43` wrapper immediately above the registered selector-`0x44` branch.","objdump + local disassembly + registration-pass correlation + selector-0x43 correlation + selector-0x44 correlation + live-train correlation"
0x004719c0,112,multiplayer_complete_selector0x48_prompt_result_and_publish_selector0x49,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Prompt-result callback used by the selector-`0x48` request family. The helper treats `[this+0x1c]` as one `0x0c`-byte staged record, derives one bit position from the current live session through `0x00521d40` and `0x0046d980`, sets that bit in record dword `[record+0x08]`, forces the same bit again when the prompt result code in `EDX` equals `0x3f2`, then republishes the updated `0x0c`-byte record through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x49` and dataset string root `[0x006cd8d8+0x8f48]`.","objdump + local disassembly + caller inspection + selector-0x48 correlation + selector-0x49 correlation + prompt-result correlation"
0x00471a30,352,multiplayer_selector0x48_match_or_prompt_12byte_record_and_publish_selector0x49,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body for the 12-byte hashed request family seeded by `0x0046cbf0`. It treats `[this+0x08]` as one `0x0c`-byte record, derives the current live-session bit position through `0x00521d40` and `0x0046d980`, and when payload dword `[+0x00]` matches the current live session id simply sets that bit in record dword `[+0x08]` before publishing selector `0x49`. Otherwise it resolves the `0x006ceb9c` and `0x0062be10` entries selected by payload bytes `[+0x05]` and `[+0x04]`, and either marks the same bit directly or formats localized status `0x0b81` into `0x006ce700` and opens a prompt through `0x00469a50` with follow-on callback `0x004719c0`. In both branches the final publish uses `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x49`.","objdump + local disassembly + registration-pass correlation + selector-0x48 correlation + selector-0x49 correlation + hashed-request correlation + prompt correlation"
0x00471b90,256,multiplayer_selector0x49_build_company_activity_bitmaps_and_publish_selector0x47,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that consumes one 12-byte record from `[this+0x08]`, hashes that record through `0x0053d870`, resolves the current keyed object through `0x00468cb0`, and merges the record's existing bitset dword `[record+0x08]` into the resolved object. It then walks `0x006ceb9c` and, for every currently active named-profile entry whose bit is not already present in that merged mask, copies the live-activity bit into the local object. After that sweep it stages the current year-derived token into `[0x006cd8d8+0x8f38]`, republishes the object through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x47`, and releases the temporary record. This is the tightest current structural read for selector `0x49` above the follow-on selector-`0x47` bitmap branch.","objdump + local disassembly + registration-pass correlation + selector-0x49 correlation + selector-0x47 correlation + keyed-object correlation"
0x00471c90,320,multiplayer_selector0x47_build_profile_masks_and_trigger_merger_vote_resolution,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that consumes one 10-byte bitmap-style payload from `[this+0x08]`, builds two ten-slot byte arrays on the stack from payload bytes `[+0x04]`, `[+0x05]`, and payload bitmask dword `[+0x08]`, and then walks `0x006ceb9c` to mark currently active entries into the second array when their bit is present or when their guard fields are already clear. It then forwards the resulting arrays into `0x004eb230` and immediately re-enters `shell_resolve_merger_vote_and_commit_outcome` `0x004ebd10(0)`. This is the clearest current structural read for selector `0x47` beneath the paired selector-`0x49` bitmap-builder branch.","objdump + local disassembly + registration-pass correlation + selector-0x47 correlation + 0x006ceb9c-correlation + merger-vote correlation"
0x00471d50,112,multiplayer_complete_selector0x4c_prompt_result_and_publish_selector0x4d,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Prompt-result callback used by the selector-`0x4c` request family. The helper treats `[this+0x1c]` as one `0x0a`-byte staged record, derives one bit position from the current live session through `0x00521d40` and `0x0046d980`, sets that bit in record dword `[record+0x06]`, forces the same bit again when the prompt result code in `EDX` equals `0x3f2`, then republishes the updated `0x0a`-byte record through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x4d` and dataset string root `[0x006cd8d8+0x8f48]`.","objdump + local disassembly + caller inspection + selector-0x4c correlation + selector-0x4d correlation + prompt-result correlation"
0x00471dc0,272,multiplayer_selector0x4c_match_or_prompt_10byte_record_and_publish_selector0x4d,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body for the 10-byte hashed request family seeded by `0x0046cc60`. It treats `[this+0x08]` as one `0x0a`-byte record, derives the current live-session bit position through `0x00521d40` and `0x0046d980`, and when payload dword `[+0x00]` matches the current live session id simply sets that bit in record dword `[+0x06]` before publishing selector `0x4d`. Otherwise it resolves the `0x006ceb9c` and `0x0062be10` entries selected by payload bytes `[+0x05]` and `[+0x04]`, and either marks the same bit directly or formats localized status `0x0b82` into `0x006ce700` and opens a prompt through `0x00469a50` with follow-on callback `0x00471d50`. In both branches the final publish uses `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x4d`.","objdump + local disassembly + registration-pass correlation + selector-0x4c correlation + selector-0x4d correlation + hashed-request correlation + prompt correlation"
0x00471ed0,256,multiplayer_selector0x4d_build_company_activity_bitmaps_and_publish_selector0x4b,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that consumes one 10-byte record from `[this+0x08]`, hashes that record through `0x0053d870`, resolves the current keyed object through `0x00468cb0`, and merges the record's existing bitset dword `[record+0x06]` into the resolved object. It then walks `0x006ceb9c` and, for every currently active named-profile entry whose bit is not already present in that merged mask, copies the live-activity bit into the local object. After that sweep it stages the current year-derived token into `[0x006cd8d8+0x8f38]`, republishes the object through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x4b`, and releases the temporary record. This is the tightest current structural read for selector `0x4d` above the follow-on selector-`0x4b` bitmap branch.","objdump + local disassembly + registration-pass correlation + selector-0x4d correlation + selector-0x4b correlation + keyed-object correlation"
0x00471fd0,176,multiplayer_selector0x4b_build_profile_masks_and_refresh_two_bitmap_helpers,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that consumes one 10-byte bitmap-style payload from `[this+0x08]`, builds two ten-slot byte arrays on the stack from payload bytes `[+0x04]`, `[+0x05]`, and payload bitmask dword `[+0x06]`, and then walks `0x006ceb9c` to mark currently active entries into the second array when their bit is present or when their guard fields are already clear. It then forwards the resulting arrays into `0x0050c4e0` and `0x0050c940`. This is the clearest current structural read for selector `0x4b` beneath the paired selector-`0x4d` bitmap-builder branch.","objdump + local disassembly + registration-pass correlation + selector-0x4b correlation + 0x006ceb9c-correlation + bitmap-helper correlation"
0x00472080,48,multiplayer_selector0x4f_republish_selector0x6f_when_session_live_and_dataset_gate_clear,shell,cdecl,inferred,objdump + local disassembly + registration-pass correlation,2,"Small selector-handler body that checks for a live session object at `0x006d40dc` and a clear dataset gate at `0x006cd91c`, then resubmits a tiny empty request through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x6f`. This is the current grounded owner for selector `0x4f`.","objdump + local disassembly + registration-pass correlation + selector-0x4f correlation"
0x004720b0,32,multiplayer_selector0x50_copy_dataset_dword_0x9058_to_0x9054_when_session_live,shell,cdecl,inferred,objdump + local disassembly + registration-pass correlation,2,"Small selector-handler body that, when the live session object `0x006d40dc` is present, copies dataset dword `[0x006cd8d8+0x9058]` into `[0x006cd8d8+0x9054]`. This is the current grounded owner for selector `0x50`.","objdump + local disassembly + registration-pass correlation + selector-0x50 correlation + dataset-field correlation"
0x004720d0,208,multiplayer_selector0x51_derive_session_status_and_publish_selector0x52_or_control0x109_fallback,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that consumes one structured payload from `[this+0x08]`, checks for a live session object at `0x006d40dc`, and then derives one small status code from `0x00468ce0`, `0x0046c280`, and `0x004eda30`. When all three routes still return `0xff`, it republishes shell control `0x109` from root `0x006cec7c` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30`; otherwise it forwards the caller buffer at `EDX+0x08` plus the derived code through the same transport with selector `0x52`. This is the clearest current structural read for selector `0x51` above that selector-`0x52` status branch.","objdump + local disassembly + registration-pass correlation + selector-0x51 correlation + selector-0x52 correlation + session-status correlation"
0x004721a0,32,multiplayer_selector0x55_store_payload_dword_into_dataset_field_0x9860,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,2,"Tiny selector-handler body that stores payload dword `[ [this+0x08] + 0x00 ]` directly into dataset field `[0x006cd8d8+0x9860]`. This is the current grounded owner for selector `0x55`.","objdump + local disassembly + registration-pass correlation + selector-0x55 correlation + dataset-field correlation"
0x004721c0,64,multiplayer_selector0x56_copy_payload_string_into_named_profile_entry,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,2,"Selector-handler body that resolves one `0x006ceb9c` entry from payload dword `[+0x04]` and copies the caller string at `[payload+0x08]` into that entry's inline name band `[entry+0x08]` until the terminating NUL. This is the current grounded owner for selector `0x56`.","objdump + local disassembly + registration-pass correlation + selector-0x56 correlation + 0x6ceb9c-entry correlation + string-copy correlation"
0x00472200,48,multiplayer_selector0x57_store_payload_dword_into_named_profile_guard_0x1e1,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,2,"Selector-handler body that resolves one `0x006ceb9c` entry from payload dword `[+0x00]` and stores payload dword `[+0x04]` into that entry's guard field `[entry+0x1e1]`. This is the current grounded owner for selector `0x57`.","objdump + local disassembly + registration-pass correlation + selector-0x57 correlation + 0x6ceb9c-entry correlation + guard-field correlation"
0x00472230,96,multiplayer_selector0x58_flush_deferred_named_profile_reset_queue,shell,cdecl,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that walks the 16-slot dataset byte queue `[0x006cd8d8+0x9864..+0x9873]`. For every slot whose byte is not `0xff`, it resolves the corresponding `0x006ceb9c` entry, clears guard dword `[entry+0x1e1]`, sets byte `[entry+0x293] = 1`, and then resets the queue slot back to `0xff`. This is the current grounded owner for selector `0x58`.","objdump + local disassembly + registration-pass correlation + selector-0x58 correlation + deferred-queue correlation + 0x6ceb9c-entry correlation"
0x00472290,208,multiplayer_selector0x59_derive_roster_capacity_status_and_publish_selector0x5a,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that validates one payload through `0x0046d7f0`, formats a temporary object through `0x005a19c4`, `0x005a125d`, and `0x00442400`, clamps object field `[obj+0x3b6]` to at most `4`, compares that result against shell field `[0x006cec7c+0x79]`, and conditionally re-enters `0x004ecc50` before setting the final status dword. It then forwards that four-byte result through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x5a`. This is the clearest current structural read for selector `0x59` above that derived selector-`0x5a` status lane.","objdump + local disassembly + registration-pass correlation + selector-0x59 correlation + selector-0x5a correlation + derived-status correlation"
0x00472360,96,multiplayer_selector0x5b_stage_current_token_and_publish_selector0x5c,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x5c`. This is the clean local selector-`0x5b` wrapper immediately above the selector-`0x5c` branch.","objdump + local disassembly + registration-pass correlation + selector-0x5b correlation + selector-0x5c correlation + staged-token correlation"
0x004723c0,144,multiplayer_selector0x5c_gate_company_entry_dispatch_0x493960_and_optional_local_metric_apply,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, resolves company id `[payload+0x00]` inside `0x0062be10`, and then branches on a float comparison from `0x0046a4b0` against threshold `0x005c8c28`. In the direct lane it dispatches the resolved company id into `0x00493960(0x006cfca8, id, 0, 0, 0)`. In the alternate lane it first performs the same dispatch and then builds a one-byte stack payload from the company id and forwards that temporary record into `multiplayer_apply_rounded_float_delta_to_company_entry_metric_pair_by_index_byte` `0x0046f870`. This is the clearest current structural read for selector `0x5c` above that dispatch-or-local-apply split.","objdump + local disassembly + registration-pass correlation + selector-0x5c correlation + company-entry correlation + local-apply correlation"
0x00472450,144,multiplayer_selector0x5d_validate_payload_string_and_publish_selector0x5e,shell,thiscall,inferred,objdump + local disassembly + registration-pass correlation,3,"Selector-handler body that validates the caller string at `[payload+0x08]` through `0x0046a440` and, when that validation passes, stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x5e`. This is the clean local selector-`0x5d` wrapper immediately above the heavier selector-`0x5e` named-profile string-update branch.","objdump + local disassembly + registration-pass correlation + selector-0x5d correlation + selector-0x5e correlation + string-validation correlation"
0x004724e0,254,multiplayer_selector0x5e_update_named_profile_entry_string_and_live_session_label,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes one variable-length payload from `[this+0x08]` and requires a positive payload length from `[this+0x0c]`. On the active branch it uses payload dword `[+0x04]` to resolve one `0x006ceb9c` entry, copies the caller string at `[payload+0x08]` into that entry's inline name band `[entry+0x08]`, resolves the live session object at `0x006d40d0` from payload dword `[+0x00]`, mirrors the same string into `[session+0x08]`, and when `[session+0x50]` is nonzero hashes that string through `0x0053d810`, stores the result in `[session+0x48]`, and mirrors the string into dataset field `[0x006cd8d8+0x8f48]`. If the updated session id matches the current live session id it also decrements `0x006d10a0` and may re-enter `0x0053f000`. Empty-input failure falls back to localized status id `0x0b83`. This is the safest current structural read for selector `0x5e` beneath the preview-dataset callback table rather than a generic string setter.","objdump + local disassembly + caller inspection + selector-0x5e correlation + 0x6ceb9c-entry correlation + live-session-string correlation"
0x004725e0,91,multiplayer_selector0x5f_stage_current_token_and_publish_selector0x60,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x60`. This is the clean local selector-`0x5f` wrapper immediately above the narrower selector-`0x60` apply branch.","objdump + local disassembly + caller inspection + selector-0x5f correlation + selector-0x60 correlation + staged-token correlation"
0x00472640,159,multiplayer_selector0x60_apply_profile_entry_byte_0x15c_by_named_index_or_publish_error,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that either applies one small byte field into a `0x006ceb9c` entry or routes an error-style fallback. On the active payload branch it optionally marks whether payload dword `[+0x00]` matches the current live session id, resolves the target `0x006ceb9c` entry from payload dword `[+0x04]`, and when that entry's guard dword `[entry+0x1e1]` is nonzero writes payload byte `[+0x08]` into `[entry+0x15c]`. On the empty-input branch it instead resolves one live world-side owner through `0x004348c0`, copies global byte `0x00622090` into `[owner+0x15c]`, and falls back to localized status id `0x0b84`. In either branch, when the local-session match or fallback path is active it decrements `0x006d10a0` and may re-enter `0x0053f000`. This is the clearest current structural read for selector `0x60` above that one-byte profile-entry apply lane.","objdump + local disassembly + caller inspection + selector-0x60 correlation + 0x6ceb9c-entry correlation + live-world-owner correlation"
0x00472700,216,multiplayer_selector0x61_match_company_name_and_publish_selector0x62_or_error,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes one payload record from `[this+0x08]`, linearly scans indexed collection `0x0062be10` for the first entry whose inline name at `[entry+0x04]` matches the caller string at `[payload+0x08]`, and on a match stages the current year-derived token into `[0x006cd8d8+0x8f38]` before submitting selector `0x62` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with the original payload pointer and length from `[this+0x0c]`. When no matching company name resolves it instead submits the paired error-style selector-`0x62` payload through the `0x21` branch using the caller fallback buffer from `EDX+0x08`. This is the clearest current structural read for the selector-`0x61` owner above that selector-`0x62` submit split.","objdump + local disassembly + caller inspection + selector-0x61 correlation + selector-0x62 correlation + indexed-company-name correlation"
0x004727e0,144,multiplayer_selector0x62_copy_0x32_byte_company_entry_band_if_live_session_matches,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that requires a positive payload length from `[this+0x0c]`, checks whether payload dword `[+0x00]` matches the current live session id, resolves one company-style entry through `multiplayer_resolve_company_entry_by_index_if_live_session_profile_index_matches` `0x0046f8f0` using payload dword `[+0x04]`, and on success copies `0x32` bytes from payload band `[+0x08]` into the resolved entry at `[entry+0x04]` through `0x0051d8a0`. When the caller's session id matches the live session id but the entry apply fails, the helper falls back to localized status id `0x0b85`; the same local-session path then decrements `0x006d10a0` and may re-enter `0x0053f000`. This is the clearest current structural read for selector `0x62` above that fixed-width company-entry copy band.","objdump + local disassembly + caller inspection + selector-0x62 correlation + live-session correlation + company-entry copy correlation"
0x00472870,198,multiplayer_selector0x63_reject_duplicate_company_field_0x37_and_publish_selector0x64_or_error,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes one payload from `[this+0x08]`, linearly scans `0x0062be10` for an existing company-style entry whose dword field `[entry+0x37]` matches payload dword `[+0x08]`, and on the no-duplicate branch stages the current year-derived token into `[0x006cd8d8+0x8f38]` before resubmitting the original payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x64`. When a duplicate field-`0x37` value already exists it instead submits the paired error-style selector-`0x64` payload through the `0x21` branch using the caller fallback buffer from `EDX+0x08`. This is the safest current structural read for selector `0x63` above the narrower selector-`0x64` field-apply branch.","objdump + local disassembly + caller inspection + selector-0x63 correlation + selector-0x64 correlation + company-entry field-0x37 correlation"
0x00472940,176,multiplayer_selector0x64_apply_company_field_0x37_or_publish_error,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that either applies payload dword `[+0x08]` into company-entry field `[entry+0x37]` or publishes an error-style fallback. On the active payload branch it checks whether payload dword `[+0x00]` matches the current live session id, resolves the matching company-style entry through `multiplayer_resolve_company_entry_by_index_if_live_session_profile_index_matches` `0x0046f8f0` using payload dword `[+0x04]`, and on success stores payload dword `[+0x08]` into `[entry+0x37]`. On the failure path it resolves one live world-side owner through `0x00434870`, copies global dword `0x00622094` into that same field offset `[owner+0x37]`, and falls back to localized status id `0x0b86`. When the local-session path is active it then decrements `0x006d10a0` and may re-enter `0x0053f000`. This is the clearest current structural read for selector `0x64` above that one-field company-entry apply lane.","objdump + local disassembly + caller inspection + selector-0x64 correlation + company-entry field-0x37 correlation + live-world-owner correlation"
0x004729f0,57,multiplayer_selector0x73_stage_current_token_and_publish_selector0x74,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x74`. This is the clean local selector-`0x73` wrapper immediately above the narrower selector-`0x74` dispatch body.","objdump + local disassembly + caller inspection + selector-0x73 correlation + selector-0x74 correlation + staged-token correlation"
0x00472a50,75,multiplayer_selector0x74_resolve_company_entry_id_and_dispatch_collection_0x62b26c,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes payload dword `[this+0x08]`, checks whether that id resolves inside collection `0x0062b26c`, and on success first trips the small gate at `0x0046d2b0(1.02f)` to toggle global latch `0x006ce9a8` before calling the collection's vtable slot `+0x08` with that same id and then restoring the latch. This is the safest current structural read for selector `0x74` above that narrow collection-dispatch lane rather than a generic callback stub.","objdump + local disassembly + caller inspection + selector-0x74 correlation + 0x62b26c-collection correlation + latch-0x6ce9a8 correlation"
0x00472aa0,57,multiplayer_selector0x71_stage_current_token_and_publish_selector0x72,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x72`. This is the clean local selector-`0x71` wrapper immediately above the heavier selector-`0x72` counted-record apply body.","objdump + local disassembly + caller inspection + selector-0x71 correlation + selector-0x72 correlation + staged-token correlation"
0x00472b00,675,multiplayer_selector0x72_apply_counted_structure_records_into_live_collections,shell,thiscall,inferred,objdump + local disassembly + caller inspection,4,"Heavier selector-handler body that consumes a counted record set from `[this+0x08]` and applies it into the live world-side collections rooted at `0x0062b2fc`, `0x0062b26c`, and `0x0062bae0`. The handler first gates through `0x0046d2b0(1.02f)` and raises latch `0x006ce9a8`, then branches on the leading count word at `[payload+0x02]`. Its singleton fast path requires count `1` and a nonzero leading key word, seeds temporary sentinel fields under `0x0062b2fc`, bumps the scoped counter `[0x0062bae0+0x88]`, validates one record through `placed_structure_validate_projected_candidate_placement` `0x004197e0`, allocates or applies the live object through `placed_structure_collection_allocate_and_construct_entry` `0x004134d0`, and refreshes the region-side derived state through `world_region_refresh_cached_structure_class_mix_scalar_0x312_from_linked_chain` `0x00420560` when the keyed `0x0062bae0` entry exists. The general path walks `count` records of stride `0x12` from `[payload+0x04]`, applies the same `0x004197e0 -> 0x004134d0 -> 0x00420560` pattern per record, and finally restores the temporary `0x0062b2fc` sentinel fields and clears latch `0x006ce9a8`. This is the safest current structural read for selector `0x72` above that counted live-world apply family rather than a generic serializer inverse.","objdump + local disassembly + caller inspection + selector-0x72 correlation + counted-record correlation + live-world-collection correlation"
0x00472db0,8,multiplayer_selector_callback_apply_metric_delta_payload_into_company_entry,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Tiny selector-facing wrapper that loads payload pointer `[this+0x08]`, forwards it into `multiplayer_apply_rounded_float_delta_to_company_entry_metric_pair_by_index_byte` `0x0046f870`, and then returns success. Registration-site xrefs place it under selector `0x6b` in the broader multiplayer callback table, so this is the local selector-`0x6b` apply leaf rather than the train-record branch.","objdump + local disassembly + caller inspection + selector-0x6b correlation + company-metric apply correlation"
0x00472dc0,8,multiplayer_selector_callback_apply_train_record_payload_into_live_train_entry,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Tiny selector-facing wrapper that loads payload pointer `[this+0x08]`, forwards it into `multiplayer_apply_train_record_fields_into_live_train_entry_by_id` `0x0046d780`, and then returns success. Registration-site xrefs place it under selector `0x6c` in the broader multiplayer selector-handler table rather than as a standalone service owner.","objdump + local disassembly + caller inspection + selector-0x6c correlation + train-apply correlation"
0x00472dd0,205,multiplayer_selector0x6d_publish_winner_status_text_into_world_buffer,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes one payload from `[this+0x08]`, checks for an active world root at `0x006cec78`, and when the leading winner id dword differs from the current world winner id from `0x004337b0` resolves the matching `0x006ceb9c` name entry and formats localized status id `0x0f4e` into a local buffer through `0x005193f0` and `0x00518de0`. It then copies that formatted string into the world-side outcome-text buffer `[world+0x4b47]`, or clears the first byte of that buffer when the name lookup fails, and finally sets world latch `[world+0x4a73] = 1`. This is the clearest current static owner for selector `0x6d` above the already-grounded live outcome-status text band.","objdump + local disassembly + caller inspection + selector-0x6d correlation + world-outcome-buffer correlation + 0x6ceb9c-name correlation"
0x00472ea0,102,multiplayer_selector0x6e_mark_matching_current_bucket_record_flag_0x08_by_payload_hash,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes a payload blob from `[this+0x08]`, resolves the current keyed bucket under `[EDX+0x2580]` using dataset key `[0x006cd8d8+0x9888]`, and then walks that bucket's linked node chain. For each node it hashes the current selector payload through `0x0053d870` when `[this+0x0c] > 0` and compares that hash against the payload's leading dword `[payload+0x00]`; on the first match it sets flag bit `0x08` in the companion object byte `[ [this+0x04] + 0x0b ]`. This is the cleanest current structural read for selector `0x6e` beneath the earlier selector-`0x13` hashed publish fallback.","objdump + local disassembly + caller inspection + selector-0x6e correlation + keyed-bucket correlation + payload-hash correlation"
0x00472f10,81,multiplayer_selector0x75_stage_current_token_and_publish_selector0x76,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x76`. This is the clean local selector-`0x75` wrapper immediately above the narrower selector-`0x76` company-entry dispatch body.","objdump + local disassembly + caller inspection + selector-0x75 correlation + selector-0x76 correlation + staged-token correlation"
0x00472f70,60,multiplayer_selector0x76_resolve_company_entry_and_dispatch_local_handler_0x409830,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes payload dword `[this+0x08]`, checks whether that id resolves inside collection `0x0062be10`, and on success resolves the matching company-style entry and forwards that entry into local handler `0x00409830`. This is the cleanest current structural read for selector `0x76` above that narrow company-entry dispatch lane rather than a generic callback stub.","objdump + local disassembly + caller inspection + selector-0x76 correlation + company-entry correlation + local-handler correlation"
0x00472fb0,81,multiplayer_selector0x77_stage_current_token_and_publish_selector0x78,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x78`. This is the clean local selector-`0x77` wrapper immediately above the heavier selector-`0x78` world-dispatch body.","objdump + local disassembly + caller inspection + selector-0x77 correlation + selector-0x78 correlation + staged-token correlation"
0x00473010,175,multiplayer_selector0x78_resolve_company_entry_and_dispatch_projection_request,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes one structured payload from `[this+0x08]`, checks whether payload dword `[+0x04]` resolves inside `0x0062be10`, and on success forwards payload tuple `[+0x04/+0x08/+0x0c]` plus local stack outputs into the broader world-side helper `0x0044b160` using scale `1.0f`. When that helper succeeds it also notifies owner `0x006d401c` through `0x00538e00(0xba, 0x808, 0, 0, 0)`. Separately, when payload dword `[+0x00]` matches the current live session id it clears field `[0x006d1a8c+0x83]`, re-enters `0x0053f000(1,0,0x15)`, and calls `0x0045ea20(0x39, 1.0f)`. This is the safest current structural read for selector `0x78` above that world-side projection or notify branch rather than a narrow leaf helper.","objdump + local disassembly + caller inspection + selector-0x78 correlation + world-helper-0x44b160 correlation + local-session correlation"
0x004730c0,81,multiplayer_selector0x79_stage_current_token_and_publish_selector0x7a,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x7a`. This is the clean local selector-`0x79` wrapper immediately above the narrower selector-`0x7a` company-entry dispatch body.","objdump + local disassembly + caller inspection + selector-0x79 correlation + selector-0x7a correlation + staged-token correlation"
0x00473120,90,multiplayer_selector0x7a_resolve_company_entry_and_dispatch_local_handler_0x427e20,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes one structured payload from `[this+0x08]`, checks whether payload dword `[+0x04]` resolves inside `0x0062be10`, and on success resolves the matching company-style entry and forwards that entry plus payload dword `[+0x08]` and zero flag into local handler `0x00427e20`. When payload dword `[+0x00]` matches the current live session id it also re-enters `0x0053f000(1,0,0)`. This is the cleanest current structural read for selector `0x7a` above that narrow company-entry dispatch lane.","objdump + local disassembly + caller inspection + selector-0x7a correlation + company-entry correlation + local-handler correlation"
0x00473180,81,multiplayer_selector0x7b_stage_current_token_and_publish_selector0x7c,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x7c`. This is the clean local selector-`0x7b` wrapper immediately above the narrower selector-`0x7c` company-entry dispatch body.","objdump + local disassembly + caller inspection + selector-0x7b correlation + selector-0x7c correlation + staged-token correlation"
0x004731e0,52,multiplayer_selector0x7c_resolve_company_entry_and_dispatch_local_handler_0x426d60,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Selector-handler body that consumes payload dword `[this+0x08]`, checks whether payload dword `[+0x04]` resolves inside `0x0062be10`, and on success resolves the matching company-style entry and forwards that entry into local handler `0x00426d60`. This is the cleanest current structural read for selector `0x7c` above that narrow company-entry dispatch lane rather than a generic callback stub.","objdump + local disassembly + caller inspection + selector-0x7c correlation + company-entry correlation + local-handler correlation"
0x00473220,81,multiplayer_selector0x7d_stage_current_token_and_publish_selector0x7e,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Small selector-forwarding body that stages the current year-derived token into `[0x006cd8d8+0x8f38]` through `0x0046b6d0` and `0x0051d3c0`, then resubmits the original payload pointer `[this+0x08]` and length `[this+0x0c]` through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x7e`. This is the clean local selector-`0x7d` wrapper immediately above the registered selector-`0x7e` branch.","objdump + local disassembly + caller inspection + selector-0x7d correlation + selector-0x7e correlation + staged-token correlation"
0x00473280,1502,multiplayer_preview_dataset_reset_global_callback_state_and_register_selector_handlers,shell,cdecl,inferred,objdump + local disassembly + caller inspection,4,"Broader callback-registry seeding pass beneath the Multiplayer preview dataset constructor. The helper zeroes the two large multiplayer-global scratch bands at `0x006ce808..0x006ce994` and `0x006ce290`, clears the staged launcher globals `0x006ce628`, `0x006ce630`, and `0x006ce9b4..0x006ce9c8`, seeds the dataset-local default callback root at `[0x006cd8d8+0x08]` with `0x0046f4a0` through `multiplayer_preview_dataset_set_default_callback_root` `0x00468b50`, and then registers the keyed selector-handler family by repeatedly calling `multiplayer_preview_dataset_register_selector_callback_if_absent` `0x00468b10` for selector ids `1..0x83` with the concrete callback roots spanning `0x0046c390..0x00473220`. Current grounded caller is the full dataset constructor/reset body `0x0046be80`, so this is the clearest current owner for the broad selector-handler registration phase above the smaller fixed-name descriptor block `0x00473a60` rather than another anonymous callback fan-out.","objdump + local disassembly + caller inspection + global-scratch reset correlation + selector-handler registration correlation"
0x00473a60,219,multiplayer_preview_dataset_register_fixed_named_callback_descriptors_1_to_10,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Registers the first fixed selector-name callback block for the preview dataset at `0x006cd8d8`. The helper repeatedly calls `multiplayer_preview_dataset_append_named_callback_descriptor` `0x00469930` with selector ids `1..0xa`, fixed internal names from the `0x005ce3ac..0x005ce40c` string band, and the paired callback roots `0x0046db10..0x0046de80`. Current direct caller is the broader preview-dataset registration pass at `0x0046c1fb`, so this is the clearest current owner for the initial fixed descriptor block beneath `[0x006cd8d8+0x8f28]` rather than another anonymous callback fan-out.","objdump + caller inspection + local disassembly + fixed-descriptor-block correlation"
0x00473bf0,257,multiplayer_preview_dataset_publish_accumulated_selector0x71_record_batch,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Packages and publishes the accumulated fixed-width record band rooted at `0x006cd990` when the live count at `0x006ce9a0` is positive. The helper allocates one `0x14 * count + 0x4` payload block, prefixes it with two 16-bit header words `(0, count)`, copies each `0x12`-byte source record into the payload, submits that payload through `multiplayer_preview_dataset_submit_transport_request` `0x00469d30` with selector `0x71`, then resets `0x006ce9a0` and frees the temporary block. Current grounded caller is the broader current-session bucket service body `0x0046b9f0`, so this is the clearest current owner for the selector-`0x71` batch publish beneath that service path rather than another generic serializer.","objdump + local disassembly + caller inspection + selector-0x71 publish correlation"
0x00473cc0,3,multiplayer_preview_fixed_record_identity_helper,shell,thiscall,inferred,objdump + local disassembly,1,"Tiny identity helper that simply returns `ECX` unchanged. Current grounded caller is the fixed-record collection builder `0x00473f80`, where it initializes one stack-local temporary record before the later constructor and destructor callbacks.","objdump + local disassembly + fixed-record temp-helper correlation"
0x00473cd0,1,multiplayer_preview_fixed_record_noop_destructor_stub,shell,thiscall,inferred,objdump + local disassembly,1,"Literal no-op stub beside the `0x005ce418` fixed-record family. Current grounded caller is `0x00473f80`, where it serves as the paired release callback for the same stack-local temporary initialized by `0x00473cc0`.","objdump + local disassembly + fixed-record temp-helper correlation"
0x00473ce0,134,multiplayer_preview_fixed_record_construct_from_payload_strings_shell_profile_bytes_and_sequence,shell,thiscall,inferred,objdump + local disassembly + field-layout correlation,2,"Constructor for the `0x005ce418` fixed-record family rooted at size `0x187`. The helper stores the caller-supplied record id at `[this+0x00]`, copies one `0x78`-byte string into `[this+0x19]`, copies one `0xf0`-byte string into `[this+0x92]`, stores one caller dword at `[this+0x183]`, mirrors the current shell-profile-derived year tuple through `0x0051d3c0` into `[this+0x08]`, copies shell bytes `[0x006cec78+0x0d/+0x0f/+0x11]` into `[this+0x0c/+0x0e/+0x10]`, clears flag byte `[this+0x18]`, stores the caller-supplied owner dword at `[this+0x04]`, and assigns a monotonically increasing sequence at `[this+0x14]` from `0x006cea48`. Current grounded caller is the collection-side allocator `0x00473f80`, so this is the clearest current owner for the fixed record constructor rather than a generic string copier.","objdump + local disassembly + field-layout correlation + shell-profile correlation + sequence-counter correlation"
0x00473d70,42,multiplayer_preview_fixed_record_collection_construct,shell,thiscall,inferred,objdump + local disassembly + collection-layout correlation,2,"Constructor for the collection object rooted at vtable `0x005ce418`. The helper resets collection state through `0x00517ce0`, installs vtable `0x005ce418`, and initializes the collection through `0x00518570` with the fixed tuple `(1, 0x187, 0x0a, 0x05, 0, 0, 0)`. Current grounded callers are the fixed-record family paths beginning at `0x00473f80`, so this is the safest current read for the collection constructor rather than a record-local leaf.","objdump + local disassembly + collection-layout correlation + fixed-record-family correlation"
0x00473da0,18,multiplayer_preview_fixed_record_collection_release_and_free,shell,thiscall,inferred,objdump + local disassembly + collection-layout correlation,1,"Destructor-side wrapper for the same `0x005ce418` collection family. The helper reinstalls vtable `0x005ce418`, re-enters `0x00518600`, and then tails into `0x00518bd0`.","objdump + local disassembly + collection-layout correlation + fixed-record-family correlation"
0x00473dc0,87,multiplayer_preview_fixed_record_collection_query_max_sequence_entry,shell,thiscall,inferred,objdump + local disassembly + collection-iteration correlation,2,"Scans the live `0x005ce418` fixed-record collection and returns the record whose sequence dword `[entry+0x14]` is greatest. When no live record exists the helper returns `0`.","objdump + local disassembly + collection-iteration correlation + sequence-field correlation"
0x00473e20,73,multiplayer_preview_fixed_record_collection_query_any_inactive_record_with_owner,shell,thiscall,inferred,objdump + local disassembly + collection-iteration correlation,2,"Returns `1` when the live `0x005ce418` collection contains at least one record whose active flag byte `[entry+0x18]` is zero and whose owner dword `[entry+0x04]` is nonzero; otherwise returns `0`. This is the cleanest current structural read for the boolean scan beneath the same fixed-record family.","objdump + local disassembly + collection-iteration correlation + fixed-record-family correlation"
0x00473e70,106,multiplayer_preview_fixed_record_collection_query_min_sequence_entry_with_optional_active_filter,shell,thiscall,inferred,objdump + local disassembly + collection-iteration correlation,2,"Scans the live `0x005ce418` fixed-record collection and returns the record whose sequence dword `[entry+0x14]` is smallest. When the caller-supplied stack flag is zero it skips records whose active byte `[entry+0x18]` is nonzero; otherwise it accepts all live records. On no match it returns `0`.","objdump + local disassembly + collection-iteration correlation + sequence-field correlation + active-flag correlation"
0x00473ee0,68,multiplayer_preview_fixed_record_collection_find_entry_by_previous_sequence,shell,thiscall,inferred,objdump + local disassembly + collection-iteration correlation,2,"Searches the live `0x005ce418` fixed-record collection for the entry whose sequence dword `[entry+0x14]` equals `arg - 1`. On success it returns the resolved entry; otherwise `0`.","objdump + local disassembly + collection-iteration correlation + sequence-field correlation"
0x00473f30,68,multiplayer_preview_fixed_record_collection_find_entry_by_next_sequence,shell,thiscall,inferred,objdump + local disassembly + collection-iteration correlation,2,"Searches the live `0x005ce418` fixed-record collection for the entry whose sequence dword `[entry+0x14]` equals `arg + 1`. On success it returns the resolved entry; otherwise `0`.","objdump + local disassembly + collection-iteration correlation + sequence-field correlation"
0x00473f80,170,multiplayer_preview_fixed_record_collection_allocate_and_construct_entry,shell,thiscall,inferred,objdump + local disassembly + caller inspection + collection-layout correlation,2,"Shared allocator and constructor beneath the `0x005ce418` fixed-record family. When the live collection size exceeds `0x19`, the helper repeatedly resolves the minimum-sequence entry through `0x00473e70(1)` and removes it through collection virtual slot `+0x08` until the size drops to `0x19` or below. It then initializes one stack-local temporary through `0x00473cc0/0x00473cd0`, allocates a new live record through `0x00518900`, resolves that record through `0x00518140`, constructs it through `0x00473ce0` with the caller-supplied payload tuple, and finally tears down the temporary helper. This is the clearest current owner for fixed-record allocation plus constructor dispatch in the preview-side family.","objdump + local disassembly + caller inspection + collection-layout correlation + fixed-record-family correlation"
0x00470210,119,multiplayer_submit_chat_or_command_line,shell,cdecl,inferred,ghidra-headless,4,Submits one Multiplayer.win chat-entry line. The wrapper first calls multiplayer_dispatch_chat_command on the raw line buffer; when the parser returns zero it formats a normal `%s > %s` named chat line from the sender object at `[edi+0x08]` and the message payload; then either publishes it locally through multiplayer_publish_wrapped_chat_message or routes it through the active transport object at `0x006cec78`. When the parser returns nonzero the wrapper skips normal chat formatting because the slash-command branch already consumed the line.,ghidra + rizin + llvm-objdump + strings
0x004ecc90,52,multiplayer_set_pending_session_substate,shell,unknown,inferred,ghidra-headless,2,Small pending-session-substate setter used by the multiplayer session-event callback family. The grounded stores are request id `5` to substate `5` request id `6` to substate `6` and request id `8` to substate `8` at `0x006d1288`. Other current callback-family callers still pass ids `1` `2` `4` and `7` without a visible store in this helper so this row stays structural for now.,ghidra + rizin + llvm-objdump
0x004edce0,19,multiplayer_notify_window_owner,shell,unknown,inferred,ghidra-headless,3,Thin Multiplayer.win owner-notification wrapper. It loads the current window owner singleton from `0x006d1268` and when present forwards the supplied payload pointer into 0x004eccd0 for owner-side handling; current grounded callers are the session-event callback family around 0x004691a0 and the related registration path near 0x0046a8b3.,ghidra + rizin + llvm-objdump
0x004ecb20,101,multiplayer_reset_local_session_slot_state,shell,cdecl,inferred,ghidra-headless,4,Resets the local Multiplayer.win session-slot state before window init or add-open-slot flows. The helper marks the local state at `0x006cec7c+0x97` initialized clears the local slot counters at `+0x79` and `+0x7b` zeroes the slot-marker bytes at `+0x87` clears the local summary block at `+0x44` and zero-fills the large session backing block at `0x006d1270` when present.,ghidra + rizin + llvm-objdump
0x004ecb90,191,multiplayer_probe_or_allocate_open_player_slot,shell,cdecl,inferred,ghidra-headless,3,Probes or allocates one open local player-slot marker against the active Multiplayer.win session block at 0x006d1270. In probe mode `ecx=1` the helper checks that the local open-slot count and slot-marker bytes at `0x006cec7c+0x87` still fit within the remote slot counts and occupancy bytes rooted at `session+0x31b` and `session+0x3a3` and returns nonzero only when one additional slot can be claimed. In allocate mode `ecx=0` it finds the first locally empty slot whose remote occupancy byte is nonzero writes marker `0x64+index` into the local slot array increments `0x006cec7c+0x7b` and returns `0xff` on success.,ghidra + rizin + llvm-objdump
0x004ed590,224,multiplayer_sync_staged_text_controls,shell,cdecl,inferred,ghidra-headless,3,Synchronizes the shared Multiplayer.win staged-text buffer into the two mirrored text controls at ids 0xe48 and 0xe5d and then copies the same string back into the active selection buffer at 0x006cec74+0x1ef when it changed. The helper reallocates each control-owned backing string as needed and is used from the larger window initializer pending-status service and one delayed service-loop recovery branch.,ghidra + rizin + llvm-objdump
0x004ed800,109,multiplayer_preview_dataset_construct,shell,thiscall,inferred,objdump + caller xrefs,3,"Constructor-style zero initializer for the large Multiplayer preview-dataset object later stored at `0x006cd8d8`. It clears the leading linkage and mode fields, resets the request and staging words around `0x8f18..0x8f44`, zeroes the shell-mode snapshot slots at `0x9050` and `0x9054`, clears the dataset state word at `0x985c`, seeds `0x9860` to `-1`, and leaves the object ready for the follow-on reset and dispatch paths.",objdump + caller xrefs
0x004ed890,164,multiplayer_schedule_requested_action,shell,cdecl,inferred,ghidra-headless,3,Initializes one requested Multiplayer.win action and resets the shared action globals before later dispatch. The helper writes the requested action id from EDI into 0x006d127c marks the action-active bit at 0x006d1274 clears the pending-step and substate fields at 0x006d1278 0x006d1280 and 0x006d1288 tears down the prior helper object at 0x006d1294 and allocates a fresh 0x10-byte helper. The currently named action writers above it queue action ids 1 and 4 from preview-dataset reset 2 from staged text-entry dialog setup 3 from staged text-entry commit and 5 or 6 from selected-preview follow-up branches.,ghidra + rizin + llvm-objdump
0x004ed940,235,multiplayer_rebuild_open_player_slot_markers,shell,cdecl,inferred,ghidra-headless,3,Rebuilds the local Multiplayer.win open-player slot markers from the active session slot table and republishes the resulting count. The helper clears any existing local slot bytes above `0x64` from `0x006cec7c+0x87` while decrementing `0x006cec7c+0x7b` then walks the remote slot records at `session+0x31b` with count `session+0x3ae`. For each remotely open record it uses multiplayer_probe_or_allocate_open_player_slot to claim the next local marker when capacity remains and then formats the updated open-slot count into shell control `0x6f` with resource id `0xe36`.,ghidra + rizin + llvm-objdump
0x004edc40,145,multiplayer_reset_preview_dataset_and_request_action,shell,cdecl,inferred,ghidra-headless,3,Resets the active Multiplayer.win preview dataset object at 0x006cd8d8 and immediately schedules the next requested action. The helper destroys any existing 0x9898-byte dataset object allocates and constructs a fresh one through 0x004ed800 clears the text control at id 0xe47 and the staged entry buffer at 0x006d11a8 and then queues action id 1 when the caller passes zero or action id 4 when the caller passes a nonzero dataset-related value.,ghidra + rizin + llvm-objdump
0x004ee0e0,225,multiplayer_open_staged_text_entry_dialog,shell,cdecl,inferred,ghidra-headless,3,Opens the small Multiplayer.win staged text-entry dialog and queues requested action 2. The helper chooses one of two prompt ids from the current preview mode copies the current profile text from 0x006cec74+0x1ef into the staging buffer at 0x006d1128 persists the profile state through 0x00484910 builds a formatted prompt string through 0x00518de0 and opens the modal shell dialog through 0x004c98a0 with the local callbacks at 0x004ed100 and 0x004ed4c0 before queuing action 2.,ghidra + rizin + llvm-objdump
0x004ee1d0,456,multiplayer_commit_staged_text_entry,shell,cdecl,inferred,ghidra-headless,3,Commits one staged Multiplayer.win text entry and queues requested action 3 when validation succeeds. The helper refreshes the mode-dependent prompt text saves the shared profile state through 0x00484910 copies either the caller-provided string or the text control 0xe47 into the staging buffer at 0x006d11a8 derives the companion buffer at 0x006d1228 from the current preview object or fallback globals and when the staged text exceeds five bytes schedules action 3 through multiplayer_schedule_requested_action; otherwise it clears the staged buffer and text control.,ghidra + rizin + llvm-objdump
0x004ee3a0,244,multiplayer_reset_tool_globals,shell,thiscall,inferred,ghidra-headless,3,Resets the smaller multiplayer-tool singleton state rooted around 0x006d1268 through 0x006d1270 for one shell mode created from 0x00482ec0. The helper seeds the shared vtable clears or rebinds the active singleton pointers and performs the same early shell-service notifications used by the larger Multiplayer.win initializer before later selection or preview code runs.,ghidra + rizin + llvm-objdump + strings
0x004ee430,141,multiplayer_update_preview_mode_labels,shell,cdecl,inferred,ghidra-headless,3,Updates the small mode-dependent label widget pair used by the Multiplayer.win preview branch. The helper chooses one of two label-id pairs anchored by string ids 0xe12 0xe18 and 0xe73 then writes them through 0x00540120 into shell controls such as ids 0x65 0x6d 0x86 and 0x87. It is called from multiplayer_load_selected_map_preview_surface the larger multiplayer initializer and the restore-from-globals callback.,ghidra + rizin + llvm-objdump + strings
0x004ee4c0,49,multiplayer_publish_control_0x69_mode,shell,cdecl,inferred,ghidra-headless,2,Publishes the current mode for Multiplayer.win control 0x69 from the presence of the session-related singleton at 0x006d40dc. The helper pushes mode 3 when that object exists or mode 1 otherwise through 0x00469d30 and is used after preview and count-setting branches to keep that control in sync with session state.,ghidra + rizin + llvm-objdump
0x004ee500,50,multiplayer_are_all_peer_ready,shell,cdecl,inferred,ghidra-headless,4,Returns true only when every element in the shell-owned multiplayer peer list exposed through 0x00521680 has ready flag bit 0x01 set at offset +0x5c. The service loop uses this gate before committing the larger multiplayer launch or transition branch.,ghidra + rizin + llvm-objdump
0x004ee540,352,multiplayer_refresh_peer_roster_list,shell,cdecl,inferred,ghidra-headless,3,Refreshes the Multiplayer.win peer-roster list for preview modes 0xe12 and 0xe13. The helper chooses one of two mode-dependent text ids updates control 0x8b when the current roster selection is valid enumerates either the direct peer list at 0x006d40d0 or the fallback dataset-backed names from 0x006cd8d8 into repeated control-0x88 entries and when no roster entries remain forces a preview-dataset reset through multiplayer_reset_preview_dataset_and_request_action. It also republishes one session-state byte into shell control 9 before returning.,ghidra + rizin + llvm-objdump
0x004ee6a0,359,multiplayer_refresh_map_entry_list,shell,cdecl,inferred,ghidra-headless,3,Refreshes the Multiplayer.win map-entry list for preview modes 0xe11 and 0xe13. The helper chooses one of two mode-dependent text ids writes the active selection header into control 0x8b walks up to 0x80 0x11c-byte records from the list object exposed by control 0xe47 publishes each entry into repeated control-0x88 rows and mirrors the currently selected matching row into control 0x66. The comparison path uses the current staged selection text copied into a local buffer before the list walk.,ghidra + rizin + llvm-objdump
0x004ee810,308,multiplayer_publish_wrapped_chat_message,shell,cdecl,inferred,ghidra-headless,4,Publishes one Multiplayer.win chat or status message into the mode-dependent chat pane. The helper chooses text resource `0xe32` or `0xe5c` from the current preview mode at `[window+0x7c]`; resolves the corresponding text list object through `0x0053f830`; word-wraps the supplied string to width `0x3e`; emits each wrapped row into control `0x88` through `0x00540120`; stores per-row metadata back into the list object; and finally updates the summary row in control `0x66` or clears the pane when the caller passes a null string. It is used by the local chat transport fallback; the named `%s > %s` message publisher; and the Multiplayer.win launch-side action wrappers.,ghidra + rizin + llvm-objdump + strings
0x004eed30,208,multiplayer_sync_selected_map_entry,shell,cdecl,inferred,ghidra-headless,3,Selection wrapper above 0x004ee950 for the multiplayer map-preview branch. It walks the current 0x25a-byte multiplayer entry table compares the selected record string against the shell selection buffer near 0x006cec7c and then calls 0x004ee950 with either the matching strings or null inputs to refresh the active preview state.,ghidra + rizin + llvm-objdump
0x004ee950,982,multiplayer_load_selected_map_preview_surface,shell,cdecl,inferred,ghidra-headless,4,Loads or refreshes the currently selected .gmt-backed preview surface for the multiplayer window family rooted at 0x006d1270. The routine validates the selected filename suffix copies selected strings into the active record updates preview or status values under offsets such as +0x3b2 and +0x3b6 formats several shell text fields through 0x00540120 and finishes by decoding a 256x256 image through 0x0053f830 and surface_init_rgba_pixel_buffer. The branch is anchored by the larger Multiplayer.win initializer at 0x004efe80.,ghidra + rizin + llvm-objdump + strings
0x004eee00,649,multiplayer_refresh_map_preview_panel,shell,cdecl,inferred,ghidra-headless,3,Refreshes the multiplayer map-preview panel for one requested preview state or sentinel value. The helper stores the requested state at [this+0x78] updates several shell text fields through 0x00540120 handles the special active state 0xe15 and the fallback -1 case copies the selected entry strings out of the multiplayer entry table at 0x006d126c into the shell selection buffer near 0x006cec7c and then routes through multiplayer_sync_selected_map_entry or multiplayer_load_selected_map_preview_surface before returning.,ghidra + rizin + llvm-objdump + strings
0x004ef090,365,multiplayer_select_preview_mode_and_refresh,shell,cdecl,inferred,ghidra-headless,3,Selects one of the top-level multiplayer preview modes identified by command ids 0xe10 through 0xe13 then refreshes the preview panel. The helper stores the requested mode at [this+0x7c] updates the four mode-button states through 0x00540120 handles the special 0xe12 branch with extra multiplayer refresh helpers and a direct multiplayer_refresh_map_preview_panel call for state 0xe15 emits a summary status field at 0xe55 falls back through multiplayer_refresh_map_preview_panel(-1) and finally refreshes the panel timestamp at [this+0x80] through 0x0051d890.,ghidra + rizin + llvm-objdump + strings
0x004ef200,1786,multiplayer_service_pending_status_state_machine,shell,cdecl,inferred,ghidra-headless,4,Services the pending Multiplayer.win status or transition state machine when the global flag at `0x006d1278` is set. The routine clears the pending flag switches over the queued step id at `0x006d1280` and now has several grounded branches: step `1` builds modal status `0xe4f` optionally appends owner text from `0x006d4118/0x006d411c` tears down the preview dataset at `0x006cd8d8` and refreshes control `0xcc`; step `2` clears `0x006cd920` destroys the preview dataset and opens status `0xe50`; step `3` gates on latch byte `0x006d1292` and warns with `0xe51`; step `4` requires `0x006cd920 != 0` and `0x006ae3c8 >= 3` or warns with `0xe52` otherwise it seeds a random `RT3Player%d` name into the staged-text controls through multiplayer_sync_staged_text_controls and sets `0x006ae3c4 = 2`; step `5` opens status `0xe54` then rebuilds the preview dataset through multiplayer_reset_preview_dataset_and_request_action. A second substate switch on `0x006d1284` formats statuses `0xe55..0xe5f` `0xe92` and `0xf53`; its `0x5` and `0x8` families either force preview mode `0xe13` or reseed the default player-name path before syncing the staged-text controls.,ghidra + rizin + llvm-objdump + strings
0x004ef960,1260,multiplayer_dispatch_requested_action,shell,cdecl,inferred,ghidra-headless,4,Dispatches the current requested Multiplayer.win action stored in `0x006d127c`. The switch drives six higher-level action cases that combine immediate mode changes through multiplayer_select_preview_mode_and_refresh with deferred pending-step writes into `0x006d1278` and `0x006d1280`. The grounded wrappers are now broader than before: action `1` either enters preview mode `0xe11` immediately or schedules pending step `1`; action `2` resets the local session-slot state through multiplayer_reset_local_session_slot_state copies the staged text buffers into the active dataset seeds one local open-slot marker refreshes the local player rows enters preview mode `0xe12` and rebuilds the open-slot markers; action `3` copies the staged text buffers back into the active multiplayer object and then uses the dataset mode at `[0x006cd8d8+0x0c]` to schedule pending steps `0xa` `0xb` `0xc` `0xe` or fallback `0x2` while its resolved-mode branch re-enters preview mode `0xe12` clears latches `0x006d1291/0x006d1292` and seeds the local player panel; action `4` promotes the committed staged text into preview mode `0xe13` or schedules pending step `5` or `6` from the launcher substate at `0x006d1288`; action `5` pumps the selected-map follow-up callback then either rebuilds the open-slot markers and refreshes status control `0x109` or schedules pending step `1` with control `0x11` updates depending on the current launch-side state; action `6` validates the staged text against the active dataset and schedules pending step `6` when the launcher substate remains armed.,ghidra + rizin + llvm-objdump
0x004efe80,1388,multiplayer_window_init_globals,shell,thiscall,inferred,ghidra-headless,4,Initializes the Multiplayer.win shell window family and its large backing state block. The constructor seeds the shared vtable at 0x005d12ac clears multiplayer globals under 0x006d1274 through 0x006d1288 allocates and zeroes a 0x100f2-byte data block stored at 0x006d1270 registers the active singleton at 0x006d1268 pushes the Multiplayer.win resource into the standard shell window setup helper and then continues with multiplayer-specific list and status initialization. `shell_transition_mode` now grounds this as its mode-`5` constructor branch at `0x483313`.,ghidra + rizin + llvm-objdump + strings + branch correlation
0x0053f830,39,shell_window_find_registered_child_control_by_id,shell,thiscall,inferred,objdump + constructor helper correlation,3,"Looks up one registered shell child control by its 16-bit control id in the intrusive child-control list rooted at `[this+0x70]`. The helper walks each child through link field `+0x8e`, compares the requested id against child field `+0x04`, and returns the matching child pointer or null. Current grounded callers include the `Setup.win` preview-surface publisher `0x00502220`, the `Setup.win` constructor `0x00504010`, and `GameUppermost.win` message handler `0x004e0ba0`, which makes this the generic shell child-control lookup helper rather than a setup-only path.","objdump + constructor helper correlation + caller xrefs + intrusive-list correlation"
0x0053f9c0,131,shell_window_register_child_control_sorted_by_priority_and_optional_tag,shell,thiscall,inferred,objdump + constructor helper correlation,3,"Registers one prepared child-control object on the owning shell window while maintaining the intrusive child-control list rooted at `[this+0x70]/[this+0x74]`. The helper first finalizes the child through `shell_child_control_set_owner_resolve_caption_and_refresh` `0x00558130(owner)`, then walks the existing child list by priority byte at child field `+0x08`, optionally using the caller-supplied u16 tag to stop on one equal-priority sibling, and finally splices the child into the doubly linked list through fields `+0x8a/+0x8e`. Current grounded callers include the `Setup.win` constructor-side optional child branch at `0x0050429b` and the dividend-modal control setup helper `0x004c4c70`, so this now reads as the generic ordered child-control registration helper beneath several shell window constructors.","objdump + constructor helper correlation + caller xrefs + intrusive-list correlation + priority-order correlation"
0x0053fa50,508,shell_window_bind_resource_and_initialize_child_control_links,shell,thiscall,inferred,objdump + constructor correlation + strings,4,"Base shell window setup helper reused by many shell-side constructors. It clears the owning window's child-control list heads at `[this+0x70]/[this+0x74]`, copies the caller-supplied resource name into the local buffer at `[this+0x35]`, seeds several base window fields such as `[this+0x21] = 0x14` and clears `[this+0x54]/[this+0x58]`, and then continues through the shared shell resource-bind path for the requested window resource. Current grounded callers include the constructors for `Setup.win`, `Multiplayer.win`, `LoadScreen.win`, `Game.win`, `Campaign.win`, `Credits.win`, `Trainbuy.win`, `TrainDetail.win`, `StationDetail.win`, and several editor or detail-side dialogs, which makes this the generic shell window resource-bind and child-list initialization helper rather than one mode-specific constructor.","objdump + constructor correlation + strings + caller xrefs + child-list initialization correlation"
0x00558130,70,shell_child_control_set_owner_resolve_caption_and_refresh,shell,thiscall,inferred,objdump + child-control correlation,3,"Initial child-control finalizer used just before intrusive registration on a shell window. The helper stores the owning window pointer at `[this+0x86]`, resolves one localized caption into the inline text buffer at `[this+0x43]` when control word `[this+0x40]` is nonzero through `0x5193f0 -> 0x51d820`, normalizes uninitialized field `[this+0x38]` to `-1`, and then re-enters the child vtable through slots `+0x14` and `+0x3c` to refresh derived control state. Current grounded caller is `shell_window_register_child_control_sorted_by_priority_and_optional_tag` `0x0053f9c0`, which makes this the generic child-control setup step rather than a setup-only helper.","objdump + child-control correlation + caller xrefs + localized-caption correlation"
0x00504010,686,shell_setup_window_construct,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Constructs the `Setup.win` shell window singleton rooted at `0x006d14c0`. The constructor seeds vtable `0x005d1664`, binds the `Setup.win` resource plus `Setup_Coast_To_Coast.imb` through the shared base helper `shell_window_bind_resource_and_initialize_child_control_links` `0x0053fa50`, seeds companion globals `0x006d14b0..0x006d14bc`, marks the runtime profile at `0x006cec7c+0x7d`, immediately refreshes the mode-dependent and summary lanes through `0x00502910` and `0x00502550`, and seeds initial submode `1` through `shell_setup_window_select_launch_mode_and_apply_shell_state` `0x00502c00(1)`. It then builds the setup-control bands rooted at ids `0x0ce8`, `0x0e86`, `0x0e87`, `0x0e88`, repeated ranges `0x0c80..0x0c86` and `0x0f6f..0x0f71`, and optional controls such as `0x0ddf`, `0x0d4c`, and `0x0bd0`. The constructor-side callback split is tighter now too: control `0x0ce8` installs the table-driven payload-category row callback `0x00502030`, while controls `0x0e86` and `0x0e87` install the persisted shell-state selector callbacks `0x00502160` and `0x005021c0`, so that trio belongs to the presentation/config-save side of `Setup.win` rather than the later startup-selector or submode-dispatch lanes. The broader constructor shape is tighter too: the repeated `0x0c80..0x0c86` and `0x0f6f..0x0f71` bands are installed homogeneously as one button-family layer, `0x0e88` is a separate special control whose returned shell object is looked up through `shell_window_find_registered_child_control_by_id` `0x0053f830` and then retuned through float fields `+0xbc/+0xc4`, and the grayscale-heightmap controls `0x0ddf` and `0x0d4c` are only installed when the small capability guard at `0x0051b6f0` says that lane is available. The remaining optional child at `0x0bd0` is tighter now too: it is not another launch root, but a constructor-only owned child control built from the template string block at `0x005d16b4`, one temporary descriptor assembled on the stack through `0x0051d820`, and one optional `0x111`-byte heap object initialized through `0x0053b070/0x0055a040` before registration through `shell_window_register_child_control_sorted_by_priority_and_optional_tag` `0x0053f9c0`. `shell_transition_mode` now grounds this as its mode-`2` constructor branch at `0x483289`.","objdump + strings + caller xrefs + branch correlation + constructor callback correlation + constructor seed-path correlation + conditional-control-install correlation + optional-child-control correlation + generic-shell-helper correlation"
0x00502030,301,shell_setup_window_draw_table_driven_payload_category_row,shell,stdcall,inferred,objdump + constructor callback correlation + data-table inspection,3,"Table-driven `Setup.win` draw callback installed on control `0x0ce8` by the constructor at `0x00504010`. The callback uses the current setup payload at `0x006d14bc` plus the caller row index to read one category byte at `+0x31a`, maps that byte through the record table rooted at `0x005f2d47` to one localized string id via `0x005193f0`, chooses one of the companion style slots `0x18/0x19` depending on whether the current row falls below the shell-state threshold `[0x006cec7c+0x79]`, and then renders the assembled label through the companion objects at `0x006d14b0` and `0x006d14b4` via `0x0053de00 -> 0x00552560`. Current evidence grounds the callback as a table-driven payload-category row renderer rather than another launch or submode selector, even though the exact player-facing category name behind byte `+0x31a` remains open.","objdump + constructor callback correlation + data-table inspection + setup-payload correlation"
0x005174e0,136,shell_video_window_construct,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Constructs the `Video.win` shell window family. The constructor seeds vtable `0x005d1a4c`, increments the live counter under `0x006d4024+0x11427a`, stores live state in globals `0x006d3b68`, `0x006d3b74`, and `0x006d3b78`, binds the `Video.win` resource through `0x0053fa50`, and seeds the primary callback control `0x0c096`. `shell_transition_mode` now grounds this as its mode-`3` constructor branch at `0x4832b7`. The nearby sibling `0x00517660` binds `WinLose.win`, which makes that helper a related child panel rather than the main transition-mode window.","objdump + strings + caller xrefs + sibling correlation"
0x00517570,101,shell_video_window_destroy,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Destructor for the `Video.win` shell window family rooted at vtable `0x005d1a4c`. It decrements the live counter under `0x006d4024+0x11427a`, restores display bounds through `0x005206b0`, notifies the shell runtime through `0x00538a40`, and when the one-shot latch at `0x006d3b68` is set it clears `[0x006cec74+0xa8]` and re-enters the shell-support path through `0x00484910(1)`. This is the destructor sibling of `shell_video_window_construct` `0x005174e0` and is the old-mode teardown branch used by `shell_transition_mode` when leaving mode `3`.","objdump + strings + caller xrefs + destructor correlation"
0x004b8dc0,149,shell_campaign_window_destroy,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Destructor for the `Campaign.win` shell mode family. It restores vtable `0x005d0570`, resets shell display bounds through `0x005206b0`, marks one runtime display flag under `[0x006cec74+0x14]+0x110`, clears globals `0x006cfd28` and `0x006cfd34`, and then tails into the common shell object destructor. This is the destructor sibling of `shell_campaign_window_construct` `0x004b8e60` and is the explicit old-mode teardown branch used by `shell_transition_mode` when leaving mode `7`.","objdump + strings + caller xrefs + destructor correlation"
0x004b8e60,610,shell_campaign_window_construct,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Constructs the `Campaign.win` shell mode family. The constructor seeds vtable `0x005d0570`, binds `Campaign.win`, clears singleton globals `0x006cfd20` and `0x006cfd28`, stores the active object at `0x006cfd1c`, creates control families rooted at `0x0c351`, `0x0c36c..0x0c371`, `0x0c397..0x0c39a`, and `0x0c39b`, seeds or refreshes the shared companion object `0x006cfd34`, and mirrors campaign selectors from `[0x006cec7c+0xc4/+0xc6]` into local state plus the control band starting at `0x0c352`. `shell_transition_mode` now grounds this as its mode-`7` constructor branch at `0x483367`.","objdump + strings + caller xrefs + branch correlation"
0x004c7bc0,181,shell_credits_window_destroy,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Destructor for the `Credits.win` shell window family rooted at `0x006cfe8c`. It restores vtable `0x005d099c`, releases the 31 loaded image handles stored from `[this+0x78]`, frees the companion globals `0x006cfe90..0x006cfe9c`, clears the singleton `0x006cfe8c`, and releases the optional shared companion object `0x006cfea0`. This is the destructor sibling of `shell_credits_window_construct` `0x004c7fc0` and is the old-mode teardown branch used by `shell_transition_mode` when leaving mode `6`.","objdump + strings + caller xrefs + destructor correlation"
0x004c7fc0,717,shell_credits_window_construct,shell,thiscall,inferred,objdump + strings + caller xrefs,4,"Constructs the `Credits.win` shell window singleton rooted at `0x006cfe8c`. The constructor seeds vtable `0x005d099c`, binds `Credits.win` through `0x0053fa50`, loads `data\\Language\\Credits.lng`, materializes up to 250 credit rows into the large local table at `[this+0x584]`, loads the `logos.imb` companion asset and three additional shell resources into globals `0x006cfe90..0x006cfe9c`, seeds control `0x0edb`, and optionally allocates the shared companion object at `0x006cfea0`. `shell_transition_mode` now grounds this as its mode-`6` constructor branch at `0x48333d`.","objdump + strings + caller xrefs + branch correlation"
0x004f03f0,3612,multiplayer_window_service_loop,shell,cdecl,inferred,ghidra-headless,3,Top-level Multiplayer.win service loop. The function performs an early startup countdown through `0x006cd90c` calls multiplayer_service_pending_status_state_machine processes the special pending-step-10 gate with latch byte `0x006d1292` clears one text field when pending step 2 completes and then continues into the broader multiplayer update loop with timed retries staged-text synchronization peer-roster and map-entry list refresh helpers object-state checks and several mode-specific update branches. It queues requested action 5 after rebuilding one selected-map preview follow-up path and requested action 6 after the validated staged-text follow-up dialog branch. The launch-side inline wrappers now separate into three behaviors: a peers-not-ready warning dialog on resource `0xf15`; an add-open-slot path that seeds `0x006cec7c+0x83` stores the callback owner in `0x006d4110` and refreshes status control `0x109`; and a missing-session or slot-capacity warning path that opens modal dialogs on resources `0x2cf` `0x2b8` or `0x2b9`.,ghidra + rizin + llvm-objdump
0x004f13e0,167,multiplayer_restore_preview_state_from_globals,shell,thiscall,inferred,ghidra-headless,3,Restores the Multiplayer.win preview UI from the current global mode and preview-state fields. The callback refreshes the mode-dependent labels through multiplayer_update_preview_mode_labels mirrors selection presence into the active shell object toggles the 0x006d1291 recursion guard replays multiplayer_select_preview_mode_and_refresh and multiplayer_refresh_map_preview_panel using the saved fields at [this+0x7c] and [this+0x78] and if the active preview resources are missing schedules pending status step 7 by writing 0x006d1278 and 0x006d1280 instead of forcing an immediate redraw.,ghidra + rizin + llvm-objdump + strings
0x00502220,813,shell_setup_window_publish_selected_profile_labels_and_preview_surface,shell,cdecl,inferred,objdump + local disassembly,3,"Publishes the currently selected `Setup.win` profile or scenario labels and optional preview surface into the live window object supplied in `ECX`. The helper synchronizes the staged path pair under `[0x006cec7c]+0x11` and `+0x44`, toggles the local presence byte `[0x006cec7c+0x10]`, formats the visible label fields `0xcf5`, `0xe7f`, `0xd4c`, and `0xd4e` through `0x00540120`, and when a live setup payload is present under `0x006d14bc` first re-enters `shell_setup_load_selected_profile_bundle_into_payload_record` `0x00442400`, then copies payload word fields `+0x14/+0x3b2/+0x3ba` plus byte `+0x20` into the staged runtime profile through `shell_setup_profile_copy_payload_scroll_count_and_campaign_byte_and_seed_row_categories` `0x0047be50`, and finally decodes the `0x100 x 0x100` preview surface through `0x0053f830 -> 0x00559520`. Current grounded callers are the list-refresh wrappers at `0x005028f6/0x00502906`, the `Setup.win` dispatcher branch at `0x0050341f`, and the early setup-mode branch at `0x00503083`. This keeps the helper on the selection-label and preview-surface side of `Setup.win` rather than the later launch-mode dispatcher rooted at `0x00502c00`.","objdump + local disassembly + caller xrefs + control-id correlation + setup-payload-load correlation"
0x00502160,85,shell_setup_window_set_first_persisted_selector_flag_or_index_and_save_config,shell,thiscall,inferred,objdump + constructor callback correlation,3,"Small `Setup.win` callback installed on control `0x0e86`. Callback value `0` clears the shell-state presence dword at `[0x006cec74+0x233]`; nonzero values set that presence dword to `1`, store the zero-based selected index at `[0x006cec74+0x237]`, and then persist the shell configuration through `shell_save_graphics_config` `0x00484910(1)`. The constructor at `0x00504010` installs this beside sibling callback `0x005021c0`, which keeps the control on the persisted shell-state selector side of `Setup.win` rather than on the startup-selector or submode-dispatch side.","objdump + constructor callback correlation + shell-state write correlation"
0x005021c0,85,shell_setup_window_set_second_persisted_selector_flag_or_index_and_save_config,shell,thiscall,inferred,objdump + constructor callback correlation,3,"Small `Setup.win` callback installed on control `0x0e87`. It is the sibling of `0x00502160`: callback value `0` clears the shell-state presence dword at `[0x006cec74+0x23b]`, nonzero values set that presence dword to `1`, store the zero-based selected index at `[0x006cec74+0x23f]`, and then persist the shell configuration through `shell_save_graphics_config` `0x00484910(1)`. Current grounded owner is the `Setup.win` constructor `0x00504010`, which makes this a persisted shell-state selector callback rather than another launch or submode control.","objdump + constructor callback correlation + shell-state write correlation"
0x00502550,456,shell_setup_window_refresh_selection_lists_and_summary_fields,shell,cdecl,inferred,objdump + local disassembly,3,"Refreshes the larger `Setup.win` list and summary panel family from the current setup payload at `0x006d14bc` and staged profile state under `0x006cec7c`. The helper publishes the staged profile-path tail into control `0xe7f`, formats the scalar summary in `0xe84` from `[0x006cec7c+0x77]`, rebuilds the two persisted selector lists rooted at controls `0xe86` and `0xe87` from the static label tables `0x00620dd8` and `0x00620e3c`, mirrors the current persisted selections from shell-state pairs `[0x006cec74+0x233/+0x237]` and `[+0x23b/+0x23f]` into the selected-row summary at control `0x66`, and republishes the config toggles `0xe88/0xe89/0xe8a` from shell-state flags `[+0x247/+0x24b/+0x243]`. It also toggles the local latch at `0x006d14a8`. Current grounded callers are the setup-dispatch branches at `0x0050373a`, `0x00503b0e`, and the constructor-side follow-up at `0x005040c1`, which keeps this bounded as the main list-and-summary refresh helper for `Setup.win` rather than another submode selector.","objdump + local disassembly + caller xrefs + control-id correlation + persisted-selector-list correlation"
0x00502720,144,paint_terrain_tool_init_globals,shell,thiscall,inferred,ghidra-headless,4,Initializes the PaintTerrain shell tool singleton rooted at 0x006d14bc. The constructor seeds the tool vtable and default fields registers the active instance globally and is selected directly from shell_transition_mode alongside the neighboring terrain-edit tool constructor at 0x004ee3a0.,ghidra + rizin + llvm-objdump + strings
0x005027b0,351,shell_setup_window_refresh_file_backed_selection_list_panel,shell,cdecl,inferred,objdump + local disassembly,3,"Refreshes the file-backed list pane used by the `Setup.win` submodes that depend on the staged dataset at `0x006d14b8`. The helper chooses one top header-control family from the current setup submode at `[window+0x7b]`, now bounded exactly as `4 -> 0xd4b`, `9 -> 0xde8`, `6/12/14 -> 0xdf2`, and `10 -> 0xe85`, rebuilds the repeated row controls rooted at `0x88` from each record's text at `+0x12d`, mirrors the selected record into the summary slot `0x66` when its secondary path matches `[0x006cec7c+0x44]`, paints the fixed status-color strip rooted at control `0xaf` from the constant table `0x00622a98`, and then re-enters `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`. RT3.lng now also tightens one earlier misread here: those `0xd4b/0xde8/0xdf2/0xe85` values are local setup header-control or resource ids, not localized text ids. The setup-art bundle tightens that split one step further too: the only distinct file-backed setup art families under `rt3_2WIN.PK4` are the shared `Setup_Load(.imb/_Buttons.imb)` family and the separate `Setup_Sandbox(.imb/_Buttons.imb)` family, which matches the earlier selector evidence that mode `10` is the sandbox-backed `new` list while the neighboring mode `12` is its `load` sibling. The upstream dataset helpers now tighten the remaining family split too: this pane consumes rows staged by `shell_setup_file_list_construct_and_scan_dataset` `0x004336a0`, and the surrounding mode selector makes modes `4/6/10/12/14` default to the ordinary setup file root while mode `9` is the only file-backed sibling that also flips the shell-side root toward the map-family branch. Combined with the dataset normalization split in `0x004333f0`, that now shows only submodes `4` and `10` using the alternate localized-stem list-label path, while `6`, `9`, `12`, and `14` keep the direct filename-normalization lane. Current grounded callers are the mode-`4`, `9`, `6`, `10`, `12`, and `14` follow-up branches inside `shell_setup_window_select_launch_mode_and_apply_shell_state` `0x00502c00`.","objdump + local disassembly + caller xrefs + header-control correlation + dataset-list correlation + setup-file-root correlation + localized-file-list split + RT3.lng negative-result correlation + setup-art-family correlation"
0x00502910,744,shell_setup_window_refresh_mode_dependent_lists,shell,cdecl,inferred,objdump + local disassembly,3,"Refreshes the shared non-file-backed `Setup.win` payload panel family, using the current setup submode at `[window+0x7b]` only as a presence gate rather than a deep selector. The helper formats the current item-count summary into `0x0cf3`, publishes one fixed placeholder or stem into `0x0cf4`, republishes the staged-path tail into `0x0cf5`, formats the scalar field from `[0x006cec7c+0x77]` into `0x0d4f`, mirrors option-byte `[0x006cec7c+0x7d]` into the five compact controls `0x0ce9..0x0ced`, looks up the constructor-installed draw callback host at `0x0ce8`, and then rebuilds the repeated row controls under `0x88` from the current setup payload at `0x006d14bc`. That payload-side row family is tighter now too: row count comes from `[payload+0x3ae]`, the draw callback id is read from `[control+0x1d6]`, row availability is gated by bytes `[payload+0x31b]` and `[payload+0x31c]`, and the live row-selection marker bytes are mirrored into `[0x006cec7c+0x87]` as `1` for the first row, `0x64+index` for later live rows, and `0` for hidden ones. After the row rebuild it republishes the active summary row in control `0x66` when the caller-supplied index still falls inside the current visible band `[submode_base + current_scroll .. + current_scroll + live_rows)`. Current grounded callers are the direct submode follow-up at `0x00503243`, the decrement or increment and option-byte branches at `0x005037e9`, `0x00503828`, `0x0050385f`, `0x005038a8`, `0x005038df`, `0x00503904`, and the constructor-side follow-up at `0x005040ba`. This now bounds it as the shared payload-driven companion to `shell_setup_window_select_launch_mode_and_apply_shell_state` `0x00502c00`, distinct from the later file-backed pane rooted at `0x005027b0` and no longer safely reducible to a mode-`3`-only helper.","objdump + local disassembly + caller xrefs + control-id correlation + payload-row-availability correlation + shared-non-file-backed-panel correlation"
0x00502c00,472,shell_setup_window_select_launch_mode_and_apply_shell_state,shell,cdecl,inferred,objdump + local disassembly,4,"Central launch-mode selector for `Setup.win`. The helper clears or sets `[0x006cec74+0x6c]` according to the requested mode id, re-enters `0x00482e50` on the shell state, toggles the file-backed launch or rehydrate latch `[0x006cec7c+0x97]`, updates the staged-profile presence byte `[0x006cec7c+0x10]`, stores the selected setup submode at `[window+0x7b]`, and republishes the controlling status widgets through `0x00540120`. The file-backed lane is tighter now too: when one dataset-backed row is successfully selected, the helper materializes that dataset through `shell_setup_file_list_construct_and_scan_dataset` `0x004336a0`, copies the row's primary `0x32`-byte stem band into `[0x006cec7c+0x11]`, copies the secondary `0x32`-byte display-name band into `[0x006cec7c+0x44]`, sets `[0x006cec7c+0x10] = 1`, and re-enters `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`; when no valid row survives it drops the staged file-list owner at `0x006d14b8` instead. The internal submode split is tighter now too: mode `1` publishes the cached local exe-version string from `runtime_query_cached_local_exe_version_string` `0x00482d80` into control `0x0c23` and is now the strongest current fit for the main landing panel; mode `2` explicitly clears the staged-profile presence byte at `[0x006cec7c+0x10]` and now most safely reads as the `Single Player` root from RT3.lng `1991/1992`; modes `4`, `9`, `6`, `10`, `12`, and `14` drive the file-backed selection pane through `shell_setup_window_refresh_file_backed_selection_list_panel` `0x005027b0`; modes `4` and `9` plus `6`, `10`, `12`, and `14` also route the `0x0d4d/0x0d4e` preview fields through `0x0053fe90`; modes `7`, `8`, and `9` are the only values that pass `1` into `0x00482e50`; and modes `6`, `9`, `12`, and `14` are the values that clear `[0x006cec7c+0x97]` while sibling file-backed modes set it. The file-backed submode-to-dataset mapping is now exact too: submode `4 -> dataset 5`, `9 -> 4`, `6 -> 8`, `10 -> 6`, `12 -> 10`, and `14 -> 9`. The top-level button-state family is tighter now too: the selector later restyles one persistent control band so that `0xbc5` tracks submode `15`, `0xbc6` tracks `16`, `0xbba` tracks `2`, `0xbbb` tracks `3`, `0xbc3` tracks `13`, `0xbbc` groups `3/4/5`, `0xbbd` tracks `4`, `0xbbe` tracks `5`, `0xbbf` groups `6/12/14`, `0xbc0` tracks `7`, `0xbc1` tracks `8`, `0xbc2` tracks `9`, `0xe75` tracks `10`, and `0xf6e` tracks `17`. The setup file-root helpers now tighten the family boundary further: `shell_setup_file_list_construct_and_scan_dataset` `0x004336a0` defaults the ordinary setup file lanes to `saved games\\*.smp`, while the shell-state branch chosen here only flips into the `maps\\*.gm*` family when the requested mode leaves `[shell+0x6c] == 1`; the separate `[shell+0x6c] == 2` branch remains the tutorial-root `data\\tutorial` family above `0x00438890`. That means the ordinary saved-game-backed family is broader than the narrower file-list-pane family: modes `3`, `4`, `5`, `6`, `10`, `12`, and `14` all stay on the ordinary `.smp` setup side, but only `4`, `6`, `9`, `10`, `12`, and `14` re-enter the dedicated file-list pane at `0x005027b0`, while mode `3` stays on the option-heavy companion at `0x00502910`. Current asset and RT3.lng evidence now tighten several of those names too: mode `3` is the strongest current fit for the shared single-player `New Game` or `Options` companion behind `Setup_Options(.imb)`; mode `5` is the strongest current fit for the `Sandbox` companion behind `Setup_Sandbox(.imb)` and the later launch byte `[0x006cec7c+0x82] = 1`; mode `10` is now the strongest current fit for the sandbox-backed template or profile list because it is the only file-backed submode with its own `0x0e85` header family and a neighboring validated launch control `0x0e81` that both routes into selector `5` and sets runtime-profile byte `[0x006cec7c+0x82] = 1`; mode `4` is therefore the strongest
0x005033d0,1963,shell_setup_window_handle_message,shell,thiscall,inferred,objdump + local disassembly,3,"Primary message or command dispatcher for the `Setup.win` family rooted at `0x00504010`. The handler switches over many control ids in the `0x0c80..0x0f71` band, routes direct mode changes through `shell_setup_window_select_launch_mode_and_apply_shell_state` `0x00502c00`, refreshes the visible list families through `shell_setup_window_refresh_mode_dependent_lists` `0x00502910` and `shell_setup_window_refresh_selection_lists_and_summary_fields` `0x00502550`, republishes the selected labels and preview surface through `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`, and writes startup-profile selector values into `[0x006cec7c+0x01]` before later shell request `0x00482150(0xcc, ...)` transitions continue. The control-id split is tighter now too: `0x0d4b/0x0de8/0x0e85` reuse the current row index from `[msg+0x08]` to republish one selected setup record through `0x00502220`; `0x0e88/0x0e89/0x0e8a` toggle the persisted shell-state booleans at `[0x006cec74+0x247/+0x243/+0x24b]` and immediately save config through `0x00484910(1)`; `0x0c1f` is the settings-window escape through `shell_has_settings_window` `0x004fe120` and `shell_open_settings_window` `0x00501e50`; `0x0c1e`, `0x0c20`, and `0x0c22` are direct shell-request branches entering `0x00482150` with request ids `0x0cc` or `0x0cd`; `0x0bc2`, `0x0bc5`, `0x0bc6`, and `0x0bc7` are the separate shell-open or help-content quartet above `shell_query_registry_open_command_for_http_or_rtf_target` `0x00501f20`; `0x0bc1` and `0x0bc8` both select submode `15`, which now safely reads as the `Extras` family because RT3.lng `3118..3129` and the surrounding shell-open quartet align with `Readme`, `Weblinks`, and the return-to-extras sibling; `0x0bc3` selects submode `16`, which now most safely reads as the remaining `High Scores` top-level root because `Credits` already lives in separate shell mode `6` `Credits.win`; `0x0bc4` selects submode `1`, the current strongest main landing-panel fit; `0x0c80` selects submode `13`, now the strongest residual fit for the `Multi Player` root; `0x0c1c` selects submode `17`, which now safely reads as the tutorial chooser because mode `17` is the only family that later exposes startup selectors `1` and `7` through controls `0x0f6f` and `0x0f70`; `0x0c1d` selects submode `2`, the current strongest `Single Player` root from RT3.lng `1991/1992`; and `0x0c24` selects submode `14`; `0x0c81`, `0x0c82`, `0x0c83`, and `0x0c84` select submodes `14`, `6`, `10`, and `12`; `0x0c85` conditionally selects submode `4` or `3` from the entry flag at `[msg+0x2c]+0x6a`; `0x0ce4` writes selector `4` and then selects submode `8`, now the strongest `New Map` chooser fit from RT3.lng `2022/2026/2028`; `0x0ce5` writes selector `3` and then selects submode `9`, now the strongest `Load Map` list sibling; `0x0de0` and `0x0dea` both select submode `7`, now the strongest `Editor` root fit from RT3.lng `1995/1996`; `0x0df4` and `0x0e80` are the high-side slider refresh pair; `0x0e83` selects submode `1`; and `0x0f71` selects submode `1` after writing selector `7`. `0x0ce6/0x0ce7` and `0x0d49/0x0d4a` are bounded decrement or increment controls over `[0x006cec7c+0x7b]` and `[0x006cec7c+0x77]`; `0x0ce9..0x0ced` plus `0x0f3d..0x0f3f` store compact option bytes into `[0x006cec7c+0x7d]`; and `0x0e82/0x0e83` are the wider clamp-to-`0x834/0x70d` slider pair that feeds `0x00502550`. The later launch-side branches are tighter in a corrective way too: the validated staged-profile launch lane no longer includes `0x0ce5` or `0x0dcb`. `0x0cf6` and `0x0e81` are the selector-`5` siblings in that validated lane; current local disassembly also shows the neighboring selector-`3` validated lane is at least shared by the later `0x0de9` and `0x0df3` controls before shell request `0x0cc` continues; and `0x0e81` is now tighter still because it is the only one of those validated controls that also sets runtime-profile byte `[0x006cec7c+0x82] = 1`, the strongest curr
0x0047bc80,457,shell_setup_payload_seed_unique_row_category_bytes_and_marker_slots,shell,thiscall,inferred,objdump + local disassembly,3,"Normalizes the live `Setup.win` payload row metadata before the shared non-file-backed panel consumes it. Outside editor-map mode `[0x006cec74+0x68] == 0`, the helper clears the static category-used table rooted at `0x005f2d28`, marks every already-nonzero payload category byte from `[payload+0x31a + row*9]`, counts the existing marker bytes across the four 10-byte local bands rooted at `[payload+0x2ca]`, and fills any remaining empty marker slots at `[payload+0x2c9 + n]` until the payload row count at `+0x3ae` is covered. On the multiplayer-preview side it also forces runtime profile dword `[0x006cec7c+0x83] = 7`. It then walks the row records again and, for any zero category byte at `[payload+0x31a + row*9]`, chooses the next unused category id using runtime profile dword `[0x006cec7c+0x83]`, the local marker-slot bytes at `[payload+0x2c9 + n]`, and a bounded retry loop before writing the chosen category back and marking the static-used table. Current grounded callers are the setup payload-copy helper at `0x0047be50` and the post-load chairman-profile builder at `0x00437220`, which makes this the shared category-byte and marker-slot normalizer beneath the setup payload panel rather than one world-only helper.","objdump + local disassembly + setup-payload correlation + category-table correlation + marker-slot correlation + caller split"
0x0047be50,69,shell_setup_profile_copy_payload_scroll_count_and_campaign_byte_and_seed_row_categories,shell,thiscall,inferred,objdump + local disassembly,3,"Copies the small shared-panel runtime fields out of one live `Setup.win` payload record into the staged runtime profile at `0x006cec7c`, then normalizes the payload row metadata. When the caller-supplied payload pointer is non-null and its first byte is nonzero, the helper copies payload word `+0x14` into profile `+0x77`, payload word `+0x3b2` into profile `+0x79`, payload word `+0x3ba` into profile `+0x7b`, and payload byte `+0x20` into profile `+0xc5`, except that the three word copies are skipped while the multiplayer-preview owner at `0x006cd8d8` is live. It then tail-calls `shell_setup_payload_seed_unique_row_category_bytes_and_marker_slots` `0x0047bc80` on the same payload. Current grounded caller is `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`, which uses this helper immediately after the heavier payload-materialization lane at `0x00422400`.","objdump + local disassembly + setup-payload correlation + runtime-profile-field correlation + caller correlation"
0x0040cb00,13,placed_structure_set_linked_site_chain_next_id_field_0x2a2,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny direct setter over linked-site word `[this+0x2a2]`. The helper stores the caller-supplied site id and returns. Current grounded callers are the world-cell linked-site chain helpers `0x0042c9a0` and `0x0042c9f0`, where this field acts as the next-site link for the cell-local linked-site chain rooted at `[cell+0xd6]`.","objdump + caller xrefs + local disassembly + linked-site-chain correlation"
0x0047d810,182,placed_structure_remove_route_entry_key_and_compact,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Removes one matching `u16` route-entry key from the six-byte route-entry list rooted at `[this+0x462]/[this+0x466]`. The helper scans the current list, copies surviving six-byte entries into a newly allocated compacted buffer, frees the old buffer, stores the replacement pointer back into `[this+0x466]`, and decrements the route-entry count at `[this+0x462]`. Current grounded caller is the linked-site refresh or teardown branch at `0x0040e102`, so this is the keyed remove-and-compact companion to the linked site's route-entry list rather than another generic free helper.","objdump + caller xrefs + callsite inspection + route-entry-list compaction correlation"
0x0047d8e0,346,placed_structure_load_dynamic_side_buffers_from_stream,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Deserializes the variable-size side buffers on one placed-structure record from the caller-supplied persistence stream. The helper reads tagged blocks through `0x00531360` and `0x00531150`, repopulates the six-byte route-entry list at `[this+0x462]/[this+0x466]`, the three five-byte-per-site arrays rooted at `[this+0x24]` from count `[this+0x30]`, the five eight-byte proximity-bucket arrays counted at `[this+0x590..0x5a0]` and rooted at `[this+0x5a4..0x5b4]`, and the trailing twelve-byte scratch band at `[this+0x34]/[this+0x38]`, then clears `[this+0x5bd]` and re-enters `0x00407780`. Current direct caller is the collection-level load pass at `0x00481464`. The real body begins at `0x0047d8e0` even though current recovered calls target the preceding padding slot `0x0047d8d0`.","objdump + caller xrefs + callsite inspection + stream-layout correlation"
0x0047dcd0,64,placed_structure_clear_proximity_bucket_lists,map,thiscall,inferred,objdump + caller xrefs + data-layout inspection,3,"Clears the five proximity-bucket arrays rooted at `[this+0x5a4..0x5b4]`, zeroes the corresponding per-bucket counts at `[this+0x590..0x5a0]`, and resets the total proximity-entry count at `[this+0x5b8]`. Current grounded callers are the linked-site teardown pass at `0x00480590` and the sibling route-anchor refresh family at `0x00480719`, so this now reads as the common clear step for the nearby-site bucket family rather than a generic free helper.","objdump + caller xrefs + data-layout inspection + proximity-bucket correlation"
0x0047d6f0,10,placed_structure_set_linked_cell_owner_next_site_id_field_0x3c,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny direct setter over linked-site word `[this+0x3c]`. The helper stores the caller-supplied site id and returns. Current grounded callers are the world-cell owner-chain helpers `0x0042bbb0` and `0x0042bbf0`, where this field acts as the next-site link for the cell-local owner chain rooted at `[cell+0xd4]`.","objdump + caller xrefs + local disassembly + cell-owner-chain correlation"
0x0047dd10,130,placed_structure_remove_site_id_from_proximity_bucket_lists,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Removes one matching site id from every proximity bucket rooted at `[this+0x590..0x5b8]`. The helper scans all five bucket arrays, matches the supplied site id against the first dword of each eight-byte entry, compacts the surviving tail when needed, decrements the per-bucket count, and decrements the total count at `[this+0x5b8]`. Current direct caller is the collection sweep at `0x004814e9`, which makes this the remove-one-site companion to the nearby-site bucket append path rather than a broader route helper.","objdump + caller xrefs + callsite inspection + proximity-bucket correlation"
0x0047fdb0,317,placed_structure_append_nearby_transit_site_distance_bucket_entry,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Appends one nearby station-or-transit site into the current record's five proximity buckets. The helper first requires the caller-supplied peer record to pass `0x0047fd50`, then measures the current-to-peer distance through `0x00455800`, `0x00455810`, and `math_measure_float_xy_pair_distance` `0x0051db80`, rejects peers outside the fixed distance threshold at `0x005c8738`, classifies the surviving peer through `0x0040d350`, and finally appends one `(peer site id, distance)` pair into the corresponding eight-byte bucket array at `[this+bucket*4+0x5a4]` while incrementing both the per-bucket count and total count `[this+0x5b8]`. Current direct caller is the collection sweep at `0x004814a9`.","objdump + caller xrefs + callsite inspection + distance-threshold correlation + proximity-bucket correlation"
0x0047fef0,619,placed_structure_rebuild_nearby_transit_site_distance_buckets_from_neighbor_cells,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Rebuilds the current linked site's five nearby-transit proximity buckets from the neighboring world cells around its current position. After requiring the current record to pass `placed_structure_is_station_or_transit_site_class` `0x0047fd50`, the helper quantizes current world coordinates through `0x00455800`, `0x00455810`, and the world scale constant at `0x005c859c`, scans the surrounding live cell window through `[0x0062c120+0x2129]`, follows each cell's linked placed-structure chain through word field `[cell+0x0d6]` and next-id `[peer+0x2a2]`, keeps only peers whose resolved candidate subtype byte `[candidate+0x32]` equals `4`, and appends the survivors into the same `(peer site id, distance)` bucket arrays rooted at `[this+0x590..+0x5a4]` using the current world-distance threshold and bucket classifier. Current grounded caller is the linked-site runtime refresh owner `0x00480710`, so this is the safest current read for the proximity-bucket rebuild pass rather than another one-peer append helper.","objdump + caller xrefs + callsite inspection + neighbor-cell sweep correlation + proximity-bucket correlation"
0x00482d10,110,runtime_query_cached_local_exe_version_float,simulation,thiscall,inferred,objdump + local disassembly,3,"Returns one cached local executable version as a float-like `major + minor/100` value. On first use the helper queries the version-info resource of the literal stem `RT3.EXE` at `0x005cec18` through `0x0055d9c0`, splits the returned packed dword into low and high 16-bit words, converts them into one float as `hi + lo/100.0`, caches the result at `0x006cec5c`, and returns that cached value on later calls. The sibling formatter `0x00482d80` and the rounded hundredths query `0x00482e00` both consume the same source, which now makes this the clearest current owner for the local `1.03/1.04/1.05/1.06`-style version float rather than a gameplay progress value.","objdump + local disassembly + version-resource correlation"
0x00482d80,128,runtime_query_cached_local_exe_version_string,simulation,thiscall,inferred,objdump + local disassembly + string inspection,3,"Returns one cached local executable version string formatted from the same `RT3.EXE` version-info source used by `0x00482d10`. On first use the helper queries the packed local version dword through `0x0055d9c0`, formats it with the literal pattern `%d.%02d` at `0x005ced5c`, allocates one small shell string object at `0x006cec24`, and returns that cached string on later calls. Current grounded callers include `multiplayer_session_event_publish_registration_field` `0x0046a6c0` and the later shell text path at `0x00503254`, which makes this the clearest current local version-string owner.","objdump + local disassembly + string inspection + caller xrefs + version-resource correlation"
0x00482e00,70,runtime_query_hundredths_scaled_build_version,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared rounded hundredths-scaled build-version query used by route, company, train, and world-side logic. In the ordinary local path the helper consults the cached local executable version float from `runtime_query_cached_local_exe_version_float` `0x00482d10`, adds the fixed offset `0.0001`, multiplies by `100.0`, and rounds the result through the CRT helper at `0x005a10d0`, which makes the local outputs line up with integer build values such as `0x67/0x68/0x69/0x6a == 1.03/1.04/1.05/1.06`. When the multiplayer-side runtime rooted at `0x006cd8d8` is active, or when the local scenario-state gate at `0x004349a0` reports a later mode, it instead delegates to the multiplayer companion path at `0x0046a4b0`, which can reuse a cached network-side integer at `0x006cd96c` or scan live session-peer version fields before falling back to the same local executable-version path. Current grounded callers include the city-connection route builder `0x00402cb0`, the auxiliary tracker pair-metric dispatcher `0x004a65b0`, and numerous neighboring world-side maintenance branches. This is no longer best-read as a gameplay progress or era index: the recovered threshold pattern is a shared executable or session build-version gate.","objdump + caller xrefs + local disassembly + multiplayer-fallback correlation + version-resource correlation + threshold-correlation"
0x00482e50,271,shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shell-state owner beneath `shell_command_toggle_editor_map_mode_with_one_shot_warning_modals` `0x00441b50` and the setup-mode selector `0x00502c00`. The helper writes the caller-supplied boolean into editor-map mode field `[this+0x68]`, then splits its refresh side effects by that target mode. When the target mode is `0` it re-enters `0x004d44a0` and `0x004dfda0` when the detail-panel controller `0x006d0818` is live, refreshes the active world root through `world_compute_transport_and_pricing_grid` `0x0044fb70` when `0x0062c120` exists, and then re-enters `shell_apply_graphics_option_runtime_effects` `0x00484d70` with mask `0x0d` and stack flag `1`. When the target mode is nonzero it instead re-enters `shell_ensure_editor_panel_window` `0x004d4500` before the same `0x00484d70(0x0d, 1)` tail. Current evidence is strong enough to treat this as the real editor-map-mode setter plus dependent detail-panel, world, and graphics refresh owner.","objdump + local disassembly + caller inspection + editor-map-mode correlation + side-effect correlation"
0x00483680,17,shell_command_cycle_display_resolution_forward,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,2,"Small registered shell command beneath action id `0x78` and localized label id `0x0d52`. The helper fixes forward step `+1` in `ECX` and tail-calls `shell_cycle_display_resolution_and_publish_status` `0x00483780`. The row is therefore kept at that display-resolution-cycle wrapper and step-direction level.","objdump + command-registration correlation + local disassembly + caller inspection + wrapper correlation"
0x00483780,527,shell_cycle_display_resolution_and_publish_status,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Broader display-resolution cycle owner reached from the small forward and backward wrappers at `0x00483680`, `0x00483990`, and `0x004839a0`. The helper requires live shell presenter root `0x006d4024`, reads the current display mode through the active mode table and the paired width-bucket tables at `0x00620e64` and `0x00620e7c`, derives one bounded six-step cycle from the caller-supplied signed step in `ECX`, selects the next supported resolution pair, and applies that requested size through `0x005206b0`. It then formats and publishes a status string through `0x0051b700`, `0x00518de0`, and `0x005386e0`, refreshes dependent presentation state through `0x004625b0`, persists the graphics config through `0x00484910(1)`, and re-enters the neighboring shell follow-on `0x004821d0`. Current evidence is strong enough to treat this as the shared display-resolution cycle-and-apply owner rather than a narrower presenter-only math helper.","objdump + local disassembly + caller inspection + display-mode-table correlation + status-publish correlation"
0x00483990,8,shell_cycle_display_resolution_forward_wrapper,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper over `shell_cycle_display_resolution_and_publish_status` `0x00483780`. The helper fixes step `+1` in `ECX` and tail-jumps into the shared display-resolution cycle owner. Current evidence grounds it as the plain forward wrapper rather than a separate settings owner.","objdump + local disassembly + caller inspection + wrapper correlation"
0x004839a0,8,shell_cycle_display_resolution_backward_wrapper,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper over `shell_cycle_display_resolution_and_publish_status` `0x00483780`. The helper fixes step `-1` in `ECX` and tail-jumps into the shared display-resolution cycle owner. Current evidence grounds it as the plain backward wrapper rather than a separate settings owner.","objdump + local disassembly + caller inspection + wrapper correlation"
0x004839b0,37,shell_setup_query_file_list_uses_map_extension_pattern,shell,thiscall,inferred,objdump + literal inspection + caller correlation,3,"Returns whether the current `Setup.win` file-list scan should enumerate the map-family extension pattern `*.gm*` instead of the saved-game pattern `*.smp`. The helper checks the live shell state rooted at `0x006cec74`: it requires the broad setup/file gate at `[shell+0x1bf]`, then returns true when either `[shell+0x68]` is nonzero or the current setup-side mode flag at `[this+0x6c]` equals `1`. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, where the result chooses the search literal at `0x005c9d14` versus `0x005c9d1c`.","objdump + literal inspection + caller correlation + setup-file-root correlation"
0x004839e0,37,shell_setup_query_file_list_root_dir_name,shell,thiscall,inferred,objdump + literal inspection + caller correlation,3,"Returns the root directory name used by the current `Setup.win` file-list scan. When `[this+0x6c] == 2` it returns the literal `data\\tutorial` at `0x005ca338`; otherwise it returns `maps` at `0x005ced78` when `[this+0x68]` is nonzero or `[this+0x6c] == 1`, and falls back to `saved games` at `0x005ced80` for the ordinary setup-side load family. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, which formats the returned root through the literal `%s\\` at `0x005c9d10`.","objdump + literal inspection + caller correlation + setup-file-root correlation"
0x00433260,400,shell_setup_filter_candidate_file_by_dataset_and_payload_flags,shell,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Filters one candidate `Setup.win` filename against the current dataset id and the small payload-flag family recovered from the staged bundle. Editor-map mode short-circuits to success immediately through `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0`; otherwise the helper builds one rooted path from `shell_setup_query_file_list_root_dir_name` `0x004839e0`, opens the candidate bundle through `0x00530c80`, reads the small chunk family `0x2ee0/0x3c2` through `0x00531150/0x00531360`, and then applies dataset-specific acceptance rules to three recovered flag bytes. The current split is tighter now: dataset `10` requires the sandbox-side payload-flag family, dataset `9` requires a different nonzero payload-flag family, dataset `8` stays on the plain non-sandbox path, and dataset `12` adds one literal stem check through `0x005c9cf8` before the later payload-flag gate. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, which uses this helper as the real extension-and-payload filter beneath the file-backed setup lists.","objdump + local disassembly + caller correlation + setup-dataset correlation + payload-flag gating correlation"
0x004333f0,674,shell_setup_build_file_list_records_from_current_root_and_pattern,shell,thiscall,inferred,objdump + literal inspection + caller correlation,3,"Builds one normalized `Setup.win` file-list record block under the small collection object passed in `ECX`. The helper queries the current root directory through `shell_setup_query_file_list_root_dir_name` `0x004839e0`, chooses either `*.gm*` or `*.smp` through `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0`, enumerates the resulting search spec, filters out leading-dot names and extension mismatches through `0x00433260`, counts the surviving rows, allocates `count * 0x25a + 1` bytes, and then repopulates each row with the raw filename at offset `0` plus the normalized display label at `+0x12d`. Dataset ids `5`, `6`, and `7` take the alternate normalization path through `0x0051c920`; sibling dataset ids keep the direct `0x0051df90` text normalization lane. The surrounding selector now bounds the current file-backed mapping more tightly too: submode `4 -> dataset 5`, `9 -> 4`, `6 -> 8`, `10 -> 6`, `12 -> 10`, and `14 -> 9`. Current grounded wrapper is `shell_setup_file_list_construct_and_scan_dataset` `0x004336a0`.","objdump + literal inspection + caller correlation + record-layout reconstruction + dataset-normalization correlation + setup-submode-dataset mapping"
0x004336a0,33,shell_setup_file_list_construct_and_scan_dataset,shell,thiscall,inferred,objdump + caller correlation,3,"Small constructor wrapper above `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`. The helper stores the caller-supplied dataset id at `[this+0x04]`, zeroes the row count `[this+0x00]` and payload pointer `[this+0x08]`, and then immediately enters the deeper scan-and-build body. Current grounded caller is `shell_setup_window_select_launch_mode_and_apply_shell_state` `0x00502c00`, whose exact file-backed setup mapping is now bounded as submode `4 -> dataset 5`, `9 -> 4`, `6 -> 8`, `10 -> 6`, `12 -> 10`, and `14 -> 9`.","objdump + caller correlation + setup-dataset reconstruction + setup-submode-dataset mapping"
0x0051dc60,242,support_insertion_sort_fixed_records_by_embedded_key_offset,support,fastcall,inferred,objdump + local disassembly + caller correlation,3,"Generic adjacent-swap insertion sort over fixed-width records. The helper takes a base pointer in `ECX`, record count in `EDX`, and caller-supplied `record_size` plus `key_offset` on the stack, allocates one temporary record buffer through `0x005a125d`, and then runs the classic nested insertion pass over adjacent records. Each comparison forwards the two embedded key pointers `record + key_offset` into `0x005a57cf`; when the left key sorts after the right key, the helper swaps the two full `record_size`-byte records through the scratch buffer with `rep movs`. It finally releases the scratch buffer through `0x005a1145`. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, which passes `record_size = 0x25a` and `key_offset = 0x12d` to sort `Setup.win` file-list rows by their normalized display label rather than by the raw filename at offset `0`.","objdump + local disassembly + caller correlation + setup-file-list-sort correlation"
0x00420650,32,world_region_lazy_seed_field_0x317_from_shell_profile_word_0x0d_and_reenter_local_refresh,map,thiscall,inferred,objdump + local disassembly + shell-state correlation,2,"Small lazy-initialization helper in the world-region record family. When dword `[region+0x317]` is already nonzero it returns immediately. Otherwise it copies shell-profile word `[0x006cec78+0x0d]` into `[region+0x317]` and then jumps into the heavier local refresh body at `0x00420350`. Current grounded caller is the linked-site display-name refresh `0x00480bb0`, where it runs after the linked-site naming and anchor rebuild work.","objdump + local disassembly + shell-state correlation + lazy-init correlation + region-family correlation"
0x00420670,56,world_region_release_profile_collection_clear_linked_structure_site_chain_and_tail_base_cleanup,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-family correlation,2,"Release-side helper in the world-region record family. The function frees optional profile-collection pointer `[region+0x37f]` through `0x00518bd0` plus `0x0053b080`, clears that field, re-enters `world_region_clear_linked_structure_site_chain_from_head_field_0x383` `0x0041f8d0`, and then tails into base cleanup `0x00455d20`. Current grounded caller is the collection-side remove helper `0x00421700`.","objdump + caller xrefs + local disassembly + region-family correlation + profile-collection correlation + link-chain correlation"
0x004206b0,274,world_region_upsert_or_remove_structure_profile_weight_by_name,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Editor-facing region-subcollection mutation helper over `[region+0x37f]`. The function linearly scans the current live subcollection for one exact profile-label match through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and `0x005a57cf`. On the not-found path it creates a new entry through collection virtual slot `+0x04` only when the caller-supplied weight is positive. On the found path it either removes the matching entry through collection virtual slot `+0x08` when the weight is non-positive or rewrites the existing entry weight at `[entry+0x1e]` when the weight stays positive. All three branches then re-enter `0x00420410` to refresh the region's derived profile cache. Current grounded caller is the `Cities/Regions` editor handler `0x004ce380`, where it reapplies per-candidate industry weighting state to the selected region.","objdump + local disassembly + caller correlation + region-subcollection correlation + editor-weighting correlation"
0x00420350,96,world_region_refresh_local_scalar_field_0x31b_from_seed_word_0x317_and_shell_profile_word_0x0d,map,thiscall,inferred,objdump + caller xrefs + local disassembly + shell-state correlation,2,"Small scalar-refresh helper in the world-region record family. It treats word or dword `[region+0x317]` as the seed year or profile lane, compares it against shell-profile word `[0x006cec78+0x0d]`, and writes the derived float result to `[region+0x31b]` through a bounded piecewise curve: zero seed produces `1.0f`; positive deltas `0..2` map upward from that base through the `(3-delta)` branch; deltas `3..5` stay flat at `1.0f`; and deltas `6+` taper back down through the scaled `(delta-6)` subtraction path after clamping at `0x14`. When region class dword `[region+0x23e]` is nonzero it applies one extra affine adjustment before returning. Current grounded entry points are the lazy seeder `0x00420650` and the second jump-in at `0x00420d39`.","objdump + caller xrefs + local disassembly + shell-state correlation + scalar-curve correlation + region-family correlation"
0x00420d40,173,world_region_accumulate_linked_structure_balance_prepass_and_tail_growth_scalar_refresh,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-normalization correlation,3,"Per-region prepass beneath `world_region_normalize_cached_structure_balance_scalars` `0x00422320`. The helper clears cached float accumulators `[region+0x306/+0x30a/+0x30e]`, then walks the linked placed-structure chain rooted at `[region+0x383]` through the live registry `0x0062b26c`. For each linked record it accumulates two float-like local metrics through the neighboring placed-structure helpers `0x0040ca70` and `0x0040ca80`, and when the resolved candidate class byte `[candidate+0x32]` is zero it also resolves the backing source record through `0x0040cec0` and adds integer field `[source+0x141]` into the third accumulator. After the chain drains it tails into `0x00420560` for the follow-on refresh. Current grounded caller is the collection-wide normalization sweep `0x00422320`, where this helper is the explicit per-region prepass before the later cohort normalization and category-count writeback stages.","objdump + caller xrefs + local disassembly + region-normalization correlation + linked-structure-chain correlation"
0x00420560,235,world_region_refresh_cached_structure_class_mix_scalar_0x312_from_linked_chain,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-normalization correlation,3,"Per-region linked-structure refresh over cached float `[region+0x312]`. The helper runs only on class-0 regions with a nonempty linked placed-structure chain at `[region+0x383]`, walks that chain through the live registry `0x0062b26c`, resolves each record's candidate through vtable slot `+0x80`, and then folds class-specific contributions into `[region+0x312]`. The current grounded split is structural but real: candidate class `0` contributes a source-derived term from `[source+0x141]` through `0x0040cec0`, class `2` contributes one branch keyed by candidate field `[candidate+0x78c]` plus placed-structure field `[site+0x246]`, class `3` adds one fixed increment, and class `1` currently contributes nothing. Current grounded callers are the prepass tail `0x00420d40`, one broader region worker at `0x00423d17`, the late world-entry region sweep at `0x00444baa`, and the paired editor-side or scenario branches at `0x00472c16` and `0x00472d2c`, so the safest current read is the shared linked-structure class-mix refresh under the broader region normalization family rather than a one-off stats formatter.","objdump + caller xrefs + local disassembly + region-normalization correlation + linked-chain-class-split correlation"
0x00420e00,453,world_region_rebuild_profile_collection_from_source_region_and_seed_default_weights,map,thiscall,inferred,objdump + caller xrefs + local disassembly + editor-copy-flow correlation,3,"Region-side subcollection rebuild helper over `[region+0x37f]`. The function first frees and recreates the current `0x88`-byte indexed collection at `[region+0x37f]`, then when the caller supplies one source region it walks that source region's live subcollection, copies each entry label into a local stack buffer, and replays the copied weight at `[entry+0x1e]` through `world_region_upsert_or_remove_structure_profile_weight_by_name` `0x004206b0`. When no source region is supplied it instead seeds one default profile set directly through repeated `0x004206b0` calls with fixed label literals and weight `0.2f`, splitting later by region live byte `[region+0x23e]`. Current grounded caller is the `Cities/Regions` editor copy-industry branch at `0x004ce72c`, so this is the safest current read for the region profile-collection rebuild plus copy-or-default seeding path rather than a generic collection allocator.","objdump + caller xrefs + local disassembly + editor-copy-flow correlation + profile-subcollection rebuild correlation"
0x00420ed0,803,world_region_rebuild_profile_collection_and_seed_class_split_default_weights,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-profile correlation,3,"Companion region-side subcollection rebuild helper over `[region+0x37f]` for the no-source default path. Like `world_region_rebuild_profile_collection_from_source_region_and_seed_default_weights` `0x00420e00`, the function first frees and recreates the current `0x88`-byte indexed collection at `[region+0x37f]`. It then immediately seeds one fixed profile-label set through repeated `world_region_upsert_or_remove_structure_profile_weight_by_name` `0x004206b0`, but the exact label set splits by region class dword `[region+0x23e]`: nonzero-class regions take one all-`0.2f` default set, while class-0 regions take a different default family that starts with one `0.3f` entry and then continues with repeated `0.2f` entries. Current grounded caller is the neighboring default-region initialization path at `0x0042141c`, so this is the safest current read for the shared class-split default profile seeding companion beneath the broader region-profile collection family rather than another editor-only copy helper.","objdump + caller xrefs + local disassembly + region-profile correlation + class-split default-set correlation"
0x00421200,547,world_region_construct_entry_with_id_class_and_default_marker09_profile_seed,map,thiscall,inferred,objdump + local disassembly + caller xrefs + region-family correlation,3,"Concrete world-region record constructor beneath the region-collection allocator. The helper writes the new region id into `[region+0x23a]`, stores the caller-supplied class dword into `[region+0x23e]`, clears the broader cached metric, queue, and linked-structure bands through `[region+0x242..+0x385]`, allocates one `0x88`-byte profile collection into `[region+0x37f]`, copies shell gate `[0x006cec74+0x174]` into `[region+0x385]`, seeds the display-name buffer `[region+0x356]` from localized id `0x00cd`, then pushes literal stem `Marker09` into `0x00455b70` before rebuilding the default profile collection through `world_region_rebuild_profile_collection_and_seed_class_split_default_weights` `0x00420ed0`. The helper also initializes cached density or growth floats such as `[region+0x25a/+0x25e] = 100.0f`, `[region+0x256] = 10`, and `[region+0x31b] = 1.0f`. Current grounded caller is `world_region_collection_allocate_and_construct_entry` `0x00421660`.","objdump + local disassembly + caller xrefs + region-family correlation + default-profile correlation"
0x00421430,49,world_region_collection_construct,map,thiscall,inferred,objdump + caller xrefs + collection correlation,2,"Small constructor for the live world-region manager stored at `0x0062bae0`. The helper first re-enters base collection setup `0x00517ce0`, then installs vtable `0x005c9ae0`, clears reentrancy dword `[this+0x88]`, and tails into `0x00518570` for the remaining collection initialization. Current grounded caller is the broader world-side bootstrap strip at `0x004487db`, which allocates `0x90` bytes and stores the result into global region-collection root `0x0062bae0`.","objdump + caller xrefs + collection correlation + bootstrap correlation"
0x00421470,22,world_region_collection_destruct,map,thiscall,inferred,objdump + vtable scan + local disassembly + collection correlation,2,"Destructor-side companion to `world_region_collection_construct` `0x00421430`. The helper reinstalls vtable `0x005c9ae0`, re-enters `0x00518600`, and then tails into `0x00518bd0`. Current evidence grounds it as the small collection destructor for the live world-region manager rather than a broader bootstrap owner.","objdump + vtable scan + local disassembly + collection correlation"
0x00421510,197,world_region_collection_refresh_records_from_tagged_bundle,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-family correlation,3,"Collection-wide tagged load owner for the live world-region manager at `0x0062bae0`. The helper opens chunk `0x5209`, refreshes collection-side metadata through `0x00518680`, opens chunk `0x520a`, then walks every live region record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` before dispatching each resolved record through vtable slot `+0x40` with the caller-supplied bundle or stream context. It closes with chunk `0x520b` and returns the accumulated tagged-load byte count. Current grounded caller is the broader world-state load branch at `0x00444887`, where it runs directly on `0x0062bae0` between neighboring tagged collection families, so this is the safest current read for the region-collection tagged load or refresh owner rather than the separate geographic-label database loader at `0x00461650` over `0x006ada80`.","objdump + caller xrefs + local disassembly + region-family correlation + chunk-family correlation"
0x004215e0,118,world_region_collection_serialize_records_into_tagged_bundle,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-family correlation,3,"Collection-wide tagged save owner for the live world-region manager at `0x0062bae0`. The helper emits chunk `0x5209`, forwards the current collection metadata through `indexed_collection_serialize_header_or_live_id_band` `0x00517d90`, emits chunk `0x520a`, then walks every live region record through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` before dispatching each resolved record through vtable slot `+0x44` with the caller-supplied bundle or stream context. It closes with chunk `0x520b`. Current grounded caller is the broader tagged world-save branch at `0x0044577d`, where it runs directly on `0x0062bae0` beside neighboring tagged collection serializers, so this is the safest current read for the region-collection tagged save owner rather than the separate geographic-label database loader `0x00461650`.","objdump + caller xrefs + local disassembly + region-family correlation + chunk-family correlation"
0x00421660,144,world_region_collection_allocate_and_construct_entry,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-family correlation,3,"Shared allocator wrapper for one live world-region record. The helper first seeds one stack-local scratch block through `0x0041f590`, allocates a new collection entry id through `0x00518900` with row size `0x389`, resolves that id through `0x00518140`, and then forwards the new region id plus the caller-supplied class and constructor arguments into `world_region_construct_entry_with_id_class_and_default_marker09_profile_seed` `0x00421200`. When the optional caller-supplied display-name pointer is nonnull it also copies up to `0x28` bytes into `[region+0x356]`, and before returning it sets world latch `[0x0062c120+0x2201] = 1`. Current grounded caller is `world_region_collection_seed_default_regions` `0x00421b60`, where it materializes the numbered default region set.","objdump + caller xrefs + local disassembly + region-family correlation + collection-allocation correlation"
0x00420410,167,world_region_refresh_profile_availability_summary_bytes_0x2f6_0x2fa_0x2fe,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small derived-summary refresh over the current region subcollection `[region+0x37f]`. The helper clears the three dword summary lanes `[region+0x2f6/+0x2fa/+0x2fe]`, walks every live profile entry through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, resolves the backing structure candidate by name through `0x00412b70`, and then inspects candidate bytes `[candidate+0xba]` and `[candidate+0xbb]`. When either byte is nonzero it sets `[region+0x2f6] = 1`; a nonzero `[candidate+0xba]` sets `[region+0x2fa] = 1`, while the complementary branch sets `[region+0x2fe] = 1`. Current grounded caller is the editor-side mutation helper `0x004206b0`, which runs this refresh after every profile add, remove, or weight update.","objdump + local disassembly + caller correlation + region-subcollection correlation + summary-byte correlation"
0x004204c0,155,world_region_refresh_profile_availability_display_strings_for_cached_selector_0x2f2,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Display-side companion to `world_region_refresh_profile_availability_summary_bytes_0x2f6_0x2fa_0x2fe` `0x00420410` over the current region subcollection `[region+0x37f]`. When the caller-supplied selector differs from cached dword `[region+0x2f2]`, the helper walks every live profile entry through `0x00517cf0/0x00518380/0x00518140`, resolves the backing structure candidate by name through `0x00412b70`, and for availability-qualified candidates formats one per-profile display string through `0x005a19c4` using format roots `0x005c93e8` or `0x005c93d8` chosen from candidate bytes `[candidate+0xba]` and `[candidate+0xbb]`. It then caches the selector back into `[region+0x2f2]`. Current grounded caller is the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40`, which reruns this helper after restoring each fixed `0x29`-byte region row and its paired profile subcollection.","objdump + local disassembly + caller correlation + region-subcollection correlation + display-string correlation + selector-cache correlation"
0x00421d20,246,world_region_collection_count_regions_with_profile_label_matching_candidate_name,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Counts the live regions in the current region collection whose profile subcollection `[region+0x37f]` contains one label equal to the candidate-name string for the caller-supplied candidate id. The helper resolves that candidate name from the global candidate pool `0x0062b268`, lowercases its first byte through `0x0051d660` as a cheap prefilter, skips region records whose class dword `[region+0x23e]` is nonzero and whose companion availability count `[region+0x242]` is nonpositive, then walks each surviving region's profile entries through `0x0041f6a0` and `0x0041fac0` until a casefolded label match through `0x005a57cf` is found. It increments the region count once per matching region and returns that total. Grounded callers include the editor-side summary builders at `0x004cdd56` and `0x004d150e`.","objdump + local disassembly + caller correlation + region-profile correlation + editor-summary correlation"
0x00421e30,275,world_region_collection_resolve_nth_region_with_profile_label_matching_candidate_name,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Resolves the Nth live region in the current region collection whose profile subcollection `[region+0x37f]` contains one label equal to the candidate-name string for the caller-supplied candidate id. The helper uses the same first-byte lowercase prefilter and full casefolded compare as `0x00421d20`, skips nonzero-class regions whose `[region+0x242]` count is nonpositive, and increments one match counter once per region rather than once per profile row. When that counter reaches the caller-supplied 1-based ordinal, it returns the matching region record pointer; otherwise it returns null. Current grounded caller is the editor-side enumerator at `0x004cdeab`, which immediately formats the returned region name for display.","objdump + local disassembly + caller correlation + region-profile correlation + editor-summary correlation"
0x00422010,155,world_region_collection_resolve_nearest_class0_region_id_covering_normalized_rect,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Scans the live region collection for class-0 region records whose normalized primary and secondary coordinates fall inside the caller-supplied inclusive float bounds, refreshes a small region-local helper through `0x00455a70(0)` on each in-bounds candidate, and keeps the nearest matching region id `[region+0x23a]` by squared XY distance through `math_measure_float_xy_pair_distance` `0x0051db80`. The helper returns `0` when no class-0 region lies inside the supplied rectangle. Current grounded callers include the world-side selection branch at `0x00452658`, where integer world arguments are converted to floats before the query, and the small string wrapper `0x004220b0`.","objdump + local disassembly + caller correlation + region-distance correlation"
0x004220b0,73,world_region_collection_query_name_of_nearest_class0_region_covering_normalized_rect_or_default,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Small wrapper above `world_region_collection_resolve_nearest_class0_region_id_covering_normalized_rect` `0x00422010`. When the inner query returns a live region id, the helper resolves that region and returns name pointer `[region+0x356]`; otherwise it copies the fallback localized string `0x00d0` into global scratch buffer `0x0062ba90` and returns that buffer instead. Grounded callers include the early world-status formatter `0x00401815`, the later world-side branch `0x00411c41`, and the terrain-side formatter at `0x004f2b97`.","objdump + local disassembly + caller correlation + region-name correlation"
0x00422100,543,world_region_collection_pick_periodic_candidate_region_and_queue_region_focus_modal_record,map,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Periodic region-side selector reached from `simulation_service_periodic_boundary_work` `0x0040a590`. The helper first requires several live world-state gates to be clear, derives one year-sensitive random threshold from selected-year fields `[world+0x05/+0x0d/+0x0f]` plus live world width `[world+0x2155]`, and returns immediately unless one bounded random test passes. On the active path it scans the live region collection twice. The first pass counts eligible class-0 regions whose transient dwords `[region+0x276]` and `[region+0x302]` are clear and which fail the city-connection peer probe `0x00420030(1,1,0,0)`. The second pass picks one random eligible region, derives one small severity bucket from cached scalar `[region+0x25e]`, stores the resulting scaled amount into `[region+0x276]`, and appends one `0x20`-byte queued record through `0x004337c0` with fixed payload `0x005c87a8`, literal kind `7`, zero promotion-latch dword `[node+0x0c]`, the chosen region id `[node+0x10]`, that scaled amount at `[node+0x14]`, and sentinel tails `-1/-1` in `[node+0x18/+0x1c]`. Kind `7` is now tighter than a generic queued-effect lane: `simulation_dispatch_runtime_effect_queue_record_by_kind_into_shell_or_world_handlers` `0x00437c00` routes it into `shell_open_region_focus_modal_and_center_world_on_confirmed_region` `0x004c7520`, which opens a callback-driven custom modal and recenters the live world on the chosen region after confirmation. So the current strongest read is a periodic class-0 region picker that queues one region-focus modal record rather than an anonymous scaled event node.","objdump + local disassembly + caller correlation + periodic-maintenance correlation + queued-record correlation + kind-7-modal correlation"
0x00421f50,181,world_region_collection_refresh_position_triplet_for_class0_regions_inside_normalized_rect,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Scans the current live region collection for class-0 records whose normalized primary and secondary coordinates fall inside the caller-supplied inclusive float rectangle, then refreshes each qualifying region's current-position triplet through `runtime_object_publish_current_position_triplet_with_height_bias` `0x00455a70(0)`. The helper performs no further aggregation and simply walks the surviving records through the live region collection interfaces `0x00517cf0/0x00518380/0x00518140`. Current grounded caller is the rectangle-side height-support owner `0x0044d410`, where this acts as one dependent region refresh across the updated work window rather than a broader collection rebuild.","objdump + local disassembly + caller correlation + region-rectangle correlation"
0x00421700,32,world_region_collection_remove_entry_by_id_release_record_and_erase_id,map,thiscall,inferred,objdump + local disassembly + collection-layout correlation,2,"Small collection-side removal helper for the live world-region manager. The function resolves the caller-supplied region id through `0x00518140`, releases the resulting record through `world_region_release_profile_collection_clear_linked_structure_site_chain_and_tail_base_cleanup` `0x00420670`, and then removes that id from the current collection through `0x00518a30`. Current evidence grounds this as the collection-owned remove-and-release wrapper for the world-region family rather than a wider rebuild pass.","objdump + local disassembly + collection-layout correlation + region-family correlation"
0x00421730,560,world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids,map,thiscall,inferred,objdump + local disassembly + caller inspection + region-correlation,3,"Region-side world-grid finalizer beneath the default region seeding path. The helper first clears the per-cell region word at `[world+0x212d] + cell*4 + 1` across the full live world raster using dimensions `[world+0x214d/+0x2151]`. It then seeds each live region entry with default bounds and helper fields `[region+0x242/+0x24e/+0x252] = 0` and `[region+0x246/+0x24a] = 0x270f`, and for every class-0 region computes one square neighborhood around the region center from `[region+0x256]`, `0x00455800`, and `0x00455810`. Within that bounded cell rectangle it evaluates one distance-like score through `0x0051dbb0` and writes the current region id `[region+0x23a]` into the per-cell word when the slot is empty or when the current region beats the previously assigned region on the same score. Current grounded callers are `world_region_collection_seed_default_regions` `0x00421b60` and the broader world-build path around `0x004476ec`, so this is the safest current read for clearing and repopulating the world-cell region-id raster rather than a generic collection sweep.","objdump + local disassembly + caller inspection + region-correlation + raster-assignment correlation"
0x0042b190,144,route_entry_list_append_six_byte_record,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Appends one six-byte `(u16 key, u32 payload)` record onto the compact route-entry list rooted at `[this+0xeb]/[this+0xef]`. The helper allocates a replacement buffer sized for one extra record, copies the existing six-byte rows, writes the caller-supplied key and payload into the new tail, frees the old buffer, stores the replacement pointer, and increments the count. Current grounded callers include the sampled-cell rebuild owner `0x0047f320` and the world-cell chain sweep `0x0042c530`, so this is the safest current read for the plain append companion beneath the broader route-entry list families.","objdump + caller xrefs + local disassembly + six-byte-record correlation"
0x0042b230,158,route_entry_list_remove_six_byte_record_by_key,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Removes one six-byte route-entry row from the compact list rooted at `[this+0xeb]/[this+0xef]` by matching the leading `u16` key. When the current count is greater than one the helper allocates a replacement buffer for `count-1` rows, copies every nonmatching six-byte row forward, frees the old buffer, stores the replacement pointer, and decrements the count; small or empty lists fall through to the same free-and-decrement tail. Current grounded caller is the sampled-cell rebuild owner `0x0047f320`, which uses it while maintaining the per-cell route-entry side list, so this is the safest current read for the keyed remove companion to `0x0042b190`.","objdump + caller xrefs + local disassembly + six-byte-record correlation"
0x0042bbb0,51,world_cell_prepend_site_id_into_owner_chain_field_0xd4,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Prepends one placed-structure site id into the world-cell owner chain rooted at word `[cell+0xd4]`. The helper resolves the caller-supplied site id through the live placed-structure collection `0x006cec20`, writes the previous head id from `[cell+0xd4]` into that site's next-site field `[site+0x3c]` through `placed_structure_set_linked_cell_owner_next_site_id_field_0x3c` `0x0047d6f0`, and then stores the new site id back into `[cell+0xd4]`. Current grounded callers are the linked-site runtime refresh strip at `0x004807d7` and the earlier world-coordinate mutation path at `0x00480673`, so this is the safest current read for the cell-owner-chain prepend helper rather than a generic word setter.","objdump + caller xrefs + local disassembly + cell-owner-chain correlation"
0x0042bbf0,124,world_cell_remove_site_id_from_owner_chain_field_0xd4,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Removes one placed-structure site id from the world-cell owner chain rooted at word `[cell+0xd4]`. The helper walks the current head id and the linked next-site field `[site+0x3c]` through the live placed-structure collection `0x006cec20` until it finds the requested site id; when the requested site is the head it replaces `[cell+0xd4]` with that site's successor, otherwise it patches the predecessor's `[site+0x3c]` through `placed_structure_set_linked_cell_owner_next_site_id_field_0x3c` `0x0047d6f0`. Current grounded callers are the linked-site teardown and refresh strip at `0x00480673` and `0x00480769`, so this is the safest current read for the cell-owner-chain remove helper rather than a broader collection sweep.","objdump + caller xrefs + local disassembly + cell-owner-chain correlation"
0x0042a970,188,shell_open_file_dialog_copy_selected_path_and_restore_cwd,shell,thiscall,inferred,objdump + literal correlation,3,"Small shell-side file-open dialog wrapper. The helper clears the caller output buffer, snapshots the current working directory through one import pair, builds a `0x4c`-byte open-file dialog record on the stack, calls the file-open import, restores the previous working directory, and returns true only when the caller buffer is left non-empty. Current grounded caller is the `Setup.win` branch at `0x005039cd`, which passes the `TGA Files (*.tga)` filter at `0x005d1674` and root `.\Data\GrayscaleMaps` at `0x005d1690`, so this is now the generic picker beneath the grayscale-heightmap generation lane rather than another multiplayer helper.","objdump + literal correlation + setup-branch reconstruction"
0x005411c0,79,shell_query_tga_header_is_supported_truecolor_image,shell,cdecl,inferred,objdump + error-string correlation,3,"Small image-header validator used by the `Setup.win` grayscale-heightmap lane. The helper opens the caller path, reads `0x12` bytes into a local buffer, closes the handle, and returns true only when the read succeeds, the error byte remains clear, and the header's image-type byte equals `2`. Current grounded caller is the `0x005039fe` branch beneath `0x005033d0`, where failure raises localized error `0x0e13` (`The selected image is not useable by the game... true-color ... Targa image.`).","objdump + caller correlation + error-string correlation + TGA-header inspection"
0x004801a0,105,placed_structure_is_linked_transit_site_reachable_from_company_route_anchor,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Boolean gate between one linked transit site and one company-side route anchor. The helper first requires the current placed structure to pass the station-or-transit gate `0x0047fd50`, then requires its linked-instance class test through `0x0040c990 == 1`. It resolves the caller-supplied company id through the live company collection `0x0062be10`, asks that company for one cached route-anchor entry id through `company_query_cached_linked_transit_route_anchor_entry_id` `0x00401860`, resolves the site's own route-entry anchor through collection `0x006cfca8`, and finally re-enters `0x0048e3c0` to test whether the two route-entry anchors lie in the same reachable route-side family. Current grounded caller is `company_rebuild_linked_transit_site_peer_cache` `0x004093d0`, where this helper gates whether a foreign linked transit site can still participate in the current company's peer cache.","objdump + caller xrefs + callsite inspection + linked-transit reachability correlation"
0x0042c530,74,world_cell_append_linked_site_chain_route_entries_into_route_list,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Walks the placed-structure linked-site chain for one world cell and appends each site's route-entry payload into the caller-owned six-byte list. The helper starts from word `[cell+0xd6]`, follows the linked-site chain through `[site+0x2a2]` in the live placed-structure collection `0x0062b26c`, and re-enters `route_entry_list_append_six_byte_record` `0x0042b190` with each visited site id plus the caller-supplied payload dword. Current grounded caller is the sampled-cell rebuild owner `0x0047f320`, so this is the safest current read for the cell-linked-site route-entry gather helper rather than a generic list walk.","objdump + caller xrefs + local disassembly + linked-site-chain correlation + route-entry-list correlation"
0x0042c580,265,world_cell_accumulate_directional_word_fan_toward_grid_target,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Accumulates one directional word fan from the current world-cell record toward a caller-supplied grid target. The helper reads the cell-local anchor pair `[cell+0xe7]` and `[cell+0xe9]`, derives the dominant-axis distance to the target, chooses one of eight direction slots from the sign pattern of the X/Y deltas, and then walks outward one step at a time through the live world-grid table rooted at `[0x0062c120+0x2129]` using the fixed offset tables at `0x00624b28` and `0x00624b48`. At each step it adds the selected directional word from `[cell+0xf3 + dir*2]` into the running float total and returns that accumulated value. Current grounded caller is the sampled-cell rebuild owner `0x0047f320`, where this helper supplies the floating score stored in each temporary `(grid x, grid y, sampled score)` row.","objdump + caller xrefs + local disassembly + directional-word-fan correlation + sampled-score correlation"
0x0042c9a0,65,world_cell_prepend_site_id_into_linked_site_chain_field_0xd6,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Prepends one placed-structure site id into the world-cell linked-site chain rooted at word `[cell+0xd6]`. The helper resolves the caller-supplied site id through the live placed-structure collection `0x0062b26c`, writes the previous head id from `[cell+0xd6]` into that site's next-site field `[site+0x2a2]` through `placed_structure_set_linked_site_chain_next_id_field_0x2a2` `0x0040cb00`, stores the new site id back into `[cell+0xd6]`, and then re-enters `0x0042c690` plus `0x0042c8f0` to refresh the same cell-local linked-site derived state. Current grounded callers are the linked-site add or reposition paths `0x0040ec58` and `0x0040f84a`, so this is the safest current read for the cell-linked-site-chain prepend helper rather than a generic word setter.","objdump + caller xrefs + local disassembly + linked-site-chain correlation"
0x0042c9f0,179,world_cell_remove_site_id_from_linked_site_chain_field_0xd6,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Removes one placed-structure site id from the world-cell linked-site chain rooted at word `[cell+0xd6]`. The helper walks the current head id and the linked next-site field `[site+0x2a2]` through the live placed-structure collection `0x0062b26c` until it finds the requested site id; when the requested site is the head it replaces `[cell+0xd6]` with that site's successor, otherwise it patches the predecessor's `[site+0x2a2]` through `placed_structure_set_linked_site_chain_next_id_field_0x2a2` `0x0040cb00`. It then re-enters `0x0042c690` and `0x0042c8f0` to rebuild the same cell-local linked-site derived state. Current grounded callers are the linked-site removal or reposition paths `0x0040e331` and `0x0040ebfe`, so this is the safest current read for the cell-linked-site-chain remove helper rather than a broader collection sweep.","objdump + caller xrefs + local disassembly + linked-site-chain correlation"
0x0042c960,51,placed_structure_query_issue_opinion_scaled_word_lane,map,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Queries one rounded integer metric by multiplying the current word lane `[this+index*2] << 4` against the issue-opinion scale returned by `0x00437d20(index)`. The helper forwards the caller index into the scenario-side issue-opinion scaler, converts the selected word lane into a float, multiplies the two factors, and rounds the result through `0x005a10d0`. Current grounded callers include the setup-side candidate local-metrics rebuild `0x0041e2b0`, the route-style helper `0x0042cab0`, the linked-site runtime refresh strip `0x0047e240/0x0047faff`, several later placed-structure and world-side callers around `0x0040faf5`, `0x00410d7a`, `0x0044a093`, `0x0045020d`, `0x00452a1c`, and shell-side branches at `0x004ba156` and `0x004def77`, so this is the safest current read for the shared issue-opinion-scaled word-lane query rather than a raw table fetch.","objdump + caller xrefs + local disassembly + issue-opinion scaling correlation"
0x00480590,371,placed_structure_teardown_linked_site_runtime_state_before_removal,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Tears down the mutable runtime side of one linked placed-structure record before collection removal. The helper clears the route-style scratch lane through `0x004077e0`, clears the proximity buckets through `placed_structure_clear_proximity_bucket_lists` `0x0047dcd0`, frees the trailing scratch buffer at `[this+0x34]`, clears the route-link list through `0x0047f320`, detaches or invalidates the current route-entry anchor at `[this+0x08]` through the route-entry collection `0x006cfca8`, recomputes the current grid-keyed owner lane through `0x0042bbf0`, frees the three per-site byte arrays at `[this+0x24..0x2c]`, clears this record's indexed byte in the corresponding arrays of every later placed-structure record in `0x006cec20`, and finally re-enters the scenario-side follow-on at `0x00436040` with the current site id. Current direct caller is `placed_structure_collection_remove_linked_site_record` `0x004813d0`, so this is the linked-site teardown pass rather than another route-anchor refresh helper.","objdump + caller xrefs + callsite inspection + linked-site teardown correlation"
0x00480710,1170,placed_structure_refresh_linked_site_runtime_side_buffers_and_route_entry_anchor,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Primary linked-site runtime-side refresh owner above the sampled-cell list and nearby-transit bucket helpers. The function first clears the current proximity buckets through `placed_structure_clear_proximity_bucket_lists` `0x0047dcd0`, runs `placed_structure_rebuild_local_service_sampled_cell_list_and_reset_route_link_scratch` `0x0047f320(1,arg1)` against the pre-update state, republishes the current site position into the world-grid owner mapping through `0x0042bbf0/0x0042bbb0`, reruns `0x0047f320(0,-1)` to materialize the current sampled-cell list, and then rebuilds the nearby-transit bucket arrays through `placed_structure_rebuild_nearby_transit_site_distance_buckets_from_neighbor_cells` `0x0047fef0`. After that it either reuses a still-valid route-entry anchor through `0x00417b40` and `placed_structure_rebind_route_entry_anchor_to_site_id` `0x0048abc0`, or synthesizes a replacement through `0x00493cf0` before rebinding it the same way; when an old anchor survives but now points at a different owner, the helper clears the prior `[entry+0x222]` back to `-1`. Current grounded callers are the world-coordinate mutation path `placed_structure_set_world_coords_and_refresh_local_runtime_side_state` `0x0040eba0` and the constructor or rebuild strip around `0x0040f6d0`, so this is the safest current read for the broader linked-site runtime-side refresh plus route-entry-anchor rebind owner rather than another narrow route selector.","objdump + caller xrefs + callsite inspection + linked-site-runtime correlation + route-entry-anchor rebind correlation + proximity-bucket correlation"
0x00480bb0,1535,placed_structure_refresh_linked_site_display_name_and_route_anchor,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,3,"Single-site post-create or post-edit refresh helper reached from `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10` when the current placed structure keeps one linked site id at `[this+0x2a8]`. The helper operates on that linked placed-structure record, optionally rebuilds one route-entry anchor at `[this+0x08]` through `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` with both optional endpoint-entry ids unset and literal policy byte `2`, then binds the chosen route entry back to the site through `0x0048abc0` and re-enters `aux_route_entry_tracker_collection_refresh_route_entry_group_membership` `0x004a45f0` so the auxiliary tracker family at `0x006cfcb4` can regroup around the refreshed anchor. Current caller correlation makes that byte the strongest current match for the broader linked-site route-anchor rebuild lane, as opposed to the narrower direct endpoint-anchor creation or replacement lane that neighboring repair branches drive through literal byte `1` into `0x00493cf0`. It also rebuilds the display-name buffer at `[this+0x46b]`: when the current site coordinates resolve a city or region entry through `0x0044a830` it copies that entry name from `[entry+0x356]`, optionally appends one civic suffix from RT3.lng ids `585..588` `Township`, `New`, `Modern`, and `Renaissance`, and on special linked-instance class branches appends `589` `Service Tower` or `590` `Maintenance Facility` with per-city counters instead. When no city entry resolves it falls back to `591` `Anytown`. The ordinary non-special branch also rotates through RT3.lng ids `578..584` `Junction`, `Crossing`, `Depot`, `Corners`, `Exchange`, `Point`, and `Center` via the static table at `0x005f2cf8`. After trimming trailing spaces it conditionally re-enters `placed_structure_route_link_collection_recompute_all_endpoint_pair_state` `0x004682c0` when the narrower station-or-transit gate `0x0047fd50` passes, clears or seeds adjacent city-side cached state through `0x004358d0` and `0x00420650`, and returns. Current direct caller is `0x0040f626`, so this now looks like the linked-site display-name and route-anchor refresh beneath placed-structure finalization rather than another city-connection owner.","objdump + caller xrefs + callsite inspection + RT3.lng strings + route-anchor correlation + linked-site refresh correlation + linked-site policy-byte split correlation + tracker-regrouping correlation"
0x00481390,55,placed_structure_collection_allocate_and_construct_linked_site_record,map,thiscall,inferred,objdump + caller xrefs + constructor inspection,3,"Small allocator wrapper over the live placed-structure collection at `0x006cec20`. The helper allocates one fresh collection entry id through `0x00518900`, resolves the new record through `0x00518140`, and then hands the new id plus the caller-supplied anchor site id and coordinate pair into `placed_structure_construct_linked_site_record_from_anchor_and_coords` `0x00480210`. Current direct caller is `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, where the returned id is published into `[site+0x2a8]` when the backing candidate subtype byte `[candidate+0x32]` is `1`. This is the allocator wrapper for the linked-site records used by the later policy-`1` and policy-`2` route-anchor refresh families rather than another anonymous collection helper.","objdump + caller xrefs + constructor inspection + linked-site correlation"
0x004813d0,91,placed_structure_collection_remove_linked_site_record,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Removes one linked-site record from the live placed-structure collection. The helper resolves the supplied site id through `0x006cec20`, derives one station-or-transit or linked-instance-class latch through `0x0047de00 -> 0x0040c990`, runs `placed_structure_teardown_linked_site_runtime_state_before_removal` `0x00480590`, and then removes the collection entry through `0x00518a30`. When scenario field `[0x006cec78+0x4c93]` is clear and the removed record passed the narrower latch, it also re-enters the company-wide follow-on at `0x00429c10`. Current direct caller is the subtype-`1` destruction path around `0x0040f626`.","objdump + caller xrefs + callsite inspection + linked-site removal correlation"
0x00481210,245,placed_structure_collection_refresh_dynamic_side_buffers_from_tagged_bundle,map,thiscall,inferred,objdump + local disassembly + caller correlation + tag-family correlation,3,"Collection-wide tagged load owner for the variable-size side buffers on placed-structure records in `0x006cec20`. The helper first reads one four-byte subtag selector from the caller bundle through `0x00531150`, refreshes collection-side metadata through `0x00518680` with size `0x465` only when that selector is `0x4a39`, opens tag `0x4a3a`, and then walks every live placed-structure record through the indexed-collection accessors. The loop body branches on the incoming subtag selector: when it is `0x4a39` it copies the live six-byte route-entry list root at `[site+0x462]` back into the earlier scratch band at `[site+0x2ba]` and clears the later side-buffer bands `[site+0x2ba..+0x389]`, `[site+0x38e..+0x5c9]`, and `[site+0x5ca..]` before re-entering `placed_structure_load_dynamic_side_buffers_from_stream` `0x0047d8e0`; the helper closes the tag family through `0x4a3b` on exit. Current grounded caller is the world-entry bringup branch at `0x004444d8`, immediately before the linked-route-object tagged load lane. This is the safest current read for the placed-structure dynamic-side-buffer tagged load owner rather than a post-load stream-only refresh pass.","objdump + local disassembly + caller correlation + tag-family correlation + side-buffer-layout correlation"
0x00481430,72,placed_structure_collection_load_dynamic_side_buffers_from_stream,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Collection-level load pass for the variable-size side buffers on placed-structure records. When the shell or world-side stream slot at `[0x006cec74+0x1c7]` is present, the helper walks the live placed-structure collection at `0x006cec20`, resolves each record by id, and re-enters `placed_structure_load_dynamic_side_buffers_from_stream` `0x0047d8e0` on it. Current direct caller is the wider post-load world-side refresh path at `0x00433b93`.","objdump + caller xrefs + callsite inspection + stream-load correlation"
0x00481310,118,placed_structure_collection_serialize_dynamic_side_buffers_into_tagged_bundle,map,thiscall,inferred,objdump + local disassembly + caller correlation + tag-family correlation,3,"Collection-wide tagged save owner for the variable-size side buffers on placed-structure records in `0x006cec20`. The helper emits tag family `0x4a9d/0x4a3a/0x4a3b` through `0x00531340`, serializes collection-side metadata through `0x00517d90`, then walks every live placed-structure record through the indexed-collection accessors before dispatching each record into `placed_structure_serialize_dynamic_side_buffers_into_tagged_bundle` `0x0047da40`. Current grounded caller is the early package-save prelude at `0x004453ca`, immediately before the linked-route-object tagged save lane. This is the safest current read for the placed-structure dynamic-side-buffer tagged save owner rather than a lower per-record serializer.","objdump + local disassembly + caller correlation + tag-family correlation + side-buffer-layout correlation"
0x00481480,64,placed_structure_collection_append_site_into_all_proximity_bucket_lists,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Walks the live placed-structure collection at `0x006cec20` and asks every record to consider one caller-supplied peer site for proximity-bucket insertion. The helper resolves each live record and re-enters `placed_structure_append_nearby_transit_site_distance_bucket_entry` `0x0047fdb0` with the supplied peer placed-structure pointer. Current direct callers are the subtype-`4` update paths at `0x0040ec73` and `0x0040fa11`, so this now reads as the add-peer sweep for the nearby-site bucket family rather than another generic collection iterator.","objdump + caller xrefs + callsite inspection + proximity-bucket correlation"
0x004814c0,64,placed_structure_collection_remove_site_id_from_all_proximity_bucket_lists,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Walks the live placed-structure collection at `0x006cec20` and asks every record to remove one caller-supplied site id from its proximity buckets. The helper resolves each live record and re-enters `placed_structure_remove_site_id_from_proximity_bucket_lists` `0x0047dd10` with the supplied site id. Current direct callers are the subtype-`4` pre-update or pre-destroy paths at `0x0040e0a2` and `0x0040ebc7`.","objdump + caller xrefs + callsite inspection + proximity-bucket correlation"
0x00429c10,88,company_collection_refresh_active_company_linked_transit_site_peer_caches,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Collection-wide company sweep above the linked-transit peer cache family. The helper first counts the active companies in the live company collection at `0x0062be10` by testing `[company+0x3f]`, then walks that active ordinal range through `company_collection_get_nth_active_company_id` `0x00429a90` and re-enters `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` on each resolved company record. Current grounded callers are the linked-site removal follow-on at `0x00481421` and the wider world-side company refresh branch at `0x00444c9c`.","objdump + caller xrefs + callsite inspection + active-company sweep correlation"
0x00481d00,612,bootstrap_parse_command_line_flags,bootstrap,cdecl,inferred,ghidra-headless,4,Parses the startup command line from ECX handling slash and dash switches and writes multiple bootstrap globals and option buffers before shell service init.,ghidra + rizin
0x00481fd0,348,bootstrap_scan_autorun_media,bootstrap,cdecl,inferred,ghidra-headless,4,Scans drive letters for RT3 autorun marker files rt3d1.txt and rt3d2.txt using GetDriveTypeA and open or close helpers before deeper shell init.,ghidra + rizin
0x00482160,101,shell_state_service_active_mode_frame,shell,thiscall,inferred,objdump + analysis-context,4,Acts as the broader shell-state service pass around one active-mode update on the shell state rooted at 0x006cec74. The helper increments nested-service depth at [this+0x64] optionally notifies the active mode object at 0x006cec78 through 0x0051f940 and 0x00434050 primes the shell runtime at 0x006d401c through 0x00538b60 conditionally services the Multiplayer preview-dataset object at 0x006cd8d8 through 0x00469720 and then dispatches shell_service_frame_cycle on the global shell controller at 0x006d4024 before decrementing the depth counter.,objdump + analysis-context + caller xrefs
0x004821d0,1019,shell_recompute_layout_slots,bootstrap,thiscall,inferred,ghidra-headless,4,Recomputes the shell layout-slot table after resolution or related display selectors change; derives normalized coordinates from static float tables updates 144 slot entries through the shell bundle child at [0x006d4024+0x18] and then commits the refreshed state.,ghidra + rizin
0x00482ec0,1359,shell_transition_mode,bootstrap,thiscall,inferred,ghidra-headless + objdump,4,"Switches the shell state's active mode at `[this+0x08]`, tears down any prior mode object, selects one of seven mode-specific handlers, updates globals like `0x006cec78`, and then notifies the shell bundle through `0x00538e50`. The calling convention is tighter now too: the function is a `thiscall` with two stack arguments, confirmed both by the entry-side stack read from `[esp+0x0c]` and by the `ret 8` epilogue at `0x48340c`. The grounded world-entry load-screen call shape at `0x443adf..0x443ae3` is therefore `(mode=4, arg2=0)`, not a one-arg mode switch. The second stack argument is tighter now too: current local evidence reads it as an old-active-mode teardown flag rather than a second mode id. The branch at `0x482fc6..0x482fff` only runs when that second argument is nonzero, and in that case it releases the old global active-mode object through `world_runtime_release_global_services` `0x00434300`, falls through the neighboring no-op placeholder `0x00433730`, and then reaches the common free path `0x0053b080` before clearing `0x006cec78`. The caller split matches that read: the world-entry load-screen transition uses `(4, 0)` as the plain `LoadScreen.win` arm, while the later world-entry reactivation branch at `0x444c3b..0x444c44` enters mode `1` as `(1, esi)` after `0x4834e0` and `0x44ce60`, making the nonzero second argument the strongest current fit for 'tear down the prior active gameplay world while switching modes'. The constructor jump table at `0x48342c` is now grounded as a real mode map rather than raw branch addresses: mode `1` enters the startup-dispatch arm at `0x483012`, mode `2` enters `Setup.win` through `shell_setup_window_construct` `0x00504010`, mode `3` enters `Video.win` through `shell_video_window_construct` `0x005174e0`, mode `4` enters the plain `LoadScreen.win` arm at `0x4832e5` through `shell_load_screen_window_construct` `0x004ea620`, mode `5` enters `Multiplayer.win` through `multiplayer_window_init_globals` `0x004efe80`, mode `6` enters `Credits.win` through `shell_credits_window_construct` `0x004c7fc0`, and mode `7` enters `Campaign.win` through `shell_campaign_window_construct` `0x004b8e60`. The startup side is correspondingly tighter now too: mode `1` first constructs and publishes one transient `LoadScreen.win` object through `0x004ea620` and `0x00538e50`, then sets `[load_screen+0x78]` through `0x004ea710`, allocates the separate startup-runtime object through `0x0053b070(0x46c40)`, clears its startup-owned bands through `world_runtime_reset_startup_dispatch_state_bands` `0x004336d0`, publishes that second object into `0x006cec78`, and only then calls `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890` with stack args `(1, 0)`. After that straight-line call it immediately unpublishes the shell-window object again through `0x005389c0([0x006d401c], [this+0x0c])` before later mode-specific destroy paths continue. Mode `4`, by contrast, only constructs and publishes `LoadScreen.win` and does not own the startup-runtime allocation or `0x00438890` callsite. The paired old-mode teardown side is now tighter too: mode `1` tears down through `shell_game_window_destroy` `0x004dfd70`, mode `3` through `shell_video_window_destroy` `0x00517570`, mode `4` through `shell_load_screen_window_destroy` `0x004ea730`, mode `6` through `shell_credits_window_destroy` `0x004c7bc0`, and mode `7` through `shell_campaign_window_destroy` `0x004b8dc0`. Current live hook probes now show the old hook-side crash is gone: on the hook-driven path `shell_transition_mode(4, 0)` returns cleanly, and the inner old-object unpublish, `0x005400c0 -> 0x0053fe00 -> 0x0053f860` removal sweep, mode-`2` teardown helper `0x00502720`, `LoadScreen.win` construct, and shell publish all return. The corrected jump-table decode now explains the remaining runtime gap too: the current plain-run logs still do not show a trusted `0x00438890` entry because the hook has been entering mode `4`, not the mode-`1` startup-dispatch arm
0x005a2d64,101,crt_init_exit_handlers,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,3,"Higher startup-side owner for the CRT init and on-exit callback tables. The helper first calls optional pre-init callback `0x00629f34` when present, walks the two fixed init-callback arrays `0x005ed018..0x005ed034` and `0x005ed000..0x005ed014`, registers callback `0x005acaa1` into the dynamic on-exit table through `crt_register_onexit_callback_return_success_bool` `0x005a2d10`, and then returns after those init strips complete. This is the concrete init owner above the dynamic on-exit callback table rooted at `0x00dbb8dc/0x00dbb8d8`, not just a generic placeholder before startup continues.","llvm-objdump + local disassembly + startup correlation + init-callback-table correlation + onexit-registration correlation"
0x005a30f2,34,__amsg_exit,startup,cdecl,inferred,ghidra-headless,4,CRT fatal-exit helper that forwards startup failures into __exit.,ghidra + rizin
0x005a3117,36,crt_fast_error_exit,startup,cdecl,inferred,ghidra-headless,4,Startup error path that optionally emits the CRT banner then formats the failure and terminates through ___crtExitProcess.,ghidra + rizin
0x005a313b,423,crt_startup_entrypoint,startup,cdecl,inferred,ghidra-headless,4,PE entrypoint for patch 1.06; performs CRT and environment setup then validates early state before handing off to application bootstrap.,sha256:01b0d2496cddefd80e7e8678930e00b13eb8607dd4960096f527564f02af36d4 + ghidra + rizin + llvm-objdump
0x0053b020,70,bootstrap_reset_locale_state,bootstrap,unknown,inferred,ghidra-headless,2,Calls the locale helper at 0x0053ae70 then frees and clears related global pointers before later shell setup continues.,ghidra + rizin
0x0053afd0,26,shared_release_owned_heap_ptr_field_0_and_clear_root,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny shared release wrapper over dword root `[this+0x00]`. When that root is non-null, the helper frees it through `0x005a1145` and clears `[this+0x00]` back to null. Current callers span the slot-table service family `0x00530a00`, the shell status and control owner `0x00538640/0x00538b60`, several world and bootstrap support strips, and multiple placed-structure or runtime-object payload owners, so this is the safest current read for a generic free-and-clear wrapper rather than a family-specific destructor.","objdump + caller inspection + local disassembly + shared-wrapper correlation"
0x0053aff0,26,shared_release_owned_heap_ptr_field_0_and_clear_root_sibling,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Sibling tiny free-and-clear wrapper over dword root `[this+0x00]`. Like `0x0053afd0`, the helper frees one non-null owned heap pointer through `0x005a1145` and clears the root back to null. Current grounded callers are narrower specialization and payload-owner families such as `0x00455d65`, `0x0045607b`, `0x0045b1f9`, `0x0045c280`, and `0x0045e516`, so this is the safest current read for a shared sibling wrapper rather than a unique subtype-specific release body.","objdump + caller inspection + local disassembly + shared-wrapper correlation"
0x0053b090,757,global_banked_13_byte_record_family_load_stream_bank_and_rebuild_bucket_tables,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Loader for one bank in the neighboring global support family rooted at `[this+0x204ac]` with active-bank count `[this+0x427b8]`. The helper acquires one stream or slot handle from the caller through `0x005a4c57(…,0x8000)`, validates two tagged `4`-byte reads through `0x005a48c5`, allocates one contiguous `13 * count` byte record slab, and then populates that slab either by copying raw `13`-byte records or by slicing the same stream into fixed `13`-byte rows. It records the active row count at `[this+bank*4+0x417ec]`, zeroes and fills one `32`-bucket histogram at `[this+bank*0x80+0x223ec]`, allocates per-bucket storage for each nonempty bucket, copies each row into the matching bucket-selected slab, frees the temporary contiguous slab, and finally increments active-bank count `[this+0x427b8]`. Current grounded caller is the static-table-driven load loop at `0x0053ce09`, so this is the safest current read for the banked fixed-record loader plus bucket-table rebuild owner rather than a generic file reader.","objdump + caller inspection + local disassembly + fixed-record correlation + bucket-table correlation"
0x0053b390,561,global_banked_13_byte_record_family_lookup_by_key_with_recent_query_cache,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Lookup core for the same banked `13`-byte-record support family. Given a caller-supplied key dword, the helper first searches a `10`-entry recent-query cache rooted at `[this+0x4290c]`, then scans the active per-bank bucket slabs selected by `key & 0x1f`, and on a hit returns the resolved bank index, bucket-local row index, and row offset to three caller output pointers. On a miss it optionally formats one diagnostic buffer from `[this+0x427c0]` and returns `0`; on a direct hit in the first bank scan it also rotates the recent-query cache fields `[this+0x4290c/+0x42934/+0x4295c/+0x42984/+0x429ac]`. Current grounded callers are the thin wrapper `0x0053b590` and a larger family of support-side query branches under `0x0053babd..0x0053ce09`, so this is the safest current read for the keyed bank-and-bucket lookup core rather than a generic map search.","objdump + caller inspection + local disassembly + keyed-lookup correlation + recent-cache correlation"
0x0053b590,35,global_banked_13_byte_record_lookup_wrapper_with_stack_locals,bootstrap,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Thin cdecl wrapper above `global_banked_13_byte_record_family_lookup_by_key_with_recent_query_cache` `0x0053b390`. The helper builds three stack-local output slots, forwards the caller key and output pointers into `0x0053b390`, and returns that same status code. This is the safest current read for the trivial lookup wrapper rather than a second independent search owner.","objdump + caller inspection + local disassembly + lookup-wrapper correlation"
0x0053b5c0,98,global_hash_string_and_copy_into_0x427c0_scratch,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small string helper in the same banked-record support family. The helper copies the caller-supplied NUL-terminated string into scratch buffer `[this+0x427c0]`, measures its length, then folds each byte through `0x0051d660` and one multiply-add recurrence seeded from `7`, returning the final signed hash-like accumulator. This is the safest current read for the support-family string-hash helper rather than a user-facing formatter.","objdump + caller inspection + local disassembly + string-hash correlation"
0x0053b630,94,global_banked_13_byte_record_family_resolve_nth_live_entry_and_cache_current,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Ordinal resolver over the same banked support family. Given one zero-based ordinal, the helper walks the `32` bucket-chain roots at `[this+0x203a4]`, advances through each linked list by link field `+0x14`, and returns the matching live entry root when found. On success it also caches the current ordinal at `[this+0x427b0]` and the current entry root at `[this+0x20424]`. This is the safest current read for the nth-live-entry resolver rather than a generic list walk.","objdump + caller inspection + local disassembly + ordinal-resolution correlation"
0x0053b690,82,global_banked_13_byte_record_family_close_current_stream_handle_if_open,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small close helper over the current entry selected through `[this+0x427bc]`. The helper resolves that current entry through `global_banked_13_byte_record_family_resolve_nth_live_entry_and_cache_current` `0x0053b630`, and when the selected entry carries a live stream or slot handle at `[entry+0x04]` it closes either the auxiliary object `[entry+0x08]` through `0x005a1740` or the raw handle itself through `0x005a440d`, then resets `[entry+0x04]` to `-1` and `[entry+0x08]` to `0`. This is the safest current read for the current-stream close helper rather than a generic free path.","objdump + caller inspection + local disassembly + current-stream correlation"
0x0053b6f0,199,global_banked_13_byte_record_family_open_current_entry_stream_from_path,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Open helper for the current selected support-family entry. The helper resolves the current entry through `0x0053b630`, copies the path string at `[entry+0x10]` into one stack buffer, opens a new stream or slot handle through `0x005a4c57(…,0x8000)`, stores that handle at `[entry+0x04]`, clears `[entry+0x08]`, and emits one diagnostics path when the open fails. This is the safest current read for opening the current entry's stream from its stored path rather than a generic file open wrapper.","objdump + caller inspection + local disassembly + current-stream correlation"
0x0053b7c0,105,global_banked_13_byte_record_family_read_bytes_from_selected_or_current_stream_and_accumulate_counters,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Shared read helper over the support family's active stream handle. When `[this+0x427bc] < 0` it resolves the current entry through `0x0053b630` and uses that entry's handle `[entry+0x04]`; otherwise it uses the active-bank handle from `[this+0x204ac + [this+0x427bc]*4]`. It then reads the caller-requested byte count through `0x005a48c5`, accumulates the total bytes-read and read-call counters into `[this+0x428ec/+0x428f0]`, and emits one diagnostics path when the short read does not match the requested size. Current grounded callers include `0x0053b830` and many support-side consumers under `0x0053cb1d..0x00566e7e`, so this is the safest current read for the family's shared byte-read helper.","objdump + caller inspection + local disassembly + stream-read correlation + counter-accumulation correlation"
0x0053b830,17,global_banked_13_byte_record_family_read_u32_wrapper,bootstrap,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Tiny wrapper above `global_banked_13_byte_record_family_read_bytes_from_selected_or_current_stream_and_accumulate_counters` `0x0053b7c0`. The helper requests exactly `4` bytes into one stack-local dword and returns that same dword to the caller. This is the safest current read for the fixed-width read wrapper rather than a second stream owner.","objdump + caller inspection + local disassembly + fixed-read-wrapper correlation"
0x0053b850,125,global_banked_13_byte_record_staging_table_grow_by_100_rows,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Growth helper over the local `13`-byte staging table rooted at `[this+0x1f400]` with current row capacity `[this+0x427b4]`. The helper allocates a new slab large enough for the current rows plus `100` more, zero-fills the extension, copies any existing rows into the new slab, frees the old slab, then stores the new root back into `[this+0x1f400]` and increments capacity `[this+0x427b4]` by `100`. This is the safest current read for the staging-table growth helper rather than a generic realloc wrapper.","objdump + caller inspection + local disassembly + staging-table correlation"
0x0053b8d0,66,global_banked_13_byte_record_staging_table_service_type7_payloads_through_0x5512f0,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Linear service pass over the same `13`-byte staging table. The helper walks all live rows in `[this+0x1f400]`, and for each row whose leading count dword is positive and whose type byte at `+0x08` equals `7`, it forwards payload dword `[row+0x09]` into `0x005512f0`. Current grounded callers include `0x0051ffba`, `0x0052b9e7`, and `0x00565164`, so this is the safest current read for one type-7 staging-table service pass rather than a broader table rebuild.","objdump + caller inspection + local disassembly + staging-table correlation + type7-service correlation"
0x0053b920,66,global_banked_13_byte_record_staging_table_service_type7_payloads_through_0x550420,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Sibling linear service pass over the same `13`-byte staging table. Like `0x0053b8d0`, the helper walks all live rows and filters on positive count plus type byte `7`, but it forwards payload dword `[row+0x09]` into `0x00550420` instead. Current grounded callers include `0x0051ffba`, `0x0052040a`, `0x0052b9c1`, and `0x0056513e`, so this is the safest current read for the second type-7 service pass rather than another generic table walk.","objdump + caller inspection + local disassembly + staging-table correlation + type7-service correlation"
0x0053b970,98,global_banked_13_byte_record_family_clear_bucket_chains_and_reset_current_selection,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Reset helper over the same banked-record support family. The helper first closes the current selected entry through `0x0053b690` when `[this+0x427bc]` is negative, then walks all `32` bucket-chain roots at `[this+0x203a4]`, frees each chained node's payload `[node+0x10]` and the node itself through `0x0053b080`, and finally clears current-entry cache `[this+0x20424]` and resets current ordinal `[this+0x427b0]` back to `-1`. Current grounded caller is the broader staging-table owner `0x0053b9f2`, so this is the safest current read for the bucket-chain reset helper rather than a full family destructor.","objdump + caller inspection + local disassembly + bucket-chain-reset correlation"
0x0053b9e0,848,global_banked_13_byte_record_family_emit_pack_system_leak_report_reset_owned_report_slots_and_close_all_bank_streams,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader report-and-reset owner over the same banked `13`-byte-record support family. The helper begins by calling `0x0053b970`, then releases four owned report-slot roots at `[this+0x429b0..+0x429bc]` plus sibling global root `0x00ccba50` through `0x0053ba46`. It next walks the local staging rows at `[this+0x1f400]`, repeatedly resolves keyed bank entries through `0x0053b390`, formats several numeric row fields through `0x0051b700`, packages the resulting line data through `0x00518de0/0x0051d680`, and publishes those lines through callback slot `0x005c8078`; the final footer uses static format string `Pack System Leak Count : %1`. After the report pass it frees the staging slab, clears active-bank count `[this+0x427b8]`, releases one `32`-entry owned-report strip through `0x0053afd0`, and closes every per-bank handle or auxiliary object rooted at `[this+0x204ac/+0x2144c]`. This is the safest current read for the pack-system leak-report and full support-family reset owner rather than a generic destructor.","objdump + caller inspection + local disassembly + leak-report-string correlation + bank-reset correlation"
0x0053ba1b,43,global_construct_0x88_pack_report_slot_through_0x518b90,bootstrap,stdcall,inferred,objdump + local disassembly,1,"Tiny owned-object constructor used in the same support-side report family. The helper allocates `0x88` bytes through `0x0053b070`, and on success forwards the new root plus caller payload into `0x00518b90(…,1,arg,10,5,0,0,0)`. This is the safest current read for a narrow `0x88`-byte report-slot constructor rather than a generic allocator wrapper.","objdump + local disassembly + ctor-shape correlation"
0x0053ba46,33,global_release_and_clear_owned_pack_report_slot_root,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,1,"Tiny release helper over one caller-supplied dword root pointer. When the root is non-null, the helper clears it, releases the owned object through `0x00519bd0`, then frees the wrapper through `0x0053b080`. Current grounded callers are the broader report owner `0x0053b9e0` and nearby support-side cleanup strips, so this is the safest current read for a narrow owned-report-slot release helper rather than a family-wide destructor.","objdump + caller inspection + local disassembly + release-shape correlation"
0x0053bd40,197,global_banked_13_byte_record_family_seek_selected_or_current_payload_stream_by_key_and_return_handle,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Keyed stream-position helper over the same banked support family. The helper resolves the caller key through `0x0053b390`; when the lookup lands in one active bank, it increments query counter `[this+0x428f4]`, computes the bank-local byte offset from the row-size base `[this+0x1f404 + bank*4]`, row count `[this+0x417ec + bank*4]`, bucket row root, and row offset, then seeks the live bank handle `[this+0x204ac + bank*4]` through `0x005ac18d(…,offset+8,0)` and returns that handle. When the lookup resolves as a negative current-entry ordinal instead, it opens the selected entry stream through `0x0053b6f0`, optionally seeks that entry handle by the caller offset, and returns the same handle. Current grounded callers allocate one output buffer from the paired length helper `0x0053c9c0` and immediately feed the returned handle into `0x0053b7c0`, so this is the safest current read for the keyed seek-and-return-stream helper rather than a raw file-open wrapper.","objdump + caller inspection + local disassembly + stream-seek correlation + keyed-lookup correlation"
0x0053be10,325,global_banked_13_byte_record_family_resolve_or_lazy_open_typed_aux_object_by_key,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Keyed typed-object resolver over the same support family. The helper resolves the caller key through `0x0053b390`; on a positive bank hit it seeks the matching bank handle to the row payload through the same offset computation used by `0x0053bd40`, then returns the cached per-bank auxiliary object at `[this+0x2144c + bank*4]` or lazily creates it through `0x005c7905` with one of two static descriptors, including one rooted at `data\\\\Other\\\\AirplaneTypes.txt`. On a negative current-entry ordinal it opens the current entry stream through `0x0053b6f0` and returns the lazily-created current-entry auxiliary object at `[entry+0x08]`. A global gate from `0x005a3f5b` can suppress one branch when the caller's flag byte is clear. Current grounded callers immediately pass the returned object into higher typed readers, so this is the safest current read for the keyed auxiliary-object resolver rather than another raw stream helper.","objdump + caller inspection + local disassembly + typed-object correlation + descriptor-string correlation"
0x0053bf60,125,global_banked_13_byte_record_staging_table_release_row_payload_by_type_and_clear_row,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Typed release helper over one local `13`-byte staging-table row selected by ordinal. The helper reads the row type byte at `+0x08` and payload root at `+0x09`, dispatches non-null payloads through type-specific release or service helpers including `0x00567520`, `0x00542c90`, `0x0053ee60`, and `0x005512a0`, then frees the payload root through `0x0053b080` when that branch returns and clears the entire row back to zero. Current grounded caller is the refcount-drop helper `0x0053c000`, so this is the safest current read for the typed row-payload release owner rather than a generic table reset.","objdump + caller inspection + local disassembly + staging-row correlation + type-dispatch correlation"
0x0053c000,98,global_banked_13_byte_record_staging_table_drop_refcount_by_payload_id_and_release_row_when_last_user,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Reference-drop helper over the same local `13`-byte staging table. Given one caller payload id, the helper scans row field `[row+0x09]` for a match, decrements that row's lead refcount dword, and returns immediately while the count stays positive. When the count reaches zero it checks one per-type persistent slot strip at `[this+0x4278c + type*4]`; if that strip is null, it tail-calls `0x0053bf60` to release the row payload and clear the row. This is the safest current read for a refcount-drop helper over staging payload instances rather than a second generic free path.","objdump + caller inspection + local disassembly + refcount correlation + staging-row correlation"
0x0053c070,333,global_banked_13_byte_record_staging_table_acquire_or_create_refcounted_row_for_payload_and_type,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Typed acquire-or-create helper over the same local `13`-byte staging table. The helper first searches existing rows for matching field `[row+0x04] == caller_payload_id`; on a hit it increments the lead refcount dword and returns the existing payload root `[row+0x09]`. On a miss it scans backward for one empty row, grows the table through `0x0053b850` when needed, seeds a new row with refcount `1`, caller payload id at `+0x04`, caller type byte at `+0x08`, and then lazily constructs the typed payload root at `+0x09` for selected types including `1 -> 0x00567500`, `6 -> 0x0053ee70`, and `7 -> 0x00551970`. This is the safest current read for the refcounted staging-row acquire-or-create owner rather than a plain append helper.","objdump + caller inspection + local disassembly + refcount correlation + typed-payload correlation"
0x0053c900,35,global_banked_13_byte_record_family_reset_bucket_stream_and_recent_query_state,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Compact reset helper above the same support family. The helper clears bucket chains through `0x0053b970`, re-enters neighboring cleanup `0x0053c820`, and then fills the `10`-entry recent-query cache rooted at `[this+0x4290c]` with `-1`. This is the safest current read for the family's compact cache-and-stream reset owner rather than a full constructor.","objdump + caller inspection + local disassembly + recent-cache correlation"
0x0053c930,140,global_banked_13_byte_record_family_lookup_composite_string_key,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Composite-string lookup wrapper over the same banked support family. The helper copies one caller primary string into a local stack buffer, optionally appends a second caller suffix string, hashes the resulting composite key through `0x0053b5c0`, and then forwards that key plus caller output slots and mode flag into `0x0053b390`. Current grounded callers use this as the main string-keyed probe across many shell and bootstrap paths, so this is the safest current read for the composite-key lookup wrapper rather than a user-facing formatter.","objdump + caller inspection + local disassembly + string-key correlation + keyed-lookup correlation"
0x0053c9c0,93,global_banked_13_byte_record_family_lookup_key_and_return_payload_byte_len,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small size resolver over the same banked support family. The helper resolves the caller key through `0x0053b390`; on a positive bank hit it returns row field `[bucket_row + row_index*0x0d + 0x04]`, while on a negative current-entry ordinal it resolves that entry through `0x0053b630` and returns `[entry+0x0c]` instead. Current grounded callers immediately pair this byte length with `0x0053bd40` and `0x0053b7c0` to allocate and read one keyed payload, so this is the safest current read for the keyed payload-length resolver rather than a generic field getter.","objdump + caller inspection + local disassembly + payload-length correlation + keyed-lookup correlation"
0x0053ca20,100,global_banked_13_byte_record_family_push_current_stream_selection_frame,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Push helper over the same banked support family's current stream-selection state. The helper allocates one `0x0c`-byte frame, snapshots either the current-entry handle `[entry+0x04]` or the active-bank handle `[this+0x204ac + [this+0x427bc]*4]` through `0x005c7820`, stores the current selection lane `[this+0x427bc]`, chains the previous frame root from `[this+0x20428]` into `[frame+0x08]`, and then publishes the new frame root back to `[this+0x20428]` while incrementing push counter `[this+0x428f8]`. Current grounded callers pair it with `0x0053ca90`, so this is the safest current read for the current-selection push helper rather than a generic alloc wrapper.","objdump + caller inspection + local disassembly + selection-frame correlation"
0x0053ca90,127,global_banked_13_byte_record_family_pop_current_stream_selection_frame_and_restore_seek,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Pop-and-restore helper over the same current stream-selection frame stack rooted at `[this+0x20428]`. When one frame is live, the helper increments `[this+0x428f8]`, closes the current entry stream through `0x0053b690` when needed, restores selection lane `[this+0x427bc]` from `[frame+0x04]`, reopens the selected current-entry stream through `0x0053b6f0` when the restored lane is negative, otherwise resolves the live bank handle from `[this+0x204ac]`, seeks that handle back to saved cursor `[frame+0x00]` through `0x005ac18d`, pops the frame chain from `[frame+0x08]`, and frees the frame root. Current grounded callers bracket typed support-side reads and object-acquisition flows, so this is the safest current read for the current-selection restore helper rather than a generic stack pop.","objdump + caller inspection + local disassembly + selection-frame correlation + stream-seek correlation"
0x0053cb10,73,global_banked_13_byte_record_family_read_two_u32_header_and_optional_heap_blob,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small read helper over the same active stream. The helper reads two `u32` values through `0x0053b7c0`; when the second value is nonzero, it allocates a heap buffer of that length through `0x005a125d`, stores the new pointer to one caller output slot, and reads that many payload bytes into the buffer through `0x0053b7c0`. Current grounded callers sit in support-family object loaders under `0x0053fb88`, `0x005403c7`, `0x0055b9a4`, and `0x00563c8f`, so this is the safest current read for a small two-dword-plus-optional-blob reader rather than a generic stream wrapper.","objdump + caller inspection + local disassembly + header-read correlation + heap-blob correlation"
0x0053cb60,1408,global_banked_13_byte_record_family_construct_reset_load_static_root_table_and_seed_report_slots,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader constructor and bootstrap-load owner for the same banked `13`-byte-record support family. The helper zeroes the per-type persistent slot strip `[this+0x4278c]`, clears the bucket-chain roots and active bank roots under `[this+0x203a4/+0x20424/+0x204ac]`, resets all counters and recent-query cache fields `[this+0x427b0..+0x429ac]`, seeds four owned report-slot roots `[this+0x429b0..+0x429bc]` through `0x0053ba1b`, grows the local staging slab through `0x0053b850`, and then walks the static pointer table rooted at `0x00624e14` through `0x00624e48`. For each table entry it formats one `%%1*.pk4`-style probe, loads one bank through `0x0053b090`, and later re-enters the keyed lookup and typed-object strip `0x0053c930/0x0053be10` to route selected records into the owned report slots with category probes such as `companyLogo`, `portrait`, and `trainSkin`. This is the safest current read for the family's constructor-plus-static-root-table bootstrap loader rather than a narrow per-bank helper.","objdump + caller inspection + local disassembly + static-root-table correlation + support-family bootstrap correlation"
0x0053d0f0,24,global_banked_13_byte_record_staging_table_acquire_type1_payload_by_string_key,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny string-keyed wrapper above the same staging-table acquire path. The helper hashes the caller string through `0x0053b5c0`, then acquires or creates a staging-row payload of type `1` through `0x0053c070`. Current grounded callers sit in shared runtime-object and support-family bootstrap flows, so this is the safest current read for the type-`1` string-keyed staging wrapper rather than a generic hash helper.","objdump + caller inspection + local disassembly + string-key correlation + type1-wrapper correlation"
0x0053d110,25,global_banked_13_byte_record_staging_table_acquire_type6_payload_by_string_key,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Sibling tiny string-keyed wrapper above `0x0053c070`. Like `0x0053d0f0`, the helper hashes one caller string through `0x0053b5c0`, but it acquires or creates a staging-row payload of type `6` instead. Current grounded callers span runtime-object, shell, and support-family flows, which makes this the safest current read for the type-`6` string-keyed staging wrapper rather than a raw field setter.","objdump + caller inspection + local disassembly + string-key correlation + type6-wrapper correlation"
0x0053d130,143,global_banked_type7_record_refresh_from_openable_path_basename_and_stem,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly + string-template correlation,2,"Path-normalizing helper beside the string-keyed staging wrappers. The function scans one caller path for the final backslash, copies the basename into a local buffer, derives a second local stem through `0x0051d8a0`, probes the original path through `support_query_path_is_openable_for_read` `0x0051e430`, and only on success forwards the basename plus stem into `0x0053c710` with the refresh flag set before resetting owner dword `[this+0x427b0] = -1`. The current grounded caller is the selector-`2` setup branch inside `shell_active_mode_run_profile_startup_and_load_dispatch` `0x00438890`, where it refreshes one support-family record from setup path buffer `0x006d1370` before the common world-init work continues, so this is the safest current read for the openable-path basename or stem refresh helper rather than a generic file parser.","objdump + caller inspection + local disassembly + string-template correlation + selector2-setup-path correlation"
0x0053d1d0,103,scored_heap_sift_up_node_by_field_0x04_and_refresh_slot_backpointers,support,thiscall,inferred,objdump + local disassembly,1,"Binary-heap sift-up helper over one owner whose array root is `[this+0x08]`. Starting from one caller index, the helper compares node score field `[node+0x04]` against the parent score, bubbles the higher-scoring node upward, and refreshes each moved node's backpointer at `[node+0x00]` to the new array slot address. This is the safest current read for a max-heap sift-up helper rather than a support-family-specific payload routine.","objdump + local disassembly + heap-shape correlation"
0x0053d240,143,scored_heap_sift_down_node_by_field_0x04_and_refresh_slot_backpointers,support,thiscall,inferred,objdump + local disassembly,1,"Binary-heap sift-down helper over the same owner. Given one caller index, the helper chooses the larger-scoring child by comparing child score field `[node+0x04]`, bubbles that child upward while its score stays above the current node's score, then writes the final node root back into the settled slot and refreshes its backpointer at `[node+0x00]`. This is the safest current read for the paired max-heap sift-down helper rather than a queue-family destructor.","objdump + local disassembly + heap-shape correlation"
0x0053d2e0,19,scored_heap_peek_top_score_field_0x04_or_zero,support,thiscall,inferred,objdump + local disassembly,1,"Tiny query helper over the same scored heap owner. When `[this+0x0c] > 0`, the helper returns score field `[heap[0]+0x04]`; otherwise it returns `0`. This is the safest current read for a top-score peek helper rather than a broader queue query.","objdump + local disassembly + heap-shape correlation"
0x0053d300,24,scored_heap_decrement_node_score_field_0x04_and_sift_down,support,thiscall,inferred,objdump + local disassembly,1,"Small heap-adjust helper over one caller node root. The helper decrements the node's score field `[node+0x04]`, derives the current array index from backpointer `[node+0x00]`, and tail-calls `0x0053d240` to restore heap order from that slot. This is the safest current read for a decrement-and-reheapify helper rather than a generic arithmetic wrapper.","objdump + local disassembly + heap-shape correlation"
0x0053d320,107,scored_node_queue_acquire_node_from_freelist_or_alloc_and_push,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small scored-node queue helper over one owner with queue root `[this+0x08]` and node-pool descriptor `[this+0x04]`. The helper first pops one reusable node from the pool freelist when available, otherwise allocates a fresh node of size `[pool+0x10]` through `0x0053b070`; it then pushes the node into the live queue rooted at `[this+0x08]`, increments that queue count, and seeds caller values into `[node+0x04]` and `[node+0x08]`. Current grounded callers pair it with `0x0053d390` and `0x0053d440`, so this is the safest current read for a scored-node queue acquire-and-push helper rather than a plain list append.","objdump + caller inspection + local disassembly + queue-shape correlation"
0x0053d390,176,scored_node_queue_pop_highest_score_payload_and_recycle_or_free_node,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Removal helper over the same scored-node queue. The helper scans the live queue rooted at `[this+0x08]` for the node with the highest score field `[node+0x04]`, unlinks that node, decrements the queue count, captures payload field `[node+0x08]`, and then either returns the node to the pool freelist described by `[this+0x04]` when it lies inside the managed pool span or frees it through `0x0053b080` otherwise. This is the safest current read for a pop-highest-score helper rather than a generic free path.","objdump + caller inspection + local disassembly + queue-shape correlation"
0x0053d440,36,scored_node_queue_contains_payload_value,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Linear membership query over the same scored-node queue. The helper walks the live queue rooted at `[this+0x08]` and returns `1` when any node carries caller payload value `[node+0x08] == arg`, or `0` on miss. Current grounded callers sit beside `0x0053d320/0x0053d390`, so this is the safest current read for a queue-membership predicate rather than a key hash helper.","objdump + caller inspection + local disassembly + queue-shape correlation"
0x0053d470,76,scored_node_queue_release_pool_and_owned_roots,support,thiscall,inferred,objdump + local disassembly,1,"Release helper over the same scored-node queue owner. The helper frees optional root `[this+0x08]` through `0x005a1145`, releases optional pool descriptor `[this+0x04]` through `0x0053dcb0` and `0x0053b080`, frees optional root `[this+0x00]`, and clears queue count `[this+0x0c]` back to zero. This is the safest current read for the queue-owner release helper rather than a family-wide support destructor.","objdump + local disassembly + queue-shape correlation"
0x0053d4c0,120,scored_heap_acquire_node_from_pool_or_alloc_insert_and_sift_up,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Pooled insert helper over the scored heap owner whose node-pool descriptor lives at `[this+0x04]`, slot array at `[this+0x08]`, and live count at `[this+0x0c]`. The helper first pops a reusable node from the pool freelist or allocates one fresh node of pool stride `[pool+0x10]`, then increments the live count, stores the new node into the next heap slot, seeds caller values into `[node+0x04]` and `[node+0x08]`, and finally re-enters `0x0053d1d0` to restore max-heap order. Current grounded callers pair it with `0x0053d540`, so this is the safest current read for the heap insert helper rather than a queue append.","objdump + caller inspection + local disassembly + heap-shape correlation"
0x0053d540,136,scored_heap_pop_top_payload_and_recycle_or_free_node,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Pop helper over the same scored heap owner. When the heap is non-empty, the helper captures the payload field `[top+0x08]`, recycles or frees the root node through the pool descriptor at `[this+0x04]`, replaces the top slot from the last live slot when more than one node remains, decrements live count `[this+0x0c]`, and re-enters `0x0053d240` to restore heap order from slot `1`. This is the safest current read for a pop-top-payload helper over the scored heap rather than a queue scan.","objdump + caller inspection + local disassembly + heap-shape correlation"
0x0053d5d0,81,scored_heap_release_pool_array_and_owned_roots,support,thiscall,inferred,objdump + local disassembly,1,"Release helper over the same scored heap owner. The helper frees optional slot-array root `[this+0x08]` through `0x0053b080`, releases optional pool descriptor `[this+0x04]` through `0x0053dcb0` and `0x0053b080`, and frees optional backing root `[this+0x00]` through `0x005a1145`. This is the safest current read for the heap-owner release helper rather than a broader family destructor.","objdump + local disassembly + heap-shape correlation"
0x0053d630,179,scored_heap_construct_with_capacity_and_pool_stride_0x0c,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Constructor for the same scored heap owner. Given one caller capacity, the helper first releases any existing owner through `0x0053d5d0`, allocates one zeroed backing slab of `capacity * 0x0c` bytes into `[this+0x00]`, allocates a `0x1c` pool descriptor into `[this+0x04]`, initializes that descriptor through `0x0053dcf0` with stride `0x0c`, and then allocates one zeroed `0x0c` slot-array header into `[this+0x08]`. Current grounded callers are the nearby owner paths at `0x00416aa4` and `0x0053d740`, so this is the safest current read for the scored-heap constructor rather than a generic vector alloc.","objdump + caller inspection + local disassembly + heap-shape correlation"
0x0053d6f0,76,extended_scored_heap_release_pool_array_and_owned_roots,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Release helper over the adjacent extended scored-heap owner. The helper frees optional slot-array root `[this+0x08]` through `0x005a1145`, releases optional pool descriptor `[this+0x04]` through `0x0053dcb0` and `0x0053b080`, frees optional backing slab `[this+0x00]`, and clears live count `[this+0x0c]` back to zero. Current grounded callers are the hotkey-report iterator teardown at `0x0045f343` and the sibling owner teardown at `0x00522f54`, so this is the safest current read for the extended heap-owner release helper rather than a generic destructor.","objdump + caller inspection + local disassembly + heap-shape correlation"
0x0053d740,178,extended_scored_heap_construct_with_capacity_and_sentinel_header,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Constructor for the adjacent extended scored-heap owner. Given one caller capacity, the helper first releases any existing owner through `0x0053d470`, allocates one zeroed backing slab of `capacity * 0x0c` bytes into `[this+0x00]`, allocates a `0x1c` pool descriptor into `[this+0x04]`, initializes that descriptor through `0x0053dcf0` with stride `0x0c`, allocates one zeroed pointer-slot array of `(capacity * 4) + 4` bytes into `[this+0x08]`, seeds sentinel header `[this+0x10]`, default best-score lane `[this+0x14] = 0x7fffffff`, and counter `[this+0x18] = 0`, and stores the sentinel header as the first slot-array entry. Current grounded callers are the temporary hotkey-report owner at `0x0045f292` and the sibling shell/runtime owner at `0x00522c67`, so this is the safest current read for the extended heap constructor rather than a second plain vector alloc.","objdump + caller inspection + local disassembly + heap-shape correlation + sentinel-header correlation"
0x0053d810,95,hash_cstring_crc32_like_with_optional_ascii_uppercase,support,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Small hashing helper over one NUL-terminated byte string. The helper folds each byte through the table rooted at `0x00624e48`, optionally uppercases ASCII letters first when mode arg1 equals `1`, and returns the final CRC32-like accumulator. Current grounded caller is `shell_input_binding_registry_resolve_entry_by_action_stem` `0x0045ede0`, which uses the uppercase-enabled path while resolving normalized action stems, so this is the safest current read for the support-side NUL-terminated hash helper rather than a generic checksum wrapper.","objdump + caller inspection + local disassembly + crc-table correlation"
0x0053d870,46,hash_fixed_length_byte_span_crc32_like,support,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Sibling hashing helper over one fixed-length byte span. The helper folds exactly `len` bytes from the caller pointer through the same table rooted at `0x00624e48` and returns the final CRC32-like accumulator. Current grounded callers hash fixed `0x0a`- and `0x1c`-byte record headers at `0x0046cc97` and `0x0047085a`, so this is the safest current read for the fixed-length support-side hash helper rather than a string normalizer.","objdump + caller inspection + local disassembly + crc-table correlation"
0x0053d8a0,186,u32_to_ptr_hash_table_release_optional_pooled_nodes_and_bucket_array,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Release helper over one intrusive `u32 -> ptr` hash-table owner. The helper walks every bucket-chain root in bucket array `[this+0x00]`, and for each node either returns that node to the optional pooled-node descriptor at `[this+0x08]` when the descriptor span and in-pool checks match, or frees it through `0x0053b080` otherwise; it then releases the optional pool descriptor, frees the optional node-backing root `[this+0x04]`, frees the bucket array root `[this+0x00]`, and clears live-node count `[this+0x0c]` plus bucket count `[this+0x10]`. Current grounded callers are the connected-component and local-bucket map owners around `0x00416170` and `0x00522ed1`, so this is the safest current read for the pooled hash-table release helper rather than a generic map clear.","objdump + caller inspection + local disassembly + intrusive-hash-table correlation"
0x0053d960,124,u32_to_ptr_hash_table_insert_or_replace_value_by_key,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Insert helper over the same intrusive `u32 -> ptr` hash-table owner. The helper acquires one pooled node from free list `[table+0x08]` or allocates a fresh node when needed, hashes the caller key through `(key ^ (key >> 15)) % [table+0x10]`, seeds node fields `[node+0x00] = key` and `[node+0x04] = value`, links the node to the head of the selected bucket chain, and leaves duplicate-key replacement to the caller's preceding remove path. Current grounded callers include the connected-component map writers at `0x00416170` and `0x00416298`, so this is the safest current read for hash-table insert-by-key rather than a generic queue push.","objdump + caller inspection + local disassembly + intrusive-hash-table correlation"
0x0053d9e0,185,u32_to_ptr_hash_table_remove_key_and_return_value,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Removal helper over the same intrusive `u32 -> ptr` hash-table owner. The helper hashes the caller key through `(key ^ (key >> 15)) % [table+0x10]`, walks the selected bucket chain, unlinks the matching node when found, returns stored value `[node+0x04]`, and then either recycles the node into the optional pool descriptor at `[table+0x08]` or frees it through `0x0053b080`. Current grounded callers are the connected-component and local-bucket refresh paths at `0x00416170`, `0x0041626c`, and `0x0041643e`, so this is the safest current read for remove-and-return-value rather than another membership predicate.","objdump + caller inspection + local disassembly + intrusive-hash-table correlation"
0x0053daa0,58,u32_to_ptr_hash_table_contains_key,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Membership predicate over the same intrusive `u32 -> ptr` hash-table owner. The helper hashes the caller key through `(key ^ (key >> 15)) % [table+0x10]`, walks the selected bucket chain by link field `+0x08`, and returns `1` on the first matching key or `0` on miss. Current grounded callers sit beside the sibling lookup and remove helpers, so this is the safest current read for a hash-table contains-key predicate rather than a value fetch.","objdump + caller inspection + local disassembly + intrusive-hash-table correlation"
0x0053dae0,54,u32_to_ptr_hash_table_lookup_value_by_key,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Lookup helper over the same intrusive `u32 -> ptr` hash-table owner. The helper hashes the caller key through `(key ^ (key >> 15)) % [table+0x10]`, walks the selected bucket chain, and returns stored value `[node+0x04]` on the first matching key or `0` on miss. Current grounded callers include `placed_structure_collection_refresh_local_runtime_side_state_in_rect_from_cell_bucket_map` `0x00419110`, the connected-component rectangle pass `0x00416170`, and `global_owner_family_lookup_key_in_selected_hash_root` `0x00531ef0`, so this is the safest current read for hash-table lookup-by-key rather than a membership-only helper.","objdump + caller inspection + local disassembly + intrusive-hash-table correlation"
0x0053db20,177,u32_to_ptr_hash_table_iterate_entries_with_optional_exact_key_filter_and_callback,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Callback iterator over the same intrusive `u32 -> ptr` hash-table owner. When key arg0 is zero, the helper walks every bucket chain in bucket array `[table+0x00]`; otherwise it hashes that key through `(key ^ (key >> 15)) % [table+0x10]` and only walks the selected bucket. For each visited node it calls the caller-supplied callback with `ecx = node`, `edx = user_arg`, and stops early on the first nonzero callback result, returning that value. Current grounded callers are the cleanup and release passes at `0x00522e85` and `0x00522ec0`, so this is the safest current read for the optional-key callback iterator rather than a value lookup helper.","objdump + caller inspection + local disassembly + intrusive-hash-table correlation + callback-iterator correlation"
0x0053dbe0,5,u32_to_ptr_hash_table_release_thunk,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tail-call thunk into `u32_to_ptr_hash_table_release_optional_pooled_nodes_and_bucket_array` `0x0053d8a0`. Current grounded callers use it as the direct release entry for hash-table owners at `0x00522e93` and `0x00522ed1`, so the safest current read is a narrow release thunk rather than an independent owner.","objdump + caller inspection + local disassembly + release-thunk correlation"
0x0053dbf0,185,u32_to_ptr_hash_table_construct_with_bucket_count_and_pooled_node_capacity,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Constructor for the same intrusive `u32 -> ptr` hash-table owner. Given caller bucket count and pooled-node capacity, the helper first releases any existing owner through `0x0053d8a0`, allocates one zeroed pooled-node backing slab of `capacity * 0x10` bytes into `[this+0x04]`, allocates a `0x1c` pool descriptor into `[this+0x08]`, initializes that descriptor through `0x0053dcf0` with stride `0x10`, allocates one zeroed bucket array of `bucket_count * 4` bytes into `[this+0x00]`, and stores pooled-node capacity `[this+0x0c]` plus bucket count `[this+0x10]`. Current grounded callers are the map-side owners under `0x00416170` and the sibling runtime owner at `0x00522e7e`, so this is the safest current read for the pooled hash-table constructor rather than a generic alloc wrapper.","objdump + caller inspection + local disassembly + intrusive-hash-table correlation"
0x0053dcb0,55,fixed_stride_pool_descriptor_release_optional_owned_block,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Release helper over one fixed-stride pool descriptor. The helper frees optional freelist or root pointer `[this+0x00]`, and when ownership flag `[this+0x18] == 1` it also frees optional owned backing block `[this+0x04]`, then leaves the descriptor itself for the caller to release. Current grounded callers are the scored-heap and hash-table owner destructors `0x0053d470`, `0x0053d5d0`, `0x0053d6f0`, and `0x0053d8a0`, so this is the safest current read for the pool-descriptor release helper rather than a family-wide destructor.","objdump + caller inspection + local disassembly + pool-descriptor correlation"
0x0053dcf0,216,fixed_stride_pool_descriptor_reset_with_optional_owned_block_and_freelist_seed,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Reset or constructor helper over one fixed-stride pool descriptor. The helper stores caller stride at `[this+0x14]`, releases prior freelist root `[this+0x00]` and any owned backing block `[this+0x04]` when ownership flag `[this+0x18]` was set, then either adopts one caller-supplied backing block and count directly or allocates an owned block of `count * stride` bytes, seeds freelist header `[this+0x00]`, block start `[this+0x04]`, block end `[this+0x08]`, count `[this+0x0c]`, stride `[this+0x10]`, and ownership flag `[this+0x18]`, and links every fixed-stride node into the freelist. Current grounded callers initialize scored-heap and hash-table pool descriptors from `0x0053d630`, `0x0053d740`, and `0x0053dbf0`, so this is the safest current read for the fixed-stride pool-descriptor reset helper rather than one pool-family-specific constructor.","objdump + caller inspection + local disassembly + pool-descriptor correlation + freelist-seed correlation"
0x0053dde0,8,world_anchor_scale_primary_extent_by_local_factor,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny world-anchor scaling helper. The function multiplies caller float arg0 by local factor `[this+0x2e]` and returns the resulting floating-point extent. Current grounded caller is `shell_queue_world_anchor_marker` `0x00552560`, which pairs it with `0x0053ddf0` while building screen-space marker extents, so this is the safest current read for the primary extent scaler rather than a generic multiply wrapper.","objdump + caller inspection + local disassembly + world-anchor correlation"
0x0053ddf0,8,world_anchor_scale_secondary_extent_by_local_factor,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Sibling world-anchor scaling helper. The function multiplies caller float arg0 by local factor `[this+0x32]` and returns the resulting floating-point extent. Current grounded caller is `shell_queue_world_anchor_marker` `0x00552560`, which uses it for the second screen-space marker extent lane, so this is the safest current read for the secondary extent scaler rather than a generic multiply wrapper.","objdump + caller inspection + local disassembly + world-anchor correlation"
0x0053de00,83,indexed_string_table_lookup_ptr_or_format_out_of_range_warning,support,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Indexed string-table getter over one owner with optional family label `[this+0x20]`, table root `[this+0x24]`, and entry count word `[this+0x28]`. When index arg0 is in range, the helper returns table entry pointer `[table + index*4]`; on overflow it formats one warning through the template at `0x005dd658` using the owner label or fallback `0x005c87a8`, then returns the first table entry. Current grounded callers are the setup payload-category row draw callback `0x00502030` and the selected-train route-and-state panel renderer `0x0050fc00`, so this is the safest current read for the indexed string-table lookup helper rather than a route-specific formatter.","objdump + caller inspection + local disassembly + indexed-string-table correlation"
0x0053de60,1137,shell_image_marker_payload_refresh_variant_table_from_screen_metrics_and_vram_policy,shell,thiscall,inferred,objdump + caller inspection + local disassembly + rdata string decode,2,"Heavy refresh pass over the typed type-`6` image-marker payload constructed by `0x0053ee70/0x0053e370`. The helper derives current screen-space scale from shell display state `[0x006d4024+0x11421e/+0x34/+0x11422f/+0x114243/+0x114247/+0x11424f/+0x1146dd]`, clears and rebuilds the local variant table rooted at `[this+0x24]`, resolves one selected TGA or DDS resource through `0x0053c1c0`, and then parses the payload's per-variant descriptors into one live table of `0x25`-byte marker variants via `0x005520a0`. The parsed keyword set is now grounded from `.rdata`: `Image`, `ImageWH`, `ImageWHForceScale`, `ImageWHWithRef`, `ImageScaled`, `ImageWHScaled`, `MaxPercentOfInterfaceVRAM`, `MaxPercentOfInterfaceVRAMToUse`, `Scaleable`, `TGATargetScreenHeight`, `TGATargetScreenWidth`, `TGAHeight`, `TGAWidth`, `TGAName`, `HorizontalScaleModifier`, and `VerticalScaleModifier`. Current direct callers are the constructor tail `0x0053ee15` and the rebuild wrapper `0x0053e2d0`, while downstream consumers include `shell_queue_world_anchor_marker` `0x00552560`, so this is the safest current read for the payload's variant-table refresh owner rather than a generic image loader.","objdump + caller inspection + local disassembly + rdata string decode + typed-payload correlation"
0x0053e2b0,32,shell_image_marker_payload_release_variant_resources_then_refresh,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small rebuild wrapper over the same type-`6` image-marker payload. The helper releases any current variant table entries rooted at `[this+0x24]`, releases optional loaded image handle `[this+0x2a]` through `0x0053c000`, clears that handle, and then tail-jumps back into `shell_image_marker_payload_refresh_variant_table_from_screen_metrics_and_vram_policy` `0x0053de60`. Current grounded caller is the shell helper-collection refresh sweep `0x00538ec0`, so this is the safest current read for the payload rebuild wrapper after shell selection or display changes rather than a pure destructor.","objdump + caller inspection + local disassembly + typed-payload correlation"
0x0053e2e0,144,shell_image_marker_payload_release_variant_table_image_handle_and_label,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Release helper over the same type-`6` image-marker payload. The helper walks every live variant pointer in `[this+0x24]`, releases each variant through `0x00552130` and `0x0053b080`, frees the variant-pointer array, releases optional loaded image handle `[this+0x2a]` through `0x0053c000`, frees optional label string `[this+0x20]`, and then notifies the shell helper collection rooted at `[0x006d401c+0xc69]` with token `[this+0x36]`. Current direct callers are the rebuild wrapper thunk `0x0053ee60` and the support-side row release paths that destroy typed type-`6` payloads, so this is the safest current read for the image-marker payload destructor rather than a generic array free.","objdump + caller inspection + local disassembly + typed-payload correlation"
0x0053e370,2744,shell_image_marker_payload_construct_from_banked_record_key,shell,thiscall,inferred,objdump + caller inspection + local disassembly + rdata string decode,2,"Constructor for the same typed type-`6` image-marker payload used by the banked-record staging family. The helper seeds default dimension and scaling fields, opens one selected support-family record stream through `0x0053bd40/0x0053c9c0/0x0053b7c0`, tokenizes the record text through `0x0051d9d0`, parses the grounded keyword set (`Image`, `ImageWH`, `ImageWHForceScale`, `ImageWHWithRef`, `ImageScaled`, `ImageWHScaled`, `MaxPercentOfInterfaceVRAM`, `MaxPercentOfInterfaceVRAMToUse`, `Scaleable`, `TGATargetScreenHeight`, `TGATargetScreenWidth`, `TGAHeight`, `TGAWidth`, `TGAName`, `HorizontalScaleModifier`, `VerticalScaleModifier`), registers one shell helper token through `[0x006d401c+0xc69]`, derives local extent ratios `[this+0x2e/+0x32]`, and finally enters `0x0053de60` to build the live variant table. Current grounded constructor wrapper is `0x0053ee70`, and the typed acquire-or-create owner `0x0053c070` already binds payload type `6` to that wrapper, so this is the safest current read for the type-`6` banked-record payload constructor rather than a generic text parser.","objdump + caller inspection + local disassembly + rdata string decode + typed-payload correlation"
0x0053ee60,5,shell_image_marker_payload_release_thunk,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tail-call thunk into `shell_image_marker_payload_release_variant_table_image_handle_and_label` `0x0053e2e0`. Current grounded caller is the typed-row release family beneath `0x0053c000/0x0053c070`, so the safest current read is a narrow type-`6` payload release thunk rather than an independent owner.","objdump + caller inspection + local disassembly + typed-payload correlation"
0x0053ee70,17,shell_image_marker_payload_construct_wrapper,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Thin wrapper above `shell_image_marker_payload_construct_from_banked_record_key` `0x0053e370`. The helper forwards the caller record key into the heavier constructor and then returns `this` unchanged. Current grounded callers are the typed type-`6` staging-row acquire path at `0x0053c070` and the broader banked-record family, so this is the safest current read for the type-`6` payload constructor wrapper rather than another parser owner.","objdump + caller inspection + local disassembly + typed-payload correlation"
0x0053ee90,104,shell_load_named_or_fallback_ui_image_handle_into_global_slot_table_ccba60,shell,cdecl,inferred,objdump + local disassembly + import-shape correlation,1,"Small shell image-handle loader over the global slot table rooted at `0x00ccba60`. The helper formats one resource name from the string table rooted at `0x00625258` plus a caller-selected index and one of two templates at `0x005dd7f0/0x005dd80c`, forwards that string into the USER32 image-load import at `0x005c829c`, and on failure falls back to the stock-image import at `0x005c82a0` with id `0x7f00`. The resolved handle is then stored into slot `0x00ccba60 + (arg0*0x17 + arg1)*4`. The row is therefore kept at that named-or-fallback UI image-slot level.","objdump + local disassembly + import-shape correlation + global-slot-table correlation"
0x0053b010,11,bootstrap_mark_runtime_started,bootstrap,cdecl,inferred,ghidra-headless,2,Single-purpose bootstrap helper that flips a process-global started flag to one before branding and shell setup continue.,ghidra + rizin
0x0054e6d0,42,bootstrap_capture_keyboard_state,bootstrap,cdecl,inferred,ghidra-headless,4,Single-purpose bootstrap probe that snapshots the host keyboard state through GetKeyboardState.,ghidra + rizin
0x00540a47,75,shell_control_refresh_matching_dynamic_text_payload,shell,unknown,inferred,objdump + caller inspection,3,"Small shell-control helper used on one matching control descriptor during refresh or replacement. When the incoming control id matches `[control+0x4]`, the helper frees any prior heap-backed text payload at `[control+0xce]`, clears that field, optionally copies a replacement payload from the caller descriptor through `0x0051d820`, and then returns `0` when the incoming control type is `0x6f` or `1` otherwise. Current grounded importance is the `CompanyDetail.win` section-0 overview widget `0x947f`: together with the sibling helper at `0x005639d2`, this makes type `0x6f` look like a special heap-backed dynamic-text control rather than an ordinary callback widget.","objdump + caller inspection + type-0x6f control correlation"
0x005639d2,22,shell_control_release_dynamic_text_payload,shell,unknown,inferred,objdump + caller inspection,3,"Tiny shell-control release helper that clears one control's attached payload through `0x0051d820` and then returns `0` when the control type at `[this+0x0]` is `0x6f` or `1` otherwise. Current grounded importance is the same CompanyDetail section-0 overview lane around control `0x947f`, where this reinforces that type `0x6f` is treated as a special dynamic-text family with its own release path instead of a normal callback-style widget.","objdump + caller inspection + type-0x6f control correlation"
0x0055da40,424,bootstrap_probe_system_profile,bootstrap,cdecl,inferred,ghidra-headless,4,Collects GlobalMemoryStatus and CPUID feature bits then stores coarse machine capability flags used by later bootstrap decisions.,ghidra + rizin
0x00507980,59,station_place_selection_id_is_special_negative_tool_item,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,2,"Tiny StationPlace selection-id predicate. The helper returns `1` only for the negative sentinel ids `-11..-17` and `-20..-22`, and `0` for every other id. Current grounded callers are the later StationPlace preview and selection branches at `0x00508c24`, `0x00508e07`, and `0x005094a1`, where it distinguishes special tool-local pseudo-items from ordinary live placement ids before helper-handle or preview follow-ons run.","objdump + caller xrefs + local disassembly + StationPlace sentinel-id correlation"
0x005079c0,138,station_place_window_release_cached_selection_handles_and_world_followons,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small StationPlace.win cleanup helper over the live tool object at `0x006d1720`. The helper first re-enters `0x00453510` on the live world root `0x0062c120` and `0x00413620` on the placed-structure owner `0x0062b26c`, then releases up to four cached selection or helper handles stored at `[this+0x7c]`, `[+0x80]`, `[+0x88]`, and `[+0x84]` through the matching global owners `0x0062b26c`, `0x006ada80`, `0x006cea50`, and `0x0062bae0`, writing `-1` back into each slot after release. Current grounded callers are the thin wrapper `0x00507a50` plus direct StationPlace branches at `0x00507b59` and `0x00509289`, so this is the safest current read for the cached selection-handle release helper beneath the StationPlace tool family rather than a generic shell window destroy stub.","objdump + caller xrefs + local disassembly + handle-release correlation"
0x00507a50,5,station_place_window_release_cached_selection_handles_and_world_followons_thunk,shell,thiscall,inferred,objdump + caller xrefs + wrapper inspection,2,"Tiny tail-jump wrapper over `station_place_window_release_cached_selection_handles_and_world_followons` `0x005079c0`. Current grounded callers are the higher save-load wrapper `0x004423a0` and the direct StationPlace cleanup branch at `0x00444e4a`, which makes this the light entry used when the broader StationPlace family only needs the cached-handle release path.","objdump + caller xrefs + wrapper inspection + StationPlace-family correlation"
0x00507a90,187,station_place_rotation_circle_callback_publish_current_heading_widget,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"StationPlace callback for the dedicated rotation-circle control `0x6987`. The helper reads the current StationPlace angle at `0x006d172c`, subtracts the active world-view angle from `[0x0062be68+0x10]`, normalizes the result through `0x005a1390`, pushes one formatted heading value plus the fixed circle-widget tuning constants into the helper object at `0x006d1724`, and then dispatches through `0x00552900`. Current grounded caller is the StationPlace constructor branch at `0x00509df6`, where this callback is wired directly onto control `0x6987`, so this is the safest current read for the rotation-circle publish path rather than a generic angle formatter.","objdump + caller xrefs + local disassembly + StationPlace control-0x6987 correlation"
0x00507b50,49,station_place_window_destruct_release_helpers_and_clear_singleton,shell,thiscall,inferred,objdump + vtable scan + local disassembly,2,"Primary StationPlace.win destructor. The helper restores vtable `0x005d17c0`, re-enters `station_place_window_release_cached_selection_handles_and_world_followons` `0x005079c0`, releases the helper handle at `0x006d1724` through the shared owner `0x006d4020 -> 0x0053c000`, clears singleton `0x006d1720`, and then tail-jumps into the common shell-window teardown at `0x0053f7d0`. Current evidence comes from the StationPlace vtable and constructor pair, so this is the safest current read for the concrete window destructor rather than another cleanup wrapper.","objdump + vtable scan + local disassembly + StationPlace destructor correlation"
0x00507b90,346,station_place_refresh_category_controls,shell,cdecl,inferred,objdump + strings + RT3.lng,4,"Refreshes the StationPlace.win category and mode controls for the current placement mode stored at 0x00622af4. The helper now grounds the six top-level category buttons rooted at 0x697c through 0x6981 as `Place a small station` 2197, `Place a medium station` 2198, `Place a large station` 2199, `Place a service tower` 2200, `Place a maintenance facility` 2201, and `Place a non-station building` 2202. It also refreshes the dependent controls around 0x69c8 0x69c9 0x6985 0x6986 and 0x6983 through 0x00540120; current evidence now bounds 0x6985 and 0x6986 as a two-state station-rotation policy toggle keyed by 0x006d1728, where 0x6985 aligns with `When placing the building, it will rotate itself as needed to orient to track or avoid obstacles.` string 2207 and 0x6986 aligns with `When placing the building, it will strictly adhere to the rotation specified by the circle above.` string 2206. In non-station-building mode 5 it can also seed [this+0x8c] from the active StationPlace list control under 0x006d1720 before preview formatting continues.",objdump + strings + RT3.lng + caller xrefs + callsite inspection
0x00507cf0,135,station_place_set_rotation_and_refresh_live_selected_site_pose,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared StationPlace rotation setter over the live tool object. The helper writes the requested heading float into global `0x006d172c`, optionally mirrors that same heading into the auto-orientation seed `0x006d1730`, and then, when the current selected placed structure at `[this+0x7c]` is live, resolves its normalized anchor pair through `0x00455800/0x00455810`, applies the new heading through `0x00455750`, and republishes the refreshed pose through `placed_structure_set_world_coords_and_refresh_local_runtime_side_state` `0x0040eba0` plus the shared runtime-object cleanup tail `0x0052eb90`. Current grounded callers are the cursor-drag rotation helper `0x00507d80`, the discrete step helper `0x005086c0`, and the preview or commit follow-ons at `0x00508fff` and `0x00509050`, so this is the safest current owner for StationPlace heading writes plus live selected-site pose refresh.","objdump + caller xrefs + local disassembly + StationPlace rotation correlation + live-site refresh correlation"
0x00507d80,255,station_place_window_drag_rotate_selected_site_toward_world_cursor,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"StationPlace live drag-rotation helper for the current selected site. The function reads the current cursor or screen-derived pair from `0x006d4018+0xa94/+0xa98`, normalizes that pair through the local scale and wrap helpers `0x005a1270` and `0x005a1390`, derives one wrapped heading delta against the current world-view angle at `[0x0062be68+0x10]`, and then re-enters `station_place_set_rotation_and_refresh_live_selected_site_pose` `0x00507cf0` with mirror flag `1`. Current grounded callers are the direct StationPlace dispatcher branches at `0x005092f3` and `0x00509aa1`, which keeps this on the live station-rotation circle or drag-update side rather than a generic view-angle helper.","objdump + caller xrefs + local disassembly + StationPlace drag-rotation correlation"
0x00507e80,432,station_place_validate_current_selection_at_world_coords_and_optionally_format_status,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared StationPlace go-or-no-go validator beneath both preview and commit paths. The helper first rejects the empty-selection case `[this+0x7c] == -1`, then resolves the current placed structure and its candidate stem through `0x0040cec0`, collects the linked-site latch through vtable slot `+0x70` and `0x0040d1f0`, computes one projected placement record through `0x00455730` and `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, and validates that projected record at the caller-supplied world coordinates through `placed_structure_validate_projected_candidate_placement` `0x004197e0`. On failure it publishes red status through `0x0040cb10`; on partial or blocked follow-on conditions it can publish yellow status plus localized short strings `0x29b/0x29c`; and on success it publishes green status after checking linked-site or territory gating through `0x0040d360` and `0x00481500`. Current grounded callers are the StationPlace preview branch `0x0050906d` and the commit branch `0x00509648`, so this is the safest current read for the shared StationPlace validation-and-status gate rather than another placed-structure-private helper.","objdump + caller xrefs + local disassembly + StationPlace validation correlation + status-color correlation"
0x00508040,1116,station_place_window_try_auto_orient_candidate_to_covering_route_entry_and_validate_placement,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + StationPlace control correlation,3,"Searches for one auto-oriented StationPlace placement pose when the strict-rotation policy is off. The helper seeds the caller heading output from global angle `0x006d1730`, snapshots the staged world-space point, derives one candidate-class latch from the current selection record at `[this+0x8c]`, and then iterates up to three orientation-search modes. On each trial it computes one candidate heading and footprint-offset pose, re-enters `route_entry_collection_try_reuse_covering_entry_for_site_coords_and_heading` `0x00417b40` to see whether an already-covered route entry can support the staged point, and then validates the accepted candidate pose through `placed_structure_validate_projected_candidate_placement` `0x004197e0` before committing it to the caller outputs. The subtype-`1` station branch also probes the route-entry collection directly through `0x00494cb0`, while the later retry loop relaxes the angle and distance thresholds through the local trig and distance helpers before trying the next orientation mode. Current grounded callers are the StationPlace preview path `0x00508f81` and the commit path `0x00509635`, and the surrounding control semantics already tie those callers to the non-strict station-rotation options at controls `0x6985/0x6986`, so this is the safest current read for the StationPlace auto-orientation search owner rather than a generic route-entry chooser.","objdump + caller xrefs + local disassembly + StationPlace control correlation + route-entry reuse correlation + placement-validation correlation"
0x005084a0,174,station_place_quantize_preview_metric_scalar_by_profile_rule,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + caller correlation,2,"Small StationPlace preview-metric quantizer beneath control `0x6983`. The helper first checks the current build version through `0x00482e00`; when that version is below `0x67`, or when the linked profile dword `[profile+0x78c]` is zero, it returns literal `1.0`. Otherwise it scales the caller-supplied float, applies one of two piecewise rounded bands through `0x005a10d0`, and returns the quantized float in steps of either `0x186a0` or `0xc350` depending on the input range. Current grounded callers are `station_place_refresh_preview_metric_control_0x6983` `0x00508550` and the StationPlace commit-side preview or feedback branch `0x0050970c`, so this is the safest current read for the shared preview-metric quantizer rather than a generic math helper.","objdump + caller xrefs + local disassembly + caller correlation + StationPlace control-0x6983 correlation"
0x00508550,363,station_place_refresh_preview_metric_control_0x6983,shell,cdecl,inferred,objdump + strings + local disassembly + caller inspection,4,"Refreshes the remaining StationPlace preview metric field at control `0x6983` for the current selection. The helper validates `[this+0x8c]`, resolves the staged world-cell category through `world_query_float_coords_within_live_grid_bounds` `0x00414bd0` and `0x0044ad60`, reads the linked profile scalar at `[profile+0x22]` through `0x0062b268`, branches on candidate subtype byte `[candidate+0x32]` to choose issue slot `0x3b` or `0x3c`, folds the raw scalar through `scenario_state_compute_issue_opinion_multiplier` `0x00436590`, passes the scaled result through the version-gated quantizer `0x005084a0`, formats the localized metric string `0x29d`, and publishes the final text through `0x00540120` into control `0x6983`. Current grounded caller is the broader preview-panel owner `0x00508730`, so this is the safest current read for the StationPlace preview metric publisher rather than the selected-site summary formatter.","objdump + strings + local disassembly + caller inspection + StationPlace control-0x6983 correlation + issue-slot correlation"
0x005086c0,58,station_place_step_rotation_by_integer_notches,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,2,"Small StationPlace rotation-step helper. The function converts the caller-supplied integer notch count into a heading delta through the fixed scalar at `0x005d1810`, adds that delta to the current StationPlace angle at `0x006d172c`, and then re-enters `station_place_set_rotation_and_refresh_live_selected_site_pose` `0x00507cf0` with mirror flag `1`. Current grounded callers are the two neighboring shell-side StationPlace rotation-step branches at `0x00440c9f` and `0x00440d5f`, which keeps this on the discrete bracket-key or rotation-control side rather than a generic angle-scaling helper.","objdump + caller xrefs + local disassembly + StationPlace discrete-rotation correlation"
0x00508700,34,station_place_query_selected_site_linked_route_entry_id_or_minus1,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,2,"Tiny StationPlace helper that resolves the current selected placed structure at `[this+0x7c]` and returns its linked route-entry id from `[site+0x2a8]`, or `-1` when no live selected site exists or no linked route entry is attached. Current grounded caller is the later StationPlace post-create notification branch at `0x0050991e`, where that linked route-entry id is forwarded into the shared world-side notifier path.","objdump + caller xrefs + local disassembly + linked-route-entry correlation"
0x00508730,292,station_place_format_preview_panel,shell,cdecl,inferred,objdump + strings + local disassembly + caller inspection,4,"Refreshes the main StationPlace preview panel for the current selection id passed in `arg_4`. The helper stores that selection into `[this+0x8c]`, publishes one preview asset into control `0x6982`, refreshes the metric field at `0x6983` through `station_place_refresh_preview_metric_control_0x6983` `0x00508550`, and then publishes the paired description block into control `0x6984`. For negative synthetic selection ids it chooses one fallback preview asset and description token from the local `0x005d1818..0x005d1848` table; for live ids it resolves the placement record through `0x0062b2fc`, formats the asset name from the linked profile block at `0x0062b268+0x4f` through `0x005a19c4`, and formats the description through `0x00413bc0`. Current grounded callers are the category refresh owner `0x00508880` and the small singleton wrapper `0x00508860`, so this is the safest current owner for the StationPlace preview-art, metric, and description refresh strip.","objdump + strings + local disassembly + caller inspection + StationPlace preview-panel correlation"
0x00508860,21,station_place_format_preview_panel_if_live_singleton_and_valid_selection,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,2,"Tiny StationPlace singleton wrapper around `station_place_format_preview_panel` `0x00508730`. The helper ignores selection id `-1`, then checks singleton `0x006d1720` and forwards the caller-supplied selection id only when the StationPlace tool window is live. Current grounded callers are the two neighboring selection-refresh branches at `0x0050a44b` and `0x0050a462`, so this is the safest current read for the guarded preview-panel refresh entry rather than a standalone formatter.","objdump + caller xrefs + local disassembly + StationPlace singleton-wrapper correlation"
0x00508880,727,station_place_select_category_and_refresh,shell,cdecl,inferred,objdump + strings + RT3.lng,4,"Primary StationPlace.win category and selection refresh helper. It stores the requested placement mode at 0x00622af4, where current grounded evidence now maps 0..5 to small station, medium station, large station, service tower, maintenance facility, and non-station building. For the three station modes it also enables the secondary style strip rooted at 0x6988 0x6989 and 0x698c, where 0x6988 and 0x6989 cycle the current building style and 0x698c displays the active style token built from `StationSml` `StationMed` or `StationLrg` plus one of the six localized architecture styles `Victorian` 2672 `Tudor` 2671 `Southwest` 2670 `Persian` 2669 `Kyoto` 2668 and `Clapboard` 2667; the player-facing tooltip for that strip is `Scroll through building styles.` string 2203. The helper resolves the current selection through 0x00622af0 and 0x00622aec, repopulates the StationPlace list controls at 0x69df and 0x69e3, and then refreshes the preview and category panels through 0x00508730 and 0x00507b90.",objdump + strings + RT3.lng + caller xrefs + callsite inspection
0x00508bb0,510,station_place_world_surface_sync_and_dispatch,shell,thiscall,inferred,objdump + caller xrefs + strings,4,"Shared world-surface helper for the active StationPlace.win tool object. It accepts direct `0x07d6` control traffic from the window dispatcher or falls back to the same shell detail-panel surface looked up through `0x006d0818`, rechecks flag bit `0x4` on that control, performs world hit tests through `0x00448ac0`, stages world coordinates into `0x006d1738/0x006d173c`, refreshes the remaining preview metric field through `station_place_refresh_preview_metric_control_0x6983` `0x00508550`, and updates the live placement selection globals at `0x00622af0`, `0x00622aec`, and `0x006d1740` plus helper objects rooted at `[this+0x80]`, `[+0x84]`, and `[+0x88]`. This makes it the clearest StationPlace-side consumer of the shared main-world interaction surface rather than only a passive status refresh helper.","objdump + caller xrefs + strings + callsite inspection + StationPlace control-0x6983 correlation"
0x005091b0,967,station_place_window_handle_message,shell,thiscall,inferred,objdump + strings + RT3.lng,4,"Primary message dispatcher for the StationPlace.win tool object at 0x006d1720. It switches over the incoming shell message id then handles the StationPlace control family rooted at category ids 0x697c through 0x6981, now grounded as the player-facing small station, medium station, large station, service tower, maintenance facility, and non-station-building buttons from strings 2197 through 2202. It also handles the style-strip controls at 0x6988 and 0x6989, which cycle the current building-style override used by station categories, the dependent controls around 0x6985 and 0x6986, now bounded as the two station-rotation policy choices from strings 2207 and 2206, the dedicated station-rotation circle control 0x6987, the list controls 0x69df and 0x69e3, and the shared world-surface control 0x07d6. The handler routes category and selection changes through 0x00508880 and 0x00507b90, uses 0x00507d80 for the live station-rotation drag/update branch, and delegates the world-hit-test path through 0x00508bb0. That makes it the clearest grounded owner for StationPlace player-facing tool commands rather than only a constructor plus frame hook.",objdump + strings + RT3.lng + caller xrefs + callsite inspection
0x00509d80,1936,station_place_window_construct,shell,thiscall,inferred,objdump + strings + RT3.lng,4,"Constructs the StationPlace.win world-tool window object later published at 0x006d1720. The constructor seeds the vtable at 0x005d17c0 binds the StationPlace.imb helper asset and StationPlace.win resource through 0x0053d110 and 0x0053fa50 clears local selection and preview fields rooted at [this+0x7c] through [this+0x94], seeds the dedicated station-rotation circle control at 0x6987 through callback 0x00507a90, seeds the list controls 0x69df and 0x69e3, and stores the singleton plus helper handle globally at 0x006d1720 and 0x006d1724. Current evidence ties that 0x6987 branch to the player-facing `Click to rotate the building. You can also use bracket keys [ and ] to rotate buildings.` string 2208 rather than to the older `Building placement center` string 671; current recovered StationPlace code paths do not show a direct live lookup of string id 671 at all, which makes it look more like a stale or legacy label than a surviving control caption in the present window flow. The current grounded caller is the shell detail-panel constructor branch at 0x004dddc4.",objdump + strings + RT3.lng + caller xrefs + callsite inspection
0x004b81d0,336,shell_building_detail_window_construct_and_bind_core_rows,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `BuildingDetail.win` family rooted at singleton `0x006cfd04`. The constructor installs vtable `0x005d00dc`, binds the helper asset `StationIcons.imb` plus `BuildingDetail.win` through `0x0053d110` and `0x0053fa50`, seeds three shell presenter handles at `0x006cfcf8..0x006cfd00`, clears local bytes `0x006cfd08/0x006cfd09`, wires the paired core action controls `0xbd17` and `0xbd18`, binds the smaller summary callbacks `0xbd13` and `0xbd14`, conditionally binds the extra row trio `0xbd19..0xbd1b` when `[0x006d3c84] == 1`, and then refreshes the visible selection band through `0x004b71b0`. Current grounded caller is the detail-panel manager branch at `0x004dde67`, which keeps this on the shell building-detail side rather than the later standalone opener rooted at `0x004bc100`.","objdump + strings + detail-manager correlation + control-wiring correlation + singleton correlation"
0x004b84b0,55,shell_bulldoze_window_refresh_ordinal_strip,shell,thiscall,inferred,objdump + constructor correlation + message-owner inspection,4,"Small refresh helper for the shell-side `Bulldoze.win` family. The helper walks the seven ordinal controls `0xbf69..0xbf6f`, compares each row against the current selected ordinal stored at `[this+0x78]`, and republishes the row styling through `0x00540120` with the usual selected-vs-unselected style split `0x87/0x65`. Current grounded callers are the constructor `0x004b8720` and the message owner `0x004b84f0`, which keeps this on the shell bulldoze tool-window side rather than the deeper world bulldoze chooser.","objdump + constructor correlation + message-owner inspection + control-strip correlation"
0x004b84f0,560,shell_bulldoze_window_handle_message,shell,thiscall,inferred,objdump + constructor correlation + caller inspection,4,"Primary message dispatcher for the shell-side `Bulldoze.win` tool window. Under message `0xc8`, control ids `0xbf69..0xbf6f` update the current ordinal at `[this+0x78]` and global `0x00621cc4` through the local setter `0x004b8470`, then re-enter `shell_bulldoze_window_refresh_ordinal_strip` `0x004b84b0`. Control `0x07d6` arms or clears the world-surface latch `[this+0x7c]` after the standard hit-test gate `0x00448ac0`. While that latch is live, the helper re-samples world coordinates, tracks the last accepted pair in globals `0x00621ce4/0x00621ce8`, queries one local world score through `0x0044b160`, and then publishes one status line through `0x00538c70` on shell runtime `0x006d401c`. Current grounded callers or owners are the constructor `0x004b8720` and the live shell message loop, which keeps this on the bulldoze tool-window side of the shared `0x07d6` world-surface family rather than on a generic shell-detail row path.","objdump + constructor correlation + caller inspection + world-surface latch correlation + local-score query correlation"
0x004b8720,128,shell_bulldoze_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `Bulldoze.win` tool window. The constructor installs vtable `0x005d02b4`, seeds the current ordinal from `0x00621cc4`, formats the visible scalar caption from `0x00621cc8` through `0x0051f070` and `0x00527de0`, binds `Bulldoze.win` through `0x0053fa50`, clears local field `[this+0x7c]`, refreshes the visible selection rows through `0x004b84b0`, and then re-enters `0x00523e10` on the shell presenter. Current grounded caller is the detail-panel manager branch at `0x004ddef0`, which keeps this on the shell tool-window side above the broader world-side bulldoze chooser `0x0044b160`.","objdump + strings + detail-manager correlation + scalar-caption correlation + singleton correlation"
0x004bcb50,160,shell_change_height_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `ChangeHeight.win` tool window. The constructor installs vtable `0x005d0690`, seeds the current ordinal from `0x00621e20`, formats the visible scalar caption from `0x00621e24`, binds `ChangeHeight.win` through `0x0053fa50`, stores live singleton `0x006cfe18`, refreshes the visible selection and mode rows through `0x004bc290`, and then triggers one world-side follow-on through `0x00452ca0` with mode id `6`. Current grounded caller is the detail-panel manager branch at `0x004ddf13`, which keeps this on the shell terrain-edit tool side rather than the generic world-surface brush owner itself.","objdump + strings + detail-manager correlation + singleton correlation + control-refresh correlation"
0x0050a530,64,station_place_window_service_frame,shell,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Recurring StationPlace.win service pass for the live station-placement tool object at `0x006d1720`. The helper checks the local latch at `[this+0x94]` plus current shell or world selection state and then delegates one branch into `station_place_world_surface_sync_and_dispatch` `0x00508bb0` for follow-up station-placement synchronization on the same shared `0x07d6` main-world surface used by the dispatcher when the surrounding world tool remains active. Current grounded callers are the higher restore wrapper `0x004423d0` plus the direct save-load tails at `0x00444eda` and `0x00445a64`, which keeps this on the recurring StationPlace tool-service side rather than a one-off constructor epilogue.","objdump + caller xrefs + callsite inspection + world-surface correlation"
0x0050dab0,84,track_lay_window_refresh_active_route_entry_linked_peer_and_publish_runtime_followon,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small TrackLay-side helper under the active route-owner path. When global route latch `[0x006cfca8+0x118]` is nonzero and route id `[+0x125]` still resolves, the helper resolves that live route entry through `0x00518140`, re-enters `0x0049afe0` on the route owner with the resolved entry, re-enters `0x0048b660` on the same entry, and then tail-jumps into `0x0049b070` on the route owner. Current grounded callers are the broader TrackLay helpers `0x0050dc80`, `0x0050dce0`, and `0x0050e070` plus several later TrackLay message branches, so this is the safest current read for the small active-route refresh and publish companion rather than a generic route-entry accessor.","objdump + caller xrefs + local disassembly + route-entry correlation + TrackLay-family correlation"
0x0050d1e0,237,track_lay_window_release_invalid_route_entries_reset_cached_selection_and_refresh_presenter,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared TrackLay.win cleanup tail over the live tool object at `0x006d1a8c`. The helper first re-enters `0x0049ad90` and `0x00495540` on the global route owner `0x006cfca8`, then branches on route latch `[route+0x118]`. When that latch is clear it validates the cached tool route id `[this+0x78]` through `0x00518140` and candidate byte `[entry+0x216]`, releasing the cached id from the route owner when the entry is no longer admitted. When the latch is set it instead walks every live route entry, removing entries whose byte `[entry+0x216]` is clear through `0x0049bbb0`. In either case it resets `[this+0x78]` to `-1`, refreshes the active shell presenter through `0x0051f070`, and conditionally tail-jumps into `0x00523e20` on presenter slot `[presenter+0x3741]`. Current grounded callers are the TrackLay entry-side helper `0x0050e070` plus direct TrackLay branches at `0x0050db19` and `0x0050ebab`, so this is the safest current read for the shared invalid-route cleanup and presenter-refresh tail rather than a generic route-store sweep.","objdump + caller xrefs + local disassembly + route-cleanup correlation + presenter-refresh correlation"
0x0050d2d0,1245,track_lay_window_refresh_controls,shell,thiscall,inferred,objdump + strings + RT3.lng,4,"Refreshes the visible TrackLay.win control state after mode or preference changes. The helper highlights the three mutually exclusive primary mode buttons rooted at control ids 0x985e 0x985f and 0x9860 from the shared track-lay mode field at 0x00622b0c; current primary evidence now strongly aligns those grounded values as 1=`Lay single track.` string id 2054 4=`Lay double track.` string id 2055 and 0x40=`Bulldoze` string id 1721. The same refresh pass also updates the bridge-type selector family rooted at 0x006cec74+0x138 through controls 0x9861 and above; formats the two wrapped frequency values at 0x006cec74+0x140 and 0x006cec74+0x13c into controls 0x9870 and 0x9871 using the localized `Never` through `Common` string ids 615 through 618; and updates the two boolean preference toggles rooted at 0x006cec74+0x144 and 0x006cec78+0x4c74 through controls 0x986e and 0x986d. Current evidence now strongly aligns that pairing as 0x986e or 0x006cec74+0x144 = `Auto-Hide Trees During Track Lay` strings 1838 and 1839 and 0x986d or 0x006cec78+0x4c74 = `Auto-Show Grade During Track Lay` strings 3904 and 3905: the first toggle lives in the compact track-lay preference block alongside bridge and frequency settings while the second lives in the broader display-runtime block and fits the grade-overlay behavior. The same refresh path also updates the electrify-all action control at 0x9873 and the surrounding status widgets, which makes it the clearest grounded owner for the TrackLay.win status panel rather than only a generic shell redraw.",objdump + strings + RT3.lng + callsite inspection
0x0050dc00,113,track_lay_window_refresh_version_gated_action_rows_then_reenter_main_refresh,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + strings,3,"Small TrackLay.win control helper over the live tool object at `0x006d1a8c`. The helper first uses the local executable-version gate from `[0x006cec78+0x0d]` to restyle the three action rows `0x986a..0x986c` through `0x00540120`, then applies the same version-gated style split to control `0x9872`, and finally tail-jumps back into `track_lay_window_refresh_controls` `0x0050d2d0`. Current grounded caller is the TrackLay constructor `0x0050e528`, so this is the safest current read for the small version-gated action-row refresh helper rather than another generic shell row styler.","objdump + caller xrefs + local disassembly + version-gate correlation + control-row correlation"
0x0050dc80,87,track_lay_window_refresh_or_clear_active_route_latch,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small TrackLay.win route-latch helper beneath the broader message owner. The helper checks whether the live route owner `0x006cfca8` still has active latch `[route+0x118]`. When that latch is set it refreshes tool-local state through `0x0050dab0`; if local byte `[this+0x82]` is clear it tail-jumps into `0x004a00b0`, otherwise it clears `[this+0x82]`, resets `[route+0x118]` to zero, and posts the fixed shell payload through `0x0053ef90`. Current grounded callers are the TrackLay message owner `0x0050e5c0` and one neighboring helper at `0x0050f4c4`, so this is the safest current read for the active route-latch refresh or clear branch rather than a generic route-entry query.","objdump + caller xrefs + local disassembly + route-latch correlation"
0x0050dce0,912,track_lay_window_sync_world_surface_hit_or_active_route_selection_into_route_owner,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + callsite-arg inspection,3,"Broad TrackLay.win world-surface and route-selection sync owner. The helper first validates the current world or route context through `0x004337a0` plus collection `0x0062be10`, releases any prior cached tool route id `[this+0x78]`, and then branches on the two caller-supplied flags. On the world-hit-test path it re-enters `0x00448ac0` to resolve current world coordinates, seeds or updates a route entry in the global route owner `0x006cfca8` through `0x00493600`, `0x0049ace0`, and several route-classification helpers, mirrors the chosen entry id back into `[this+0x78]` and class byte `[entry+0x216]` into `[this+0x7c]`, updates route-owner byte `[route+0x11c]`, and publishes the chosen entry through `0x0049b180`. On the active-route branch it can refresh or recreate route-owner field `[route+0x125]` through `0x004955b0` and `0x00493cf0`, then re-enter the later route-update helper `0x004a04c0`. On the cleanup side it posts the fixed shell payload through `0x0053ef90`, can clear route latch `[route+0x118]`, can delete route ids `[route+0x125]` and `[route+0x129]` through `0x0049bbb0`, and can set local byte `[this+0x82]` for a later clear pass. Current grounded callers are the recurring TrackLay service-frame path `0x0050e3ed` and the TrackLay message owner branch `0x0050e8a2`, so this is the safest current read for the shared TrackLay world-surface or active-route synchronization owner rather than a narrow hit-test helper.","objdump + caller xrefs + local disassembly + callsite-arg inspection + route-owner correlation + world-surface correlation"
0x0050e070,358,track_lay_window_push_reentry_guard_snapshot_world_route_state_and_refresh_tool_state,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + strings,3,"Entry-side TrackLay.win helper over the live tool object at `0x006d1a8c`. The helper increments the local nested-service guard at `[this+0x87]` and only runs the heavier body on the outermost entry. In bulldoze mode `0x40` it immediately tail-jumps into `0x004361d0`; otherwise it snapshots several live route-entry fields from the global route owner `0x006cfca8` into tool slots `[this+0x9b..+0xaf]`, clears or advances the matching world-side route-anchor fields at `[route+0x88/+0x90/+0x94/+0x98]`, re-enters `0x0050dab0` to refresh the tool-local state, mirrors later route fields `[route+0x118/+0x125/+0x11d/+0x121]` into `[this+0x8b..+0x97]`, and then tail-jumps into `0x0050d1e0`. Current grounded callers are the save-load wrapper `0x004423a0` and the direct save path at `0x00444e3b`, so this is the safest current read for the TrackLay entry-side nested-service snapshot and route-state handoff rather than the recurring per-frame service pass.","objdump + caller xrefs + local disassembly + route-owner correlation + nested-service correlation"
0x0050e1e0,534,track_lay_window_service_frame,shell,thiscall,inferred,objdump + caller xrefs + strings,4,"Recurring TrackLay.win service pass for the active track-lay tool object at `0x006d1a8c`. The helper decrements the local reentry guard at `[this+0x87]` and when the pass is active it either routes the current track-lay drag state through `0x0050d740` while the grounded `Bulldoze` mode value `0x40` is live in `0x00622b0c` or synchronizes the staged world-interaction state back into the live world owner through `0x006cfca8` and `0x0050dce0`. The same service family also special-cases control id `0x07d6` through the tool-owned current-control field `[this+0x7e]`, which now strongly suggests that `0x07d6` is the shared main-world interaction surface for TrackLay.win rather than a generic shell-detail button. Current grounded callers are the higher restore wrapper `0x004423d0` plus the direct save-load tails at `0x00444ee9` and `0x00445a73`; the paired entry-side helper is `track_lay_window_push_reentry_guard_snapshot_world_route_state_and_refresh_tool_state` `0x0050e070`.","objdump + caller xrefs + strings + callsite inspection + nested-service correlation"
0x0050db10,236,track_lay_window_destroy_release_routes_reset_singleton_and_tail_shell_teardown,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + teardown correlation,3,"Destructor-side TrackLay.win teardown helper. The function restores vtable `0x005d191c`, re-enters `track_lay_window_release_invalid_route_entries_reset_cached_selection_and_refresh_presenter` `0x0050d1e0`, runs the route-owner post-change sweep `0x004a3db0`, clears the global singleton `0x006d1a8c`, posts the fixed shell payload rooted at `0x005c87a8` through `0x0053ef90`, conditionally mirrors one world scalar from `[world+0x1689]` into `[world+0x168d]` when `[0x006cec74+0x263]` is set and `0x006d1a94` is still clear, replays `0x00453510` on live world mode `0x15` when the `0x006cec74+0x2cc` gate and `0x00450150` allow it, tail-jumps into `0x004361d0` on the startup object, clears `[this+0x83]`, conditionally re-enters `0x00491880` on the route owner, optionally posts shell status id `0xba` through `0x00538e00`, and finally tail-jumps into `0x0053f7d0`. Current grounded caller is the shell detail-panel transition manager `0x004ddbd0`, so this is the safest current read for the TrackLay.win destroy path rather than another internal route-store helper.","objdump + caller xrefs + local disassembly + teardown correlation + route-owner correlation + shell-status correlation"
0x0050e400,448,track_lay_window_construct,shell,thiscall,inferred,objdump + caller xrefs + strings,4,Constructs the TrackLay.win world-tool window object later published at 0x006d1a8c. The constructor seeds the vtable at 0x005d191c clears the tool-state fields rooted at [this+0x78] [this+0x7d] [this+0x82] and [this+0x87] binds the TrackLay.win resource through 0x0053fa50 refreshes the visible control set through 0x0050dc00 snapshots one world span from 0x0062c120 into 0x006d1a94 and stores the singleton globally before returning. The current grounded caller is the shell detail-panel constructor branch at 0x004ddecd.,objdump + caller xrefs + strings + callsite inspection
0x0050e5c0,3867,track_lay_window_handle_message,shell,thiscall,inferred,objdump + strings + RT3.lng,4,"Primary message dispatcher for the TrackLay.win tool object at 0x006d1a8c. It switches over the incoming shell message id then handles control ids in the TrackLay.win family such as 0x9858 through 0x9874 plus the special world-surface control 0x07d6. The handler uses world hit tests through 0x00448ac0 to arm and release the drag latch at [this+0x7d] on 0x07d6 transitions, routes the active mode through the shared track-lay state at 0x00622b0c including the now-bounded primary values 1=`Lay single track.` 4=`Lay double track.` and 0x40=`Bulldoze`, updates the selected world object path rooted at 0x006cfca8+0x118, and refreshes the tool UI through 0x0050d2d0 0x0050d740 and 0x0050dce0. The same dispatcher also owns the TrackLay.win preference and action controls: it toggles the two boolean track-lay options rooted at 0x006cec74+0x144 and 0x006cec78+0x4c74, where current evidence now strongly aligns the first control branch at 0x985a with `Auto-Hide Trees During Track Lay` and the later `0x006cec78+0x4c74` branch with `Auto-Show Grade During Track Lay`; it also cycles the bridge-type selector family at 0x006cec74+0x138, wraps the two frequency settings at 0x006cec74+0x140 and 0x006cec74+0x13c, and routes the electrify-all command through the localized confirmation and failure strings 3083 3084 3837 and 3900. This makes it the clearest grounded owner for player-facing TrackLay.win commands rather than only a passive status panel.",objdump + strings + RT3.lng + callsite inspection
0x0051d900,155,string_find_substring_ex,support,cdecl,inferred,ghidra-headless,3,Reusable substring finder that returns a pointer to the first matching window in the haystack or null. It precomputes both string lengths then slides across the haystack calling one of two compare helpers depending on the mode flag pushed on the stack; the graphics branch uses it to probe adapter strings for legacy GPU-profile tokens and bootstrap code uses it for startup media or compatibility string checks.,ghidra + rizin + llvm-objdump
0x0051d870,21,bootstrap_seed_tick_count,bootstrap,cdecl,inferred,ghidra-headless,4,Lazily snapshots GetTickCount into a bootstrap-global cache so later subsystems start from a nonzero host tick baseline.,ghidra + rizin
0x0051ea80,304,shell_controller_reset_core_state_fields_and_seed_small_defaults,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small shell-controller reset helper beneath global-controller install. The function clears the early controller pointer and scalar band at `[this+0x00..+0x1c]`, seeds several small mode and flag fields such as `[this+0x11421a] = 1`, `[this+0x11420e] = 0x5c`, `[this+0x114228] = 2`, `[this+0x114232] = 1`, `[this+0x114254] = 1`, and `[this+0x114227] = 0x11`, and resets a broader set of small controller bytes and dwords under `[this+0x11422c..+0x11427e]` plus `[this+0x1136a9/+0x1136ad]`. Current grounded caller is `shell_install_global_controller` `0x0051ff90`, so this is the safest current read for the controller's core small-field reset-plus-default seeding path rather than the larger display-runtime reset owner at `0x0051ebc0`.","objdump + caller inspection + local disassembly + field-reset correlation"
0x0051ebc0,731,shell_reset_display_runtime_defaults,shell,cdecl,inferred,ghidra-headless,3,Resets the global display runtime defaults rooted at 0x006d4024. It clears the large display-settings block under offsets 0x11468a and above seeds default resolution and capability flags from mode 0x006d4028 and reinitializes several shell display toggles before later preset application continues.,ghidra + rizin + llvm-objdump
0x0051eea0,128,shell_save_display_runtime_config,shell,cdecl,inferred,ghidra-headless,4,Writes the larger display-runtime blob to data\\configuration\\engine.cfg. It stores version key 0x41b serializes the 0x1e4-byte runtime block rooted at [this+0x11468a] and writes an additional 0x1ec-byte companion block before closing the file.,ghidra + rizin + llvm-objdump + strings
0x0051ef20,194,shell_load_display_runtime_config_or_init_defaults,shell,cdecl,inferred,ghidra-headless,4,Loads the larger display-runtime blob from data\\configuration\\engine.cfg. When the file is missing invalid or already superseded by mode state at 0x006d4028 it falls back to 0x0051ebc0 and 0x0051eea0; otherwise it validates key 0x41b restores the 0x1e4-byte and 0x1ec-byte blocks and clears one shell display flag when [this+0x11474a] is set.,ghidra + rizin + llvm-objdump + strings
0x0051eff0,8,shell_controller_store_pointer_field_0x0c,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Trivial field setter that stores the caller pointer argument into controller dword `[this+0x0c]` unchanged. Current grounded callers are the neighboring window-family branches at `0x0054bdf8` and `0x0054be8c`, which use it while installing or clearing one live controller-owned pointer during the `World` window setup path.","objdump + caller inspection + local disassembly + field-store correlation"
0x0051f000,101,shell_register_world_window_class_from_static_wndproc,shell,thiscall,inferred,objdump + local disassembly + string correlation + import-shape correlation,3,"Small shell-side window-class registration helper. The function builds one local `WNDCLASS`-style descriptor with style `3`, class name `World`, static window procedure `0x0054e3a0`, and one stock brush handle derived from argument `0x7f00`, then forwards the descriptor into the USER32 class-registration import and returns the resulting class atom as a zero-extended `u16`. The grounded class-name string `World` and the static wndproc make this the safest current read for the shared world-window class registration helper rather than a generic USER32 wrapper.","objdump + local disassembly + string correlation + import-shape correlation + wndproc correlation"
0x0051f070,4,shell_controller_get_primary_presentation_owner,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Returns controller dword `[this+0x18]` unchanged. Current grounded callers include `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80`, several shell caption-formatting branches, and broader presentation helpers, so the safest current read is the controller's primary presentation-owner accessor rather than a raw anonymous field load.","objdump + caller inspection + local disassembly + presentation-owner correlation"
0x0051f080,8,shell_controller_set_primary_presentation_owner,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Stores one caller pointer into controller dword `[this+0x18]` unchanged. Current grounded caller is the shell-side initialization path at `0x0055e3c9`, which seeds the same presentation-owner lane later queried by `0x0051f070`.","objdump + caller inspection + local disassembly + presentation-owner correlation"
0x0051f090,4,shell_controller_get_world_basis_owner,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Returns controller dword `[this+0x1c]` unchanged. Current grounded callers immediately feed the result into world-basis or view-space helpers such as `0x00534490`, `0x00534c50`, `0x00534910`, and `0x00534930`, so the safest current read is the controller's world-basis owner accessor rather than a raw anonymous field load.","objdump + caller inspection + local disassembly + world-basis correlation"
0x0051f0a0,8,shell_controller_set_world_basis_owner,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Stores one caller pointer into controller dword `[this+0x1c]` unchanged. Current grounded callers include the world-view setup branches around `0x00537e56` and `0x00537eda`, which seed or clear the same owner later queried through `0x0051f090`.","objdump + caller inspection + local disassembly + world-basis correlation"
0x0051f0b0,4,shell_controller_get_cursor_service_active_flag,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Returns controller dword `[this+0x20]` unchanged. Current grounded caller is `shell_mouse_cursor_adjust_showcursor_refcount_and_sync_screen_position_if_live` `0x0051e810`, which uses this value as the gate for the live cursor-position sync branch.","objdump + caller inspection + local disassembly + mouse-cursor correlation"
0x0051f0c0,8,shell_controller_mark_input_subobject_index_present,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small shell-input helper that resolves controller subobject `[this+0x24]` and forwards one caller byte index into the byte-table writer at `0x00564180`, which stores value `1` at `[subobject + index]`. Current grounded caller is the main shell window-message dispatcher `0x0054e3a0` on the `WM_KEYDOWN` branch.","objdump + caller inspection + local disassembly + window-message correlation"
0x0051f0d0,8,shell_controller_mark_input_subobject_index_absent,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small shell-input helper that resolves controller subobject `[this+0x24]` and forwards one caller byte index into the byte-table writer at `0x00564190`, which stores value `0` at `[subobject + index]`. Current grounded caller is the main shell window-message dispatcher `0x0054e3a0` on the `WM_KEYUP` branch.","objdump + caller inspection + local disassembly + window-message correlation"
0x0051f0e0,8,shell_controller_query_input_subobject_index_flag,shell,thiscall,inferred,objdump + local disassembly + helper correlation,2,"Small shell-input helper that resolves controller subobject `[this+0x24]` and forwards one caller byte index into the byte-table reader at `0x005641a0`, returning the current byte flag at `[subobject + index]`. This is the query-side sibling of `0x0051f0c0` and `0x0051f0d0`.","objdump + local disassembly + helper correlation + byte-table correlation"
0x0051f0f0,3,shell_controller_get_window_handle,shell,thiscall,inferred,objdump + import-table,4,Returns the native shell window handle stored at [this+0x00]. Callers forward the returned handle into USER32 imports such as SetFocus SetMenu and SetCapture during shell startup and presentation interaction.,objdump + USER32 import table + callsite xrefs
0x0051f100,143,shell_controller_copy_active_display_mode_tuple,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Copies the active display-mode tuple from the controller mode table rooted at `[this+0x34]` using live selector `[this+0x11421e]`. The helper always writes the first two dwords from offsets `+0x00` and `+0x04`, optionally copies dword `+0x08`, conditionally returns either `0` or dword `+0x0c` depending on graphics-range scalar `[this+0x11470e]`, and optionally copies trailing byte `+0x14` as a zero-extended dword. Current grounded callers include the graphics-range predicates `0x0051fd00/0x00520fd0`, the mouse-cursor sync helper `0x0051e810`, and the window-class or view-side coordinate helpers, so this is the safest current read for the active display-mode tuple materializer rather than another opaque table accessor.","objdump + caller inspection + local disassembly + display-mode-table correlation + graphics-range correlation"
0x0051f1a0,7,shell_controller_get_graphics_mode_byte,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Returns graphics-mode byte `[this+0x114226]` as a zero-extended integer. Current grounded callers include the graphics settings page, the mouse-cursor family, the shell input window-message family, and several world-presentation gates, so this is the safest current read for the controller's current graphics-mode-byte accessor.","objdump + caller inspection + local disassembly + graphics-mode correlation"
0x0051f1b0,7,shell_controller_get_display_runtime_dword_1146f6,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Returns display-runtime dword `[this+0x1146f6]` unchanged. Current grounded caller is the shell-side initialization path at `0x0055e3ed`, which snapshots the field into a local runtime record.","objdump + caller inspection + local disassembly + field-correlation"
0x0051f1c0,8,shell_controller_set_display_runtime_dword_1146f6,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Stores one caller dword into display-runtime field `[this+0x1146f6]` unchanged. Current grounded callers include `0x00527cb4` and `0x0052c136`, which write new values back through the controller rather than touching the field directly.","objdump + caller inspection + local disassembly + field-correlation"
0x0051f1d0,90,shell_signal_deferred_work_item_shutdown,shell,thiscall,inferred,ghidra-headless,3,Walks the shell deferred-work item queue at [this+0x1136a5] and inspects each queued payload object's nested message queue at [item+0xe4]. When intrusive_queue_peek_tail_payload finds a nonnull tail payload it clears the outer queued-handle slot at [item+0xe8] and appends a null sentinel into the nested queue through intrusive_queue_push_back before continuing iteration.,ghidra + rizin + llvm-objdump
0x0051f230,128,shell_enqueue_deferred_work_message,shell,thiscall,inferred,ghidra-headless,4,Routes one deferred-work message through the shell queue system. When the global routing gate at 0x006d4034 and shell flag [this+0x11369c] are both set it feeds the special queue at [this+0x11369d]; otherwise a nonnull payload object is queued once in [this+0x1136a5] with the returned queue-node handle cached at [item+0xe8] and the message is appended to the payload-owned nested queue at [item+0xe4] while a null payload appends directly into the fallback queue at [this+0x1136a1].,ghidra + rizin + llvm-objdump
0x0051f2b0,104,shell_post_deferred_message_type5,shell,thiscall,inferred,ghidra-headless,4,Allocates one 0x5e-byte deferred-message record from the shell-owned slab rooted at [this+0x5c] using count [this+0x58] tags it as type 0x05 stores four caller dwords at offsets +0x01 +0x05 +0x09 and +0x0d and then posts the record directly into the shell deferred queue roots through [this+0x11369d] or [this+0x1136a1].,ghidra + rizin + llvm-objdump
0x0051f320,72,shell_post_deferred_message_type6,shell,thiscall,inferred,ghidra-headless,4,Allocates one 0x5e-byte deferred-message record from the same shell slab and tags it as type 0x06 before posting it directly into the shell deferred queue roots. This is the minimal direct-post sibling of the type-0x05 builder and uses the same count field at [this+0x58] and slab base at [this+0x5c].,ghidra + rizin + llvm-objdump
0x0051f370,229,shell_enqueue_deferred_message_type4,shell,thiscall,inferred,ghidra-headless,4,Allocates one 0x5e-byte deferred-message record from the shell-local slab at [this+0x5c] populates the larger multi-field payload tags it as type 0x04 mixes the shell byte [this+0x114227] into record byte +0x5d and routes the finished record through shell_enqueue_deferred_work_message.,ghidra + rizin + llvm-objdump
0x0051f460,173,shell_enqueue_deferred_message_type1,shell,thiscall,inferred,ghidra-headless,4,Allocates one 0x5e-byte deferred-message record from the same shell-local slab fills the smaller type-0x01 payload subset mixes the shell byte [this+0x114227] into record byte +0x5d and routes the finished record through shell_enqueue_deferred_work_message.,ghidra + rizin + llvm-objdump
0x0051f510,48,shell_set_gamma_ramp_scalar,shell,thiscall,inferred,ghidra-headless,4,Applies one shell gamma-ramp scalar to the active display runtime state. When the presentation service pointer at [this+0x0c] is live it forwards the scalar into 0x00547f20 for an immediate hardware upload; otherwise it only caches the requested value at [this+0x1146b9] until the service is ready.,ghidra + rizin + llvm-objdump
0x0051d890,13,shell_get_elapsed_tick_count_since_bootstrap_seed,shell,cdecl,inferred,objdump + timer-caller correlation,4,"Returns the current wall-clock tick count minus the bootstrap seed stored at `0x006d3d14`. The helper is a one-line elapsed-time primitive over the same USER32 tick import used by `bootstrap_seed_tick_count` `0x0051d870`. Current grounded callers include the timer-gated `SettingsWindow.win` graphics service strip around `0x004ffafb/0x004ffb64`, the world-view keyboard pan helper, and the frame-time history family.","objdump + timer-caller correlation + bootstrap-seed correlation"
0x0051fd00,64,shell_query_graphics_range_has_live_custom_payload,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Reports whether the graphics-range family currently has a live custom payload worth reapplying. The helper first rejects graphics mode byte `[this+0x114226] == 0`, then calls `0x0051f100` to materialize the current range tuple into five stack outputs and returns true only when the first returned dword is nonzero. Current grounded caller is `shell_settings_window_handle_graphics_range_custom_mode_toggle` `0x004ffd10`, which uses this predicate to decide whether the custom-mode toggle can proceed directly or must fall back to the warning path.","objdump + settings-window caller correlation + stack-output correlation"
0x0051fd40,29,shell_query_graphics_range_custom_mode_flag,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Returns one small custom-range mode flag for the graphics settings family. The helper reports true only when byte `[this+0x1146ae]` is set and dword `[this+0x11427a]` is still zero; otherwise it returns false. Current grounded caller is `shell_settings_window_refresh_graphics_page` `0x004fe770`, which uses this flag together with `shell_query_graphics_range_scalar` `0x0051fd60` to decide how controls `0x7555` and `0x7578` should be republished.","objdump + settings-window caller correlation + field-gate correlation"
0x0051fd60,7,shell_query_graphics_range_scalar,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Returns graphics-range scalar dword `[this+0x11470e]` unchanged. Current grounded caller is the graphics settings page refresh `0x004fe770`, which pairs this with `shell_query_graphics_range_custom_mode_flag` `0x0051fd40` when formatting controls `0x7555` and `0x7578`.","objdump + settings-window caller correlation"
0x0051fd70,516,shell_update_frame_time_history,shell,thiscall,inferred,ghidra-headless,4,Updates a 256-sample frame-time history from successive GetTickCount deltas. The helper advances the ring index in 0x006d403c stores each delta under [this+0x11428a] and derives a smoothed frame scalar at [this+0x114282] for later shell frame consumers such as 0x0051ff80 and the presentation-frame path.,ghidra + rizin + llvm-objdump
0x0051ff80,7,shell_get_smoothed_frame_scalar,shell,thiscall,inferred,objdump,4,Returns the smoothed frame scalar cached at [this+0x114282]. shell_update_frame_time_history refreshes that field each frame and shell_refresh_presentation_frame consumes it during the main presentation refresh path.,objdump + callsite xrefs
0x0051ff90,24,shell_install_global_controller,shell,thiscall,inferred,objdump + analysis-context,4,Installs one shell controller as the process-global singleton at 0x006d4024 clears controller flag [this+0x114201] reruns the local state reset helper at 0x0051ea80 and returns the same controller pointer. bootstrap_init_shell_window_services calls it immediately after allocating the 0x11486e-byte controller object.,objdump + analysis-context + startup xrefs
0x00520fd0,87,shell_set_graphics_range_custom_mode_flag_and_reapply_if_needed,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Applies a requested custom-mode flag for the graphics-range family. The helper compares the incoming boolean against `shell_query_graphics_range_custom_mode_flag` semantics over `[this+0x1146ae]` and `[this+0x11427a]`, stores the new byte at `[this+0x1146ae]` only when it changed, rejects the enabling path when `shell_query_graphics_range_has_live_custom_payload` `0x0051fd00` is false, and when reapplication is allowed forwards the current graphics mode byte `[this+0x114226]` plus the live selector dword `[this+0x11421e]` into `0x00520400`. Current grounded caller is `shell_settings_window_handle_graphics_range_custom_mode_toggle` `0x004ffd10`.","objdump + settings-window caller correlation + graphics-range-reapply correlation"
0x00521030,45,shell_set_graphics_range_scalar_and_reapply_if_needed,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Stores one replacement graphics-range scalar dword at `[this+0x11470e]` and, when graphics mode byte `[this+0x114226]` is nonzero, immediately re-enters `0x00520400` with the live selector dword `[this+0x11421e]` plus the current mode. Current grounded caller is `shell_settings_window_handle_graphics_range_scalar_zero_nonzero_toggle` `0x004ffe72`, which uses this helper to flip the scalar between zero and nonzero states.","objdump + settings-window caller correlation + graphics-range-reapply correlation"
0x00521d10,38,multiplayer_request_peer_session_control,shell,cdecl,inferred,ghidra-headless,3,Requests one direct session-control action for a resolved multiplayer peer object. When the live session transport at `0x006d40dc` is present it follows the transport-owned interface at `[ecx+0x18e]->+0x08` and invokes vtable slot `+0x68` with the target peer object and three zero trailing arguments; the current grounded callers are the `\\kick` branch and the online-peer `\\unban` follow-up path.,ghidra + rizin + llvm-objdump
0x0051fa00,56,shell_get_memory_budget_ceiling_bytes,shell,thiscall,inferred,ghidra-headless,3,Returns the current upper memory-budget bucket in bytes for the shell display runtime. When override field [this+0x1146ca] is set it maps that tier through the shared table at 0x00624c34 containing 0 1MB 2MB and 4MB entries; otherwise it starts from baseline field [this+0x1136ad] and adjusts it by the active lower-tier delta derived from [this+0x1146c6] and [this+0x1136a9] before clamping negative results to zero.,ghidra + rizin + llvm-objdump
0x0051fa40,25,shell_get_memory_budget_floor_bytes,shell,thiscall,inferred,ghidra-headless,3,Returns the current lower memory-budget bucket in bytes for the shell display runtime. When field [this+0x1146c6] is nonzero it maps that tier through the shared 0 1MB 2MB 4MB table at 0x00624c34; otherwise it falls back to baseline field [this+0x1136a9].,ghidra + rizin + llvm-objdump
0x0051fa60,63,shell_get_nonnegative_memory_budget_floor_bytes,shell,thiscall,inferred,ghidra-headless,3,Returns a nonnegative lower memory-budget value for float consumers in the shell and presentation paths. It prefers explicit tier field [this+0x1146ce] then the active floor bucket behind [this+0x1146c6] and finally baseline field [this+0x1136a9] using the shared 0 1MB 2MB 4MB table at 0x00624c34 and clamping negative results to zero.,ghidra + rizin + llvm-objdump
0x005204b0,128,shell_flush_deferred_work_queues,shell,thiscall,inferred,ghidra-headless,4,Flushes the shell controller's three deferred-work queue roots at [this+0x1136a1] [this+0x11369d] and [this+0x1136a5]. The helper clears the first two containers through intrusive_queue_clear_and_release then rewinds the deferred-item queue through intrusive_queue_rewind_iterator repeatedly pops each queued payload through intrusive_queue_next_iterator_node clears its outer queued-handle slot at [item+0xe8] and finally releases the remaining queue storage before returning. It is used at the end of shell_service_frame_cycle and from the broader shell-mode helper at 0x00443a50.,ghidra + rizin + llvm-objdump
0x00520620,141,shell_service_frame_cycle,shell,thiscall,inferred,ghidra-headless,4,Acts as the outer owner for one pending shell frame cycle on the active controller. When pending-frame state is armed through [this+0x56] and controller pointers [this+0x18] [this+0x1c] and [this+0x28] are live it runs shell_refresh_presentation_frame through 0x0052b990; otherwise it still updates frame timing through 0x0051fd70 runs the mouse-cursor frame updater 0x0053f4e0 requests the deeper layout-state rebuild path through 0x00565110 performs a one-time ShowWindow on the controller window handle at [this] drains deferred work through 0x005204b0 and clears the pending flags at [this+0x56] and [this+0x58].,ghidra + rizin + llvm-objdump
0x00521060,805,bootstrap_init_shell_service_bundle,bootstrap,cdecl,inferred,ghidra-headless,4,Builds the shell-facing singleton bundle stored through globals like 0x006d4024 0x006d402c and 0x006d4030 wiring startup width and height state an rt3_ prefixed service path and the separate shell input-state object rooted at 0x006d4018.,ghidra + rizin + objdump
0x00521390,486,bootstrap_destroy_shell_service_bundle,bootstrap,cdecl,inferred,ghidra-headless,4,Destroys the shell service bundle created by 0x00521060 releasing each global singleton and clearing 0x006d4024 0x006d402c 0x006d4030 0x006d4020 and 0x006d4018.,ghidra + rizin
0x00523d90,65,shell_commit_layout_updates,bootstrap,thiscall,inferred,ghidra-headless,3,Applies pending layout-slot changes from the shell controller into its subordinate layout-state object at [this+0x2d] by walking embedded service pointers and issuing the follow-on rebuild or refresh calls that make the updated slot table live.,ghidra + rizin
0x00523e40,51,shell_invalidate_layout_state,bootstrap,thiscall,inferred,ghidra-headless,4,Marks the shell controller's layout-state path dirty by setting flags [this+0x3747] [this+0x3748] and [this+0x3749] then forwarding two state parameters into the subordinate object at [this+0x2d].,ghidra + rizin
0x005270d0,8,shell_mark_layout_dirty,bootstrap,thiscall,inferred,ghidra-headless,2,Marks the shell layout child dirty by setting byte flag [this+0x3749] before later code forces a commit pass.,ghidra + rizin
0x00527650,1476,shell_publish_texture_budget_report,shell,thiscall,inferred,ghidra-headless,4,Builds and publishes a shell-side texture budget report through the current layout state at [this+0x2d]. The routine formats the current memory-budget floor and ceiling buckets from 0x0051fa40 and 0x0051fa00 converts them to kilobytes adds the current texture-change counter through 0x0055d390 appends labels like Texture changes per frame Texture SRAM and Texture VRAM and forwards the assembled text into 0x00566980.,ghidra + rizin + llvm-objdump + strings
0x00527de0,46,shell_presenter_publish_scaled_scalar_caption_and_store_aux_weight,bootstrap,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Shared shell-presenter scalar-caption helper. The routine scales the caller float argument by `0x005dd158`, forwards that value through `0x0052ea90` on nested presenter field `[this+0x364d]`, scales a second incoming float by `0x005c8568`, and stores the result into `[this+0x3728]` as an auxiliary weight or caption-side scalar. Current grounded callers are several shell tool-window constructors and setters including `Bulldoze.win` `0x004b8720`, `ChangeTrees.win` `0x004bcdd0/0x004bcc20`, the world-surface brush ordinal setter `0x004bc210`, `PaintRegion.win` `0x004f5080`, `PaintSound.win` `0x004f55b0/0x004f5670`, `PaintTerrain.win` `0x004f5cf0`, `PaintTerritory.win` `0x004fcaf0`, and the ungrouped caller strips at `0x0050a430` and `0x0050d5d0`, so this is the current safest read for the shared shell scalar-caption publisher rather than a window-specific caption formatter.","objdump + caller correlation + local disassembly + shell-presenter correlation"
0x00527e10,868,shell_update_layout_tracking_sample,bootstrap,thiscall,inferred,ghidra-headless,4,Samples a tracked shell target from the object argument computes distance heading and orientation deltas against cached values at [this+0x36b8..0x36cc] consults the dirty flags and index helper at 0x00526590 and returns whether the controller should drive a fresh layout-state apply; on success it updates the cached sample fields and the global tick at 0x00cc3b4c.,ghidra + rizin
0x0052b990,4993,shell_refresh_presentation_frame,shell,thiscall,inferred,ghidra-headless,3,Main shell frame-style refresh pass for the active controller and layout-state path. It handles mode-sensitive layout-state rebuilds and dirties updates tracked shell samples through 0x00527e10 runs the nearby geographic-label static-cell animated-quad ranked-overlay and ranked-billboard sweeps applies presentation-node properties and cached vertex spans optionally publishes the texture budget report through 0x00527650 may request a deeper rebuild through 0x00565110 and can recurse once for a follow-up presentation pass before downstream timing or present helpers run.,ghidra + rizin + llvm-objdump
0x0052da00,102,vehicle_visual_register_attachment_object,bootstrap,thiscall,inferred,ghidra-headless,3,Registers one prebuilt attachment object on the owning vehicle visual. The helper lazily allocates a small attachment list at [this+0x81] pushes the object through 0x00556e10 copies the owner tint triple from [this+0x1e2] [this+0x1e6] and [this+0x1ea] into the object through 0x005545d0 and links the owner back through 0x005540a0.,ghidra + rizin + llvm-objdump
0x00529840,400,shell_build_static_cell_triangle_sweep,bootstrap,thiscall,inferred,ghidra-headless,4,Builds the fixed-cell triangle sweep over the grid returned by 0x00533cd0. It samples shell brightness to derive one grayscale packed color binds the layout-state vertex24 table once and then expands each accepted 0x24-byte cell record into six vertex24 records by emitting the same three-point face twice before committing the span and restoring presentation state.,ghidra + rizin + llvm-objdump
0x00529b50,1149,shell_build_geographic_label_vertex24_sweep,bootstrap,thiscall,inferred,ghidra-headless,4,Builds the geographic-label vertex24 sweep over the grid returned by 0x00533db0. It gates on config byte [this+0x29+0x63] primes one vertex24 span and text presentation state samples shell brightness and the 0x006d9098 priority map to derive per-item alpha rejects items through virtual check +0x0c emits per-item geographic-label frame geometry through 0x00539fb0 optionally emits geographic-label text through 0x0053a960 and commits buffered spans through the layout-state presentation helpers. The naming matches the dedicated geographic-label asset family backed by gpdLabelDB and 2DLabel.imb.,ghidra + rizin + llvm-objdump
0x00528d90,1824,shell_process_nearby_presentation_item,bootstrap,thiscall,inferred,ghidra-headless,3,Processes one candidate item for the nearby-presentation sweep. It rejects disabled entries and mode-mismatched flags optionally gates by forward-range tests around the caller origin lazily assigns the item's segment-record window from the layout-state tables stores accepted nearest-candidate distances in the side buffer at [this+0xa9] and [this+0xad] and forwards the item plus eligible child collections into the active presentation lists.,ghidra + rizin + llvm-objdump
0x005294b0,912,shell_update_nearby_presentation_sweep,bootstrap,thiscall,inferred,ghidra-headless,3,Performs the higher-level nearby-presentation sweep for the current shell state. It scans candidate cells from the offset table at [this+0x374f] using the priority map at 0x006d9098 enumerates item lists for each accepted cell normalizes the first accepted direction vector binds the segment-record presentation table through 0x0054bab0 calls 0x00528d90 for each candidate and then selects the nearest buffered item into [this+0x366e] before refreshing presentation batches through 0x00548da0.,ghidra + rizin + llvm-objdump
0x00529fd0,793,shell_build_cell_vertex24_sweep,bootstrap,thiscall,inferred,ghidra-headless,4,Builds the animated-quad cell sweep over the grid returned by 0x00533e30 depending on the boolean mode argument. It gates on configuration bytes [this+0x29+0x5f] or [this+0x29+0x60] walks candidate-cell offsets from [this+0x374f] selects the primary list at [cell+0x1c] or alternate list at [cell+0x20] initializes the layout-state vertex24 table once through 0x0054bb70 streams each list through 0x00567c70 or 0x00567ce0 and then commits the accumulated span through 0x00545c50 before restoring presentation state.,ghidra + rizin + llvm-objdump
0x0052a2f0,736,shell_build_ranked_overlay_vertex24_sweep,bootstrap,thiscall,inferred,ghidra-headless,3,Builds a ranked secondary vertex24 overlay pass over the cell grid returned by 0x00533e50 and two object collections at [this+0x85] and [this+0x81]. It computes a per-frame packed tint from the current shell brightness gathers and sorts candidate items by priority field [item+0x1d9] binds the layout-state vertex24 table and emits accepted items through 0x00524780 and 0x00554e70 before committing the span.,ghidra + rizin + llvm-objdump
0x0052a5d0,1784,shell_build_ranked_object_billboard_sweep,bootstrap,thiscall,inferred,ghidra-headless,3,Builds the sibling ranked object-overlay pass gated by config byte [this+0x29+0x5e]. It merges candidates from the object collections at [this+0x85] and [this+0x81] sorts them by priority field [item+0x1d9] prepares billboard basis state through 0x00566670 and emits accepted entries through 0x00554e70 before committing the vertex24 span.,ghidra + rizin + llvm-objdump
0x0052dd00,864,runtime_object_emit_materialized_group_packet_rows_as_segment_record_window,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared segment-record emitter beneath `runtime_object_emit_selected_grouped_subrecords_into_global_packet_ring` `0x0052f500` in the broader `0x23a` runtime-object family. Starting from the currently selected group header `[this+0x14/+0x3a/+0x21]`, the helper resolves the active materialized row payload at `[row+0x35]`, the current packet source span from `[record+0x04/+0x08/+0x0c]`, and one shell-presenter-derived count through `0x0051f090`, then emits `count*3` transformed `0x20`-byte segment records into the caller-provided buffer while advancing the output-count accumulator. In the nonnegative `[this+0x69]` branch each output record carries two vec3 blocks at `+0x00` and `+0x0c` plus scalar slots at `+0x18` and `+0x1c`; in the negative branch it emits the same triplet family with the reduced scalar form. Current grounded caller is the layout-state presentation owner `0x005490b0`, so this is the safest current read for emitting materialized group packet rows as one segment-record window rather than a shell-only batch expander.","objdump + caller inspection + local disassembly + grouped-subrecord correlation + packet-row correlation + segment-record-window correlation"
0x0053f000,238,mouse_cursor_select_shape_id_load_handle_and_refresh_shell_presentation,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Core `MouseCursor.cpp` selector over one requested cursor-shape id. The helper normalizes negative ids to zero, optionally short-circuits when the requested id already matches `[this+0x04]`, refreshes the local elapsed-tick latch `[this+0x24]` through `0x0051d890`, toggles cursor visibility through `0x0051e810` on the special `0 -> nonzero` and `nonzero -> 0` transitions, lazily loads the corresponding native cursor handle into table `0x00ccba60` through `0x0053ee90`, publishes that handle through the USER32 cursor-set import, resolves one shell presentation payload through `0x0053d110` when the requested id is nonzero, releases the previous payload through `0x0053c000`, and then stores the new payload at `[this+0x00]` plus the selected id at `[this+0x04]`. Current grounded callers include shell modal setup `0x004c98a0`, several detail-panel mode publishers, and the rest of the mouse-cursor owner family, so this is the safest current read for the live cursor-shape selector plus presentation refresh owner.","objdump + caller inspection + local disassembly + source-string correlation + cursor-handle-table correlation"
0x0053f0f0,115,mouse_cursor_enter_hidden_or_captured_mode_and_clear_selection,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Mode-transition branch in the `MouseCursor.cpp` owner family. When local state `[this+0x18]` is still clear, the helper first pings shell work owner `[0x006d4024+0x28]` through vtable slot `+0x1c`, then calls one zero-argument USER32 import, marks `[this+0x18] = 1`, clears `[this+0x14]`, seeds `[this+0x08] = 1`, mirrors shell latch `[0x006d4024+0x11473e] = 1`, and, when a non-`-1` cursor id is active, forces cursor visibility down through `0x0051e810(0)` before re-entering `0x0053f000(-1, 0, 0)`. Current grounded callers are the graphics-backend service branches `0x004ffb64`, the coarse mouse-cursor service `0x0053f400`, and the local constructor sync at `0x0053f330`, so the safest current read is a hidden-or-captured mode entry branch rather than a generic state toggle.","objdump + caller inspection + local disassembly + source-string correlation + shell-latch correlation"
0x0053f170,159,mouse_cursor_begin_pending_release_from_hidden_mode,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Release-side mode-transition branch in the `MouseCursor.cpp` owner family. When `[this+0x14]` is still clear, the helper conditionally forwards the shell window handle through one one-argument USER32 import when graphics mode byte `[0x006d4024+0x114226]` is active, pings shell work owner `[0x006d4024+0x28]` through vtable slot `+0x1c`, re-enters `0x0053f000(0, 0, 0)` to clear the live cursor selection, clears `[this+0x18]`, sets `[this+0x14] = 1`, zeroes shell latches `[0x006d4024+0x11473a/+0x11473e]`, and, when local byte-flag dword `[this+0x08]` is nonzero, raises cursor visibility back through `0x0051e810(1)`. Current grounded callers are the graphics-backend service-and-repaint branch `0x004ffafb`, the coarse mouse-cursor service `0x0053f400`, and the local inside-view watcher `0x0053f450`, so this is the safest current read for the begin-release transition out of the hidden mode.","objdump + caller inspection + local disassembly + source-string correlation + shell-latch correlation"
0x0053f210,166,mouse_cursor_complete_release_and_raise_shell_visible_latch,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Second release-side mode-transition branch in the same `MouseCursor.cpp` family. When either `[this+0x14]` or `[this+0x18]` is still set, the helper reruns the same shell-window and shell-work-owner follow-ons as `0x0053f170`, clears the live cursor selection through `0x0053f000(0, 0, 0)`, clears both `[this+0x18]` and `[this+0x14]`, writes shell latch `[0x006d4024+0x11473a] = 1` while keeping `[+0x11473e] = 0`, restores the saved selected id into `[this+0x04]`, and when `[this+0x08]` is nonzero raises cursor visibility through `0x0051e810(1)`. Current grounded callers are the graphics-backend no-repaint service branch `0x004ffb64` and the local chooser `0x0053f2c0`, so this is the safest current read for the completed release-to-visible transition rather than another generic toggle.","objdump + caller inspection + local disassembly + source-string correlation + shell-latch correlation"
0x0053f2c0,32,mouse_cursor_service_pending_mode_choice_from_shell_latch,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small chooser over the two release-transition branches in the `MouseCursor.cpp` family. When local pending flag `[this+0x14]` is nonzero, it dispatches either to `0x0053f0f0` or `0x0053f210` according to shell latch `[0x006d4024+0x11473e]`; otherwise it returns immediately. Current grounded caller is the timer-gated graphics-page service branch `0x004ffafb`.","objdump + caller inspection + local disassembly + shell-latch correlation"
0x0053f2f0,32,mouse_cursor_push_selection_hold_and_optionally_switch_to_id6,shell,thiscall,inferred,objdump + local disassembly + family correlation,2,"Small hold-counter increment helper in the `MouseCursor.cpp` family. On the first nested hold when `[this+0x0c]` is still zero, it snapshots the current selected id from `[this+0x04]` into `[this+0x10]`, switches the live cursor through `0x0053f000(6, 0, 0)`, and then increments the hold count at `[this+0x0c]`.","objdump + local disassembly + family correlation + hold-counter correlation"
0x0053f310,28,mouse_cursor_pop_selection_hold_and_restore_saved_or_default_id,shell,thiscall,inferred,objdump + local disassembly + family correlation,2,"Hold-counter decrement helper paired with `0x0053f2f0`. The helper decrements `[this+0x0c]`, and when the count reaches zero it restores the saved id from `[this+0x10]` or fallback id `1` through `0x0053f000(saved_or_default, 0, 0)`.","objdump + local disassembly + family correlation + hold-counter correlation"
0x0053f330,146,mouse_cursor_reset_controller_state_and_sync_shell_mode_latches,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Constructor-side reset for the global `MouseCursor.cpp` controller at `0x00ccbb20`. The helper clears the local state band `[this+0x00..+0x28]`, seeds `[this+0x08] = 1`, `[this+0x10] = 1`, and `[this+0x04/+0x20] = -1`, re-enters `0x0053f000(0, 0, 0)`, frees any auxiliary handle at `[this+0x1c]`, and then syncs the local hidden or visible mode latches from shell dwords `[0x006d4024+0x11473e/+0x11473a]` by optionally entering `0x0053f0f0` or setting `[this+0x14]` directly. The tail also clears the shared cursor-handle table `0x00ccba60`. Current grounded caller is `shell_install_global_controller` follow-on startup beneath the mouse-cursor owner family.","objdump + caller inspection + local disassembly + source-string correlation + startup correlation"
0x0053f3d0,39,mouse_cursor_release_current_selection_and_aux_handle,shell,thiscall,inferred,objdump + local disassembly + family correlation,2,"Small cleanup helper in the `MouseCursor.cpp` family. The helper clears the current selection through `0x0053f000(0, 0, 0)`, frees the auxiliary handle at `[this+0x1c]` when present, and zeroes that slot. This is the direct release-side sibling of the constructor reset at `0x0053f330`.","objdump + local disassembly + family correlation + cleanup correlation"
0x0053f400,80,mouse_cursor_service_coarse_global_mode_latches,shell,cdecl,inferred,objdump + caller inspection + local disassembly + family correlation,3,"Coarse service branch over the global `MouseCursor.cpp` mode latches `0x00ccbb18/0x00ccbb1c/0x00ccbb24/0x00ccba58/0x00ccba5c`. The helper decrements countdown `0x00ccbb24`, and when that reaches zero it dispatches either into `0x0053f0f0` or `0x0053f170` from the pending global owners, then mirrors the surviving globals back into shell latches `[0x006d4024+0x11473e/+0x11473a]`. Current grounded caller is the frame updater `0x0053f4e0`.","objdump + caller inspection + local disassembly + family correlation + shell-latch correlation"
0x0053f450,134,mouse_cursor_refresh_inside_active_view_and_toggle_visibility_hint,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Small view-sensitive refresh in the `MouseCursor.cpp` family. The helper samples the current `cursor inside active view` predicate through `shell_input_cursor_inside_active_view` `0x0054f540`, compares that boolean against local state `[this+0x08]`, and on changes updates the same state plus toggles cursor visibility through `0x0051e810(0/1)` when hidden mode `[this+0x18]` is active. On the fallback path it also consults the global shell-side cursor owner at `0x00ccbb20` and, when the global `ShowCursor` refcount is positive, refreshes the coarse elapsed-tick latch `[this+0x24]` or re-enters `0x0053f000(1, 1, 0)`. Current grounded callers are `mouse_cursor_update_frame_state` `0x0053f4e0` and the shell camera action helper `0x004e0780`, so this is the safest current read for the inside-view watcher plus visibility hint owner.","objdump + caller inspection + local disassembly + source-string correlation + inside-view correlation"
0x0053f4e0,739,mouse_cursor_update_frame_state,shell,thiscall,inferred,ghidra-headless,4,Per-frame MouseCursor.cpp updater for the global cursor controller at 0x00ccbb20. It refreshes elapsed tick state through 0x0051d890 re-arms the active cursor selection through 0x0053f450 and 0x0053f000 when the 150 ms and 15 s idle thresholds trip resets per-frame cursor globals through 0x0054f6c0 and 0x0054f6d0 samples cursor placement and world-relative state through world_anchor_measure_projected_half_width world_anchor_measure_projected_half_height and shell_queue_world_anchor_marker and publishes the resulting cursor presentation state through shell_publish_text_callout_presentation before finalizing through 0x0054f6e0.,ghidra + rizin + llvm-objdump + strings
0x0052e060,537,runtime_object_emit_materialized_group_packet_rows_as_vertex24_window,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Vertex24-emission sibling to `0x0052dd00` beneath `runtime_object_emit_selected_grouped_subrecords_into_global_packet_ring` `0x0052f500` in the broader `0x23a` runtime-object family. The helper resolves the same selected group header, active materialized row payload at `[row+0x35]`, and packet source span from `[record+0x04/+0x08/+0x0c]`, then emits `count*3` transformed `0x18`-byte vertex24 records into the caller-provided buffer while advancing the output-count accumulator. Each emitted record stores one vec3 at `+0x00`, style dword `[this+0x43]` at `+0x0c`, and scalar lanes at `+0x10/+0x14`, with the same nonnegative-versus-negative `[this+0x69]` split used by `0x0052dd00`. Current grounded caller is the shell-side presentation branch `0x00528821`, so this is the safest current read for emitting materialized group packet rows as one vertex24 window rather than a shell-only triplet expander.","objdump + caller inspection + local disassembly + grouped-subrecord correlation + packet-row correlation + vertex24-window correlation"
0x0052cd20,21,embedded_view_controller_copy_eye_triplet_to_out_vec3,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny copy helper over the embedded world-view controller base. The function copies the current eye triplet `[this+0x1c/+0x20/+0x24]` into one caller-supplied contiguous `vec3` buffer. Current grounded caller is the world-view wrapper `0x00527e5e`, which uses it together with the focus-triplet sibling `0x0052cd40`, so this is the safest current read for the packed eye-triplet copy helper rather than a broader serializer.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cd40,21,embedded_view_controller_copy_focus_triplet_to_out_vec3,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Packed focus-triplet sibling to `0x0052cd20` over the same embedded controller base. The helper copies the current focus triplet `[this+0x04/+0x08/+0x0c]` into one caller-supplied contiguous `vec3` buffer. Current grounded caller is the same world-view wrapper `0x00527e6a`, so this is the safest current read for the packed focus-triplet copy helper rather than another generic memcpy leaf.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cd60,28,embedded_view_controller_copy_eye_triplet_to_three_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Split-out eye-triplet copy helper over the embedded world-view controller base. The function writes current eye lanes `[this+0x1c/+0x20/+0x24]` into three separate caller out-pointers. Current grounded callers include the world-view wrappers `0x00524089`, `0x00528226`, `0x00528384`, `0x00529508`, `0x00529c02`, `0x0052a79a`, the local helper strip around `0x0052bb01`, and sibling controller-bridge calls inside `0x00548382/0x005484de`, so this is the safest current read for the split eye-triplet export helper rather than a subtype-specific query.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cd80,28,embedded_view_controller_copy_focus_triplet_to_three_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Split-out focus-triplet sibling to `0x0052cd60` over the same embedded controller base. The function writes current focus lanes `[this+0x04/+0x08/+0x0c]` into three separate caller out-pointers. Current grounded callers include world-side and setup-side branches `0x0042ac39`, `0x0042ad67`, `0x00487483`, `0x0052ad16`, `0x0052bad3`, and sibling controller-bridge calls inside `0x0054836c/0x005484c8`, so this is the safest current read for the split focus-triplet export helper rather than a generic outparam block.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cda0,28,embedded_view_controller_copy_aux_triplet_0x2c_0x34_to_three_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small auxiliary-triplet export helper over the embedded controller base. The function writes lanes `[this+0x2c/+0x30/+0x34]` into three separate caller out-pointers. Current grounded caller is the neighboring layout-state bridge `0x00548398`, so this is the safest current read for exporting the auxiliary cached triplet at `+0x2c..+0x34` rather than a named world coordinate without broader owner evidence.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cdc0,22,embedded_view_controller_store_aux_triplet_0x2c_0x34,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny setter companion to `0x0052cda0` over the same controller base. The helper stores three caller dwords into auxiliary triplet `[this+0x2c/+0x30/+0x34]`. Current grounded callers are the setup-side world-view branches `0x004592ef` and `0x00459b7b`, so this is the safest current read for the auxiliary-triplet store helper rather than a broader camera-mode owner.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cde0,48,embedded_view_controller_set_dirty_latch_0x64_and_optionally_snapshot_focus_eye_heading_distance_band,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Dirty-latch helper over the embedded controller base. The function stores the caller boolean into byte `[this+0x64]`; when the boolean is zero it also snapshots the current heading and pitch lanes `[this+0x10/+0x14]`, focus triplet `[this+0x04/+0x08/+0x0c]`, and distance lane `[this+0x18]` into the cached companion band `[this+0x44/+0x48/+0x38/+0x3c/+0x40/+0x4c]`. Current grounded caller is `0x0052c2ef`, so this is the safest current read for the primary dirty-latch and cached focus-eye-orientation snapshot helper rather than a generic flag setter.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052ce20,54,embedded_view_controller_set_dirty_latch_0x65_and_optionally_snapshot_focus_heading_distance_band_0x72_0x86,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Secondary dirty-latch helper over the same controller base. The function stores the caller boolean into byte `[this+0x65]`; when that boolean is zero it snapshots heading and pitch lanes `[this+0x10/+0x14]`, focus triplet `[this+0x04/+0x08/+0x0c]`, and distance lane `[this+0x18]` into the secondary companion band `[this+0x72/+0x76/+0x7a/+0x7e/+0x82/+0x86]`. Current grounded caller is the later owner branch `0x0052cc5d`, so this is the safest current read for the secondary dirty-latch and cached snapshot helper rather than a generic mode toggle.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052ce60,5,embedded_view_controller_raise_dirty_latch_0x64,shell,thiscall,inferred,objdump + local disassembly,1,"Tiny leaf over the embedded controller base that only sets dirty byte `[this+0x64] = 1`. Current evidence keeps it at the direct dirty-latch raiser level.","objdump + local disassembly + controller-base correlation"
0x0052ce70,43,embedded_view_controller_refresh_shell_presenter_scalar_0x6a_and_consume_dirty_latch_0x64,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small shell-state synchronization helper over the same controller base. The function compares cached scalar `[this+0x6a]` against current shell presenter dword `[0x006d4024+0x114222]`, raises dirty byte `[this+0x64]` and stores the new shell scalar when they differ, then returns the prior dirty state and clears `[this+0x64]` back to zero. Current grounded caller is `0x0052c29c`, so this is the safest current read for the shell-scalar refresh plus dirty-latch consume helper rather than a generic poll routine.","objdump + caller inspection + local disassembly + controller-base correlation + shell-scalar correlation"
0x0052cea0,19,embedded_view_controller_copy_heading_pitch_pair_to_two_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny heading/pitch export helper over the embedded controller base. The function copies lanes `[this+0x10/+0x14]` into two caller out-pointers. Current grounded caller is the later support branch `0x00566700`, so this is the safest current read for the heading-pitch pair copy helper rather than a broader serializer fragment.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cec0,49,embedded_view_controller_sample_owner_height_at_current_eye_xz,shell,thiscall,inferred,objdump + local disassembly,1,"Small owner-height query helper beneath the same controller base. The function scales current eye X/Z lanes `[this+0x1c/+0x24]` through the recurring world-unit constants, then forwards the resulting pair into owner handle `[this+0x6e]` through `0x00534490`. Current evidence grounds it as the direct sampled-height query at the controller's current eye X/Z position.","objdump + local disassembly + controller-base correlation + sampled-height correlation"
0x0052cf00,436,embedded_view_controller_query_owner_height_peak_over_clamped_xy_extent_pair,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Broader owner-height extent query over the embedded controller base. The helper clamps the caller-supplied X and Y extent floats against lower bound `2.0` and against owner-derived width and height limits from `0x00533970/0x00533980`, samples an initial owner height through `0x00534490`, and then walks a rectangular neighborhood in repeated world-unit steps to keep the highest sampled height, returning that peak float. Current grounded callers are the current-eye wrapper `0x0052d0dc`, the world-view clamp owner `0x0045211f`, and the later support branch `0x0053037f`, so this is the safest current read for querying the peak sampled owner height across one clamped XY extent pair rather than a generic math loop.","objdump + caller inspection + local disassembly + controller-base correlation + sampled-height correlation"
0x0052d0c0,33,embedded_view_controller_query_owner_height_peak_over_current_eye_xz_extent_pair,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Current-eye wrapper over `0x0052cf00` in the embedded controller base. The helper scales current eye X/Z lanes `[this+0x1c/+0x24]` into owner-space extents and forwards them into the broader peak-height query `0x0052cf00`. Current grounded callers are the world-view clamp owners `0x00439942` and `0x0043ceec`, so this is the safest current read for the current-eye peak-height wrapper rather than a separate terrain query family.","objdump + caller inspection + local disassembly + controller-base correlation + sampled-height correlation"
0x0052d0f0,64,embedded_view_controller_query_normalized_scalar_band_contains_xy_pair,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small range predicate over normalized scalar band `[this+0x50/+0x54/+0x58/+0x5c]` in the embedded controller base. The helper returns `1` only when the caller-supplied XY pair lies inside that stored scalar rectangle and `0` otherwise. Current grounded callers are the world-side branch `0x0045211f` and the later support branch `0x0053037f`, so this is the safest current read for the normalized-band containment predicate rather than a generic compare helper.","objdump + caller inspection + local disassembly + controller-base correlation + normalized-rect correlation"
0x0052d140,29,embedded_view_controller_store_four_blend_scalars_0x50_0x5c,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny setter over the embedded world-view controller base. The helper copies four caller-supplied dwords into scalar lanes `[this+0x50/+0x54/+0x58/+0x5c]` unchanged. Current grounded callers are the mode-`0x19` variant seed owners `0x0043a0a0`, `0x0043ace3`, the setup-side world-view branches `0x00459139`, `0x00459982`, and the later world-side owner `0x005208ad`, so this is the safest current read for the four-scalar controller-blend setter rather than a higher-level mode owner.","objdump + caller inspection + local disassembly + controller-band correlation"
0x0052d180,91,embedded_view_controller_store_focus_triplet_and_mark_dirty_if_changed,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Core focus-triplet setter beneath the embedded world-view controller base. The helper compares the incoming focus XYZ against the current stored triplet `[this+0x04/+0x08/+0x0c]`; when any component moves beyond the small epsilon at `0x005dd1c0` it sets dirty byte `[this+0x64] = 1`. It then stores the new triplet into `[+0x04/+0x08/+0x0c]`. Current grounded callers are the shell-input controller path `0x0043a1c3`, the transient-offset service `0x0043a54b`, the local clamp helper `0x00439820`, setup-side world-view branches `0x004592b8/0x00459b61`, and the runtime-object support strip `0x0052d440/0x0052bf65`, so this is the safest current read for the focus-triplet setter plus dirty-latch update rather than a generic vec3 copy.","objdump + caller inspection + local disassembly + controller-base correlation + dirty-latch correlation"
0x0052d1e0,67,embedded_view_controller_store_eye_triplet_and_refresh_vertical_delta,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Eye-triplet setter beneath the same embedded controller base. The helper stores the caller eye XYZ into `[this+0x1c/+0x20/+0x24]`; when owner handle `[this+0x6e]` is live it also samples the owner's height through `0x00534490` at the new X/Z pair and writes the resulting vertical delta `eye_y - sampled_height` into `[this+0x66]`, otherwise it copies the eye Y lane directly into `[this+0x66]`. Current grounded callers are the local clearance-ring clamp `0x00439820`, the setup-side controller owners `0x00459139/0x004592b8/0x00459afe`, and the helper itself's paired rebuild path `0x0052d440`, so this is the safest current read for storing the eye triplet and refreshing the sampled vertical delta rather than a generic world-position setter.","objdump + caller inspection + local disassembly + controller-base correlation + vertical-delta correlation"
0x0052d230,115,embedded_view_controller_query_focus_to_eye_distance_heading_and_pitch,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Pure query helper over the same controller base. Starting from the current focus triplet `[this+0x04/+0x08/+0x0c]` and eye triplet `[this+0x1c/+0x20/+0x24]`, the function can write the straight-line distance, one heading-like angle, and one pitch-like angle into up to three caller out-pointers. Current grounded caller is the world-side wrapper `0x0052fa59`, which consumes these as a bundled camera-state query, so this is the safest current read for the focus-to-eye distance and angle extractor rather than a standalone math primitive.","objdump + caller inspection + local disassembly + controller-base correlation + polar-query correlation"
0x0052d2b0,178,embedded_view_controller_serialize_focus_eye_and_orientation_triplets,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared serializer for the embedded controller base. The helper writes the current focus triplet `[this+0x04/+0x08/+0x0c]`, distance or view-height lane `[this+0x18]`, heading and pitch lanes `[this+0x10/+0x14]`, and eye triplet `[this+0x1c/+0x20/+0x24]` into the caller stream through repeated `0x00531030` writes, followed by one fixed zeroed `0x14`-byte trailer. Current grounded caller is `world_view_store_camera_view_slot_snapshot` `0x00439ac0`, so this is the safest current read for the controller-base snapshot serializer rather than a generic stream writer.","objdump + caller inspection + local disassembly + camera-view correlation + controller-base correlation"
0x0052d3e0,21,embedded_view_controller_clear_presenter_owner_slot_if_self,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny presenter cleanup leaf beneath the embedded controller base. When the live shell presenter exists and its owner slot `[0x006d4024+0x28]` still points at `this`, the helper clears that slot to null. Current grounded callers are the controller release owners `0x0043a58d` and `0x0043ac5c`, so this is the safest current read for the conditional presenter-owner clear helper.","objdump + caller inspection + local disassembly + presenter-owner correlation"
0x0052d400,69,embedded_view_controller_rebuild_focus_triplet_from_eye_heading_pitch_and_distance,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Inverse rebuild helper for the same embedded controller base. Starting from the current eye triplet `[this+0x1c/+0x20/+0x24]`, heading and pitch lanes `[this+0x10/+0x14]`, and distance or view-height lane `[this+0x18]`, the function reconstructs the implied focus triplet on the stack and then stores that triplet through `0x0052d180`. Current grounded caller is the world-view camera-restore branch `0x0043c960`, which adjusts heading before re-entering this helper, so this is the safest current read for rebuilding focus from eye-orientation-distance rather than another trig primitive.","objdump + caller inspection + local disassembly + controller-base correlation + focus-triplet correlation"
0x0052d450,117,embedded_view_controller_rebuild_eye_triplet_from_focus_heading_pitch_and_distance,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Core rebuild helper for the embedded controller base. Using the stored focus triplet `[this+0x04/+0x08/+0x0c]`, heading and pitch lanes `[this+0x10/+0x14]`, and distance lane `[this+0x18]`, the function recomputes the eye triplet into `[this+0x1c/+0x20/+0x24]` by applying the usual trig decomposition. When owner handle `[this+0x6e]` is live it also samples the owner's height through `0x00534490` at the rebuilt X/Z pair and refreshes vertical delta `[this+0x66]`; otherwise it copies the rebuilt eye Y lane there directly. Current grounded callers are the controller reset or clamp helpers `0x0052d5bf`, `0x0052d646`, and the world-view side branch `0x0043e4ce`, so this is the safest current read for rebuilding the eye triplet from focus, orientation, and distance rather than a generic trig helper.","objdump + caller inspection + local disassembly + controller-base correlation + eye-triplet correlation"
0x0052d4d0,143,embedded_view_controller_materialize_active_display_rect_from_normalized_scalars_0x50_0x5c,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small display-rect materializer beneath the embedded world-view controller base. The helper samples the active shell display width and height pair from `[0x006d4024+0x34 + [0x006d4024+0x11421e]*0x15]`, multiplies those two display metrics by the stored normalized scalar band `[this+0x50/+0x54/+0x58/+0x5c]`, rounds the four products through `0x005a10d0`, and writes the resulting integer rectangle corners through the caller out-pointers. Current grounded caller is the layout-state bridge `0x005482e0`, so this is the safest current read for materializing one active-display rect from the controller's normalized scalar band rather than a generic scaling helper.","objdump + caller inspection + local disassembly + controller-base correlation + display-rect correlation"
0x0052d570,27,embedded_view_controller_rebind_base_vtable_and_clear_presenter_owner_slot,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny base-reset leaf for the embedded controller object. The helper restores the base vtable root `0x005dd1c8` at `[this]` and clears presenter owner slot `[0x006d4024+0x28]` when it still points at `this`. Current grounded callers are the world-view release path `0x0043a595`, the setup-side teardown path `0x00458258`, the world-side cleanup branches `0x00520d43` and `0x0052bfd3`, so this is the safest current read for the base-vtable rebind and presenter-owner clear leaf.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052d5a0,144,embedded_view_controller_reset_scalar_bands_defaults_and_dirty_latches,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader initializer for the embedded controller base. The helper clears owner handle `[this+0x6e]`, sampled vertical delta `[+0x66]`, heading `[+0x10]`, several transient scalar lanes `[+0x44/+0x48/+0x60]`, focus and eye triplets `[+0x04..+0x0c]` and `[+0x38..+0x40]`, re-enters `0x0052d450`, seeds default scalar lanes such as `[+0x14]=0.2`, `[+0x18]=100.0`, `[+0x28]=100`, `[+0x30/+0x58/+0x5c]=1.0`, `[+0x4c]=100.0`, dirty byte `[+0x64]=1`, and sentinel `[+0x6a]=-1`, then copies the rebuilt heading or pitch defaults into `[+0x72/+0x76]` and `[+0x86]`. Current grounded callers are the world-view reset owner `0x0043a5a3`, the local constructor `0x0052d6d9`, and the later rebuild paths `0x0052d6d9/0x0052d869`, so this is the safest current read for the embedded controller-base reset and default seeding owner rather than a generic constructor stub.","objdump + caller inspection + local disassembly + controller-base correlation + reset-owner correlation"
0x0052d640,131,embedded_view_controller_clamp_distance_against_sampled_eye_height_and_rebuild_eye_triplet,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Distance-clamp helper for the embedded controller base. The function first rebuilds the current eye triplet through `0x0052d450`, compares owner-derived metric `vtable[+0x0c]` against eye height `[this+0x20]`, and when the current distance or view-height lane `[this+0x18]` is too large it computes one reduced value from the current height gap, pitch sine, and the sampled vertical offset, stores the clamped result back into `[this+0x18]`, and rebuilds the eye triplet again through `0x0052d450`. Current grounded callers are the world-view heading and zoom-step paths `0x0043cb16/0x0043cc16`, the controller seed path `0x0043ce3a`, the motion wrapper `0x0043d09f`, and the local constructor `0x0052d744`, so this is the safest current read for the distance clamp and eye-triplet rebuild helper rather than a generic projection recompute.","objdump + caller inspection + local disassembly + controller-base correlation + distance-clamp correlation"
0x0052d6f0,90,embedded_view_controller_seed_focus_distance_owner_and_rebuild_eye_triplet,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Compact constructor-side seed helper for the embedded controller base. The function stores one caller-supplied owner handle into `[this+0x6e]`, seeds the focus triplet into `[this+0x04/+0x08/+0x0c]`, seeds distance or view-height lane `[this+0x18]` plus its copy `[this+0x4c]`, mirrors shell presenter scalar `[0x006d4024+0x114222]` into `[this+0x6a]`, derives one bucket-like value from `0x51f070(1)` into `[this+0x28]`, and then tail-calls `0x0052d640` to rebuild the eye triplet and apply any needed clamp. Current grounded callers are the world-view owner `0x0043ce0e` and the stream-load branches `0x0052d7da/0x0052d889`, so this is the safest current read for the seeded controller-base setup helper rather than a generic stream-load leaf.","objdump + caller inspection + local disassembly + controller-base correlation + seed-owner correlation"
0x0052d750,260,embedded_view_controller_load_focus_eye_and_orientation_snapshot_from_stream,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared stream-load companion to the camera-view snapshot serializer `0x0052d2b0`. The helper first clears presenter owner slot `[0x006d4024+0x28]` when it still points at `this`, then reads the stored focus triplet `[+0x04/+0x08/+0x0c]` and distance lane `[+0x18]` through repeated `0x00531150` calls, resolves one owner handle from that focus or distance tuple through shell presenter helper `0x0051f090`, and re-enters `0x0052d6f0` to seed the controller base. After that it loads heading and pitch lanes `[+0x10/+0x14]`, eye triplet `[+0x1c/+0x20/+0x24]`, and consumes the trailing zeroed `0x14`-byte trailer. Current grounded caller is the world-view stream-load owner `0x0043ac30`, so this is the safest current read for loading one embedded controller snapshot from a stream rather than a generic byte-reader block.","objdump + caller inspection + local disassembly + stream-load correlation + camera-view correlation + controller-base correlation"
0x0052d860,50,embedded_view_controller_construct_reset_and_seed_from_focus_distance_owner,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Compact constructor wrapper for the same embedded controller base. The helper rebinds base vtable `0x005dd1c8`, re-enters `0x0052d5a0` to reset and seed defaults, and then forwards one caller-supplied owner handle, focus triplet, and distance lane into `0x0052d6f0`. Current grounded callers are the placed-structure and world-side builders `0x004581ff` and `0x0052087e`, so this is the safest current read for the reset-plus-seed constructor wrapper rather than another raw allocator tail.","objdump + caller inspection + local disassembly + controller-base correlation + constructor-wrapper correlation"
0x0052d8a0,170,runtime_object_register_relative_child_in_owned_list_field_0x75,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared owned-list registration helper over list root `[this+0x75]` in the broader `0x23a` runtime-object family. The function lazily allocates that list root through `0x00556db0`, optionally rewrites the incoming child object's anchor triplet `[child+0x1e2/+0x1e6/+0x1ea]` into coordinates relative either to current group-anchor `[this+0x14]` or to this object's own anchor when state bit `0x10` is still clear, sets bit `0x10` in the child state byte `[child+0x20]`, and then pushes the child through `0x00556e10`. Current grounded callers include the placed-structure specialization builders `0x0045b6f0`, `0x0045b760`, `0x0045c310`, the vehicle-side branches `0x00485933..0x00485ddb`, and the effect-side builders `0x0045b96b`, `0x0045c39c`, and `0x0045da83..0x0045e305`, so this is the safest current read for registering one relative child object in owned list `[this+0x75]` rather than a subtype-specific builder.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list correlation + relative-anchor correlation"
0x0052d950,71,runtime_object_register_record_in_owned_list_field_0x79_with_group_anchor_copy,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared owned-list registration helper over list root `[this+0x79]` in the broader `0x23a` runtime-object family. The function lazily allocates that list root through `0x00556db0`, copies the current group-anchor triplet from `[this+0x14]` into record fields `[record+0x29/+0x2d/+0x31]`, and then pushes the record through `0x00556e10`. Current grounded callers include the specialization payload publishers `0x00474f3e`, `0x00485f30`, and `0x00486029`, so this is the safest current read for registering one record in owned list `[this+0x79]` with a copied group anchor rather than a bare list append.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list correlation + group-anchor correlation"
0x0052d9a0,79,runtime_object_register_record_in_owned_list_field_0x7d_with_group_anchor_copy,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Sibling owned-list registration helper over list root `[this+0x7d]` in the broader `0x23a` runtime-object family. The function lazily allocates that list root through `0x00556db0`, copies the current group-anchor triplet from `[this+0x14]` into record fields `[record+0x29/+0x2d/+0x31]`, and then pushes the record through `0x00556e10`. Current grounded callers include the placed-structure specialization publishers `0x00456ad4`, `0x00456b80`, `0x00456c5a`, `0x00457047`, `0x0045b141`, `0x0045b14f`, `0x0045e305`, and the vehicle-side helpers `0x0048597a`, so this is the safest current read for registering one record in owned list `[this+0x7d]` with a copied group anchor rather than a subtype-specific payload constructor.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list correlation + group-anchor correlation"
0x0052da70,32,runtime_object_refresh_dependent_handle_0x0c_if_flag_0x40_and_owner_live,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small dependent-handle refresh helper beneath the broader `0x23a` runtime-object family. When owner pointer `[this+0x04]` is live and state byte `[this+0x20]` still carries bit `0x40`, the helper clears that bit, rebuilds one dependent handle through `0x00533bc0`, and stores the result into `[this+0x0c]`. Current grounded callers are the nearby world-side support strips `0x00421415` and `0x00461300`, so this is the safest current read for the `0x40`-bit dependent-handle refresh leaf rather than a generic flag clear.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + dependent-handle correlation"
0x0052daa0,67,runtime_object_select_grouped_subrecord_by_clamped_index,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared grouped-subrecord selector over the broader `0x23a` runtime-object family. When grouped table root `[this+0x14]` is live, the helper clamps the caller-requested index against the current group count from the selected `0x45`-byte group header `[group+0x14]`, stores the resulting cursor into `[this+0x21]`, updates active subrecord pointer `[this+0x18]` to the corresponding `0x45`-byte payload row under `[group+0x0c]`, and returns whether the requested index was already in range. Current grounded callers are the world-side wrappers `0x0042aba0`, `0x00455c73`, `0x00528721`, and `0x0052941f`, so this is the safest current read for the explicit grouped-subrecord select helper rather than a generic array index setter.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + grouped-subrecord correlation"
0x0052db10,224,runtime_object_store_scalar_0x69_mark_transform_dirty_and_materialize_group_packet_rows,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader grouped-subrecord materialization helper beneath the same `0x23a` runtime-object family. The function stores one caller-supplied scalar into `[this+0x69]`, sets dirty bit `0x02` in state byte `[this+0x20]`, raises byte `[this+0x8d]`, resolves the currently selected group header from `[this+0x14]` and group index `[this+0x3a]`, and then walks every `0x45`-byte row in that group. For each row it caches the active row pointer in globals `0x00cc3b58/0x00cc3b6c`, lazily allocates row-local payload storage when `[row+0x35]` is still null, copies the row's packed source span there, zero-fills the trailing companion area, and advances to the next row. Current grounded callers are the vehicle-side visual builders `0x00485a1d` and `0x00485a68` plus the shell-side presentation branch `0x005287af`, so this is the safest current read for storing scalar lane `[+0x69]` and materializing the current group's packet rows rather than a pure allocator helper.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + grouped-subrecord correlation + packet-row correlation"
0x0052dc00,240,runtime_object_bucket_materialized_group_packet_rows_by_four_float_thresholds,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Companion grouped-row helper immediately above `0x0052db10` in the same `0x23a` runtime-object family. When byte latch `[this+0x8d]` is live and local bucket byte `[this+0x5b]` is still below `2`, the function increments that bucket, stores one caller float into threshold lane `[this+0x69 + bucket*4]`, resolves the currently selected `0x45`-byte group, and then walks every materialized row payload at `[row+0x35]`. For each copied entry it compares the entry's two stored floats against the four caller-supplied threshold bounds and, on success, writes the current bucket byte into the compact trailing byte band of the copied row payload. Current grounded callers are the vehicle-side visual builders `0x00485a8c`, `0x00485ab0`, `0x00485ad4`, and `0x00485af8`, so this is the safest current read for bucketing the materialized group packet rows by threshold windows rather than a generic float clamp.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + grouped-subrecord correlation + threshold-bucket correlation"
0x0052eb20,51,shell_read_optional_presentation_extents4,bootstrap,thiscall,inferred,ghidra-headless,4,Reads an optional four-float extent block from the active presentation-batch record when byte flag [this+0x25] is set; copies dwords at +0x26 +0x2a +0x2e and +0x32 into caller outparams for the presentation-extents helper at 0x547d10.,ghidra + rizin
0x0052eb60,6,runtime_object_constant_0x46_stub_vtable_5cfd00_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns literal `0x46` in `EAX` and exits immediately. Current evidence keeps the row at that fixed-return slot level.","objdump + vtable scan + local disassembly"
0x0052eb70,6,runtime_object_constant_0x46_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second tiny constant-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper also returns literal `0x46` in `EAX` and exits immediately. Current evidence keeps the row at that fixed-return slot level.","objdump + vtable scan + local disassembly"
0x0052eb80,7,runtime_object_constant_float_1_25_stub_vtable_5cfd00_slot,map,thiscall,inferred,objdump + vtable scan + local disassembly + rdata inspection,1,"Tiny float-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper loads and returns the constant float at `0x005dd1e8`, which is `1.25f`. Current evidence grounds it only as a fixed float-return slot.","objdump + vtable scan + local disassembly + rdata inspection"
0x0052eb90,53,runtime_object_release_all_entries_in_list_field_0x79_via_0x554d50,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared cleanup helper over the broader `0x23a` runtime-object family. When list root `[this+0x79]` is nonnull, the helper walks that collection through `0x00556ef0/0x00556f00` and releases every entry through `0x00554d50` until no child remains. Current grounded callers include placed-structure rebuild or mutation branches `0x0046f055`, `0x004707e1`, `0x00507d70`, and `0x00509057`, where it acts as the release-side companion after local-runtime state mutations.","objdump + caller inspection + local disassembly + shared-runtime-object correlation"
0x0052ebd0,122,runtime_object_load_two_flag_bits_into_byte_0x20_and_optionally_refresh_handle_0x0c,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared stream-load helper beneath the broader `0x23a` runtime-object family. The function reads two one-byte flag lanes from the caller-supplied stream through `0x00531150`, folds those values into bits `0x20` and `0x40` of state byte `[this+0x20]`, and when the refreshed `0x40` bit ends up enabled with owner pointer `[this+0x04]` already live it clears that bit again, rebuilds one dependent handle through `0x00533bc0`, and stores the result into `[this+0x0c]`. Current grounded caller is the tagged payload loader `0x004560c0`, so the safest read is a two-bit load helper with an optional dependent-handle refresh rather than a generic byte reader.","objdump + caller inspection + local disassembly + stream-load correlation"
0x0052ec50,68,runtime_object_serialize_two_flag_bits_from_byte_0x20,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared stream-save companion to `0x0052ebd0` beneath the broader `0x23a` runtime-object family. The helper extracts bits `0x20` and `0x40` from state byte `[this+0x20]` as two one-byte values and writes both bytes into the caller-supplied stream through `0x00531030`. Current grounded caller is the shared tagged serializer `0x00455a22`, so this is the safest current read for the two-bit save helper rather than a broader payload writer.","objdump + caller inspection + local disassembly + stream-save correlation"
0x0052eca0,46,runtime_object_query_next_grouped_0x45_byte_subrecord_from_table_0x14,map,thiscall,inferred,objdump + local disassembly + field inspection,2,"Shared fixed-record cursor helper over the broader `0x23a` runtime-object family. When grouped table root `[this+0x14]` is live and current subrecord index `[this+0x21] + 1` remains below the current group count taken from the `0x45`-byte group header selected by `[this+0x3a]`, the helper returns the next subrecord pointer from that group's payload base `[group+0x0c]`; otherwise it returns null. Current evidence keeps the row at the grouped-table cursor level over the `0x45`-byte records.","objdump + local disassembly + field inspection + grouped-subrecord correlation"
0x0052ecd0,272,runtime_object_reset_local_state_and_seed_default_scalar_flag_bands,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared low-level reset helper beneath the broader `0x23a` runtime-object family. The function clears the local list and handle roots at `[this+0x04/+0x08/+0x0c/+0x10/+0x14/+0x1c/+0x75..+0x81]`, resets string or scalar side bands around `[this+0x4b..+0x65]`, clears cached words at `[this+0x8d]`, `[this+0x1be..+0x1da]`, and related spans, preserves only selected low bits of state byte `[this+0x20]` before forcing default mask `0x62`, writes `-1` sentinels into `[this+0x3e]`, `[this+0x1ee]`, and `[this+0x1fa]`, and seeds the recurring default `1.0f` lanes at `[this+0x36]`, `[this+0x18e]`, `[this+0x1a2]`, `[this+0x1b6]`, `[this+0x1ca]`, and `[this+0x1da]`. Current grounded callers are the shared payload loaders `0x00455b70`, `0x00455fc0`, and the deeper init branch `0x0052edf0`, so this is the safest current read for the common local-state reset and default seeding owner.","objdump + caller inspection + local disassembly + shared-runtime-object correlation"
0x0052edf0,178,runtime_object_seed_owner_handle_anchor_triplet_and_default_color,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared post-reset initializer beneath the broader `0x23a` runtime-object family. After re-entering `0x0052ecd0`, the helper stores one caller-supplied owner or parent pointer into `[this+0x04]`, optionally resolves a primary handle from the second caller argument through owner `0x006d4020` into `[this+0x10]`, optionally resolves a secondary handle from the third argument into `[this+0x1c]`, copies the first triplet from the resolved primary handle into `[this+0x1e2/+0x1e6/+0x1ea]`, sets bit `0x08` in state byte `[this+0x20]`, and seeds packed color lane `[this+0x43]` to `0x007f7f7f`. When the primary handle argument is null, it zeros `[this+0x10/+0x14/+0x18]` and the copied triplet instead. Current grounded callers are the shared initializers `0x00455b70`, `0x00485819`, and `0x0053065a`, so this is the safest current read for seeding the owner-handle and anchor-triplet band rather than a subtype-specific constructor.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + anchor-triplet correlation"
0x0052eeb0,93,runtime_object_release_owned_entry_list_field_0x79_and_clear_root,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared release helper over owned list root `[this+0x79]` in the broader `0x23a` runtime-object family. The function walks the current list through `0x00556ef0/0x00556f00`, releases each live entry through `0x00556460`, frees those entries through `0x0053b080`, then destroys and frees the root list object itself through `0x005571d0` plus `0x0053b080`, and finally clears `[this+0x79]` back to null. Current grounded callers are the deeper release body `0x0052ef70` and the specialization-side cleanup `0x0045b734`, so this is the safest current read for the owned-list `[this+0x79]` release path.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list-release correlation"
0x0052ef10,93,runtime_object_release_owned_entry_list_field_0x7d_and_clear_root,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Sibling release helper over owned list root `[this+0x7d]` in the broader `0x23a` runtime-object family. The function walks the current list through `0x00556ef0/0x00556f00`, releases each live entry through `0x00553a00`, frees those entries through `0x0053b080`, then destroys and frees the root list object itself through `0x005571d0` plus `0x0053b080`, and finally clears `[this+0x7d]` back to null. Current grounded callers are the deeper release body `0x0052ef70` and specialization-side cleanup `0x0045b701`, so this is the safest current read for the owned-list `[this+0x7d]` release path.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list-release correlation"
0x0052ef70,424,runtime_object_release_owned_lists_detach_world_binding_and_free_handles,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader release body over the shared `0x23a` runtime-object family. The helper first clears the live shell-side preview or helper owner through `0x0052d160` when the active presentation owner still references `this`, releases the dependent handle at `[this+0x0c]` through `0x00533bd0`, then re-enters the owned-list cleanup helpers for `[this+0x79]` and `[this+0x7d]`. It also recursively releases the nested object list at `[this+0x75]` by rebasing each entry to vtable `0x005dd1f0`, calling `0x0052ef70` on that child, and then freeing both each child and the root list, while the sibling list at `[this+0x81]` is walked through `0x005540b0` plus the same free-root pattern. After those releases it clears one shell-side owner slot at `[presentation+0x366e]` when it still points at `this`, detaches the world binding through `0x00533c20` when owner `[this+0x04]` and handle `[this+0x08]` are live, and finally frees the optional handles at `[this+0x10]` and `[this+0x1c]` through owner `0x006d4020`. Current grounded callers are the shared cleanup wrapper `0x00455d47` and the recursive child-release path inside this same helper, so this is the safest current read for the common owned-list, binding, and handle teardown body.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + recursive-release correlation + world-binding-teardown correlation"
0x0052f120,192,runtime_object_refresh_cached_4x4_transform_block_when_dirty_bit_0x02,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared dirty-bit refresh helper over the broader `0x23a` runtime-object family. When state byte `[this+0x20]` still has bit `0x02` set, the helper clears that bit, sets bit `0x04`, zeroes the cached 16-dword transform block at `[this+0x14e]`, seeds its scale and anchor lanes from `[this+0x36]` and `[this+0x1e2/+0x1e6/+0x1ea]`, writes default scalar `1.0f` at `[this+0x18a]`, and then rebuilds the remaining matrix-style contents through `0x0056d3cd`. When the sign bit of `[this+0x20]` is clear it first derives one temporary basis from local vector lanes `[this+0x4b/+0x4f/+0x53]` through `0x0056e1a8`; otherwise it uses the stored fallback block at `[this+0x18e]` directly. Current grounded callers include constructors or refresh paths `0x004aa9be`, `0x00524470`, `0x005287ee`, `0x0052893e`, `0x005289d4`, `0x00528b63`, `0x005306b7`, and `0x0055613a`, so this is the safest current read for cached transform-block refresh rather than a generic math helper.","objdump + caller inspection + local disassembly + dirty-bit correlation + transform-block correlation"
0x0052f1e0,391,geometry_query_five_vec3_separating_volume_overlap_predicate,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Pure boolean geometry helper that consumes five 3-float vector blocks and returns `1` only when a sequence of signed-volume or separating-plane style tests all pass. The routine builds local difference vectors from two of the input vec3s, forms intermediate cross-style terms against a third input vec3, rejects when the first signed volume is nonpositive, repeats the same pattern against a fourth input vec3, and then performs a final doubled-threshold comparison before returning. Current grounded callers are `0x0052f737` and `0x00530241`, where it acts as a geometric overlap or side-test predicate rather than as a stateful runtime-object helper. The exact higher-level shape semantics remain open, so this note stays structural.","objdump + caller inspection + local disassembly + geometric-predicate correlation"
0x0052f370,385,runtime_object_quantize_world_position_sample_group_metric_and_select_subrecord,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared quantized-selection helper over the broader `0x23a` runtime-object family. The function rounds the caller-supplied world coordinates, folds them through the quantized lookup table at `0x006d9098`, derives one odd metric seed from the final table index, queries a scaled scalar through owner handle `[this+0x04]` and `0x00533120`, applies one or two global scale adjustments from shell state, updates flag bit `0x02` in byte `[this+0x5c]` against threshold `0x005c8628`, and then chooses the active grouped `0x45`-byte subrecord by scanning the current group at `[this+0x14]` until the stored threshold field exceeds that sampled metric. The helper stores the selected subrecord index in `[this+0x21]` and the corresponding subrecord pointer in `[this+0x18]`. Current grounded caller is `0x00528f5b`, so this is the safest current read for a quantized metric-driven subrecord selector rather than a generic coordinate utility.","objdump + caller inspection + local disassembly + quantized-lookup correlation + grouped-subrecord correlation"
0x0052f500,1134,runtime_object_emit_selected_grouped_subrecords_into_global_packet_ring,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared packet-emission owner over the broader `0x23a` runtime-object family. The helper begins from the currently selected grouped subrecord at `[this+0x18]`, snapshots the active global packet write pointer and remaining count at `0x00cc3b64/0x00cc3b5c`, and rejects early when the selected group has no entries. When state bit `0x01` is active it also consumes caller-supplied world vectors, lazily refreshes the cached transform block when bit `0x04` is still set, transforms those vectors through the cached basis lanes `[this+0x8e..+0xb6]`, and runs the resulting geometry through `geometry_query_five_vec3_separating_volume_overlap_predicate` `0x0052f1e0` to decide whether one alternate emission branch should be used. In either branch it emits one run of `0x20`-byte output packets built from the current global packet source span and the selected grouped `0x45`-byte records, advancing the global packet pointer by `0x4c` per source packet while decrementing the shared remaining count. Current grounded callers are the world-side emission paths `0x005290d8`, `0x0052917f`, `0x0055dc3e`, `0x0055dc78`, `0x0055dcb4`, and `0x0055dd2a`, so this is the safest current read for grouped subrecord emission into the global packet ring rather than a local math helper.","objdump + caller inspection + local disassembly + packet-ring correlation + grouped-subrecord correlation + transform-refresh correlation"
0x0052fb70,480,runtime_object_set_packed_color_lane_and_optionally_propagate_child_brightness,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared packed-color helper over the broader `0x23a` runtime-object family. The function takes one caller-supplied byte and, when the shell-side gate at `[0x006d4024+0x114742]` is live, derives visible packed color `[this+0x43]` from stored high-byte lane `[this+0x47]` plus either dim RGB literal `0x003c3c3c` or full-bright literal `0x00ffffff` depending on whether the byte is below `0xff`. It also pushes the same dim-or-bright RGB triplet into every nested child reachable through list root `[this+0x75]` via `0x0052e680`, and when the recursive flag argument is nonzero it reapplies the same packed-color update to each child by re-entering itself. When the shell gate is absent, the helper instead stores the raw byte into high-byte lane `[this+0x47]` and only recurses that byte state to children. Current grounded callers are the specialization-side refresh and UI branches `0x004871b3`, `0x004a8277`, `0x004ad0a6`, `0x004af6b6`, `0x004b0e36`, and the local recursive calls inside this helper, so this is the safest current read for packed color or brightness propagation rather than a more specific UI event sink.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + child-color-propagation correlation"
0x0052fd60,93,runtime_object_publish_anchor_triplet_to_attached_entry_list_field_0x81,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared anchor-triplet publish helper over attached list root `[this+0x81]` in the broader `0x23a` runtime-object family. When that list exists and its root carries a nonnull payload at `[root+0x0c]`, the helper walks the entries through `0x00556ef0/0x00556f00` and forwards the current anchor triplet `[this+0x1e2/+0x1e6/+0x1ea]` into each live entry through `0x005545d0`. Current grounded callers are the relocation or republish paths `0x004acf51`, `0x0052fdc0`, `0x005307dc`, and `0x00530808`, so this is the safest current read for publishing the current anchor triplet to attached entries rather than a broader list-service helper.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + attached-entry-publish correlation"
0x0052fdc0,496,runtime_object_translate_anchor_triplet_rebind_world_cell_handle_and_refresh_attached_entries,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared relocation helper over the broader `0x23a` runtime-object family. The function first marks state byte `[this+0x20]` dirty with bit `0x02`, then adds the caller-supplied triplet delta to current anchor `[this+0x1e2/+0x1e6/+0x1ea]`. When owner `[this+0x04]` is live, it quantizes the old and new X/Z anchor lanes through `0x005a10d0` and the same world-scale constant used by `0x00530720`, checks the resulting cell indices against world-grid bounds from `0x00533970/0x00533980`, and if the quantized cell changed rebinds world handle `[this+0x08]` by detaching the old slot through `0x00533c20` and attaching the new slot through `0x00533bf0`. On success it republishes the current anchor triplet through `0x0052fd60`; on out-of-bounds failure it restores the prior anchor and returns `0`. Current grounded callers are the movement or placement-side branches `0x0045647b`, `0x00457d48`, `0x00458ec1`, and `0x00459945`, so this is the safest current read for anchor-triplet translation plus optional world-cell rebinding rather than a generic vector-add helper.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + world-binding-rebind correlation"
0x0052ffb0,115,runtime_object_scale_current_axis_angle_rotation_and_rebuild_orientation_block,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared rotation-scale helper over the broader `0x23a` runtime-object family. The function converts current local 4-dword orientation block `[this+0x1ce..+0x1da]` into one temporary axis-angle style representation through `0x0056e556`, scales the recovered angle by the caller-supplied float, rescales the axis lanes by constant `0x005c9b08`, and then rebuilds the stored orientation block by re-entering `0x0052e9f0`. Current grounded callers are the same specialization-side geometry and animation branches `0x00458b86`, `0x00458da5`, `0x00458e7f`, and `0x0045967c`, so this is the safest current read for scaling the current axis-angle rotation and rebuilding the cached orientation block rather than a generic scalar setter.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + axis-angle correlation"
0x00524780,1252,shell_emit_ranked_overlay_cell_items,bootstrap,thiscall,inferred,ghidra-headless,3,Processes one ranked-overlay cell list for 0x0052a2f0. It samples shell range thresholds through 0x00533180 and 0x00533160 filters cell items by distance and intensity derives an alpha-biased packed color from the caller input and emits accepted items into the current vertex24 span through layout helper 0x005468c0.,ghidra + rizin + llvm-objdump
0x00530030,591,runtime_object_query_selected_grouped_packet_overlap_against_input_segment,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared overlap-style query over the broader `0x23a` runtime-object family. The helper starts from the currently selected grouped `0x45`-byte subrecord and snapshots the same global packet source span used by `0x0052f500`, lazily refreshes the cached basis block at `[this+0x8e..+0xce]` when bit `0x04` is still set, transforms one caller-supplied input triplet through that basis, and then walks the remaining packet span at `0x00cc3b64/0x00cc3b5c`. For each candidate packet it assembles three packet-side vec3 triplets plus the transformed caller triplet and re-enters `geometry_query_five_vec3_separating_volume_overlap_predicate` `0x0052f1e0`, returning `1` on the first passing packet and `0` when the whole span fails. Current grounded caller is the world-side branch `0x005291ea`, so this is the safest current read for a selected-grouped-packet overlap query against one caller-provided segment or vector pair rather than a broad renderer.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + packet-overlap-query correlation"
0x005305c0,118,runtime_object_set_bit0_in_owned_entry_field_0xb0_across_list_0x79,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small list-bit propagation helper over owned entry list `[this+0x79]` in the broader `0x23a` runtime-object family. The function walks the list through `0x00556ef0/0x00556f00` and either sets or clears bit `0` in each live entry's dword `[entry+0xb0]` according to the caller's boolean. Current grounded callers are the specialization-side rebuild branches `0x0045cce7`, `0x0045cf90`, and one later sibling call at `0x00530857`, so this is the safest current read for propagating one mode bit across the owned-entry list rather than a generic iterator.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-entry-flag propagation correlation"
0x00530640,35,runtime_object_construct_vtable_5dd1f0_and_seed_owner_handle_anchor,map,thiscall,inferred,objdump + caller inspection + local disassembly + rdata scan,2,"Tiny constructor wrapper for the sibling runtime-object table `0x005dd1f0`. The function installs vtable `0x005dd1f0`, forwards the caller's three setup arguments into `0x0052edf0`, and returns `this`. Current grounded callers are repeated descriptor or child-allocation branches including `0x0041ded0`, `0x0042ab05`, `0x00455148`, `0x00456e49`, `0x0045b95d`, `0x00474e61`, and `0x0055e71a`, so this is the safest current read for the shared seeded constructor wrapper rather than a subtype-specific allocator.","objdump + caller inspection + local disassembly + rdata scan + sibling-vtable correlation"
0x00530670,11,runtime_object_init_vtable_5dd1f0_and_reset_local_state,map,thiscall,inferred,objdump + caller inspection + local disassembly + rdata scan,1,"Tiny init wrapper for the sibling runtime-object table `0x005dd1f0`. The helper installs vtable `0x005dd1f0`, re-enters `0x0052ecd0`, and returns `this`. Current grounded callers are the local constructors `0x00455b24`, `0x00456104`, and `0x0048576c`, so the safest read is a minimal vtable-install plus shared-reset helper.","objdump + caller inspection + local disassembly + rdata scan + sibling-vtable correlation"
0x00530680,11,runtime_object_rebind_vtable_5dd1f0_and_tail_release_shared_lists,map,thiscall,inferred,objdump + caller inspection + local disassembly + rdata scan,1,"Tiny release-side wrapper for the sibling runtime-object table `0x005dd1f0`. The helper installs vtable `0x005dd1f0` and immediately tail-jumps into shared release body `0x0052ef70`. Current grounded callers are repeated cleanup paths including `0x0041df19`, `0x0045738b`, `0x0045c3fe`, `0x0045d729`, `0x004874f0`, and `0x0055e098`, so this is the safest current read for the sibling-table release thunk rather than a standalone destructor body.","objdump + caller inspection + local disassembly + rdata scan + sibling-vtable correlation"
0x00530690,133,runtime_object_copy_cached_blocks_from_source_object_and_recurse_children,map,thiscall,inferred,objdump + caller inspection + local disassembly + rdata scan,2,"Shared copy or refresh helper for the sibling runtime-object table `0x005dd1f0`. The function queries one 16-dword block from the caller-supplied source object through vtable slot `+0x44` and copies it into `[this+0x10e]`, triggers source slot `+0x10`, rebuilds local cached transform block `[this+0x14e]` through `0x0052f120` and source slot `+0x20`, copies the second 16-dword block from source slot `+0x44` into `[this+0xce]`, and then recursively applies the same copy to every child in list `[this+0x75]` before finally calling source slot `+0x0c`. Current grounded callers are the world-side branch `0x00528f18` and the local recursive descent inside this helper, so this is the safest current read for copying cached blocks from one source object into this object tree rather than a generic serializer.","objdump + caller inspection + local disassembly + rdata scan + sibling-vtable correlation + recursive-copy correlation"
0x00530720,242,runtime_object_publish_anchor_triplet_and_optionally_rebind_world_cell_handle,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared anchor-triplet publish helper over the broader `0x23a` runtime-object family. The function marks state byte `[this+0x20]` dirty with bit `0x02`, stores one caller-supplied absolute triplet into `[this+0x1e2/+0x1e6/+0x1ea]`, and when owner `[this+0x04]` is live quantizes the old and new X/Z anchor lanes through `0x005a10d0`, checks whether the world-cell binding changed, optionally detaches old handle `[this+0x08]` through `0x00533c20`, attaches the new slot through `0x00533bf0`, and then republishes the current anchor triplet through `0x0052fd60`. When owner `[this+0x04]` is null or the quantized cell does not change, it still writes the absolute triplet and republishes attached entries. Current grounded callers include `0x0040b4c7`, `0x004558ff`, `0x004871b3`, `0x0048dd50`, and the stream-load companion `0x00455870`, so this is the safest current read for publishing an absolute anchor triplet with optional world-cell rebinding rather than a generic vec3 setter.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + anchor-triplet correlation + world-binding correlation"
0x00530820,425,runtime_object_format_status_label_from_group_selection_and_shell_mode,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared fallback formatter beneath `0x00455860` over the broader `0x23a` runtime-object family. The helper only runs when shell gate `[0x006d4024+0x1146be]` is live, state bit `0x10` is clear, vtable slot `+0x14` returns zero, and the owned-entry bit propagator `0x005305c0` reports a live path. It then formats one caller-owned text buffer through `0x0051d8a0` using one of three structural branches: when grouped table `[this+0x14]` is null it emits a fixed fallback block via `0x5193f0/0x518de0`; when shell mode `[0x006d4024+0x1146be] == 1` it emits either literal `X` or the current grouped index `[this+0x21]`; otherwise it combines the current grouped float lane `[subrecord+0x10]`, the grouped index `[this+0x21]`, and one shell-mode-dependent wrapper block built through repeated `0x0051b700` calls before copying the final text. Current grounded callers are the shared thunk `0x00455860`, the placed-structure UI query wrapper `0x0040e9d0`, and the city-site status formatter `0x004207d0`, so this is the safest current read for a shared group-selection status-label formatter rather than a subtype-specific UI routine.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + fallback-formatter correlation"
0x005309d0,35,global_indexed_slot_table_initialize_once_0xccb880,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"One-shot initializer for the indexed global slot table rooted at `0x00ccb880`. When guard dword `0x00ccb9ec` is still zero, the helper clears `0x5a` dwords starting at `0x00ccb880`, then sets the guard to `1`; otherwise it returns immediately. Current grounded callers are the setup and shell branches `0x004820d3` and `0x00521084`, so this is the safest current read for lazy table initialization rather than a broader mode reset.","objdump + caller inspection + local disassembly + global-slot-table correlation"
0x00530a00,364,global_indexed_slot_table_service_or_release_one_slot_state,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Indexed service or release helper over the global slot table rooted at `0x00ccb880`. The function switches on slot state dword `[slot+0x00]`, using the per-slot handle, buffer, capacity, and length lanes at `[+0x08/+0x18/+0x14/+0x1c/+0x20/+0x24]`. The observed branches cover: releasing the primary handle when the state is `0/1`; a state-`2` growth path that reallocates and copies the payload buffer when `[slot+0x0c] < [slot+0x14]`; state `4` forwarding one handle plus a size pair through `0x005a4c57/0x005a464d`; state `5/6` releasing one or two payload buffers through `0x0053afd0` and `0x005a440d`; and a final cleanup step that clears active flag `[slot+0x01]` and drops the auxiliary buffer when needed. Current grounded callers include the live-world serializer paths `0x004424ee`, `0x00443cab`, `0x00445916`, the shell-side branches `0x0048496f`, `0x00489920`, `0x004e180a`, and the late global cleanup loop `0x00530bb1`, so this is the safest current read for servicing or releasing one indexed slot-table state rather than a file-family-specific bundle helper.","objdump + caller inspection + local disassembly + global-slot-table correlation + state-machine correlation"
0x00530b70,20,global_indexed_slot_table_query_slot_primary_handle_metric,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Tiny indexed query over the global slot table rooted at `0x00ccb880`. The helper resolves per-slot primary handle `[slot+0x08]` and forwards it into `0x005c7820`, returning the resulting metric unchanged. Current grounded callers are the serializer-side branch `0x00442676`, where the returned value is treated as a byte-count or size-like metric, so this is the safest current read for a primary-handle metric query rather than a direct pointer accessor.","objdump + caller inspection + local disassembly + global-slot-table correlation"
0x00530b90,11,global_indexed_slot_table_query_slot_primary_handle,map,cdecl,inferred,objdump + local disassembly,1,"Tiny pointer query over the global slot table rooted at `0x00ccb880`. The helper returns per-slot dword `[slot+0x08]` unchanged. Current evidence only grounds it as a direct primary-handle accessor.","objdump + local disassembly + global-slot-table correlation"
0x00530ba0,98,global_indexed_slot_table_release_slot_buffers_and_service_if_active,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Release-side companion over the global slot table rooted at `0x00ccb880`. When active flag `[slot+0x00]` is nonzero it first re-enters `0x00530a00`; when slot-owned payload flag `[slot+0x01]` is nonzero it frees the auxiliary payload and staging buffers at `[slot+0x18]` and `[slot+0x14]` through `0x005a1145`, then clears those pointers and the flag. Current grounded caller is the late cleanup path `0x00530bb1`, so this is the safest current read for releasing one slot's owned buffers and forcing a final service step when needed.","objdump + caller inspection + local disassembly + global-slot-table correlation + cleanup correlation"
0x00530c10,11,global_indexed_slot_table_query_slot_payload_length,map,cdecl,inferred,objdump + local disassembly,1,"Tiny indexed accessor over the global slot table rooted at `0x00ccb880`. The helper returns per-slot dword `[slot+0x14]` unchanged. Current evidence only grounds it as a payload-length or used-size accessor.","objdump + local disassembly + global-slot-table correlation"
0x00530c80,943,global_indexed_slot_table_open_or_reuse_named_stream_slot,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Primary open-or-reuse entry over the indexed slot table rooted at `0x00ccb880`. The helper first lazily initializes the table when needed, then for requested slot types `2` and `3` scans active entries whose type dword `[slot+0x0c]` is also `2/3`, comparing the caller-supplied name against stored pointer `[slot+0x20]` through `0x005a57cf`; type `2` also forces `0x00530ba0` cleanup before reusing the slot. Otherwise it locates a free slot, marks `[slot+0x00]` and `[slot+0x04]` active, stores the requested type into `[slot+0x0c]`, allocates and copies the caller name into `[slot+0x20]`, clears the size and cursor lanes, and then stages the backing resource according to type. Type `0` opens one direct handle through `0x005a4c57` with `(0x8301,0x80)`. Types `5` and `6` open through the same path with `(0x8000,0x100)` and then either stage the whole payload into owned buffer `[slot+0x1c]` or cap the staging window at `0x30d40`, sometimes collapsing type `6` back into type `5` when the payload is small. The recursive type-`3` branch allocates one scratch slot of length `0x30d40` plus one caller-sized owned buffer. Current callers span setup, shell, world, and serializer-loader paths including `0x00433260`, `0x00442463`, `0x00443a50`, `0x00444e83`, `0x00484939`, `0x0051c230`, and `0x0051eebe`, so this is the safest current read for opening or reusing one named bundle or stream slot rather than a file-family-specific loader.","objdump + caller inspection + local disassembly + global-slot-table correlation + bundle-slot correlation"
0x00531030,271,global_indexed_slot_table_write_bytes_into_slot,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Write-side byte pump over one indexed slot in the global table rooted at `0x00ccb880`. When slot type `[slot+0x0c]` is `0`, the helper forwards the caller buffer and requested length directly to handle `[slot+0x08]` through `0x005a464d`. When the type is `2` or `4`, it appends into owned buffer `[slot+0x1c]` at cursor `[slot+0x18]`, grows capacity `[slot+0x10]` in bounded chunks up to `0x186a0` through `0x005a125d/0x005a1145`, copies the caller bytes in place, advances the cursor, and raises used size `[slot+0x14]` when needed. Current callers are spread across the save and bundle serializer paths, including `0x004416af`, `0x0042ba7b`, `0x004462fa`, `0x004e1803`, `0x00517da4`, and the local tagged-header wrapper `0x00531340`, so this is the safest current read for the shared slot-table write primitive rather than a narrower world-only serializer.","objdump + caller inspection + local disassembly + global-slot-table correlation + shared-serializer correlation"
0x00531150,559,global_indexed_slot_table_read_bytes_from_slot,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Read-side byte pump over one indexed slot in the global table rooted at `0x00ccb880`. When slot type `[slot+0x0c]` is `1`, the helper reads directly from handle `[slot+0x08]` through `0x005a48c5`. When the type is `6`, it serves the caller from a rolling `0x30d40` staging buffer rooted at `[slot+0x1c]`, refilling that buffer from the same handle through `0x005a48c5` whenever cursor `[slot+0x18]` reaches the staged byte count and advancing the cursor after each copy. All remaining in-memory slot types read from owned buffer `[slot+0x1c]`, bounded by available count `[slot+0x14] - [slot+0x18]`, and then advance the cursor. Current callers are pervasive across setup, world, save, and runtime-object load paths, including `0x00412134`, `0x00413fa4`, `0x00443c39`, `0x00446ddb`, `0x00455888`, `0x00481a53`, `0x005186a6`, and the tagged-header and varlen readers `0x00531360/0x00531380`, so this is the safest current read for the shared slot-table read primitive rather than a file-family-specific chunk decoder.","objdump + caller inspection + local disassembly + global-slot-table correlation + shared-loader correlation"
0x00531340,20,global_indexed_slot_table_write_one_tagged_u32_header,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny write-side tagged-header wrapper over the same global slot table. The helper forwards the caller-supplied header dword in `EDX` into `0x00531030` with fixed length `4` and no auxiliary counter bump, using the current slot index in `ECX`. Current grounded callers are the many serializer-side tag brackets in world, scenario, and runtime-object save paths, including `0x0040b6b0`, `0x00413f3f`, `0x00441f40`, `0x00444f8a`, `0x004459df`, `0x0045b576`, and `0x005537f2`, so this is the safest current read for writing one tagged four-byte block header rather than a broader open-or-close primitive.","objdump + caller inspection + local disassembly + tagged-block correlation"
0x00531360,32,global_indexed_slot_table_read_one_tagged_u32_header_and_optionally_bump_counter,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny read-side tagged-header wrapper over the same global slot table. When the caller-supplied stack flag is nonzero it increments global dword `0x00ccb9e8`, then reads one four-byte header from the current slot through `0x00531150` into the caller-supplied `u32` destination. Current grounded callers are the many loader-side tag brackets in world, scenario, setup, and runtime-object paths, including `0x0040b5ee`, `0x00413f3f`, `0x0041e8f4`, `0x0042dbf9`, `0x00443c56`, `0x0045600c`, `0x0046fd87`, and `0x00553258`, so this is the safest current read for reading one tagged four-byte block header with an optional global counter bump rather than a broader chunk-open helper.","objdump + caller inspection + local disassembly + tagged-block correlation"
0x00531380,144,global_indexed_slot_table_read_varlen_heap_string,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared variable-length string reader built on top of `0x00531150`. The helper first frees the caller-owned destination pointer when nonnull, then reads a one-byte prefix. Prefix `0` leaves the destination null. Prefixes `1..0x7f` are treated as the byte length directly. Prefixes with bit `0x80` set read one extra byte and combine the low seven high bits with that second byte into a `u15` length. The helper then allocates that many bytes through `0x005a125d`, stores the new heap pointer to the caller slot, and reads the payload bytes through `0x00531150`. Current grounded callers include `runtime_object_load_tagged_string_triplet_and_reseed_scalar_bands` `0x00455fc0`, `placed_structure_specialization_load_payload_and_rebuild_transients` `0x0045c150`, and the later payload loader at `0x0045e594`, so this is the safest current read for the shared variable-length heap-string import helper rather than a narrower subtype loader.","objdump + caller inspection + local disassembly + varlen-string correlation"
0x00531410,128,global_indexed_slot_table_write_varlen_heap_string,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared variable-length string writer built on top of `0x00531030`. Null pointers emit a single zero byte. Nonnull pointers are measured as a NUL-terminated byte string plus terminator; lengths up to `0x7f` emit one prefix byte, while longer lengths emit two prefix bytes with the high seven bits flagged by `0x80`. The helper then writes the string payload bytes through `0x00531030`. Current grounded callers include `runtime_object_serialize_tagged_string_triplet_and_dispatch_slot_0x4c` `0x004559d0`, `placed_structure_specialization_serialize_payload_via_0x45b560` `0x0045b560`, and the city-entry-family serializer `0x0045c6f0`, so this is the safest current read for the shared variable-length heap-string save helper rather than a generic raw buffer writer.","objdump + caller inspection + local disassembly + varlen-string correlation"
0x00531490,27,global_indexed_slot_table_write_nul_terminated_string_without_length_prefix,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny raw string writer over the same slot-table byte pump. The helper computes the caller-supplied NUL-terminated string length plus terminator from `EDX` and forwards those bytes directly into `0x00531030` without any explicit prefix layer. Current grounded callers are the neighboring shell-side branches `0x00489396` and `0x004894ec`, so the safest current read is a direct NUL-terminated string write helper rather than a broader tagged serializer.","objdump + caller inspection + local disassembly + raw-string-write correlation"
0x005314b0,79,global_callback_0x5c8454_query_first_nonzero_result_up_to_index,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Small callback-driven selector over global dword `0x00ccba08`. The helper clears that global, then iterates indices `0..arg0`, repeatedly calling function pointer `0x005c8454` with one stack-local index slot plus the address of `0x00ccba08`, and stops when the callback returns zero; otherwise it increments the index and continues. On success it returns the value written to `0x00ccba08`, else `0`. Current grounded callers include `0x004fdb9b`, `0x0053166b`, `0x005321b4`, and `0x00532248`. The owning resource behind `0x005c8454` remains intentionally structural at the current evidence level.","objdump + caller inspection + local disassembly + callback-selector correlation"
0x00531500,25,global_query_mode1_owner_and_audio_override_gate_0xccb9f4_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny global gate for the neighboring audio owner family. The helper returns `1` only when dword `[this+0x04]` equals `1` and global override gate `0x00ccb9f4` is nonzero; otherwise it returns `0`. Local shutdown or rebuild owner `0x00531a10` raises that gate before fading or tearing the family down and clears it again on exit, while the adjacent wrappers `0x00531520..0x00531840` mostly require the inverse gate. Current grounded callers include the neighboring UI or status-object branches `0x0046fd87`, `0x004b8f71`, `0x004c8243`, the setup-side branch `0x004e1a05`, and the runtime-object helper `0x00557e5c`, so this is now safest as the mode-`1` plus override-active query rather than an owner-unknown structural test.","objdump + caller inspection + local disassembly + global-gate correlation + shutdown-override correlation"
0x00531520,59,global_mode1_gate_query_primary_handle_status_code_4_or_8_then_clear_unregister_and_notify,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small mode-gated forwarding helper over global owner `0x00ccba00`. The helper only runs when `[this+0x04] == 1` and global `0x00ccb9f4` is still null. Under that gate it first queries `0x00557c90` on `0x00ccba00` for owner-handle status code `4`; when that does not return `1` it queries `0x00557cb0` for status code `8`; and when either query succeeds it tail-dispatches the same owner through `0x00557cd0` to clear the handle, unregister it from global ten-slot table `0x00d973b8`, and optionally notify callback `0x00d973e0`. Current grounded caller is the neighboring branch `0x004b8ea8`.","objdump + caller inspection + local disassembly + owner-handle correlation + global-slot correlation"
0x00531560,79,global_mode1_gate_dispatch_arg_selected_0x557d90_or_0x56a8e0_0x569ae0,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Mode-gated argument-selected forwarding helper spanning globals `0x00ccba00`, `0x00ccb9f8`, and `0x00ccb9fc`. The same gate applies: it only runs when `[this+0x04] == 1` and `0x00ccb9f4` is null. When selector arg1 is `0`, it forwards arg0 into owner `0x00ccba00` through `0x00557d90`. When selector arg1 is `2`, it forwards arg0 into `0x0056a8e0(0x00ccb9f8)` and then into `0x00569ae0(0x00ccb9fc)`. Current grounded callers span several shell and world-adjacent branches including `0x0043643b`, `0x00464b3b`, `0x004833c4`, `0x004feea4`, `0x00517a04`, and `0x005212ae`, so the safest current read is a small selector wrapper over three global owners rather than a named feature toggle.","objdump + caller inspection + local disassembly + mode-gated-forwarder correlation"
0x005315c0,91,affine_transform_three_float_outputs_by_matrix_3x4,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared affine transform helper over a 3x4 float matrix rooted at `ECX`. The helper reads three caller-supplied float slots from the output pointers at stack args `+0x04/+0x08/+0x0c`, multiplies them against matrix coefficients `[this+0x08..+0x30]`, adds translation lanes `[this+0x38/+0x3c/+0x40]`, and writes the transformed X, Y, and Z values back in place. Current grounded callers include `0x00569628`, `0x0056a1e2`, and `0x0056a5e5`, so this is the safest current read for the shared 3x4 affine point-transform helper rather than another mode gate.","objdump + caller inspection + local disassembly + affine-transform correlation"
0x00531620,32,shell_audio_service_query_selected_miles_3d_provider_name_or_fallback_pointer_when_mode1,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small mode-gated query wrapper over the Miles 3D owner `0x00ccb9fc`. When `[this+0x04] == 1` and global override gate `0x00ccb9f4` is clear, the helper dispatches service object `0x00ccb9fc` through `0x00569720` to return the current provider-name pointer; otherwise it returns literal pointer `0x00ccba0c`. Current grounded caller is `0x004638f1`, so this is now safest as the selected-provider-name query with one fixed fallback pointer rather than an unnamed generic query.","objdump + caller inspection + local disassembly + mode-gated-query correlation + Miles-3D correlation + provider-name correlation"
0x00531640,129,shell_audio_service_query_selected_miles_3d_provider_index_by_name,shell,thiscall,inferred,objdump + caller inspection + local disassembly + settings-window caller correlation,3,"Queries the currently selected Miles 3D provider index from the shell audio service. When service mode dword `[this+0x04]` is `1` and override gate `0x00ccb9f4` is clear, the helper pulls the current provider-name stem through `0x00569720` on service object `0x00ccb9fc`, enumerates candidate names through `0x005314b0(index,1)`, and returns the first matching callback index. Otherwise it falls back to `0`. Current grounded callers include the `Sound` page refresh and callback paths, which use it to mirror the live provider selector into controls such as `0x7551`.","objdump + caller inspection + local disassembly + settings-window caller correlation + Miles-3D correlation + provider-name-match correlation"
0x005316d0,48,shell_audio_service_query_miles_3d_provider_preferred_flag_by_callback_index,shell,thiscall,inferred,objdump + caller inspection + local disassembly + settings-window caller correlation,3,"Returns the preferred or availability flag for the requested Miles 3D provider callback index. When service mode dword `[this+0x04]` is `1` and override gate `0x00ccb9f4` is clear, the helper resolves the provider-name pointer through `0x005314b0(index,1)`, writes that pointer back into the stack-local argument slot, and forwards it into `0x00569730` on service object `0x00ccb9fc`; otherwise it returns `0`. Current grounded callers are the `Sound` page refresh and callback paths, which republish the returned flag through control `0x7550`.","objdump + caller inspection + local disassembly + settings-window caller correlation + Miles-3D correlation + provider-flag correlation"
0x00531710,26,shell_audio_service_forward_set_miles_3d_listener_position_xyz_when_mode1,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny mode-gated Miles 3D listener-position wrapper. When `[this+0x04] == 1` and `0x00ccb9f4` is null, the helper dispatches service object `0x00ccb9fc` through `0x00569660`; otherwise it returns immediately. Current grounded callers are `0x0040b8e1` and `0x00464c21`.","objdump + caller inspection + local disassembly + Miles-3D correlation + listener-position correlation"
0x00531730,26,shell_audio_service_forward_set_miles_3d_listener_orientation_basis_when_mode1,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny mode-gated Miles 3D listener-orientation wrapper. When `[this+0x04] == 1` and `0x00ccb9f4` is null, the helper dispatches service object `0x00ccb9fc` through `0x005696b0`; otherwise it returns immediately. Current grounded callers are `0x0040b8d0` and `0x0043ac4b`.","objdump + caller inspection + local disassembly + Miles-3D correlation + listener-orientation correlation"
0x00531750,26,shell_audio_service_forward_set_active_miles_3d_speaker_type_when_mode1,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny mode-gated Miles 3D speaker-type setter wrapper. When `[this+0x04] == 1` and `0x00ccb9f4` is null, the helper dispatches service object `0x00ccb9fc` through `0x00569540`; otherwise it returns immediately. Current grounded callers are `0x00464c21`, `0x0048434c`, `0x004fd1a5`, and `0x0055edee`.","objdump + caller inspection + local disassembly + Miles-3D correlation + speaker-type correlation"
0x00531770,32,shell_audio_service_query_active_miles_3d_speaker_type_when_mode1,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny mode-gated Miles 3D speaker-type getter wrapper. When `[this+0x04] == 1` and `0x00ccb9f4` is null, the helper dispatches service object `0x00ccb9fc` through `0x005695d0` and returns that result; otherwise it returns `0`. Current grounded callers are `0x0046388e` and `0x004fdcb5`.","objdump + caller inspection + local disassembly + Miles-3D correlation + speaker-type correlation"
0x00531790,27,shell_audio_service_forward_update_non3d_sample_volume_levels_by_key_when_mode1,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny mode-gated non-3D sample-volume wrapper over service object `0x00ccb9f8`. When `[this+0x04] == 1` and `0x00ccb9f4` is null, the helper forwards directly into `0x0056acd0` to scale and apply the requested sample-record volume by key; otherwise it returns immediately. Current grounded callers include `0x0043a342` and `0x0055412c`.","objdump + caller inspection + local disassembly + Miles correlation + volume-refresh correlation"
0x005317b0,63,shell_audio_service_release_sample_record_by_key_on_non3d_or_miles3d_owner_when_mode1,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Mode-gated sample-record release selector spanning globals `0x00ccb9f8` and `0x00ccb9fc`. When `[this+0x04] == 1` and `0x00ccb9f4` is null, selector arg1 `0` forwards arg0 into non-3D owner `0x00ccb9f8` through `0x0056ac50`, while selector arg1 `1` zeroes the optional direct-record argument and dispatches Miles 3D owner `0x00ccb9fc` through `0x00569c40` to release by key. Current grounded callers include `0x0040b7fc`, `0x0040c889`, `0x0043a50c`, `0x0045e3c2`, `0x004b87fc`, and `0x00554767`.","objdump + caller inspection + local disassembly + Miles correlation + sample-record correlation"
0x00531800,52,shell_audio_service_mark_non3d_sample_record_pending_flag_0x100_by_key_when_unlocked,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Null-override-gated wrapper over non-3D audio owner `0x00ccb9f8`. When global gate `0x00ccb9f4` is clear, the helper increments reentrancy counter `0x00ccb9f0`, forwards arg0 into `0x0056ae80(0x00ccb9f8,arg0)` to mark pending flag bit `0x100` on the keyed live sample record, then decrements the same counter before returning. Current direct caller is `0x00531f69`.","objdump + caller inspection + local disassembly + Miles correlation + record-flag correlation + reentrancy-counter correlation"
0x00531840,52,shell_audio_service_mark_miles_3d_sample_record_pending_flag_0x100_by_key_when_unlocked,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Null-override-gated wrapper over Miles 3D audio owner `0x00ccb9fc`. When global gate `0x00ccb9f4` is clear, the helper increments reentrancy counter `0x00ccb9f0`, forwards arg0 into `0x00569cf0(0x00ccb9fc,arg0)` to mark pending flag bit `0x100` on the keyed live sample record, then decrements the same counter before returning. This is the direct Miles 3D sibling of `0x00531800`.","objdump + caller inspection + local disassembly + Miles-3D correlation + record-flag correlation + reentrancy-counter correlation"
0x00531880,46,global_release_optional_handle_field_0x4c_when_0x624d58_is_1,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small release helper over one optional handle field at `[this+0x4c]`. When that field is not `-1` and global dword `0x00624d58` equals `1`, the helper first dispatches the handle through function pointer `0x005c83b8`, then through `0x005c8450`, and finally resets `[this+0x4c]` to `-1`. Current grounded callers are the local owner-family constructors or service branches `0x00531f69` and `0x00532294`, so the safest current read is an optional-handle release helper rather than a broader object teardown.","objdump + caller inspection + local disassembly + optional-handle correlation"
0x005318b0,10,spin_wait_until_global_reentrancy_counter_0xccb9f0_reaches_zero,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Tiny busy-wait helper over global reentrancy counter `0x00ccb9f0`. The function loops until that dword reaches zero, then returns. Current grounded callers are the neighboring owner-family methods in the `0x569a..0x56ae..` strip, so this is the safest current read for a spin-wait on the shared counter rather than a named scheduler primitive.","objdump + caller inspection + local disassembly + reentrancy-counter correlation"
0x005318c0,35,global_dispatch_0x56a970_or_0x569f30_based_on_0xccba04,map,cdecl,inferred,objdump + local disassembly,1,"Tiny global dispatch selector. When global dword `0x00ccba04` is zero, it dispatches owner `0x00ccb9f8` through `0x0056a970`; otherwise it dispatches owner `0x00ccb9fc` through `0x00569f30`. The current evidence grounds it only as a small owner-family selector between the two globals.","objdump + local disassembly + global-owner-selector correlation"
0x005318f0,280,global_owner_family_construct_0xccb9f8_0xccb9fc_and_0xccba00_then_arm_mode1_flag,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Primary constructor or bootstrap path for the neighboring global-owner family. The helper first registers fixed literal `0x005dd240` through the `0x005c847c/0x0056c840/0x005c83b4` strip, allocates `0x30` bytes and constructs owner `0x00ccb9f8` through `0x0056aee0`, then allocates `0x64` bytes and constructs owner `0x00ccb9fc` through `0x0056a6e0`, forwarding the caller-supplied arg0 into `0x005698a0`. It then allocates one `0x108`-byte object into global `0x00ccba00`, zeroes its leading dword, seeds `[obj+0x104] = 1.0f`, and when all three globals are live it sets mode flag `[this+0x04] = 1`. Failure paths release partially constructed owners through `0x0056a740/0x0056af20` and free the backing allocations through `0x0053b080`. Current grounded callers are the neighboring owner-family wrappers `0x00531c3d` and `0x005321be`, so the safest current read is a shared global-owner constructor plus mode-flag arming path rather than a file-specific loader.","objdump + caller inspection + local disassembly + global-owner-family correlation"
0x00531a10,496,global_owner_family_shutdown_with_optional_scalar_fade_and_full_teardown,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Primary shutdown or teardown owner for the same global-owner family. The helper first raises global override gate `0x00ccb9f4`, then, when mode flag `[this+0x04]` is live and caller arg0 is zero, runs a short fade loop over scalar lanes `[0x00ccba00+0x104]` and `[0x00ccb9fc+0x58]` by repeatedly re-entering `0x00557d90(0x00ccba00,...)`, `0x00569ae0(0x00ccb9fc,...)`, and `0x00569ca0(0x00ccb9fc)` with one `0x10`-tick sleep through function pointer `0x005c81f0`. It then spin-waits on `0x005318b0`, dispatches the three global owners through `0x00557cd0`, `0x0056a880`, `0x00569a80`, `0x00569d90`, and `0x0056aeb0`, releases optional handle `[this+0x4c]` through `0x00531880`, tears the globals down through `0x0053b080`, clears mode flag `[this+0x04]`, and finally drops override gate `0x00ccb9f4` back to `0`. Current grounded callers are the local rebuild and destructor side at `0x00531c26`, `0x00532213`, and `0x0053224b`, so this is the safest current read for the full owner-family shutdown with optional scalar fade rather than a one-shot stop helper.","objdump + caller inspection + local disassembly + global-owner-family correlation + fade-loop correlation"
0x00531c00,304,global_owner_family_rebuild_from_string_and_seed_default_scalars,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared rebuild owner for the same global-owner family. The helper first force-shuts the current family through `0x00531a10(this,1)`, copies the caller string into a local stack buffer, reconstructs the three global owners through `0x005318f0`, and when mode flag `[this+0x04]` is live seeds the default active state through `0x005696b0(0x00ccb9fc,...)`, `0x00569660(0x00ccb9fc,...)`, `0x00557d90(0x00ccba00, shell_scalar*0x005c9c80)`, `0x0056a8e0(0x00ccb9f8, shell_scalar)`, and `0x00569ae0(0x00ccb9fc, shell_scalar)`. Current grounded callers are controller-side rebuild helpers `0x0053224b`, `0x0053225b`, and the settings-window branch `0x004ffc80`, so this is the safest current read for the shared rebuild-from-string plus default-scalar seed path rather than another small wrapper.","objdump + caller inspection + local disassembly + global-owner-family correlation + rebuild correlation"
0x00531d30,144,global_owner_family_refresh_primary_scalar_and_dispatch_0x557e50,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Active-mode service wrapper over the same owner family. When mode flag `[this+0x04]` is live and override gate `0x00ccb9f4` is clear, the helper refreshes the primary scalar on owner `0x00ccba00` from one shell-side scalar, optionally toggles the neighboring `0x00557c90/0x00557cb0/0x00557cd0` branch when `[0x00ccba00+0x104]` stays positive, and then dispatches `0x00557e50(0x00ccba00,arg0,[0x00ccb9f8+0x2c])`. Current grounded caller is the local callback service strip under `0x00531fd0`, so the safest current read is a primary-scalar refresh plus dispatch wrapper rather than a named backend command.","objdump + caller inspection + local disassembly + scalar-refresh correlation"
0x00531dc0,80,global_owner_family_query_primary_scalars_idle_or_nonpositive,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small active-mode predicate over the same owner family. When mode flag `[this+0x04]` is live and override gate `0x00ccb9f4` is clear, the helper checks readiness-style scalar lanes `[0x00ccb9f8+0x20]` and `[0x00ccb9fc+0x58]` against the local zeroish threshold at `0x005c8598` and returns `1` only on the idle or nonpositive side of that split; otherwise it returns `0`. Current grounded caller is the local settings or service strip at `0x004ffcf0`, so the safest current read is a shared dual-scalar idle predicate rather than a named backend-health query.","objdump + caller inspection + local disassembly + scalar-idle correlation"
0x00531e50,64,shell_audio_service_dispatch_named_string_event_if_ready,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"String-driven sibling of `shell_audio_service_apply_indexed_feedback_event_if_ready` `0x00531e10`. The helper only dispatches when service mode dword `[this+0x04]` equals `1`, override gate `0x00ccb9f4` is clear, the secondary readiness scalar at `[0x00ccb9fc+0x58]` passes the local positive check, and the caller string is nonempty; on the ready path it tail-jumps into `0x0056a520`. Current grounded caller is `placed_structure_specialization_service_timed_anim_light_and_random_sound_variants` `0x0045baf0`, which uses this as the final named-event sink for the `rnd_%1_%2.wav` and anim or light family.","objdump + caller correlation + local disassembly + readiness-gate correlation + named-event correlation"
0x00531e90,64,global_owner_family_stage_16_dword_payload_block_and_mark_ccb9fc_mode2,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Active-mode staging helper over the same owner family. When mode flag `[this+0x04]` is live and override gate `0x00ccb9f4` is clear, the helper marks byte `[this+0x48] = 1`, copies one caller-supplied 16-dword block into local storage `[this+0x08..+0x44]`, and then forces mode dword `[0x00ccb9fc+0x60] = 2`. Current grounded caller is the local controller-side path around `0x005322c0`, so the safest current read is a staged payload-block copy plus mode-2 mark rather than a named decode routine.","objdump + caller inspection + local disassembly + staged-payload correlation"
0x00531ed0,32,global_owner_family_query_ccb9f8_field_0x2c_when_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny active-mode query wrapper. When mode flag `[this+0x04]` is live and override gate `0x00ccb9f4` is clear, the helper returns dword `[0x00ccb9f8+0x2c]`; otherwise it returns `0`. Current grounded caller is the neighboring controller family at `0x005322b2`, so the safest current read is the shared `0x00ccb9f8+0x2c` query wrapper rather than a named selector.","objdump + caller inspection + local disassembly + shared-field-query correlation"
0x00531ef0,80,global_owner_family_lookup_key_in_selected_hash_root,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Active-mode selected-hash lookup helper over the same owner family. When mode flag `[this+0x04]` is live and override gate `0x00ccb9f4` is clear, selector arg1 `0` probes key arg0 through `0x0053dae0` against hash root `[0x00ccb9f8+0x0c]`, while selector arg1 `1` probes the sibling hash root `[0x00ccb9fc+0x14]`. Current grounded callers include settings-window and neighboring shell branches at `0x004ffcdc`, `0x004ffe51`, and `0x004ffecb`, so the safest current read is a selected hash-root key lookup rather than a fully named registry query.","objdump + caller inspection + local disassembly + hash-root correlation"
0x00531f40,80,global_owner_family_service_ccb9f8_ccb9fc_and_clear_staged_flag,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Active-mode service helper over the same owner family. The helper optionally releases handle `[this+0x4c]` through `0x00531880`, dispatches owner `0x00ccb9f8` through `0x0056ae30`, dispatches owner `0x00ccb9fc` through `0x00569ca0`, and finally clears staged flag byte `[this+0x48]`. Current grounded caller is the timed transition path `0x005322ed`, so the safest current read is a small paired-owner service pass plus staged-flag clear rather than another constructor or query.","objdump + caller inspection + local disassembly + paired-owner-service correlation"
0x00531f90,64,global_owner_family_register_selected_guarded_callback_0x531800_or_0x531840,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small callback-registration selector over the same owner family. When mode flag `[this+0x04]` is live and override gate `0x00ccb9f4` is clear, selector arg1 `0` installs callback target `0x00531800` through function pointer `0x005c83a8`, while selector arg1 `1` installs sibling callback target `0x00531840` through `0x005c83a4`. Current grounded caller is the controller-side bind path `0x005322d8`, so the safest current read is a selected guarded-callback registration helper rather than a broader scheduler primitive.","objdump + caller inspection + local disassembly + callback-registration correlation"
0x00531fd0,384,global_owner_family_timed_primary_scalar_transition_service,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Timed transition service over the same owner family. When override gate `0x00ccb9f4` is clear, the helper increments reentrancy counter `0x00ccb9f0`, branches on selector arg0, and then updates the primary scalar owner `0x00ccba00` from shell-derived values through `0x00557d90`, `0x00557c90`, `0x00557cb0`, and `0x00557cd0`, coordinating the transition with globals `0x00624d58` and `0x00624d60`. One branch seeds `0x00624d60` from the current owner scalar and another forces `0x00624d58 = 1` plus `0x00624d60 = -1.0f` before returning. All exits decrement the same reentrancy counter. Current grounded caller is the controller-side bind helper `0x005322d8`, so the safest current read is a timed primary-scalar transition service rather than a narrow audio-only callback.","objdump + caller inspection + local disassembly + scalar-transition correlation + reentrancy-counter correlation"
0x00532150,176,global_owner_family_controller_construct_and_optionally_bootstrap_selected_entry,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Constructor for the local controller object that fronts the same global-owner family. The helper zeroes the controller block, seeds multiple default float lanes to `1.0f`, clears or presets local flags and handles, and when caller arg0 is not `-1` resolves one callback-selected entry through `0x005314b0` before forwarding it into `0x005318f0`. On successful bootstrap it also allocates one `0x44`-byte local payload into `[this+0x00]` and initializes that payload through `0x00564570`. Current grounded caller is the broader controller allocation path `0x00521254`, so the safest current read is a local controller constructor plus optional selected-entry bootstrap rather than the global owner constructor itself.","objdump + caller inspection + local disassembly + controller-constructor correlation"
0x00532200,48,global_owner_family_controller_shutdown_and_release_payload,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Destructor-side companion to `global_owner_family_controller_construct_and_optionally_bootstrap_selected_entry` `0x00532150`. When controller mode flag `[this+0x04]` is live, the helper first shuts the shared owner family down through `0x00531a10(this,0)`, then releases optional local payload `[this+0x00]` through `0x00564560` and `0x0053b080`. Current grounded caller is the local lifetime strip under `0x005212a6`, so the safest current read is controller shutdown plus payload release rather than a global-owner reset.","objdump + caller inspection + local disassembly + controller-destructor correlation"
0x00532230,48,global_owner_family_controller_rebuild_from_selected_callback_entry,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small controller-side rebuild wrapper over the same owner family. When global owner `0x00ccb9fc` exists, the helper resolves one callback-selected entry through `0x005314b0` and forwards that string into `0x00531c00(this,...)`. Current grounded callers are settings-window backend-selection branches at `0x004fefb0` and the neighboring controller strip, so the safest current read is a rebuild-from-selected-entry helper rather than another query.","objdump + caller inspection + local disassembly + controller-rebuild correlation"
0x00532260,176,global_owner_family_controller_rebind_primary_handle_and_register_transition_callback,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Controller-side bind or rebinding owner for the same global-owner family. When controller mode flag `[this+0x04]` is live and override gate `0x00ccb9f4` is clear, the helper optionally releases existing handle `[this+0x4c]` through `0x00531880`, registers transition callback `0x00531fd0` through function pointer `0x005c83f4`, stores the returned handle in `[this+0x4c]`, seeds selector `[this+0x50]`, resets global float `0x00624d60 = -1.0f`, and then drives one branch-specific initialization strip through `0x00557d90` plus function pointers `0x005c8400`, `0x005c83c8`, and `0x005c83a0` with mode selectors `1`, `2`, or `3`. Current grounded callers include shell-side branches at `0x0048314c`, `0x00483ffc`, `0x0048431f`, and `0x00517444`, so the safest current read is a primary-handle rebind plus transition-callback registration owner rather than a one-shot play command.","objdump + caller inspection + local disassembly + controller-bind correlation + transition-callback correlation"
0x00533ba0,39,shell_grid_get_nearby_presentation_cell,bootstrap,thiscall,inferred,ghidra-headless,4,Returns one tile-grid cell from the nearby-presentation layer rooted at [this+0x1671]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x1671].,ghidra + rizin + llvm-objdump
0x00533bc0,11,shell_nearby_presentation_queue_push_back_payload,bootstrap,thiscall,inferred,objdump + local disassembly + intrusive-queue correlation,2,"Tiny queue append helper over the shell nearby-presentation queue root `[this+0x166d]`. The helper forwards the caller payload into `intrusive_queue_push_back` `0x00556e10`.","objdump + local disassembly + intrusive-queue correlation"
0x00533bd0,11,shell_nearby_presentation_queue_remove_payload,bootstrap,thiscall,inferred,objdump + local disassembly + intrusive-queue correlation,2,"Tiny queue removal helper over the shell nearby-presentation queue root `[this+0x166d]`. The helper forwards the caller payload into `0x00556e80` on the same intrusive queue root.","objdump + local disassembly + intrusive-queue correlation"
0x00533be0,7,shell_query_nearby_presentation_queue_root,bootstrap,thiscall,inferred,objdump + local disassembly + field correlation,2,"Tiny getter for the shell nearby-presentation intrusive queue root `[this+0x166d]`.","objdump + local disassembly + field correlation"
0x00533bf0,37,shell_nearby_presentation_cell_queue_push_back_payload,bootstrap,thiscall,inferred,objdump + local disassembly + intrusive-queue correlation,2,"Cell-addressed append helper over the nearby-presentation cell table `[this+0x1671]`. The helper resolves one 16x16 tile cell from caller coordinates using width `[this+0x15d9]` and then pushes the payload into that cell's intrusive queue through `intrusive_queue_push_back` `0x00556e10`. Current grounded callers include the shared runtime-object world-binding paths `0x0052fdc0` and `0x00530720`.","objdump + local disassembly + intrusive-queue correlation + cell-table correlation"
0x00533c20,37,shell_nearby_presentation_cell_queue_remove_payload,bootstrap,thiscall,inferred,objdump + local disassembly + intrusive-queue correlation,2,"Cell-addressed removal helper over the nearby-presentation cell table `[this+0x1671]`. The helper resolves one 16x16 tile cell from caller coordinates using width `[this+0x15d9]` and removes the payload from that cell's intrusive queue through `0x00556e80`. Current grounded callers include the shared runtime-object world-binding paths `0x0052ef70`, `0x0052fdc0`, and `0x00530720`.","objdump + local disassembly + intrusive-queue correlation + cell-table correlation"
0x00533c50,30,world_region_border_overlay_get_chunk_queue_by_cell,bootstrap,thiscall,inferred,objdump + local disassembly + field correlation,2,"Tiny cell-addressed getter over the region-border overlay chunk table `[this+0x1679]`. The helper resolves one 16x16 chunk slot from caller coordinates using width `[this+0x15d9]` and returns that slot pointer.","objdump + local disassembly + field correlation + coarse-chunk correlation"
0x00533c70,37,world_region_border_overlay_chunk_queue_push_back_payload,bootstrap,thiscall,inferred,objdump + local disassembly + intrusive-queue correlation,2,"Cell-addressed append helper over the region-border overlay chunk table `[this+0x1679]`. The helper resolves one 16x16 chunk slot and forwards the caller payload into `intrusive_queue_push_back` `0x00556e10`.","objdump + local disassembly + intrusive-queue correlation + coarse-chunk correlation"
0x00533ca0,37,world_region_border_overlay_chunk_queue_remove_payload,bootstrap,thiscall,inferred,objdump + local disassembly + intrusive-queue correlation,2,"Cell-addressed removal helper over the region-border overlay chunk table `[this+0x1679]`. The helper resolves one 16x16 chunk slot and forwards the caller payload into `0x00556e80`.","objdump + local disassembly + intrusive-queue correlation + coarse-chunk correlation"
0x00533cd0,39,shell_grid_get_static_vertex24_cell,bootstrap,thiscall,inferred,ghidra-headless,4,Returns one tile-grid cell from the fixed-geometry vertex24 layer rooted at [this+0x167d]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x167d].,ghidra + rizin + llvm-objdump
0x00533db0,30,shell_grid_get_geographic_label_cell,bootstrap,thiscall,inferred,ghidra-headless,4,Returns one tile-grid cell from the geographic-label layer rooted at [this+0x1675]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x1675].,ghidra + rizin + llvm-objdump
0x00533dd0,37,shell_geographic_label_cell_queue_push_back_payload,bootstrap,thiscall,inferred,objdump + local disassembly + intrusive-queue correlation,2,"Cell-addressed append helper over the geographic-label cell table `[this+0x1675]`. The helper resolves one 16x16 tile cell from caller coordinates and forwards the payload into `intrusive_queue_push_back` `0x00556e10`.","objdump + local disassembly + intrusive-queue correlation + cell-table correlation"
0x00533e00,37,shell_geographic_label_cell_queue_remove_payload,bootstrap,thiscall,inferred,objdump + local disassembly + intrusive-queue correlation,2,"Cell-addressed removal helper over the geographic-label cell table `[this+0x1675]`. The helper resolves one 16x16 tile cell from caller coordinates and forwards the payload into `0x00556e80`.","objdump + local disassembly + intrusive-queue correlation + cell-table correlation"
0x00533e30,32,shell_grid_get_animated_quad_cell,bootstrap,thiscall,inferred,ghidra-headless,4,Returns one tile-grid cell from the animated-quad presentation layer rooted at [this+0x1681]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x1681].,ghidra + rizin + llvm-objdump
0x00533e50,32,shell_grid_get_ranked_overlay_cell,bootstrap,thiscall,inferred,ghidra-headless,4,Returns one tile-grid cell from the ranked secondary overlay layer rooted at [this+0x1685]. The helper uses the same 16x16 tile addressing and grid width field at [this+0x15d9] as the other shell cell-grid accessors and currently feeds 0x0052a2f0.,ghidra + rizin + llvm-objdump
0x00533e70,168,world_secondary_overlay_refresh_coarse_chunks_in_rect,map,thiscall,inferred,objdump + caller inspection + local disassembly + field correlation,3,"Rectangle-wide coarse-chunk refresh helper over the secondary overlay table rooted at `[this+0x1685]`. The function clamps the caller-supplied world-grid rectangle to the live bundle dimensions `[this+0x15d9/+0x15d5]`, converts the surviving bounds to `16x16` chunk coordinates, walks every chunk slot in that coarse range, and when a chunk pointer is present re-enters `0x0056b770(world)` to rebuild that chunk's per-cell sampled side bytes from the current world callbacks. Current grounded callers include the late world-entry tail at `0x00444b48`, the secondary-grid overlay-cache service `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670`, one neighboring world-side refresh branch at `0x0044d469`, and the shell-side world-mode branch at `0x00484f51`, so this is the safest current read for the shared coarse secondary-overlay rectangle refresh helper rather than a release or one-shot startup scrub.","objdump + caller inspection + local disassembly + field correlation + coarse-chunk correlation + secondary-overlay correlation"
0x00533fe0,89,world_secondary_overlay_write_local_chunk_cell_value,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small write-side companion to the secondary overlay coarse-chunk family rooted at `[this+0x1685]`. The helper resolves the caller-supplied world-grid cell into one 16x16 chunk slot using width field `[this+0x15d9]`, keeps only the low local cell offsets inside that chunk, and when the chunk object exists delegates the local write or clear through `0x0056b000(chunk, world, x_local, y_local, arg2)`. Current grounded callers include the post-load `319` cleanup sweep through `world_run_post_load_generation_pipeline` `0x004384d0`, neighboring placed-structure or world-overlay branches at `0x00414f33`, `0x004158a6`, `0x0041ff3c`, and `0x00454ede`, and one later world-entry-side caller at `0x00444712`, so this is the safest current read for the shared local secondary-overlay chunk-cell write helper rather than a broad chunk reset or allocator.","objdump + caller inspection + field correlation + coarse-chunk correlation + write-side companion correlation"
0x00534160,259,world_secondary_overlay_ensure_coarse_chunk_and_seed_local_marks,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Shared coarse-chunk helper beneath the secondary overlay family rooted at `[this+0x1685]`. The helper converts the caller-supplied world-grid coordinates into one 16x16 chunk index using width field `[this+0x15d9]`, lazily allocates one `0x54`-byte chunk object into `[this+0x1685]` through `0x0053b070` when that slot is empty, initializes the new chunk from chunk-space coordinates through `0x0056af70`, and then re-enters `0x0056b580` up to the caller-supplied step count capped at `6` using the low-bit local offsets plus two extra caller parameters. Current grounded callers include the late secondary-grid overlay service `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670`, the neighboring startup-side branch at `0x00447faf`, one earlier placed-structure overlay builder at `0x004157d2`, and one world-side surface branch at `0x004545b2`, so this is the safest current read for the shared coarse secondary-overlay chunk ensure-and-seed helper rather than a one-shot startup allocator.","objdump + caller inspection + field correlation + coarse-chunk correlation + secondary-overlay correlation"
0x005339a0,144,math_build_plane_from_three_xyz_points_store_abc_and_negd,bootstrap,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Reusable three-point plane-construction helper. The routine treats the first nine float arguments as three XYZ points, computes the cross product of the two edge vectors rooted at the first point, stores the resulting plane coefficients `A`, `B`, and `C` through the caller pointers in `ECX`, `EDX`, and the fourth stack pointer, and then stores `-(A*x0 + B*y0 + C*z0)` through the final out-pointer. Current grounded callers are the neighboring world-presentation geometry owners at `0x005346b8` and `0x005346ff`, which immediately package the four outputs as one local plane record, so the safest current read is a shared plane-equation builder rather than a presentation-only scoring helper.","objdump + caller inspection + local disassembly + plane-equation correlation"
0x00533a30,176,math_solve_plane_y_from_three_xyz_points_and_xz,bootstrap,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Reusable plane-sampling helper over the same three-point XYZ input family as `0x005339a0`. The routine rebuilds the plane coefficients from the first three points, derives the plane constant, substitutes the caller-supplied query `x` and `z` arguments, divides by coefficient `B`, and returns the solved height on the x87 stack. Current grounded callers are the neighboring world-presentation geometry owners at `0x0053458b` and `0x005345af`, which use it as the direct height interpolation step over one local three-sample patch, so the safest current read is a shared plane-height solver rather than a broader world-score helper.","objdump + caller inspection + local disassembly + plane-height correlation"
0x00534910,8,shell_world_presentation_query_staging_flag,bootstrap,thiscall,inferred,objdump + caller inspection + field correlation,2,"Tiny flag getter over the shared shell-side world-presentation bundle. The helper returns staging byte `[this+0x1588]` unchanged. Current grounded caller is the broad derived-surface rebuild owner `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940`, which uses it only as the fast staging-presence test before sampling the live staging buffer or rebuilding the rectangle.","objdump + caller inspection + field correlation + staged-surface correlation"
0x00534920,8,shell_world_presentation_query_staging_buffer_root,bootstrap,thiscall,inferred,objdump + caller inspection + field correlation,2,"Tiny pointer getter over the shared shell-side world-presentation bundle. The helper returns the live staging dword buffer root `[this+0x1584]` unchanged. Current grounded caller is `world_rebuild_secondary_raster_derived_surface_and_companion_planes_in_rect` `0x0044e940`, which samples that root only after the neighboring staging-flag getter `0x00534910` succeeds.","objdump + caller inspection + field correlation + staged-surface correlation"
0x00534930,448,shell_world_presentation_stage_overlay_rect_from_normalized_bounds,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly + field correlation,3,"Shared rect-staging owner over the shell-side world-presentation bundle. When staging flag `[this+0x1588]` is clear, the helper quantizes the caller-supplied normalized bounds into scaled surface coordinates using width or height fields `[this+0x157c/+0x1580]`, stores the surviving rectangle into `[this+0x1589..+0x1595]`, allocates one dword staging buffer at `[this+0x1584]`, marks staging byte `[this+0x1588] = 1`, and copies the current per-strip surface rows through lazily materialized strip objects from `[this+0x08..]` into that buffer. It optionally returns the staged rect origin through two out-pointers. Current grounded callers include earlier overlay builders at `0x00418032`, startup or world-entry siblings at `0x0044664c` and `0x00447428`, the late secondary-grid overlay path at `0x0044c9e6`, the broad derived-surface rebuild owner at `0x0044ea0a`, the transport or pricing preview builder at `0x0044f861`, the shell-side world branch at `0x0047a184`, and one terrain-preview caller at `0x004f7ee4`, so this is the safest current read for the shared staged-overlay rect capture helper rather than a generic allocator or the later publish step.","objdump + caller inspection + local disassembly + field correlation + staged-surface correlation + normalized-bounds quantization"
0x00534af0,350,shell_world_presentation_publish_staged_overlay_surfaces_and_release_buffer,bootstrap,thiscall,inferred,objdump + caller inspection + field correlation,3,"Shared publish-or-teardown helper over the shell-side world-presentation bundle. The helper first requires staging flag byte `[this+0x1588]`. In normal publish mode `arg0=0` it walks the staged dword buffer at `[this+0x1584]` across the rectangle `[this+0x1589..+0x1591] x [this+0x158d..+0x1595]`, lazily materializes up to `0xff` temporary strip or surface objects through `0x00541970` using the per-slot roots at `[this+0x08..]`, copies staged row dwords into those objects, and then finalizes each populated slot through `0x005438d0`. In teardown-only mode `arg0!=0` it skips the publish sweep and goes straight to cleanup. Both paths then clear `[this+0x1588]`, free the staging buffer at `[this+0x1584]`, and null that pointer. Current grounded callers include the late secondary-grid overlay path at `0x0044cdff`, startup-side and neighboring world branches at `0x00446691`, `0x00447754`, `0x0044f63b`, and `0x0044fada`, earlier overlay builders at `0x004180a8`, `0x004184bf`, and `0x00418584`, plus shell-side callers at `0x0047b061` and `0x004f5f74`, so this is the safest current read for the shared staged-overlay surface publish-and-release helper rather than a world-only renderer or a pure destructor.","objdump + caller inspection + field correlation + staged-surface correlation + publish-vs-teardown correlation"
0x00534c50,32,shell_world_presentation_query_scaled_surface_dimensions,bootstrap,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny dimension query over the shared shell-side world-presentation bundle. The helper reads dwords `[this+0x157c]` and `[this+0x1580]`, shifts both left by two, and writes the results to the caller-supplied out-pointers as one scaled width-height pair. Current grounded callers first resolve the live presentation object through the shell owner at `0x006d4024` or the neighboring bundle resolver and then use these scaled dimensions in overlay, bounds, or allocation setup, including the late secondary-grid overlay path at `0x0044ca3e`, neighboring world-side branches at `0x0044ea34` and `0x0044f876`, earlier placed-structure overlay builders at `0x0041538a` and `0x00417fad`, and one shell-side allocator at `0x004f7f0a`, so this is the safest current read for the shared scaled surface-dimension query rather than a world-only or startup-only helper.","objdump + caller inspection + field correlation + shell-world-bundle correlation"
0x00534e10,64,world_secondary_raster_query_cell_class_in_set_1_3_4_5,map,thiscall,inferred,objdump + caller inspection + raster-cell correlation,3,"Tiny reusable predicate over one 3-byte cell record in the secondary raster family rooted at `[this+0x165d]` with row stride `[this+0x15dd]`. The helper resolves the requested cell from caller-supplied world-grid coordinates, masks the low three class bits from the first byte, and returns `1` when that class is `1`, `3`, `4`, or `5`, else `0`. Current grounded callers span many world-side placement, overlay, and scan branches including `placed_structure_validate_projected_candidate_placement` `0x004197e0`, `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0`, the late world-entry tail around `0x004481a6`, and one secondary-grid sibling under `0x0044c450`, so this is the safest current read for the shared secondary-raster class-set predicate rather than a startup-only helper.","objdump + caller inspection + raster-cell correlation + late-world-tail correlation"
0x00534f60,28,world_presentation_base_init_and_clear_surface_owner_field_0x154c,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small base initializer for the world-presentation owner family. The helper installs vtable `0x005dd25c`, clears dword `[this+0x154c]`, and then re-enters the lower shared initializer `0x00532590` before returning `this`. Current grounded callers are `world_construct_root_and_load_bundle_payload_thunk` `0x0044e910` and the neighboring load-side branch at `0x0044cf73`, so this is the safest current read for the immediate presentation-owner base init rather than a broader world-root constructor.","objdump + caller inspection + local disassembly + world-presentation-family correlation"
0x00534f80,50,world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b,map,thiscall,inferred,objdump + caller inspection + field correlation,2,"Small release helper over one transient surface-handle field in the world-presentation owner family. When pointer `[this+0x478]` is non-null the helper finalizes it through `0x00542c90`, frees it through `0x0053b080`, clears `[this+0x478]`, and then clears byte `[this+0x159b]`. Current grounded callers include the world-side status or action strip around `0x00452fa5`, `0x0045339d`, `0x004535f8`, and `0x00453617`, plus one neighboring world branch at `0x0045074f`, so the safest current read is a focused transient-surface release helper rather than a full presentation teardown.","objdump + caller inspection + field correlation + transient-surface correlation"
0x00534e50,50,world_secondary_raster_query_cell_class_in_set_1_4,map,thiscall,inferred,objdump + caller inspection + raster-cell correlation,3,"Tiny reusable companion predicate over the same 3-byte secondary-raster cell family rooted at `[this+0x165d]` with row stride `[this+0x15dd]`. The helper resolves one caller-selected world-grid cell, masks the low three class bits from the first byte, and returns `1` only when that class is `1` or `4`, else `0`. Current grounded callers include the transportation or pricing grid pass `world_compute_transport_and_pricing_grid` `0x0044fb70`, the live-world `.smp` serializer `world_runtime_serialize_smp_bundle` `0x00446240`, and several neighboring world-side scan or presentation branches at `0x00448c2f`, `0x00449d46`, `0x0044ec29`, `0x00451016`, and `0x0047a551`, which makes this the safest current read for the shared secondary-raster class-subset predicate rather than a transport-only helper.","objdump + caller inspection + raster-cell correlation + transport-grid correlation + serializer correlation"
0x00534e90,48,world_secondary_raster_query_cell_marked_bit,map,thiscall,inferred,objdump + caller inspection + raster-cell correlation,3,"Tiny reusable bit query over the same 3-byte secondary-raster cell family rooted at `[this+0x165d]` with row stride `[this+0x15dd]`. The helper resolves one cell from caller-supplied world-grid coordinates, reads the 16-bit companion word from that cell record, and returns bit `9` as a boolean marked-state flag. Current grounded callers include the secondary-grid overlay-cache service `world_service_secondary_grid_marked_cell_overlay_cache` `0x0044c670`, neighboring world scan or mutation branches at `0x004499a6`, `0x00449bdf`, and `0x00450f69`, plus one shell-side or editor-adjacent caller at `0x004a0e72`, which makes this the safest current name for the shared secondary-raster marked-bit predicate.","objdump + caller inspection + raster-cell correlation + secondary-grid overlay correlation"
0x00534ec0,56,world_secondary_raster_query_cell_class_in_set_2_4_5,map,thiscall,inferred,objdump + caller inspection + raster-cell correlation,3,"Tiny reusable class-subset predicate over the same 3-byte secondary-raster family rooted at `[this+0x165d]` with row stride `[this+0x15dd]`. The helper resolves one caller-selected world-grid cell, masks the low three class bits from the first byte, and returns `1` only when that class is `2`, `4`, or `5`, else `0`. Current grounded callers include neighboring world-side setup, scan, and presentation branches around `0x00446418`, `0x00449c88`, `0x0044bdfc`, `0x0044dd78`, `0x0044ec51`, `0x0044f30e`, `0x0044f445`, `0x00450f7a`, and `0x004fa86c`, plus serializer-adjacent paths under `0x00446240`, so this is the safest current read for the shared secondary-raster class-subset predicate rather than a more player-facing terrain label.","objdump + caller inspection + raster-cell correlation + serializer correlation"
0x00534f00,52,world_secondary_raster_query_cell_class_in_set_3_5,map,thiscall,inferred,objdump + caller inspection + raster-cell correlation,3,"Tiny reusable class-subset predicate over the same 3-byte secondary-raster family rooted at `[this+0x165d]` with row stride `[this+0x15dd]`. The helper resolves one caller-selected world-grid cell, masks the low three class bits from the first byte, and returns `1` only when that class is `3` or `5`, else `0`. Current grounded callers include neighboring world-side setup, serializer, and presentation branches around `0x00446240`, `0x00448cbf`, `0x0044dbcd`, `0x0044ec3d`, `0x0044ede9`, `0x0044ee0a`, `0x0044ef7a`, `0x0044f131`, `0x0044f1b5`, `0x0045105e`, `0x0047a569`, and `0x004df627`, so this is the safest current read for the shared secondary-raster class-subset predicate rather than a more player-facing terrain label.","objdump + caller inspection + raster-cell correlation + serializer correlation"
0x0053fda0,96,shell_service_one_object_child_queue_and_deferred_state,shell,thiscall,inferred,objdump + analysis-context,4,Services one shell object beneath shell_runtime_prime. The helper optionally notifies the global shell controller at 0x006d4024 through 0x0051f950 when [this+0x5c] is nonnull then walks the child or service-node list rooted at [this+0x70]. For each child it conditionally signals deferred work through shell_signal_deferred_work_item_shutdown 0x0051f1d0 and dispatches the child through vtable slot +0x18. If byte [this+0x1d] is set the tail path also jumps through 0x0051f930 on the same shell controller. Current static context places it under shell_runtime_prime 0x00538b60 on the null-0x006cec78 mode-4 service path.,objdump + analysis-context + caller context
0x00539fb0,924,shell_emit_geographic_label_frame_vertex24_records,bootstrap,thiscall,inferred,ghidra-headless,4,Expands the current geographic-label item into cached frame vertex24 records inside the caller buffer. The helper patches packed alpha into up to sixteen prebuilt 0x18-byte records copies additional 24-byte frame blocks from fixed item offsets and returns the emitted vertex count for the label border or backing geometry.,ghidra + rizin + llvm-objdump
0x0053a440,14,shell_set_geographic_label_item_alpha,bootstrap,thiscall,inferred,ghidra-headless,4,Stores an 8-bit alpha input into the high-byte color field at [this+0x5b] for the current geographic-label item before frame or text emission.,ghidra + rizin + llvm-objdump
0x0053a960,723,shell_emit_geographic_label_text_span,bootstrap,thiscall,inferred,ghidra-headless,4,Builds and emits one geographic-label text span for the current cell item. The helper calls the item vtable at +0x10 to materialize a null-terminated display string up to 0x12c bytes computes placement from item float fields and shell service state checks visibility through the shell bundle and forwards the resolved text payload into the presentation path through 0x005519f0. The item family aligns with gpdLabelDB and 2DLabel.imb rather than the parallel city assets.,ghidra + rizin + llvm-objdump
0x00543f10,853,layout_state_bind_presentation_asset_bundle,bootstrap,thiscall,inferred,ghidra-headless,4,Initial bind-time asset loader for the layout state's presentation node at [this+0x25df]; pulls a fixed presentation bundle through the node vtable at +0x5c and +0x60 including standalone assets stored around 0x2643 0x2647 0x264b 0x264f 0x2653 0x265b 0x265f and 0x2663 plus a 64-entry asset bank at 0x31ab while advancing an internal asset-offset cursor at [this+0x2543].,ghidra + rizin
0x00544270,21,layout_state_store_local_scalar_pair_0x25ef_0x25f3,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny local-scalar setter adjacent to the span-descriptor strip. The helper copies its two caller-supplied dwords into local scalar lanes `[this+0x25ef]` and `[this+0x25f3]`. Current evidence only supports this structural scalar-pair store description.","objdump + local disassembly + layout-state correlation + local-scalar correlation"
0x00544290,195,layout_state_publish_local_descriptor_0x352f_from_integer_span_pair,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Local descriptor-publish helper in the layout-state family. The helper derives one normalized span scalar from the caller's two integer inputs, combines that value with local scalar lanes `[this+0x25eb/+0x25ef/+0x25f3]`, builds one `0x100`-byte descriptor rooted at `[this+0x352f]` through `0x0056e41a`, stores one derived shell-scaled scalar into `[this+0x36f9]`, and publishes that descriptor through node slot `+0x94` on the bound presentation node `[this+0x25df]` for selector `3`. Current grounded callers are the neighboring rect and span owners `0x00548120`, `0x00548180`, and `0x005482e0`, so this is the safest current read for publishing local descriptor `[+0x352f]` from an integer span pair rather than a generic math helper.","objdump + caller inspection + local disassembly + layout-state correlation + local-descriptor correlation"
0x00544360,208,layout_state_reset_local_descriptor_0x34ef_to_identity_and_publish,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Identity-reset companion to `0x00544290` in the same layout-state family. The helper zeroes the local `0x100`-byte descriptor block rooted at `[this+0x34ef]`, seeds the four diagonal scalar lanes `[+0x34ef/+0x3503/+0x3517/+0x352b]` to `1.0f`, and publishes that block through node slot `+0x94` on the bound presentation node `[this+0x25df]`. Current grounded callers include the neighboring rect and span owners `0x00548120` and a wider set of shell presentation rebuild paths such as `0x00524d05`, `0x00528805`, `0x00529dab`, and `0x0054d93a`, so this is the safest current read for resetting local descriptor `[+0x34ef]` to identity and publishing it rather than a standalone memset wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + local-descriptor correlation"
0x005443b0,54,layout_state_copy_record_payload_plus_0xce_into_local_descriptor_0x34ef_and_publish,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Copy-side sibling to `0x00544360` in the same layout-state family. The helper copies one fixed `0x100`-byte descriptor payload from caller record `[arg+0xce]` into local descriptor `[this+0x34ef]` and immediately republishes that block through node slot `+0x94` on the bound presentation node `[this+0x25df]`. Current grounded caller is `0x005288bf`, so this is the safest current read for copying the incoming payload into local descriptor `0x34ef` and publishing it rather than another memset-style reset helper.","objdump + caller inspection + local disassembly + layout-state correlation + local-descriptor correlation"
0x005443f0,88,layout_state_export_handle_0x33ab_matrix_pair_and_aux_band_into_record_payload,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Export-side helper above the local descriptor strip in the same layout-state family. The helper queries handle `[this+0x33ab]` through vtable slot `+0x44` twice and slot `+0x18` once, then copies those returned blocks into caller record payload offsets `[arg+0xce]`, `[arg+0x10e]`, and `[arg+0x14e]`. Current grounded callers are the clustered record-update branches `0x0052447f`, `0x005287fd`, `0x0052894d`, and `0x00528b72`, so this is the safest current read for exporting the current `0x33ab` matrix pair plus auxiliary band into a caller-owned record payload rather than a generic copy helper.","objdump + caller inspection + local disassembly + layout-state correlation + handle-export correlation"
0x00544450,24,layout_state_query_flag_0x36f7_and_optionally_clear,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny flag helper adjacent to the local-descriptor strip. The helper returns byte `[this+0x36f7]` in `AL` and, when the caller-supplied byte is nonzero, clears that same flag back to `0` before returning. Current evidence only supports this structural query-and-optional-clear description.","objdump + local disassembly + layout-state correlation + flag correlation"
0x00544470,143,layout_state_recompose_local_descriptor_stack_356f_362f_35af_33ef_from_34ef_and_33af,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Local descriptor-recompose owner in the layout-state family. The helper republishes local blocks `[this+0x356f]` and `[this+0x362f]` through node slot `+0x94` for selectors `3` and `2`, composes stack blocks from `[this+0x34ef]`, `[this+0x33af]`, and `[this+0x342f]` through the shared matrix-style helpers `0x0056d3cd`, `0x0056d616`, and `0x0056d8d9`, and finally copies the resulting block rooted at `[this+0x33af]` into `[this+0x33ef]`. Current grounded caller is `0x0052bdf6`, so this is the safest current read for recomposing the local `0x356f/0x362f/0x35af/0x33ef` descriptor stack from `0x34ef` and `0x33af` rather than a generic math wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + descriptor-compose correlation"
0x00544500,153,layout_state_recompose_local_descriptor_stack_35ef_366f_from_352f_34ef_33af_342f,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Sibling recompose owner to `0x00544470` in the same layout-state family. The helper republishes local blocks `[this+0x352f]` and `[this+0x35ef]` through node slot `+0x94`, then uses the same shared matrix-style helpers `0x0056d3cd` and `0x0056d8d9` to combine local blocks `[this+0x34ef]`, `[this+0x33af]`, and `[this+0x342f]`, writing the final result into local block `[this+0x366f]`. Current grounded caller is `0x005288bf`, so this is the safest current read for recomposing the local `0x35ef/0x366f` descriptor stack from the adjacent descriptor blocks rather than a generic math wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + descriptor-compose correlation"
0x00544630,31,layout_state_store_local_scalar_triplet_0x2533_0x2537_0x253b,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny local-scalar setter adjacent to the descriptor-recompose strip. The helper copies three caller-supplied dwords into local scalar lanes `[this+0x2533]`, `[this+0x2537]`, and `[this+0x253b]`. Current evidence only supports this structural scalar-triplet store description.","objdump + local disassembly + layout-state correlation + local-scalar correlation"
0x00544660,65,layout_state_query_local_rect_band_0x2523_0x2527_0x252b_0x252f,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Four-outparam local-rect query helper in the same layout-state family. The helper conditionally writes cached scalar lanes `[this+0x2523]`, `[this+0x252b]`, `[this+0x2527]`, and `[this+0x252f]` into up to four caller-supplied outparams. Current evidence only supports this structural local-rect export description.","objdump + local disassembly + layout-state correlation + local-rect correlation"
0x005446b0,147,layout_state_project_xyz_through_local_block_0x33ef_to_xy_pair,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small projection helper beneath the local descriptor-recompose strip. The helper applies caller XYZ through local block `[this+0x33ef..+0x342b]`, derives one reciprocal depth-like scalar from the second row result, and writes the resulting projected XY pair through two caller outparams. Current grounded caller is `0x0052b72f`, so this is the safest current read for projecting XYZ through local block `0x33ef` into an XY pair rather than a broader camera owner.","objdump + caller inspection + local disassembly + layout-state correlation + projection correlation"
0x00544750,229,layout_state_project_xyz_through_local_block_0x33af_to_xy_pair_and_optional_depth_when_w_positive,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Visibility-gated projection sibling to `0x005446b0` in the same layout-state family. The helper applies caller XYZ through local block `[this+0x33af..+0x33eb]`, checks the resulting depth-like lane for a positive projective divisor, returns `1` when that test fails, and otherwise writes the projected XY pair through two caller outparams plus the raw depth-like scalar through an optional third outparam. Current grounded caller is `0x00527476`, so this is the safest current read for projecting XYZ through local block `0x33af` into XY plus optional depth with a positive-divisor gate rather than a broader world-view owner.","objdump + caller inspection + local disassembly + layout-state correlation + projection correlation"
0x00544860,201,layout_state_apply_local_descriptor_0x34ef_to_vec3_with_projective_divide,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Vec3-output projective-apply helper adjacent to the same local descriptor strip. The helper applies caller XYZ through local descriptor `[this+0x34ef..+0x352b]`, derives one reciprocal depth-like scalar from the resulting fourth lane, and writes the projectively divided XYZ result back through the caller output vector. Current grounded caller is `0x00528c7d`, so this is the safest current read for applying local descriptor `0x34ef` to one vec3 with projective divide rather than a generic math wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + projective-apply correlation"
0x00544930,332,layout_state_project_weighted_xyz_through_composed_local_blocks_0x34ef_0x35ef_0x352f_to_xy_pair_and_score,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader weighted projection owner above the local descriptor strip. The helper first composes temporary blocks from local descriptors `[this+0x34ef]`, `[this+0x35ef]`, and `[this+0x352f]` through the shared matrix-style helper `0x0056d3cd`, then applies three caller float scalars through that composed stack. It returns `0xff` when the resulting depth-like lane fails the positive projective test, otherwise writes the projected XY pair through two caller outparams and returns one derived magnitude score through `0x005a10d0`. Current grounded caller is `0x00528c37`, so this is the safest current read for projecting weighted XYZ through the composed `0x34ef/0x35ef/0x352f` stack into XY plus one score rather than a generic math helper.","objdump + caller inspection + local disassembly + layout-state correlation + projection correlation + composed-descriptor correlation"
0x00544a80,243,layout_state_map_local_xy_pair_through_rect_band_and_affine_triplet_0x342f_0x346b_to_xyz,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Local-space mapper beneath the same descriptor and rect-band strip. The helper first normalizes caller XY against cached rect band `[this+0x2523/+0x2527/+0x252b/+0x252f]`, then applies the resulting pair through the affine coefficient triplet bands `[this+0x342f..+0x346b]` plus constant `0x005dd990`, and writes the resulting XYZ triple through three caller outparams. Current grounded callers are `0x005240c2`, `0x0052424c`, and `0x005283cb`, so this is the safest current read for mapping one local XY pair through the cached rect band and affine triplet into XYZ rather than a generic scalar helper.","objdump + caller inspection + local disassembly + layout-state correlation + affine-map correlation"
0x00544b80,247,layout_state_map_local_xy_pair_through_rect_band_and_affine_triplet_0x342f_0x346b_relative_to_vec3,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Relative-mapping sibling to `0x00544a80` in the same layout-state family. The helper again normalizes caller XY against cached rect band `[this+0x2523/+0x2527/+0x252b/+0x252f]`, applies the result through affine coefficient triplet `[this+0x342f..+0x346b]`, and then subtracts the resulting XYZ triple from one caller-supplied vec3 reference block before writing the relative XYZ result through the output buffer. Current grounded caller is `0x005246a0`, so this is the safest current read for mapping local XY through the cached rect band and affine triplet relative to one vec3 reference block rather than a generic scalar helper.","objdump + caller inspection + local disassembly + layout-state correlation + affine-map correlation + relative-output correlation"
0x00544c80,47,layout_state_clear_property_pair_0x0d_0x0e_for_selector4,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny clear sibling in the same layout-state property strip. The helper writes `0` into bound-node property groups `0x0d` and `0x0e` for selector `4` through node slot `+0xfc` on `[this+0x25df]`. Current grounded caller is `0x0052b8b6`, so this is the safest current read for the selector-`4` clear helper rather than another generic grouped-property wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation"
0x00544cb0,64,layout_state_publish_property_pair_0x0d_0x0e_for_selector3,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small property-pair publisher in the same layout-state family. The helper forwards one caller-supplied byte value into bound-node property groups `0x0d` and `0x0e`, both for selector `3`, through vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural property-pair publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544cf0,48,layout_state_clear_property_pair_0x0d_0x0e_for_selector2,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny clear sibling to `0x00544cb0` in the layout-state family. The helper writes `0` into bound-node property groups `0x0d` and `0x0e` for selector `2` through vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural clear helper description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544d20,96,layout_state_set_property_pair_0x0d_0x0e_for_selector1_to_1,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small arming helper over the same layout-state property strip. The helper first clears bound-node property groups `0x0d` and `0x0e` for selector `1`, then republishes both groups with literal value `1` through vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural selector-`1` property-pair arm description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544d80,32,layout_state_publish_property_0x3c_packed_dword,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny packed-property setter over the bound presentation node `[this+0x25df]`. The helper forwards one caller-supplied dword into property `0x3c` through node vtable slot `+0xc8`. Current evidence only supports this structural packed-dword publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544da0,48,layout_state_publish_property_0x3c_with_cached_rgb_and_alpha_byte,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small color-pack sibling to `0x00544d80` in the layout-state family. The helper reads cached RGB lanes from `[this+0x25a3]`, masks them down to `0x00ffffff`, combines that value with one caller-supplied alpha byte in the high lane, and publishes the packed result into property `0x3c` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural cached-RGB-plus-alpha publisher description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544dd0,32,layout_state_publish_property_group_0x0b_for_selector_with_value,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny grouped-property publisher over the same bound node. The helper forwards its two caller-supplied dwords as selector and value into property group `0x0b` through node vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural grouped-property publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544df0,320,layout_state_apply_capability_and_mode_gated_property_strip_0x1d_0x13_0x14_0x12,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader property-strip owner in the layout-state family. The helper first checks shell capability byte `[0x006d4024+0x11422e]` and publishes property `0x1d` on the bound node `[this+0x25df]`, then conditionally seeds fixed property pair `0x13 = 5` and `0x14 = 6` when state byte `[this+0x83c+0x21]` is live. After that it derives one per-slot mode value from state dword `[this+0x83c+0x29]` and local slot count `[this+0x258f]`, publishes property `0x13` across every active slot, and finally publishes property `0x12` across the same slot span with the derived mode selector. Current grounded caller is the neighboring layout-state owner branch `0x0052bc18`, so this is the safest current read for the capability and mode-gated `0x1d/0x13/0x14/0x12` property-strip owner rather than a named UI action.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation"
0x00544f30,208,layout_state_apply_slot_range_property_strip_0x15_0x1a_0x11_0x10,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Broader slot-range property-strip owner adjacent to `0x00544df0` in the same layout-state family. The helper derives one active slot range from the caller's signed start byte and the current slot count `[this+0x258f]`, optionally clears property `0x15` down to zero and raises property `0x1a = 1` when the caller's boolean flag is set, then walks the active slot range publishing property groups `0x11` and `0x10` with one derived mode value. That derived mode depends on both the caller flag and state byte `[this+0x83c+0x1e]`. Current evidence only supports this structural slot-range property-strip description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00545000,32,layout_state_clear_property_0x89,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny bound-node property clear in the layout-state family. The helper writes literal `0` into property `0x89` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural property clear description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00545020,32,layout_state_publish_property_0x89_from_state_byte_0x22,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small sibling publisher to `0x00545000`. The helper reads byte `[this+0x83c+0x22]` and forwards that value into bound-node property `0x89` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural cached-byte property publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00545040,64,layout_state_publish_property_0x89_from_state_byte_0x22_and_notify_slot_0,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Notify-style sibling over the same cached state byte `[this+0x83c+0x22]`. The helper first publishes that byte into property `0x89` through node slot `+0xc8`, then forwards the same value into node slot `+0xb8` with selector `0`. Current evidence only supports this structural publish-plus-notify description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00545080,32,layout_state_clear_property_0x0e,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny bound-node property clear in the same layout-state strip. The helper writes `0` into property `0x0e` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural property clear description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x005450a0,32,layout_state_set_property_0x0e_to_1,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny sibling setter to `0x00545080`. The helper writes literal `1` into property `0x0e` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural property-set description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x005450c0,32,layout_state_copy_cached_local_block_0x24f0_to_out_buffer,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small cached-block exporter in the layout-state family. The helper copies the fixed `0x33`-byte local block rooted at `[this+0x24f0]` into one caller-supplied output buffer through a straight `rep movs` copy. Current evidence only supports this structural cached-block export description.","objdump + local disassembly + layout-state correlation + cached-block correlation"
0x005450e0,80,layout_state_export_negated_local_scalar_triplet_0x2517_0x251b_0x251f_with_mid_clamp,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Three-outparam local scalar exporter in the layout-state family. The helper reads float lanes `[this+0x2517]`, `[this+0x251b]`, and `[this+0x251f]`, negates all three, scales the third lane through the same constant used by neighboring layout-state math, and writes them to three separate outparams. The middle exported scalar is then clamped up to `0.5f` when the negated source would fall below that floor. Current evidence only supports this structural negated-triplet export description.","objdump + local disassembly + layout-state correlation + local-scalar correlation"
0x00545130,80,layout_state_export_negated_local_scalar_triplet_0x2517_0x251b_0x251f_to_vec3_with_mid_clamp,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Packed-output sibling to `0x005450e0` in the same layout-state family. The helper writes the same negated local scalar triplet derived from `[this+0x2517/+0x251b/+0x251f]` into one caller-supplied contiguous three-float buffer, again scaling the third lane and clamping the middle lane up to `0.5f`. Current grounded caller is the neighboring layout-state owner branch `0x0052bbb7`, so this is the safest current read for the packed vec3 export sibling rather than another generic copy helper.","objdump + caller inspection + local disassembly + layout-state correlation + local-scalar correlation"
0x00545180,640,layout_state_build_default_preset_table_0x840_from_angular_sweep,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Default preset-table builder in the same layout-state family. The helper walks `0x90` fixed records of size `0x33` rooted at `[this+0x840]`, deriving one normalized vector pair, several companion float lanes, and three byte-scaled threshold lanes from an angular sweep that starts at `-0xa8c0` and advances by `0x258` per row. Current grounded caller is the default-cache bootstrap path `0x0054be29`, which only invokes this builder when global dirty byte `0x00ccd820` is still clear; otherwise that owner copies preset rows from global cache `0x00ccbb68`. So the safest current read is a generated default preset-table builder rather than a generic trig helper.","objdump + caller inspection + local disassembly + layout-state correlation + preset-table correlation + default-cache correlation"
0x00545400,32,layout_state_store_preset_row_float_0x23_in_table_0x840,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny indexed preset-row setter in the layout-state family. The helper stores one caller-supplied float into offset `0x23` of the selected `0x33`-byte row under preset table `[this+0x840]`. Current evidence only supports this structural preset-row float-store description.","objdump + local disassembly + layout-state correlation + preset-table correlation"
0x00545420,32,layout_state_store_scalar_pair_arrays_0x25f7_0x25ff_by_index,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small paired scalar-array setter adjacent to the preset-table strip. The helper stores two caller-supplied floats into indexed arrays `[this+0x25f7 + index*4]` and `[this+0x25ff + index*4]`. Current evidence only supports this structural paired-array store description.","objdump + local disassembly + layout-state correlation + paired-array correlation"
0x00545440,48,layout_state_query_scalar_pair_arrays_0x25f7_0x25ff_by_index,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small paired scalar-array query sibling to `0x00545420`. The helper conditionally writes indexed floats from `[this+0x25f7 + index*4]` and `[this+0x25ff + index*4]` into up to two caller-supplied outparams. Current evidence only supports this structural paired-array query description.","objdump + local disassembly + layout-state correlation + paired-array correlation"
0x00545470,48,layout_state_store_two_floats_into_preset_row_column_pair,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small indexed preset-row setter adjacent to `0x00545400`. The helper resolves one selected `0x33`-byte row under `[this+0x840]`, then stores two caller-supplied floats into the first and second column bands using the caller's subindex as a `4`-byte lane selector. Current evidence only supports this structural two-float row-store description.","objdump + local disassembly + layout-state correlation + preset-table correlation"
0x005454a0,32,layout_state_query_float_from_preset_row_column_band_0x840,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny indexed preset-row query helper over the same table `[this+0x840]`. The helper resolves one selected `0x33`-byte row and returns the float stored in the first column band at the requested `4`-byte subindex. Current evidence only supports this structural preset-row float-query description.","objdump + local disassembly + layout-state correlation + preset-table correlation"
0x005457c0,224,layout_state_publish_property_0x8b_with_stack_descriptor_and_optional_capability_scaled_scalar,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Stack-descriptor publisher in the layout-state family. The helper zeroes one local descriptor block, optionally seeds one capability-gated scaled scalar from `[this+0x25fb] * [this+0x24f4]` when both the caller flag and shell capability byte `[0x006d4024+0x11422e]` are live, pushes packed color `0xffafafaf` into property `0x8b` on the bound node `[this+0x25df]`, and then forwards the prepared stack descriptor through node slot `+0xa8`. Current grounded callers include nearby layout-state refresh owners `0x00524cd3`, `0x00524e28`, `0x0052a641`, `0x0052ac7a`, `0x0052ae3d`, `0x0052b42f`, `0x0052bbc1`, `0x0054d944`, and later support branches `0x00564c38`, so the safest current read is a property-`0x8b` stack-descriptor publish helper rather than a named UI action.","objdump + caller inspection + local disassembly + layout-state correlation + stack-descriptor correlation"
0x005458a0,48,layout_state_borrow_current_segment_record_window_handle_0x265b_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over current segment-record handle `[this+0x265b]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x2800`-byte window through handle vtable slot `+0x2c`, and returns the borrowed scratch pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + segment-record correlation"
0x005458d0,32,layout_state_release_current_segment_record_window_handle_0x265b_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x005458a0`. The helper decrements global counter `0x00ccd824` and forwards current segment-record handle `[this+0x265b]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + segment-record correlation"
0x005459f0,48,layout_state_release_segment_record_window_handle_0x2643_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to the `0x2643` segment-record window readers. When gate byte `[this+0x254e]` is live, the helper clears that gate, decrements global counter `0x00ccd824`, and forwards handle `[this+0x2643]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + segment-record correlation"
0x00545a20,32,layout_state_release_handle_0x264f_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny release-side wrapper over handle `[this+0x264f]` in the layout-state family. The helper decrements global counter `0x00ccd824` and forwards that handle through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545a40,48,layout_state_borrow_handle_0x264f_window_0x7800_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x264f]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x7800`-byte window through handle vtable slot `+0x2c`, writes the borrowed pointer to local scratch `[this+0x2657]`, and returns that pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545a70,48,layout_state_borrow_handle_0x2653_window_0x3e80_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x2653]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x3e80`-byte window through handle vtable slot `+0x2c`, and returns the borrowed pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545aa0,32,layout_state_release_handle_0x2653_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x00545a70`. The helper decrements global counter `0x00ccd824` and forwards handle `[this+0x2653]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545ac0,48,layout_state_borrow_handle_0x264b_window_0x3e80_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x264b]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x3e80`-byte window through handle vtable slot `+0x2c`, and returns the borrowed pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545af0,32,layout_state_release_handle_0x264b_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x00545ac0`. The helper decrements global counter `0x00ccd824` and forwards handle `[this+0x264b]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545b90,32,layout_state_release_vertex24_window_handle_0x2647_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to the vertex24 window readers over handle `[this+0x2647]`. The helper decrements global counter `0x00ccd824` and forwards that handle through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + vertex24 correlation"
0x00545bb0,48,layout_state_borrow_handle_0x263f_window_0x2ee00_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x263f]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x2ee00`-byte window through handle vtable slot `+0x2c`, and returns the borrowed pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545be0,32,layout_state_release_handle_0x263f_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x00545bb0`. The helper decrements global counter `0x00ccd824` and forwards handle `[this+0x263f]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545ca0,176,layout_state_clear_first_optional_binding_publish_property_0x9e_and_commit_span_type1,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small commit-side owner in the layout-state family. When gate byte `[this+0x254d]` is still clear and slot count `[this+0x258f]` is positive, the helper clears the first optional slot binding `[this+0x2593][0]` through node slot `+0xf4` when that binding is nonnull, then publishes property `0x9e = 1.0f` on the bound node `[this+0x25df]`, accumulates one derived span count into `[this+0x3711]`, and commits the caller-supplied range through node slot `+0x118` with primitive-type argument `1`. Current evidence only supports this structural clear-plus-commit description.","objdump + local disassembly + layout-state correlation + span-commit correlation"
0x00545d50,16,layout_state_query_accumulated_span_counter_0x3711,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny accessor in the same layout-state family. The helper returns accumulated span counter `[this+0x3711]` unchanged. Current evidence only supports this structural counter-query description.","objdump + local disassembly + layout-state correlation + counter correlation"
0x00545d60,80,layout_state_reset_counters_0x370d_0x3711_and_optionally_reseed_bound_node_mode2,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Reset-side helper adjacent to the span-commit strip. The function zeroes local counters `[this+0x370d]` and `[this+0x3711]`, optionally dispatches the bound node `[this+0x25df]` through vtable slot `+0x90` with selector `2` and one `1.0f` scalar when the caller requests it, and then unconditionally forwards the node through slot `+0x88`. Current evidence only supports this structural reset-and-optional-reseed description.","objdump + local disassembly + layout-state correlation + counter correlation"
0x00545db0,64,layout_state_finalize_bound_node_and_optionally_clear_zero_mode_through_slot_0x3c,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small finalize-side helper over the bound node `[this+0x25df]`. The helper first dispatches node slot `+0x8c`, then, when the caller's boolean is still zero, clears one four-zero argument lane through node slot `+0x3c`. Current evidence only supports this structural finalize-and-optional-clear description.","objdump + local disassembly + layout-state correlation + bound-node correlation"
0x00545e00,48,layout_state_classify_bound_node_signature_0x88760868_0x88760869_or_other,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny classifier over the bound node `[this+0x25df]`. The helper queries node slot `+0x0c` and returns `1` for signature `0x88760868`, `2` for `0x88760869`, `0` for a null signature, and `3` for any other nonzero result. Current evidence only supports this structural node-signature classifier description.","objdump + local disassembly + layout-state correlation + node-signature correlation"
0x00554830,142,attachment_object_init_named_asset,bootstrap,thiscall,inferred,ghidra-headless,3,Initializes one named attachment object from a caller-supplied asset string and placement parameters. The helper copies the asset name into the local object buffer at [this+0x10] stores attachment selectors at [this+0x130] and [this+0x138] optionally derives a cached scale pair at [this+0x120] and [this+0x124] and then finalizes object state through 0x005545d0.,ghidra + rizin + llvm-objdump
0x00531e10,48,shell_audio_service_apply_indexed_feedback_event_if_ready,shell,thiscall,inferred,objdump + caller correlation + local disassembly,4,"Small shell-audio-service sink beneath the indexed feedback-nudge helper `0x0045ea20`. The helper only dispatches when service mode dword `[this+0x04]` equals `1`, override gate `0x00ccb9f4` is clear, and the service-side readiness scalar at `[0x00ccb9f8+0x20]` passes the local positive check; on the ready path it tail-jumps into `0x0056ad20` with the caller's table-driven event pair and scalar, otherwise it returns `0`. Current grounded direct caller is `shell_emit_indexed_audio_feedback_nudge_if_live` `0x0045ea20`, which keeps this safely on the shell-audio feedback side rather than the broader backend-selection family.","objdump + caller correlation + local disassembly + readiness-gate correlation"
0x0053ef60,4,graphics_backend_query_primary_status_dword_18,shell,thiscall,inferred,objdump + settings-window caller correlation,3,"Returns graphics-backend dword `[this+0x18]` unchanged. Current grounded callers are the `Graphics` page refresh and graphics-selector callback strip, which pair this value with `graphics_backend_query_both_status_slots_clear` `0x0053ef70` when deciding how controls `0x757c` and `0x759a` should be republished.","objdump + settings-window caller correlation"
0x0053ef70,23,graphics_backend_query_both_status_slots_clear,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Returns `1` only when both graphics-backend dword `[this+0x18]` and dword `[this+0x14]` are zero; otherwise returns `0`. Current grounded callers are the `Graphics` page refresh and the graphics-selector callback strip, which use this test as the fallback branch when republishing controls `0x757c` and `0x759a`.","objdump + settings-window caller correlation + status-slot correlation"
0x00540e30,283,surface_owner_base_init_and_register_on_global_list,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Base initializer for the `0xec`-byte RGBA surface-owner family. The helper copies one fixed owner label into `[this+0x13]`, seeds capability and mode bytes from the live shell presenter into `[this+0x96/+0x97]`, clears the cached byte-count and pointer bands `[this+0xc0..+0xe8]`, allocates two small companion helper objects through `0x0053b070 -> 0x00556d80`, clears the eight-entry row bands `[this+0x98..+0x9f]` and `[this+0xa0..+0xbc]`, resets selector dword `[this+0x07]`, and finally links the owner into the global intrusive list rooted at `0x00ccbb2c`, incrementing `0x00ccbb30`. Current grounded caller is `surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode` `0x00543980`, so this is the safest current read for base-init plus global registration rather than a generic shell allocator.","objdump + caller inspection + local disassembly + surface-family correlation + global-list correlation"
0x00540fc0,304,surface_owner_refresh_cached_byte_totals_and_release_all_row_buffers,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Two-part maintenance owner in the same surface-owner family. Its first half clears cached byte totals `[this+0xcc/+0xd0]` and then walks the eight row slots `[this+0xa0..+0xbc]`, accumulating active row byte sizes `[row+0x04]` into total bytes when backing pointer `[row+0x22]` is live and into selected bytes when companion byte `[this+0x98 + slot]` is set and selector dword `[this+0x07]` matches the shell mode token `[0x006d4024+0x114222]`. Its second half walks the same slots again and frees row buffers `[row+0x2a/+0x26/+0x2e]`, clears `[row+0x22]`, and resets owner selector `[this+0x07]`. Current grounded callers are the surface constructor `0x00543980` and the cached-surface commit helper `0x005438d0`, so this is the safest current read for the cached-byte refresh plus full row-buffer release owner rather than a narrow query helper.","objdump + caller inspection + local disassembly + surface-family correlation + byte-total correlation + row-release correlation"
0x00541160,88,surface_owner_query_dimension_cap_from_mode_and_quality_band,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Small dimension-cap query in the same surface-owner family. When owner byte `[this+0x05]` is clear it returns the broad fallback cap `0x800`. Otherwise it derives a tighter power-of-two limit from the shell editor or capability gate `[0x006d4024+0x11422f]` and then clamps that base cap against quality-style selector dword `[this+0xd8]`, yielding at most `0x100`, `0x200`, or `0x400`. Current grounded caller is the type-`2` import branch at `0x00542e15`, so this is the safest current read for the shared surface-dimension cap helper rather than a generic scalar accessor.","objdump + caller inspection + local disassembly + surface-family correlation + dimension-cap correlation"
0x00541210,709,surface_row_repack_rgba_or_rgb32_into_active_16bit_buffer_with_palette_mode_gate,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Row-side repack owner beneath the same RGBA surface family. When shell capability byte `[0x006d4024+0x114255]` is live and editor-map gate `[0x006d4024+0x11422f]` is clear, the helper requires row backing buffer `[row+0x26]`, ensures one active output buffer at `[row+0x2a]`, seeds row state `[row+0x04/+0x10/+0x1c/+0x22]`, and then repacks the caller pixels into a 16-bit destination. The current split is structural but real: when owner byte `[this+0x96]` is nonzero it computes a palette-like packed color from accumulated channel maxima; otherwise it uses direct nibble-packed conversion from the source dwords. When owner byte `[this+0x97]` is clear it also frees the source backing pointer `[row+0x26]` on exit. Current grounded callers are `surface_owner_commit_backing_rgba_buffer_recompute_size_and_republish` `0x005438d0` and the broader row-type import body at `0x00541c30`, so this is the safest current read for the active 16-bit repack owner rather than a generic blit.","objdump + caller inspection + local disassembly + surface-family correlation + repack correlation + capability-gate correlation"
0x00541970,292,surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Shared query-or-materialize helper in the same `0xec`-byte surface-owner family. For non-type-`2` rows it optionally returns width and height from `[row+0x08/+0x0c]`, then returns active RGBA backing pointer `[row+0x26]` when already live. If that RGBA buffer is still null, the helper allocates `width * height * 4` bytes, expands the current 16-bit source buffer `[row+0x2a]` into nibble-doubled RGBA dwords, stores the result into `[row+0x26]`, and returns that pointer. Current grounded callers include the cached world-presentation strip `0x005323f0/0x00532460`, the staged overlay publisher `0x00534af0`, the secondary-overlay loaders `0x00535430/0x00538060`, and the save/setup preview seam below `0x00542550`, so this is the safest current read for querying or materializing the RGBA backing buffer from the active 16-bit row rather than a generic width or height helper.","objdump + caller inspection + local disassembly + surface-family correlation + RGBA-materialization correlation"
0x00541aa0,48,surface_owner_query_first_row_width_or_one,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Tiny first-row width query in the same surface-owner family. When active-count byte `[this+0x04]`, companion byte `[this+0x98]`, and first row pointer `[this+0xa0]` are all live, the helper returns width dword `[row+0x08]`; otherwise it falls back to `1`. Current grounded callers include the world-presentation math strips at `0x0055238a/0x005523b6` and the later projection-side branch `0x0055f5d0`, so this is the safest current read for the first-row width-or-one helper rather than a generic scalar accessor.","objdump + caller inspection + local disassembly + surface-family correlation + width-query correlation"
0x00541ad0,48,surface_owner_query_first_row_height_or_one,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Height-side sibling to `surface_owner_query_first_row_width_or_one` in the same surface-owner family. When active-count byte `[this+0x04]`, companion byte `[this+0x98]`, and first row pointer `[this+0xa0]` are all live, the helper returns height dword `[row+0x0c]`; otherwise it falls back to `1`. Current grounded callers include the same world-presentation and projection-side strips at `0x0055250e/0x0055253a` and `0x0055f5ed`, so this is the safest current read for the first-row height-or-one helper rather than a generic scalar accessor.","objdump + caller inspection + local disassembly + surface-family correlation + height-query correlation"
0x00541bf0,32,surface_owner_refresh_cached_shell_scalar_0xd4_and_return_bound_handle_0xc0,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Small state-refresh helper in the same surface-owner family. The helper reads the live shell presenter through `0x0051f070`, copies presenter dword `[presenter+0x05]` into cached owner field `[this+0xd4]`, and returns bound handle `[this+0xc0]`. Current grounded caller is the layout-state binding strip at `0x00545566`, so this is the safest current read for refreshing cached shell scalar `0xd4` and returning handle `[+0xc0]` rather than a broader semantic owner.","objdump + caller inspection + local disassembly + surface-family correlation + cached-shell-scalar correlation"
0x00541c10,32,surface_owner_release_selector_handle_0x07_if_present,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Tiny selector-handle release helper in the same surface-owner family. When owner field `[this+0x07]` is nonzero, the helper re-enters `0x00541780` on that handle and then clears `[this+0x07]` back to zero. Current grounded callers include the broader release body `0x00542c90`, the local maintenance strip at `0x0053293c`, and the cache-refresh owner around `0x00543521/0x00543593`, so this is the safest current read for releasing selector handle `+0x07` rather than a generic destructor fragment.","objdump + caller inspection + local disassembly + surface-family correlation + selector-handle correlation"
0x00541b10,132,surface_owner_allocate_first_free_row_slot_0xa0_and_seed_dimensions_and_type,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Slot allocator in the `0xec`-byte RGBA surface-owner family. The helper scans the eight-entry row-pointer band `[this+0xa0 .. +0xbc]` for the first null slot, increments active-count byte `[this+0x04]`, marks companion byte `[this+0x98 + slot] = 1`, allocates one `0x32`-byte row, zeroes it, seeds row fields `[row+0x08]` and `[row+0x0c]` from the caller width and height, mirrors the third caller dword into `[row+0x14/+0x18]`, stores the row into `[this+0xa0 + slot*4]`, and returns the slot index or `-1` when no slot is free. Current grounded caller is `surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode` `0x00543980`, which invokes it as `(..., width, height, 3)`, so this is the safest current read for allocating the first free surface-row slot rather than a generic small object allocator.","objdump + caller inspection + local disassembly + surface-family correlation + row-slot correlation"
0x00541ba0,66,surface_owner_release_row_slot_0xa0_by_index,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Release-side companion to `0x00541b10` in the same surface-owner family. When the caller-supplied slot index is in range and row pointer `[this+0xa0 + slot*4]` is live, the helper decrements active-count byte `[this+0x04]`, releases the row through `0x00540f60`, clears companion byte `[this+0x98 + slot]`, and nulls the stored row pointer. Current evidence grounds it as the indexed row-slot releaser beneath the same temporary-surface and cached-surface owner family.","objdump + caller inspection + local disassembly + surface-family correlation + row-slot correlation"
0x00541c30,1024,surface_row_import_tagged_baba_babb_babe_payload_to_rgba_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Broader type-`4` row-import owner beneath `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50`. After the usual early fast path through `0x00541210`, the helper reads one tagged payload stream, validates the fixed tag sequence rooted at `0xbabe` and the following `0xbaba/0xbabb` alternatives, allocates temporary buffers for the recovered bands, and then reconstructs one RGBA destination buffer from those tagged payload pieces before storing it back into the active row. The current grounded split is structural but real: one branch routes the recovered tagged bands through `0x00553120`, another copies one direct recovered band, and the mismatch branch falls back to an all-`0xff` fill. On success it seeds row fields `[row+0x08/+0x0c/+0x10/+0x14/+0x18/+0x1c/+0x26]` for the type-`4` family and then re-enters `0x00541210` to materialize the live 16-bit buffer. This is the safest current read for the tagged `0xbabe/0xbaba/0xbabb` payload importer rather than a generic stream helper.","objdump + caller inspection + local disassembly + surface-family correlation + tagged-payload correlation"
0x00542030,905,surface_row_import_headered_rgb_or_paletted_payload_to_rgba_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Broader type-`3` row-import owner beneath `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50`. After the same early repack fast path through `0x00541210`, the helper resolves one headered payload through the local stream service, validates recovered width and height against the live shell caps, rejects unsupported header combinations, allocates a full RGBA destination plus one temporary `0x40000` staging buffer, and then decodes the payload into RGBA rows. The current grounded split is structural but real: it accepts direct `0x20`-byte-per-pixel and `0x18`-byte-per-pixel source bands, can reseed an auxiliary table lookup through `0x0053b7c0`, and treats one large-value branch as a staged scanline reader rather than a raw memcpy. On success it seeds row fields `[row+0x08/+0x0c/+0x10/+0x14/+0x18/+0x1c/+0x26]` for the type-`3` family and re-enters `0x00541210` with row flag byte `[row+0x20]` selected from the dimension threshold branch. This is the safest current read for the headered RGB or paletted payload importer rather than another generic buffer copy.","objdump + caller inspection + local disassembly + surface-family correlation + headered-payload correlation"
0x005423d0,380,surface_row_materialize_dxt3_payload_into_active_16bit_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"DXT3 materializer beneath the same type-`2` row family. When the active output buffer `[row+0x2a]` is still null and compressed payload `[row+0x2e]` is live, the helper builds two temporary codec-side objects through `0x00570691`, forwards the row payload and format tag `0x33545844` (`DXT3`) into the adjacent decode path `0x0057025d`, runs the follow-on materialization step `0x005706f7`, and then allocates the live output buffer `[row+0x2a]`, copies the decoded bytes into it, seeds row state `[row+0x04/+0x10/+0x14/+0x1c/+0x22]`, and releases the temporary codec objects. Current grounded caller is the non-editor tail of `surface_row_import_dds_dxt3_payload_and_optionally_materialize_buffer` `0x00542d50`, so this is the safest current read for materializing the compressed DXT3 row payload into the active output buffer rather than another generic codec wrapper.","objdump + caller inspection + local disassembly + surface-family correlation + DXT3-correlation + decode-materialization correlation"
0x00542550,786,surface_owner_capability_gated_postprocess_non_type2_rows_into_live_16bit_buffers,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Capability-gated row postprocess owner in the same surface family. When shell capability byte `[0x006d4024+0x11422d]` is live and owner byte `[this+0x95]` has not already latched, the helper walks the active row slots, skips type-`2` rows and rows whose processed byte `[row+0x21]` is already set, forces RGBA materialization through `surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row` `0x00541970`, marks the row processed, seeds row state `[row+0x1c] = 0x3c`, discards the previous live 16-bit buffer `[row+0x2a]`, allocates a replacement destination, and then rebuilds `[row+0x22/+0x2a]` from a float-heavy neighbor-difference transform over the RGBA source. For rows whose pixel-size tag `[row+0x10]` equals `0x20`, it halves the stored byte count `[row+0x04]` after the rebuild. Current grounded caller is the world-presentation template seeder `0x005356e0`, which revisits the earlier overlay slot series and runs this helper after clearing byte `[slot+0x05]`, so this is the safest current read for the capability-gated postprocess over non-type-`2` rows rather than a generic buffer conversion.","objdump + caller inspection + local disassembly + surface-family correlation + processed-row correlation + neighbor-difference correlation"
0x00542870,69,surface_owner_release_all_row_slots_0xa0,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Compact full-slot release helper in the same surface-owner family. The function walks all eight row slots `[this+0xa0..+0xbc]`, and for each live slot decrements active-count byte `[this+0x04]`, releases the row through `0x00540f60`, clears companion byte `[this+0x98 + slot]`, and nulls the stored row pointer. Current grounded caller is the broader release owner `surface_owner_release_helpers_unlink_global_entry_and_drop_row_slots` `0x00542c90`, which uses this after unlinking the global owner entry, so this is the safest current read for releasing all row slots rather than a generic loop body.","objdump + caller inspection + local disassembly + surface-family correlation + full-slot-release correlation"
0x005428c0,607,surface_row_encode_active_pixels_and_write_tagged_records_to_open_stream,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Broader file-write owner in the same import/export surface seam. The helper allocates one alpha-sized plane and one `3 * width * height` RGB plane from the active row dimensions, splits current backing pixels `[row+0x26]` into those temporary buffers, seeds a stack image/codec object, and then writes several tagged records into the already-open stream passed by the caller. The current grounded split is structural: when the caller requests the transformed path it forwards the temporary planes through `0x00553000` before writing the tagged records `0xbaba`, `0xbabb`, and `0xbabe`; otherwise it writes the raw split buffers and the same trailing tag family directly. It frees the temporary planes before returning. Current grounded caller is `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50`, which opens the destination path in `a+b` mode and forwards the resulting stream here, so this is the safest current read for encoding the active surface row and writing tagged records to the open stream rather than a generic image copy helper.","objdump + caller inspection + local disassembly + surface-family correlation + tagged-record correlation + open-stream correlation"
0x00542b30,208,surface_owner_write_first_row_rgba_payload_with_0x12_byte_header_to_named_file,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Direct file-write sibling to `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50` in the same preview-surface seam. The helper opens one caller-supplied path in `wb` mode, builds a compact `0x12`-byte header on the stack with row type `2`, the first-row width and height, fixed pixel-size byte `0x20`, and one optional flag bit `0x20` when the second caller argument is nonzero, then optionally forces RGBA materialization through `surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row` `0x00541970` and writes the first-row RGBA payload `[row+0x26]` plus the header to the open stream. Current grounded callers are the paired export-side branches at `0x00520cda`, `0x00520f61`, and `0x00534dd6`, each of which uses this as the direct-file alternative to `0x00542f50` before releasing the temporary surface owner through `0x00542c90 + 0x0053b080`, so this is the safest current read for writing the first row plus its `0x12`-byte header to a named file rather than a generic save helper.","objdump + caller inspection + local disassembly + surface-family correlation + direct-file-write correlation"
0x00542c10,114,shell_release_active_global_layout_cache_entries,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Global cache-release sweep in the shell layout-state family. The helper walks the linked list rooted at `0x00ccbb2c`, and for every active entry `[entry+0x07]` releases optional handles `[entry+0xc0]` and `[entry+0xc8]` through vtable slot `+0x08`, refreshes controller-side cached field `[0x006d4024+0x1136ad]` through `0x0051f990`, clears sibling bookkeeping dwords `[entry+0xcc/+0xd0/+0xd4]`, decrements active-count global `0x00ccbb34`, and resets `[entry+0x07]` back to `0`. Current grounded callers are the small and broad layout-state release bodies `0x0055dd80` and `0x0055e060`, so this is the safest current read for releasing the active global layout-cache entries rather than a generic list walk.","objdump + caller inspection + local disassembly + layout-state correlation + global-cache correlation"
0x00542c90,177,surface_owner_release_helpers_unlink_global_entry_and_drop_row_slots,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Primary release body for the same global surface-owner family. The helper releases optional companion helpers `[this+0xdc]` and `[this+0xe4]` through `0x005571d0 + 0x0053b080`, clears sibling field `[this+0xe0]`, unlinks the owner from the intrusive global list rooted at `0x00ccbb2c`, conditionally refreshes the live shell presenter through `0x005271a0` when owner byte `[this+0x93]` is set, re-enters `0x00541780` to drop any active selector-side handle, re-enters `surface_owner_release_all_row_slots_0xa0` `0x00542870`, and finally clears `[this+0x07]` plus `[this+0xc0]`. Current grounded callers include the save-side temporary preview helper `0x00442740`, the world-presentation slot-release strips `0x00532760/0x00532b30/0x00534f80`, and the shell overlay release path `0x0047b320`, so this is the safest current read for releasing helper objects, unlinking the global surface-owner entry, and dropping the row slots rather than a generic destructor stub.","objdump + caller inspection + local disassembly + surface-family correlation + global-list correlation + row-slot-release correlation"
0x00542f50,95,surface_owner_open_named_resource_and_dispatch_row_type_import,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Named-resource import dispatcher in the same temporary-surface and cached-surface family used by the setup/save preview helpers. The function takes one caller path seed, opens or resolves the matching resource file through the neighboring file-open strip, forwards the result into `0x005428c0`, and then dispatches the imported row by embedded type dword `[row+0x18]`: current grounded branches are type `2 -> 0x00542d50`, type `3 -> 0x00542030`, and type `4 -> 0x00541c30`, with the fallback returning `2`. Current grounded caller is `shell_build_temp_surface_from_payload_preview_pixels_and_query_named_resource_field_0x46` `0x00442740`, which uses the returned dword as payload field `[record+0x18]`, so this is the safest current read for the named-resource open-and-import dispatcher rather than a generic file helper.","objdump + caller inspection + local disassembly + surface-family correlation + row-type-dispatch correlation"
0x00542fb0,64,surface_owner_dispatch_row_import_by_embedded_type,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Small row-type selector beneath the same import seam. The helper reads embedded row type dword `[row+0x18]` and dispatches type `2` to `surface_row_import_dds_dxt3_payload_and_optionally_materialize_buffer` `0x00542d50`, type `3` to `surface_row_import_headered_rgb_or_paletted_payload_to_rgba_buffer` `0x00542030`, and type `4` to `surface_row_import_tagged_baba_babb_babe_payload_to_rgba_buffer` `0x00541c30`, returning `2` on the unsupported fallback path. Current grounded caller is the temporary-slot wrapper `0x00543000`, so this is the safest current read for the embedded row-type import selector rather than another file-open helper.","objdump + caller inspection + local disassembly + surface-family correlation + row-type-dispatch correlation"
0x00543000,128,surface_owner_allocate_temp_row_slot_dispatch_import_and_release_on_failure,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Temporary-slot import wrapper in the same surface-owner family. The helper clears selector field `[this+0x07]`, allocates one fresh slot through `surface_owner_allocate_first_free_row_slot_0xa0_and_seed_dimensions_and_type` `0x00541b10`, dispatches the newly allocated row through `surface_owner_dispatch_row_import_by_embedded_type` `0x00542fb0`, releases the slot again through `0x00541ba0` when the import result is `1` or `2`, and then refreshes cached byte totals and row state through `0x00540fc0` before returning the import status. Current grounded callers are the higher surface-owner service strip immediately above `0x00543080`, so this is the safest current read for allocating a temporary row slot, dispatching the type-specific import, and releasing it on failure rather than a broader constructor.","objdump + caller inspection + local disassembly + surface-family correlation + temp-slot-import correlation"
0x00543080,403,surface_owner_refresh_row_budget_flags_and_optionally_postprocess_or_republish,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Broader per-owner validation and budget-refresh pass above the temporary-slot import seam. Unless constructor bytes `[this+0x93/+0x94]` stay live or selector token `[this+0x07]` already matches the current shell mode token `[0x006d4024+0x114222]`, the helper walks the eight row slots `[this+0xa0..+0xbc]`, re-enters `surface_owner_dispatch_row_import_by_embedded_type` `0x00542fb0` on each live row payload, drops rows whose import result is `1` or `2`, and otherwise marks the per-row readiness bytes `[this+0x98..+0x9f]` against the caller-supplied byte-budget threshold plus fixed ceiling `0x84d0`. It then derives owner byte `[this+0x06]` from the surviving ready rows, returns `2` when active-count byte `[this+0x04]` is zero, optionally clears postprocess latch `[this+0x95]` and re-enters `surface_owner_capability_gated_postprocess_non_type2_rows_into_live_16bit_buffers` `0x00542550` when the local non-type-`2` gate stays armed, and can optionally tail into `0x005435d0` for the publish side. Current grounded callers are the broader global service owner `0x00543220` and the bound-handle refresh owner `0x005435d0`, so this is the safest current read for refreshing row budget flags and triggering the later postprocess or republish strip rather than a smaller row-import loop.","objdump + caller inspection + local disassembly + surface-family correlation + row-budget correlation + postprocess correlation"
0x00543220,929,surface_owner_service_global_active_list_with_camera_motion_budget,shell,fastcall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Broader global service owner above `0x00543080` for the intrusive surface-owner list rooted at `0x00ccbb2c`. When caller `ECX` is null, the helper first rate-limits the pass through `0x0051d890` and the timestamp cache at `0x00ccbb54`, samples the live shell view matrix from `[0x006d4024+0x28]`, computes one summed camera-motion delta against cached globals `0x00ccbb3c..0x00ccbb50`, and then chooses one dynamic byte-budget threshold from the fixed ladder `0x172/0x25d/0x28f/0x2c1/0x325/0x41f/0x613/0x9fb` before caching the current matrix band back into those globals. It then enters the active-owner service side, clears the local visit counter `0x00ccbb38`, refreshes one shell-side gate through `0x0051f070/0x0051f990`, retires stale owners whose cached timestamp `[owner+0xd4]` lags the current shell scalar by more than `0x3e8`, and finally revisits the surviving active owners through `surface_owner_refresh_row_budget_flags_and_optionally_postprocess_or_republish` `0x00543080` whenever the current dynamic budget crosses the local scaled row thresholds. Current grounded callers are the camera-command registration strip at `0x00466911/0x00466948` and the setup-side owner branch at `0x0052c1cb`, so this is the safest current read for the global active-list service with camera-motion-derived byte budget rather than a generic list walk.","objdump + caller inspection + local disassembly + surface-family correlation + global-list correlation + camera-motion-budget correlation"
0x005435d0,763,surface_owner_publish_first_ready_row_chain_into_bound_handle_and_free_uploaded_buffers,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Primary bound-handle publish owner beneath the surface-row commit and layout-slot binding strips. When constructor byte `[this+0x93]` is set, the helper can lazily ensure selector handle `[this+0x07]` through `0x005417e0` from the stored dimension pair `[this+0x0b/+0x0f]` and the caller-supplied presentation handle, then stamps `[this+0x07]` to the current shell mode token once prerequisites `[this+0xc4/+0xc8]` are live. On the ordinary branch it first re-enters `surface_owner_refresh_row_budget_flags_and_optionally_postprocess_or_republish` `0x00543080` when bound handle `[this+0xc0]` is still absent or the caller forces refresh, then finds the first ready row flagged in `[this+0x98..]`, snapshots one shell scalar into `[this+0xd4]`, and asks the caller-supplied presentation or resource handle to materialize the matching target through vtable slot `+0x50`, storing the resulting handle in `[this+0xc0]`. It then uploads the chosen row and any matching-dimension siblings as a mip-style chain through `[bound_handle]+0x3c`, copying row payload `[row+0x22]` into the acquired target buffer and releasing the temporary target each time. After upload it frees the consumed row buffers `[row+0x22/+0x26/+0x2a/+0x2e]`, stamps selector token `[this+0x07]` to the current shell mode, increments active-owner global `0x00ccbb34`, and refreshes cached byte totals and row state through `0x00540fc0`. Current grounded callers are `surface_owner_commit_backing_rgba_buffer_recompute_size_and_republish` `0x005438d0` and `layout_state_set_optional_item_binding_in_slot_table_0x2593` `0x00545520`, so this is the safest current read for publishing the first ready row chain into the bound handle and freeing the uploaded buffers rather than a generic constructor or free helper.","objdump + caller inspection + local disassembly + surface-family correlation + bound-handle correlation + mip-chain correlation"
0x005438d0,173,surface_owner_commit_backing_rgba_buffer_recompute_size_and_republish,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Commit-side publish helper in the same `0xec`-byte RGBA surface-owner family used by `0x00543980`. When the caller supplies a nonnull backing buffer, the helper replaces existing row buffer `[row+0x26]`, freeing the old buffer when it differs. It then resets state byte `[row+0x20]` to `0`, restores state dword `[row+0x1c] = 0x15`, mirrors active backing pointer into `[row+0x22]`, recomputes byte size `[row+0x04] = width * height * 4` from `[row+0x08/+0x0c]`, re-enters `0x00541210`, publishes through `0x005435d0`, and finally clears owner dwords `[this+0xcc/+0xd0]`. Current grounded callers are the surface constructor `0x00543980`, the cached world-presentation surface strip at `0x00532460/0x00534af0`, and the shell overlay raster wrappers `0x0047b3d0/0x0047b470`, so this is the safest current read for committing the active RGBA backing buffer and republishing the live surface row rather than a generic free helper.","objdump + caller inspection + local disassembly + surface-family correlation + republish correlation"
0x00543980,131,surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Constructor or ensure helper for the `0xec`-byte RGBA surface-owner family. The function takes an optional caller pixel buffer, width, height, and one extra mode or flag argument. When the pixel buffer is null it allocates `width * height * 4` bytes itself, then re-enters `0x00540e30`, copies the fixed owner label at `0x005dd924` into `[this+0x13]`, and on first use seeds local bytes `[this+0x94] = 1` and `[this+0x96] = 0`, allocates one slot row through `0x00541b10(width, height, 3)`, and commits the active backing pixels through `0x005438d0`. It finishes by re-entering `0x00540fc0`, clears byte `[this+0x05]`, and returns `this`. Current grounded callers include the save-side temporary preview helper `0x00442740`, the world-presentation cached-surface owners `0x005323f0/0x00535100/0x00535430`, and the shell overlay ensure-surface owner `0x0047b470`, so this is the safest current read for initializing or ensuring one RGBA surface owner from caller pixels and dimensions rather than a world-only allocator.","objdump + caller inspection + local disassembly + surface-family correlation + first-use-slot-allocation correlation"
0x00543a10,191,shell_cursor_capture_init_bind_helper_object_and_seed_half_xy_defaults,shell,thiscall,inferred,objdump + caller inspection + local disassembly + mouse-cursor correlation,2,"Constructor-side initializer for the shell cursor-capture helper family. The helper seeds stored XY `[this+0x09/+0x0d]` to `0.5f`, clears the stored XYZ triplet `[this+0x11/+0x15/+0x19]`, edge-mask dword `[this+0x1d]`, and active byte `[this+0x08]`, then allocates and binds two owned helper objects through the caller-supplied roots and fixed literals `0x005dd974`, `0x005dd934`, and `0x005e1b34`. It finishes by forwarding the second caller argument into the bound helper through vtable slot `+0x34` with selector `5`. Current grounded caller is `0x00520341`, which stores the resulting object at `[owner+0x20]`, so this is the safest current read for initializing the cursor-capture helper, binding its owned helper objects, and seeding the half-XY defaults rather than a generic allocator.","objdump + caller inspection + local disassembly + mouse-cursor correlation + constructor correlation"
0x00543ae0,61,shell_cursor_capture_begin_and_snapshot_live_xy,shell,thiscall,inferred,objdump + caller inspection + local disassembly + mouse-cursor correlation,2,"Small begin-capture helper in the shell cursor-helper family. When active byte `[this+0x08]` is clear, the helper sets it, dispatches vtable slot `+0x1c` on helper object `[this+0x04]`, and snapshots current live shell cursor XY from `0x006d4018+0xa94/+0xa98` into `[this+0x09/+0x0d]`. Current grounded callers are `0x0051e941` and `0x005203bd`, which use it when the surrounding mouse or view mode toggles into the captured branch, so this is the safest current read for beginning cursor capture and snapshotting the live XY anchor rather than a generic state setter.","objdump + caller inspection + local disassembly + mouse-cursor correlation + capture-anchor correlation"
0x00543b20,121,shell_cursor_capture_end_and_restore_screen_position_from_stored_xy,shell,thiscall,inferred,objdump + caller inspection + local disassembly + mouse-cursor correlation,2,"End-capture companion to `0x00543ae0` in the same shell cursor-helper family. When active byte `[this+0x08]` is set, the helper clears it, dispatches vtable slot `+0x20` on helper object `[this+0x04]`, scales stored XY `[this+0x09/+0x0d]` against the current shell zoom table rooted at `[0x006d4024+0x11421e/+0x34]`, adds the current window origin returned through `0x005201e0`, and then forwards the resulting screen coordinate pair through import `0x005c8264`. Current grounded callers are `0x0051e955`, `0x005203d8`, and the release helper `0x00543e60`, so this is the safest current read for ending cursor capture and restoring one screen position from the stored XY anchor rather than a generic vtable thunk.","objdump + caller inspection + local disassembly + mouse-cursor correlation + screen-position-restore correlation"
0x00543ba0,97,shell_cursor_capture_query_stored_or_live_xyz_triplet,shell,thiscall,inferred,objdump + caller inspection + local disassembly + mouse-cursor correlation,2,"Triple-output query helper in the same shell cursor-helper family. The helper copies stored accumulators `[this+0x11/+0x15/+0x19]` into the caller out-pointers when active byte `[this+0x08]` is set. Otherwise it falls back to the current live shell cursor triplet from `0x006d4018+0xa94/+0xa98/+0xa9c`. Current grounded callers include `world_view_service_shell_input_pan_and_hover` `0x0043db00`, so this is the safest current read for querying the stored-or-live cursor triplet rather than a generic copy helper.","objdump + caller inspection + local disassembly + mouse-cursor correlation + cursor-triplet correlation"
0x00543c10,63,shell_cursor_capture_query_stored_or_live_xy_pair,shell,thiscall,inferred,objdump + caller inspection + local disassembly + mouse-cursor correlation,2,"XY-only sibling to `0x00543ba0` in the same shell cursor-helper family. The helper copies stored XY `[this+0x09/+0x0d]` into the caller out-pointers when active byte `[this+0x08]` is set, otherwise falling back to the current live shell cursor pair from `0x006d4018+0xa94/+0xa98`. Current grounded callers include `shell_publish_text_callout_presentation` `0x005519f0`, the world-view side `0x0043919c`, and multiple shell helper branches around `0x00458ef2`, `0x0051e869`, and `0x0053f5ac`, so this is the safest current read for querying the stored-or-live cursor XY pair rather than a broader mouse-state owner.","objdump + caller inspection + local disassembly + mouse-cursor correlation + cursor-xy correlation"
0x00543c50,432,shell_cursor_capture_service_relative_deltas_clamps_and_edge_flags,shell,thiscall,inferred,objdump + caller inspection + local disassembly + mouse-cursor correlation,2,"Broader service owner above the stored cursor-query helpers. When active byte `[this+0x08]` is set, the helper first queries one current window or view metric bundle from helper object `[this+0x04]` through vtable slot `+0x24(0x14, ...)`; on failure it clears the active byte and re-enters `0x00543ae0` to reseed capture. On success it converts the returned integer delta band into floats, suppresses repeated zero-delta states through globals `0x00ccbb5c/0x00ccbb60`, accumulates the resulting motion into stored XY `[this+0x09/+0x0d]` plus the wider triplet `[this+0x11/+0x15/+0x19]`, clamps the XY anchors to `[0.0, 1.0]`, derives one local edge-flag bitmask in `[this+0x1d]`, and then forwards the current XY, one depth-like scalar, and those flag bits into `0x0054eb90` when live shell input `0x006d4018` is present. Current grounded callers are `world_view_service_shell_input_pan_and_hover` `0x0043db00` and the shell-side caller at `0x0053f589`, so this is the safest current read for servicing relative cursor deltas, clamps, and edge flags rather than a smaller coordinate getter.","objdump + caller inspection + local disassembly + mouse-cursor correlation + relative-delta correlation + edge-flag correlation"
0x00543e00,24,shell_input_query_live_word_0xa8c_bit_0x400,shell,cdecl,inferred,objdump + caller inspection + local disassembly + input-word correlation,2,"Tiny live-input predicate over shell input root `0x006d4018`. When that root is present, the helper masks input word `[input+0xa8c]` with `0x400` and returns the resulting nonzero or zero value; otherwise it returns `0`. Current grounded callers are the world-view pan predicates `0x0043af60` and `0x0043b030`, the larger input service `0x0043db00`, and one shell helper branch at `0x00458f70`, so this is the safest current read for querying live input bit `0x400` rather than a broader mode owner.","objdump + caller inspection + local disassembly + input-word correlation + world-view correlation"
0x00543e20,24,shell_input_query_live_word_0xa8c_bit_0x2000,shell,cdecl,inferred,objdump + caller inspection + local disassembly + input-word correlation,2,"Small sibling to `0x00543e00` over the same live shell input word. When input root `0x006d4018` is present, the helper masks `[input+0xa8c]` with `0x2000` and returns the resulting nonzero or zero value; otherwise it returns `0`. Current grounded callers are the same world-view pan predicates `0x0043af60` and `0x0043b030`, the recurring world-view input service `0x0043db00`, and the `GameUppermost` strip around `0x004e07f8/0x004e0aad`, so this is the safest current read for querying live input bit `0x2000` rather than a broader shell-state owner.","objdump + caller inspection + local disassembly + input-word correlation + world-view correlation"
0x00543e40,24,shell_input_query_live_word_0xa8c_bit_0x800,shell,cdecl,inferred,objdump + caller inspection + local disassembly + input-word correlation,2,"Small sibling to `0x00543e00/0x00543e20` over the same live shell input word. When input root `0x006d4018` is present, the helper masks `[input+0xa8c]` with `0x800` and returns the resulting nonzero or zero value; otherwise it returns `0`. Current grounded callers are again the world-view pan predicates `0x0043af60` and `0x0043b030`, the recurring input service `0x0043df9d`, and the `GameUppermost` strip at `0x004e07f8/0x004e0aad`, so this is the safest current read for querying live input bit `0x800` rather than a broader shell-state owner.","objdump + caller inspection + local disassembly + input-word correlation + world-view correlation"
0x00543e60,27,shell_cursor_capture_release_owned_helpers_after_end_capture,shell,thiscall,inferred,objdump + caller inspection + local disassembly + mouse-cursor correlation,2,"Release-side companion to the same shell cursor-capture helper family. The helper first re-enters `shell_cursor_capture_end_and_restore_screen_position_from_stored_xy` `0x00543b20`, then releases owned helper object `[this+0x04]` and the outer root object `[this+0x00]` through their vtable slot `+0x08` destructors. Current grounded callers are the owner teardown branches `0x0051ffc8`, `0x00520418`, and `0x005214c5`, which drop the helper stored at `[owner+0x20]`, so this is the safest current read for releasing the owned cursor-capture helpers after ending capture rather than a generic destructor thunk.","objdump + caller inspection + local disassembly + mouse-cursor correlation + release correlation"
0x00543e80,32,layout_state_publish_fixed_unit_scalar_block_to_bound_node_slot_0x90_selector3,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly + bound-node correlation,2,"Small fixed publish helper in the layout-state family. The function forwards the fixed argument block `(0, 0, 3, 0, 1.0f, 0)` into bound presentation node `[this+0x25df]` through node vtable slot `+0x90`. Current grounded caller is the setup-side branch at `0x0052be6b`, which reaches this helper when shell byte `[0x006d4024+0x11421a]` is clear before republishing property `0x07`, so this is the safest current read for publishing the fixed unit-scalar block to node slot `+0x90` selector `3` rather than a broader mode owner.","objdump + caller inspection + local disassembly + layout-state correlation + bound-node correlation"
0x00543ea0,64,layout_state_publish_optional_rgb_and_scalar_block_to_bound_node_slot_0x90_selector3,bootstrap,cdecl,inferred,objdump + caller inspection + local disassembly + bound-node correlation,2,"Broader sibling to `0x00543e80` in the same layout-state family. When the first caller byte is nonzero, the helper optionally derives a 24-bit RGB value from `[this+0x25a3]` when the second caller byte is set, then forwards `(0, 0, 3, rgb_or_0, scalar, edge_flag)` into bound presentation node `[this+0x25df]` through node vtable slot `+0x90`, where the scalar comes from the third caller argument and `edge_flag` is the first caller byte. Current grounded callers are the setup-side branches `0x0052be2c` and `0x0052c091`, so this is the safest current read for publishing the optional RGB-plus-scalar block to node slot `+0x90` selector `3` rather than a generic color helper.","objdump + caller inspection + local disassembly + layout-state correlation + bound-node correlation + optional-rgb correlation"
0x00543ee0,33,layout_state_publish_fixed_unit_scalar_block_to_bound_node_slot_0x90_selector2,bootstrap,thiscall,inferred,objdump + local disassembly + bound-node correlation,2,"Fixed selector-`2` sibling to `0x00543e80` in the same layout-state family. The function forwards the fixed argument block `(0, 0, 2, 0, 1.0f, 0)` into bound presentation node `[this+0x25df]` through node vtable slot `+0x90`. Current grounded evidence is the internal fixed-branch sibling immediately below `0x00543ea0`, so this is the safest current read for the fixed selector-`2` publish helper rather than a broader mode owner.","objdump + local disassembly + layout-state correlation + bound-node correlation"
0x005454c0,82,layout_state_snapshot_current_slot_triplet_table_into_history_list_0x259f,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared slot-table snapshot helper in the broader layout-state presentation family. The function allocates one temporary copy of the current `0x18`-byte-per-slot triplet table `[this+0x2597]`, copies the whole live slot table into that buffer, and then appends the copied buffer into the history-style list rooted at `[this+0x259f]` through `0x00556e10`. Current grounded callers are the tightly clustered probe-side branches `0x0055de10..0x0055df9f`, so this is the safest current read for snapshotting the current slot-triplet table into history list `[+0x259f]` rather than a generic allocator wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + slot-triplet correlation + history-list correlation"
0x00545520,179,layout_state_set_optional_item_binding_in_slot_table_0x2593,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared optional-binding setter over slot table `[this+0x2593]` in the broader layout-state presentation family. When the requested slot index is in range, the helper compares the incoming item pointer against the current slot binding. For nonnull items it first checks item dword `[item+0x07]` against the current shell-side mode token `[0x006d4024+0x114222]`; mismatches are normalized through `0x005435d0(item, [this+0x25df], 0)` before the final bind. Effective changes then publish node property slot `+0xf4` on `[this+0x25df]`, using the derived item-side dword returned from `0x00541bf0` for nonnull bindings or `0` for clears, incrementing local change counter `[this+0x370d]` and mirroring the final pointer back into `[this+0x2593 + slot*4]`. Current grounded callers include the nearby-presentation and layout-state refresh strips `0x005243eb`, `0x0052876a`, `0x00548a24`, and many sibling presentation owners, so this is the safest current read for the optional per-slot item-binding publisher rather than a generic list write.","objdump + caller inspection + local disassembly + layout-state correlation + slot-binding correlation"
0x005455e0,224,layout_state_set_slot_triplet_lo,bootstrap,thiscall,inferred,ghidra-headless,4,Updates the first three cached per-slot presentation scalars in the 24-byte slot table at [this+0x2597+slot*24]. In notify mode it compares against the cached values and forwards only changed fields into the bound presentation node through vtable slot +0xfc with subproperty ids 1 through 3.,ghidra + rizin + llvm-objdump
0x005456d0,240,layout_state_set_slot_triplet_hi,bootstrap,thiscall,inferred,ghidra-headless,4,Updates the second three cached per-slot presentation scalars in the same 24-byte slot table at [this+0x2597+slot*24]. In notify mode it compares against the cached values and forwards only changed fields into the bound presentation node through vtable slot +0xfc with subproperty ids 4 through 6.,ghidra + rizin + llvm-objdump
0x005458f0,169,layout_state_read_segment_record_window,bootstrap,thiscall,inferred,ghidra-headless,4,Gates the 32-byte segment-record table at [this+0x2643]; queries record bounds then copies a start-to-end or wrapped window into scratch storage at [this+0x2657] through vtable slot +0x2c while toggling byte flag [this+0x254e]. The downstream shell path treats each 0x20-byte record as two vec3 blocks plus two trailing scalars.,ghidra + rizin
0x005459a0,69,layout_state_read_segment_record_block,bootstrap,thiscall,inferred,ghidra-headless,4,Reads one 32-byte-indexed segment-record block from the same [this+0x2643] table into scratch storage at [this+0x2657] through vtable slot +0x2c using a fixed 0x2800-byte transfer span.,ghidra + rizin
0x00545b10,57,layout_state_read_vertex24_block,bootstrap,thiscall,inferred,ghidra-headless,4,Reads one 24-byte-indexed vertex block from the presentation table at [this+0x2647] through vtable slot +0x2c using index*24 addressing and returns the copied pointer through a stack outparam. The downstream shell emitter treats each record as vec3 plus a style dword plus two trailing scalars.,ghidra + rizin
0x00545b50,59,layout_state_read_vertex24_window,bootstrap,thiscall,inferred,ghidra-headless,4,Copies a window between two 24-byte vertex indices from [this+0x2647] into scratch storage at [this+0x2657] through vtable slot +0x2c using index*24 addressing and a fixed 0x1800-byte transfer span. The downstream shell emitter treats each record as vec3 plus a style dword plus two trailing scalars.,ghidra + rizin
0x00545c50,67,layout_state_commit_vertex24_span,bootstrap,thiscall,inferred,ghidra-headless,4,Converts a start and end vertex index range into a triplet count by dividing the delta by three accumulates that count at [this+0x3711] and notifies the bound presentation node at [this+0x25df] through vtable slot +0x118 with primitive-type argument 4.,ghidra + rizin
0x00545e30,1657,layout_state_query_external_report_and_build_summary_text_0x43c,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader report-summary owner in the layout-state family beneath the release and capability-gated property strip. The helper first queries one external/provider object through `0x0058bc36`; when that lookup fails it formats localized id `0x73` directly into summary buffer `[this+0x43c]` and returns success. On the live path it fetches one capability-style report through vtable slot `+0x10`, clears summary buffer `[this+0x43c]`, and then appends a sequence of localized fragments `0x74..0x7d`, fixed format strings such as `%1(16-bit HW) ` and `%1(8-bit HW) `, and several numeric fields from the returned report before returning. Current grounded caller is the broader setup-side layout-state owner branch `0x0054a12b`, so this is the safest current read for querying the external report and building summary text buffer `0x43c` rather than a generic string formatter.","objdump + caller inspection + local disassembly + layout-state correlation + summary-buffer correlation + external-report correlation"
0x00546390,63,layout_state_try_apply_shell_selected_resource_to_bound_owner_and_outparam_pair,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small apply-or-reject helper in the layout-state family. The function asks shell helper `0x0051f0f0` to resolve one intermediate object from the caller-supplied resource or selector plus bound-node pair `[this+0x25df]`, then forwards the returned object into owner `[this+0x25db]` through vtable slot `+0x3c` with fixed mode `1` and selector `0`. It returns success in `AL` when that owner call is nonnegative. Current grounded direct caller is the setup-side branch at `0x00549a6a`, which retries this helper across two shell-state variants before surfacing localized notice `0x0db9`, so this is the safest current read for trying to apply one shell-selected resource to the bound owner and caller outparam pair rather than a generic callback thunk.","objdump + caller inspection + local disassembly + layout-state correlation + bound-owner correlation + shell-helper correlation"
0x005463e0,149,layout_state_release_midband_bound_handles_with_notice_0x9b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Midband handle-release strip in the layout-state family. The helper walks a five-handle band rooted at `[this+0x260f]`, `[this+0x2617]`, `[this+0x261f]`, `[this+0x2627]`, and `[this+0x262f]`, releasing each live entry through vtable slot `+0x08`, clearing the corresponding field back to `0`, and emitting localized notice `0x9b` when the release reports success. Current grounded callers are the repeated layout-state owner branches `0x00549f1c..0x0054a1c2`, including the broader bound-presentation release body `0x0054a190`, so this is the safest current read for the midband bound-handle cleanup strip rather than a generic field reset.","objdump + caller inspection + local disassembly + layout-state correlation + handle-band correlation"
0x005464d0,105,layout_state_run_four_pass_bound_node_reset_strip,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small four-pass bound-node reset strip in the layout-state family. The helper re-enters node slot `+0x88`, then publishes fixed selector/value pairs through node slot `+0x90` and finally clears slot `+0x3c`, repeating that sequence four times against bound presentation node `[this+0x25df]`. Current grounded caller is the same broader owner strip that invokes `0x00545e30` and then selects shell mode `4` or `5`, so this is the safest current read for the repeated bound-node reset strip rather than a generic loop body.","objdump + caller inspection + local disassembly + layout-state correlation + bound-node correlation"
0x00546540,19,layout_state_set_property_0x17_to_7,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny fixed property setter over the bound presentation node `[this+0x25df]`. The helper simply publishes value `7` into property `0x17`. Current grounded caller is `0x0052cb68`, so this is the safest current read for setting property `0x17` to `7` rather than a broader mode switch.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation"
0x00546560,19,layout_state_set_property_0x17_to_4,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small sibling to `0x00546540` in the same layout-state family. The helper simply publishes value `4` into property `0x17` on bound node `[this+0x25df]`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00546580,19,layout_state_clear_property_0xa8,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny property-clear helper over bound presentation node `[this+0x25df]`. The function publishes `0` into property `0xa8`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x005465a0,19,layout_state_set_property_0xa8_to_0x0f,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small fixed property setter beside `0x00546580` in the same layout-state family. The helper publishes value `0x0f` into property `0xa8` on bound node `[this+0x25df]`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00546760,23,layout_state_publish_property_0x07_from_caller_dword,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny single-property publish helper in the layout-state family. The function forwards one caller dword into property `0x07` on the bound presentation node `[this+0x25df]` through node slot `+0xc8`. Current grounded callers include `0x0052be14`, `0x0052be74`, and `0x00564c54`, so this is the safest current read for publishing property `0x07` from the caller dword rather than a generic scalar setter.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation"
0x00546780,24,layout_state_publish_property_0x09_as_caller_dword_plus_one,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small sibling to `0x00546760` in the same layout-state family. The function increments the caller dword by one and forwards the result into property `0x09` on the bound presentation node `[this+0x25df]` through node slot `+0xc8`. Current grounded caller is `shell_commit_layout_updates` `0x00523d90`, so this is the safest current read for publishing property `0x09` as caller-plus-one rather than a broader mode owner.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation"
0x005467a0,50,layout_state_enable_presentation_gate,bootstrap,thiscall,inferred,ghidra-headless,4,Ensures the presentation node gate property 0x1c is enabled once for the layout state when the template flag at [[this+0x83c]+0x2e] permits it by setting [this+0x2549] and forwarding the toggle into the node at [this+0x25df].,ghidra + rizin
0x005467e0,41,layout_state_disable_presentation_gate,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Clear-side sibling to `0x005467a0` in the same layout-state family. When local gate byte `[this+0x2549]` is live, the helper clears that byte and publishes `0` into property `0x1c` on bound node `[this+0x25df]`.","objdump + local disassembly + layout-state correlation + presentation-gate correlation"
0x00546810,67,layout_state_raise_property_0x16_to_3_when_template_flag_0x1c_permits,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Template-gated property raiser in the layout-state family. When local mode byte `[this+0x254a]` is not already `2` and template byte `[[this+0x83c]+0x1c]` is nonzero, the helper publishes value `3` into property `0x16` on bound node `[this+0x25df]` and stores mode byte `[this+0x254a] = 2`.","objdump + local disassembly + layout-state correlation + template-gate correlation + property-strip correlation"
0x00546850,30,layout_state_set_property_0x16_to_2_and_store_mode1,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small sibling to `0x00546810` in the same layout-state family. The helper publishes value `2` into property `0x16` on bound node `[this+0x25df]` and stores mode byte `[this+0x254a] = 1`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00546890,41,layout_state_clear_property_0x16_and_reset_mode_byte_0x254a,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Clear-side sibling to `0x00546810/0x00546850` in the same layout-state family. When local mode byte `[this+0x254a]` is nonzero, the helper publishes value `1` into property `0x16` on bound node `[this+0x25df]` and resets `[this+0x254a]` back to `0`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00546a30,333,layout_state_rebuild_variant_asset_cache,bootstrap,thiscall,inferred,ghidra-headless,3,Releases any loaded entries in the 64-slot presentation asset bank rooted at 0x31ab then rebuilds the paired-key metadata table at 0x266b tracking active entries count at [this+0x2667] and sibling or reuse links for later keyed lookups.,ghidra + rizin
0x005465c0,284,layout_state_release_variant_bank_and_late_bound_handles_with_notice_0x9b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Late cleanup strip in the layout-state family beneath the broader bound-presentation release path. The helper first walks the 64-entry variant-bank table rooted at `[this+0x31ab]`, releasing every live entry through vtable slot `+0x08` with localized notice `0x9b` on successful release, then performs the same release-and-clear pattern on the later bound-handle band `[this+0x263f/+0x2643/+0x264f/+0x265b/+0x265f/+0x2663]`. Current grounded caller is the broader bound-presentation release body `0x0054a190`, so this is the safest current read for releasing the variant bank and late bound handles rather than a generic array clear.","objdump + caller inspection + local disassembly + layout-state correlation + variant-bank correlation + handle-band correlation"
0x00546d40,712,layout_state_publish_transform_descriptor_from_local_scalars_and_seeded_handle_0x36fd,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader descriptor-publish helper in the layout-state family. The helper builds one large stack descriptor from local scalar bands `[this+0x2517/+0x251b/+0x251f/+0x25f7/+0x25ff]`, scale factors `[this+0x24f0/+0x24f8]`, the seeded handle `[this+0x36fd]`, and a local side buffer at `[this+0x35af]`, then forwards that descriptor into the bound presentation node `[this+0x25df]`. Current grounded caller is the three-slot batch owner `0x0054ab20`, so this is the safest current read for publishing one transform-style descriptor from local scalars and seeded handle `0x36fd` rather than a generic math helper.","objdump + caller inspection + local disassembly + layout-state correlation + descriptor-publish correlation"
0x005471f0,176,layout_state_bind_table_0x112_or_0x142_and_optionally_publish_property_0x154,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Generalized table-bind helper in the layout-state family beneath the local `0x2643/0x2647/0x264f` wrapper strip. When the caller-supplied table pointer differs from cached field `[this+0x2637]`, the helper binds that table onto the bound presentation node `[this+0x25df]`, choosing property `0x112` for `0x20`-byte records or property `0x142` for `0x18`-byte records through node slots `+0x130/+0x14c`, then caches the new table pointer. It also optionally forwards one caller dword through node slot `+0x154` and mirrors that value into `[this+0x263b]`. Current grounded callers are the small wrappers `0x0054bbd0` and `0x0054bbf0`, so this is the safest current read for the shared table-bind plus optional property-`0x154` publish helper rather than a single table-specific owner.","objdump + caller inspection + local disassembly + layout-state correlation + table-bind correlation + bound-node correlation"
0x005472a0,20,layout_state_clear_property_0x1b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny property-clear helper over the bound presentation node `[this+0x25df]`. The function simply publishes `0` into property group `0x1b` through node slot `+0xc8`. Current grounded callers include layout-state owner branches `0x0052888d`, `0x0052b93b`, `0x0052bebc`, `0x0052caf4`, `0x00564d58`, and `0x0056507e`, so this is the safest current read for clearing property `0x1b` rather than a broader state reset.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation"
0x005472c0,33,layout_state_set_flag_0x36f8_when_shell_bytes_0x11422e_or_0x11422f_are_live,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small shell-flag bridge in the layout-state family. The helper checks shell bytes `[0x006d4024+0x11422e]` and `[0x006d4024+0x11422f]`, and when either one is nonzero it stores byte `[this+0x36f8] = 1`. Current grounded caller is the branch at `0x0052c120`, which selects this helper versus its clear-side sibling from a floating-point threshold test, so this is the safest current read for setting flag `0x36f8` from the two shell bytes rather than a generic boolean setter.","objdump + caller inspection + local disassembly + layout-state correlation + shell-flag correlation"
0x005472f0,7,layout_state_clear_flag_0x36f8,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny clear-side sibling to `0x005472c0` in the same layout-state family. The function stores byte `[this+0x36f8] = 0`. Current grounded caller is the neighboring branch at `0x0052c127`, so this is the safest current read for clearing flag `0x36f8` rather than a broader state reset.","objdump + caller inspection + local disassembly + layout-state correlation + flag correlation"
0x00547300,31,layout_state_publish_property_0x1b_from_template_flag_bit0,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small property publisher beside `0x005472a0` in the same layout-state family. The helper reads template byte bit `0` from `[[this+0x83c]+0x21]` and forwards that one-bit value into property group `0x1b` on the bound presentation node `[this+0x25df]` through node slot `+0xc8`. Current grounded callers include layout-state owners `0x00524c3c`, `0x0052889d`, `0x005289a0`, `0x0052ae55`, `0x0052b89c`, `0x0052cb4e`, and later shell-side presentation branches, so this is the safest current read for publishing property `0x1b` from the template bit rather than a generic flag copy.","objdump + caller inspection + local disassembly + layout-state correlation + template-flag correlation + property-strip correlation"
0x00547320,96,layout_state_apply_capability_gated_property_0x0f_0x18_0x19_strip,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Capability-gated three-property strip in the layout-state family. When shell capability byte `[0x006d4024+0x114252]` is live, the helper publishes `1` into property `0x0f`, forwards the caller dword into property `0x18`, and then publishes fixed value `7` into property `0x19` on the bound node `[this+0x25df]`. Current grounded callers include layout-state owners `0x005243c1`, `0x00524cc9`, `0x0052873c`, `0x00529995`, `0x0052a1c9`, `0x0052a50c`, `0x0052ae5f`, `0x0052b8a6`, `0x0052c824`, and later shell-side branches, so this is the safest current read for the capability-gated `0x0f/0x18/0x19` property strip rather than an isolated scalar setter.","objdump + caller inspection + local disassembly + layout-state correlation + capability-gate correlation + property-strip correlation"
0x00547380,64,layout_state_clear_capability_gated_property_0x0f_0x18_strip,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small clear-side sibling to `0x00547320` in the same layout-state family. When capability byte `[0x006d4024+0x114252]` is live, the helper clears property `0x0f` and property `0x18` on the bound node `[this+0x25df]` by publishing zero into both groups. Current grounded callers include layout-state owner branches `0x00528895` and `0x0052b940`, so this is the safest current read for clearing the capability-gated `0x0f/0x18` strip rather than a generic branch reset.","objdump + caller inspection + local disassembly + layout-state correlation + capability-gate correlation + property-strip correlation"
0x00547610,48,layout_state_publish_bound_node_pair_0x2607_0x260b_once,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small one-shot publisher over the bound presentation node `[this+0x25df]` in the layout-state family. When local gate byte `[this+0x254c]` is still clear, the helper forwards dwords `[this+0x2607]` and `[this+0x260b]` into node vtable slot `+0x7c`, then marks the gate byte live. Current grounded callers are the setup-side owner `0x0052c032`, the small and broad release bodies `0x0055dd57/0x0055dd87/0x0055e07b`, and sibling rebuild paths such as `0x0052cc7d` and `0x0055e978`, so this is the safest current read for publishing the cached bound-node pair once rather than a generic setter.","objdump + caller inspection + local disassembly + layout-state correlation + bound-node correlation"
0x00547640,7,layout_state_clear_bound_node_pair_0x2607_0x260b_publish_gate,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny gate-clear sibling to `0x00547610` in the same layout-state family. The helper only resets byte `[this+0x254c]` back to `0`, allowing the next `0x00547610` call to republish dwords `[this+0x2607/+0x260b]` into the bound node. Current grounded callers are nearby presentation owners such as `0x0052bc20` and `0x0052bdd3`, so this is the safest current read for clearing the one-shot publish gate rather than a broader state reset.","objdump + caller inspection + local disassembly + layout-state correlation + publish-gate correlation"
0x00547650,578,layout_state_apply_capability_gated_presentation_property_strip_and_bind_aux_handles,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Capability-gated presentation property owner over the bound node `[this+0x25df]` in the layout-state family. When shell capability byte `[0x006d4024+0x11422d]` is live, the helper seeds one fixed property strip through repeated node slot `+0xfc` writes over property groups `0x0b`, `0x18`, `0x0d`, and `0x0e`, then binds auxiliary handles `[this+0x2623]` and `[this+0x2633]` through node slots `+0x130` and `+0x160`. When the first gate is clear but capability byte `[0x006d4024+0x114250]` is live, it instead builds one stack descriptor rooted at local handle `[this+0x36fd]`, publishes that block through node slot `+0x94` on property `0x11`, and then applies the reduced `0x0d/0x0e` property pair. Both branches finish by clearing the `0x0d/0x0e` property lane for selector `3`. Current grounded callers are the neighboring layout-state owner paths `0x0054abd1`, `0x0054b0e1`, and `0x0054b5de`, so this is the safest current read for the capability-gated presentation property strip and auxiliary-handle bind rather than a small scalar setter.","objdump + caller inspection + local disassembly + layout-state correlation + capability-gate correlation + bound-node correlation"
0x005478a0,680,layout_state_apply_trig_derived_presentation_property_strip_and_bind_aux_handles_0x261b_0x262b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Alternate property-strip sibling to `0x00547650` in the same layout-state family. After one external timing or state query, the helper applies the same initial `0x0b/0x18` property band on the bound node `[this+0x25df]`, then publishes trig-derived scalar pairs into property groups `0x07..0x0a` for selectors `2` and `3`, sets both `0x0d/0x0e` groups for selector `2`, clears those groups for selector `3`, and finally binds auxiliary handles `[this+0x261b]` and `[this+0x262b]` through node slots `+0x130` and `+0x160`. Current grounded callers are the batch owners `0x0054abca` and `0x0054b0da`, so this is the safest current read for the trig-derived alternate property strip rather than a generic sine-cosine helper.","objdump + caller inspection + local disassembly + layout-state correlation + trig-strip correlation + bound-node correlation"
0x00547c30,224,layout_state_store_four_local_scalars_0x36df_0x36eb_and_publish_property_0x07_block,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared four-scalar publisher beneath the trig-derived layout-state strip. The helper stores four caller dwords into local scalar fields `[this+0x36df/+0x36e3/+0x36e7/+0x36eb]`, validates them against the zero-threshold path, and then publishes either one identity-like `(0,0,1,1)` block or one block using the negated first pair plus the unmodified second pair into property group `0x07` on the bound presentation node `[this+0x25df]` through node slot `+0x13c` with notify flag `1`. Current grounded callers are the neighboring owner branches `0x0052c701` and `0x0052c77e`, so this is the safest current read for storing the local four-scalar band and publishing the derived property-`0x07` block rather than a generic math helper.","objdump + caller inspection + local disassembly + layout-state correlation + four-scalar correlation + property-strip correlation"
0x00547d10,288,layout_state_apply_presentation_extents4,bootstrap,thiscall,inferred,ghidra-headless,4,Applies a four-float extent or quad block onto presentation property 0x18 for the bound node at [this+0x25df]. If all four inputs are nonpositive it clears the property through vtable slot +0xfc; otherwise it builds a 0x10-field stack block with the four caller values and a unit scalar then commits it through node slots +0xfc and +0x94.,ghidra + rizin + llvm-objdump
0x00547f20,177,layout_state_apply_gamma_ramp_scalar,bootstrap,thiscall,inferred,ghidra-headless,4,Builds a 256-entry three-channel gamma-ramp buffer from the caller scalar and uploads it through vtable slot +0x48 on the bound presentation node at [this+0x25df]. The helper clamps each 16-bit ramp entry stores the accepted scalar in the subordinate state block at [[this+0x83c]+0x2f] and respects shell capability guards under 0x006d4024 before touching the display device.,ghidra + rizin + llvm-objdump
0x00548030,43,layout_state_publish_property_pair_0x13_0x14_as_1_6,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny property-pair setter in the layout-state family. The helper publishes value `1` into property `0x13` and value `6` into property `0x14` on the bound presentation node `[this+0x25df]`. Current grounded caller is the neighboring owner branch `0x0052b8ae`, so this is the safest current read for the fixed `0x13/0x14 = 1/6` publish pair rather than a broader mode switch.","objdump + caller inspection + local disassembly + layout-state correlation + property-pair correlation"
0x00548060,43,layout_state_publish_property_pair_0x13_0x14_as_5_6,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small sibling to `0x00548030` in the same layout-state family. The helper publishes value `5` into property `0x13` and value `6` into property `0x14` on the bound presentation node `[this+0x25df]`. Current grounded caller is the neighboring owner branch `0x0052b91c`, so this is the safest current read for the fixed `0x13/0x14 = 5/6` publish pair rather than a generic wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + property-pair correlation"
0x00548120,92,layout_state_reset_local_descriptor_identity_ensure_fallback_block_0x25e3_and_refresh_current_span,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small rect-strip owner in the layout-state family. The helper resets local descriptor `[this+0x34ef]` to identity through `0x00544360`, lazily allocates fallback block `[this+0x25e3]` and registers it on the bound node `[this+0x25df]` through slot `+0xa4`, then refreshes the sibling local descriptor `[this+0x352f]` from the current integer span pair `[this+0x25c7/+0x25cb]` by tail-calling `0x00544290`. Current grounded caller is `shell_commit_layout_updates` `0x00523d90`, so this is the safest current read for the identity-reset plus fallback-block ensure path rather than a generic constructor fragment.","objdump + caller inspection + local disassembly + layout-state correlation + rect-strip correlation"
0x00548180,350,layout_state_store_normalized_local_rect_0x2523_0x252f_publish_dynamic_or_fallback_block_and_refresh_span,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader rect update owner immediately above `0x00548120` in the same layout-state family. The helper lazily allocates fallback block `[this+0x25e3]`, stores four normalized local rect scalars into `[this+0x2523/+0x2527/+0x252b/+0x252f]` from the caller's integer rectangle corners and current span pair `[this+0x25c7/+0x25cb]`, publishes either that derived dynamic block through node slot `+0xa0` or the fallback block when the rectangle is too small, and then refreshes sibling descriptor `[this+0x352f]` by re-entering `0x00544290` with the resulting width and height deltas. Current grounded caller is the neighboring bridge `0x005482e0`, so this is the safest current read for storing the normalized local rect, publishing the dynamic-or-fallback block, and refreshing the current span rather than a generic rectangle math helper.","objdump + caller inspection + local disassembly + layout-state correlation + rect-strip correlation + fallback-block correlation"
0x005482e0,109,layout_state_apply_display_rect_or_delta_span_from_controller_normalized_scalars,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Bridge between the embedded view-controller scalar band and the layout-state rect-strip owners. The helper first materializes one active-display rectangle from controller scalar band `[controller+0x50..+0x5c]` through `embedded_view_controller_materialize_active_display_rect_from_normalized_scalars_0x50_0x5c` `0x0052d4d0`; when that resolved rectangle is nondegenerate it forwards the four corners into `0x00548180`, and otherwise it computes simple width and height deltas and refreshes descriptor `[this+0x352f]` directly through `0x00544290`. Current grounded callers are shell presentation branches `0x0052c108` and `0x0052ccd8`, so this is the safest current read for applying a controller-derived display rect or fallback delta span into the layout-state family rather than a generic clamp helper.","objdump + caller inspection + local disassembly + layout-state correlation + controller-bridge correlation + rect-strip correlation"
0x00548820,116,layout_state_seed_all_slot_triplets_to_1_2_1_pattern,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small slot-table seed helper in the broader layout-state presentation family. The function walks every live slot in `[this+0x2597]` and writes the same six-scalar pattern into both triplet halves of each `0x18`-byte slot record: `(1, 2, 1)` at `+0x00/+0x04/+0x08` and again at `+0x0c/+0x10/+0x14`. Current grounded caller is the capability-side `TextureForTests` probe strip at `0x0055dfaa`, so this is the safest current read for seeding all slot triplets to the fixed `1,2,1` pattern rather than a general reset helper.","objdump + caller inspection + local disassembly + layout-state correlation + slot-triplet correlation"
0x005488a0,157,layout_state_snapshot_current_slot_triplet_table_into_seeded_list_and_optionally_apply,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared slot-table snapshot helper in the broader layout-state presentation family. The function allocates one temporary copy of the current `0x18`-byte-per-slot triplet table `[this+0x2597]`, pushes that copied table into the seeded-record list rooted at `[this+0x259b]` through `0x00557150`, and, when the caller requests it, immediately re-applies the copied low and high triplet halves to every live destination slot through `0x005455e0` and `0x005456d0` with notify flag `1`. Current grounded callers include several nearby-presentation builders `0x00524393`, `0x00524cca`, `0x005288ec`, `0x00528a20`, the broader probe path `0x00548a3b`, and later sibling presentation owners, so this is the safest current read for snapshotting the current slot-triplet table into the seeded list with an optional immediate re-apply rather than a generic memcpy helper.","objdump + caller inspection + local disassembly + layout-state correlation + seeded-list correlation + slot-triplet correlation"
0x005489f0,237,layout_state_run_texture_for_tests_binding_probe,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly + rdata string decode,2,"Capability-style probe owner in the broader layout-state presentation family. The helper allocates one temporary payload from literal `TextureForTests` through `0x0053c1c0(0, 0, 0x7f)`, binds that payload across every live optional item slot through `0x00545520`, snapshots or reapplies the current slot-triplet state through `0x005488a0`, queries the bound presentation node at `[this+0x25df]` through vtable slot `+0x100`, re-applies the first seeded slot-triplet pair through `0x00548940(1)`, clears the live optional slot bindings back to null through `0x00545520`, releases the temporary payload through `0x0053c000`, and returns the resulting boolean-like probe outcome. Current grounded callers are the later capability-setting branch `0x0055dfc1/0x0055dfe0/0x0055e004/0x0055e047`, which mirror that result into shell capability bytes `[0x006d4024+0x114250/+0x114251]`, so this is the safest current read for the `TextureForTests` binding probe rather than a generic presentation refresh owner.","objdump + caller inspection + local disassembly + rdata string decode + layout-state correlation + capability-probe correlation"
0x00548940,167,layout_state_apply_first_n_seeded_slot_triplet_pairs_from_list_0x259b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared slot-triplet apply helper over the seeded record list rooted at `[this+0x259b]` in the broader layout-state presentation family. The function clamps the caller-requested record count against list count `[[this+0x259b]+0x0c]`, iterates that many seeded `0x18`-byte records through `0x00556e50`, and for each destination slot index writes the first and second triplet blocks into the cached slot table `[this+0x2597]` through `0x005455e0` and `0x005456d0` with notify flag `1`. After the pass it releases the temporary seeded-list cursor through `0x005a1145`. Current grounded callers include the nearby-presentation sweeps `0x00524521`, `0x00524e32`, `0x00529998`, the broader layout-state owner `0x00548a71`, and several sibling presentation rebuild paths, so this is the safest current read for applying the first N seeded slot-triplet pairs from list `[+0x259b]` rather than a generic list walk.","objdump + caller inspection + local disassembly + layout-state correlation + slot-triplet correlation"
0x00548c50,342,layout_state_release_history_seeded_lists_and_clear_optional_slot_bindings,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Pre-release cleanup owner in the layout-state presentation family. When live slot count `[this+0x258f]` is positive, the helper drains and frees every record in the history list `[this+0x259f]` and the seeded-record list `[this+0x259b]`, releases the two list owners themselves, clears both fields back to `0`, and then walks the optional slot-binding table `[this+0x2593]` to publish null bindings through bound-node slot `+0xf4` before zeroing each slot entry. Current grounded caller is the broader bound-presentation release body `0x0054a190`, so this is the safest current read for releasing the history and seeded lists plus clearing optional slot bindings rather than a narrow list helper.","objdump + caller inspection + local disassembly + layout-state correlation + seeded-list correlation + optional-binding correlation"
0x00548da0,1328,layout_state_refresh_presentation_batches,bootstrap,thiscall,inferred,ghidra-headless,4,Walks the active presentation-batch list and refreshes the bound node state for each selected item. The routine applies batch extents through 0x00547d10 pushes style and gate properties including packed color property 0x3c updates per-slot triplets through 0x005455e0 and 0x005456d0 and emits segment-record or vertex24 spans from the current batch family before advancing to the next record.,ghidra + rizin + llvm-objdump
0x005492d0,3747,layout_state_probe_d3d8_capabilities,bootstrap,thiscall,inferred,ghidra-headless,4,Creates a Direct3D8 probe object and walks adapter or device capability queries for the layout-state presentation path. The routine caches probed texture-memory style fields into shell globals under 0x006d4024 including the values later reported as Texture SRAM and Texture VRAM consults the shell memory-budget helpers 0x0051fa40 and 0x0051fa60 refreshes the gamma ramp through 0x00547f20 when needed and assigns a local renderer capability tier at [this+0x04].,ghidra + rizin + llvm-objdump + strings
0x0054a0c0,176,layout_state_bind_external_source_rebuild_summary_reset_bound_node_and_select_mode_4_or_5,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader setup-side owner in the layout-state family above the newly grounded summary and reset strips. The helper binds one caller-supplied external source onto the bound presentation node `[this+0x25df]` through node slot `+0x12c`, falls back to the midband-handle cleanup strip `0x005463e0` when that bind reports failure, conditionally reapplies the cached gamma-ramp scalar from template field `[[this+0x83c]+0x2f]` through `0x00547f20`, seeds optional handle `[this+0x33ab]` through `0x00570fbd`, rebuilds summary buffer `[this+0x43c]` through `0x00545e30`, runs the repeated bound-node reset strip `0x005464d0`, clears local byte `[this+0x254d]`, and finally selects layout-state mode dword `[this+0x04]` as `4` or `5` from shell dimensions `[0x006d4024+0x11423b/+0x11423f]`. Current grounded caller is the surrounding setup-side branch that prepares the subordinate layout state before later property application, so this is the safest current read for binding the external source, rebuilding the summary/reset strip, and selecting mode `4` or `5` rather than a generic constructor fragment.","objdump + caller inspection + local disassembly + layout-state correlation + bound-node correlation + summary-buffer correlation + resolution-tier correlation"
0x0054a190,228,layout_state_release_bound_presentation_handles_and_clear_controller_slot_0x08,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broad bound-presentation release body in the layout-state family. The helper first re-enters `0x00548c50`, then releases optional handles `[this+0x33ab]`, `[this+0x25e3]`, `[this+0x25e7]`, `[this+0x25df]`, and `[this+0x25db]`, emitting shell notices through localized ids `0x9b` or `0x9c` when the bound-node release paths report success. It also re-enters the two adjacent cleanup helpers `0x005463e0` and `0x005465c0`, clears local presentation pointers `[this+0x2643/+0x25df/+0x25db]`, and finally clears shell controller dword `[0x006d4024+0x08]` back to `0`. Current grounded callers are the direct layout-state branches `0x0054bd64` and `0x0054be7f`, so this is the safest current read for releasing the bound presentation handles and controller slot rather than a generic object destructor.","objdump + caller inspection + local disassembly + layout-state correlation + presentation-release correlation"
0x0054a280,626,layout_state_apply_presentation_properties,bootstrap,thiscall,inferred,ghidra-headless,4,Pushes visibility color and mode-dependent scalar properties from the layout state into the bound presentation node at [this+0x25df]; toggles gate property 0x1c writes packed color property 0x22 from bytes 0x2510..0x2512 updates mode properties 0x23 through 0x26 from template flags and caller-supplied scalars and caches the leading scalar at [this+0x25b3].,ghidra + rizin
0x0054a500,1568,layout_state_refresh_variant_bank_batches_from_handle_0x2663_or_local_descriptor_set,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader batch owner in the layout-state family above the newly grounded `0x00547c30` strip. The helper requires active batch count `[this+0x2667]`, clears the local visited-byte strip `[this+0x254f..]`, pulses property groups `0x89` and `0x0e`, derives two normalized shell-scalars from the current shell presentation size through `0x0051f090 -> 0x00533970/0x00533980`, and then branches on midband handle `[this+0x260f]`. On the null-handle path it snapshots the current slot-triplet state through `0x005488a0`, seeds one fixed triplet pair, binds handle `[this+0x2663]` as one `0x18`-byte table on property `0x142`, reads that table through vtable slot `+0x2c`, rescales the resulting rows by local scalar band `[this+0x36df/+0x36e3/+0x36e7/+0x36eb]`, and commits the resulting batch ranges through variant-bank entries `[this+0x31ab + batch*4]` into node slot `+0x11c`. On the live-handle path it instead binds current segment-record handle `[this+0x265b]`, publishes the local descriptor rooted at `[this+0x35af]`, pushes two fixed property blocks `5` and `6`, and then commits the same visited batch ranges. Current grounded caller is the neighboring owner branch `0x0052c73d`, so this is the safest current read for refreshing the variant-bank batches from handle `0x2663` or the local descriptor set rather than a generic layout rebuild body.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + variant-bank correlation"
0x0054ab20,1262,layout_state_refresh_presentation_batches_with_three_slot_binding_candidates,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader batch-refresh owner in the layout-state family with three optional slot-binding candidates. The helper clears the visited-byte strip `[this+0x254f..]`, rebinds current segment-record handle `[this+0x265b]` onto node property `0x112` when needed, chooses between the capability-gated property strips `0x00547650` and `0x005478a0`, applies one descriptor publish through `0x00546d40`, and then walks the active `0x2d`-stride batch records rooted at `[this+0x266f]`. During that walk it compares previous/current/next candidate values, updates optional slot bindings through `0x00545520` for slots `0`, `1`, and `2`, emits batch ranges through variant-bank entry `[this+0x31ab + batch*4]` into node slot `+0x11c`, marks visited batch bytes under `[this+0x254f]`, and follows the per-batch next-link selectors at `+0x267b/+0x2683/+0x2687`. Current grounded callers are the setup-side layout-state owner branches `0x0052c4d6`, `0x0052c50c`, and `0x0052c53d`, so this is the safest current read for the three-slot candidate batch-refresh owner rather than a generic batch loop.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + slot-binding correlation"
0x0054b030,1159,layout_state_refresh_presentation_batches_with_two_slot_binding_candidates,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Two-slot sibling to `0x0054ab20` in the same layout-state batch family. The owner clears the visited-byte strip `[this+0x254f..]`, rebinds current segment-record handle `[this+0x265b]` when needed, chooses between `0x00547650` and `0x005478a0`, and then walks the same `0x2d`-stride batch records rooted at `[this+0x266f]`. Its candidate-comparison and rebinding phase only manages slots `0` and `1` through `0x00545520`, then commits the selected ranges through variant-bank entry `[this+0x31ab + batch*4]` into node slot `+0x11c`, marks visited bytes, and follows the same per-batch next-link selectors. Current grounded callers are the setup-side owner branches `0x0052c578`, `0x0052c5e5`, `0x0052c63c`, and `0x0052cb2f`, so this is the safest current read for the two-slot candidate batch-refresh owner rather than another generic batch loop.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + slot-binding correlation"
0x0054b4e0,1465,layout_state_refresh_handle_0x265f_backed_batches_with_capability_variant_switch,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Capability-switched batch-refresh owner in the same layout-state family. The helper clears the visited-byte strip `[this+0x254f..]`, rebinds current segment-record handle `[this+0x265b]` onto property `0x112` when needed, pulses property group `0x1b`, and reapplies capability-gated strip `0x00547650`. It then first asks the bound presentation node through slot `+0x128` whether handle `[this+0x265f]` plus the caller's two selector values can bind the special descriptor path; on success it publishes `[this+0x265b]` through property `0x24`, reasserts node property `0x152`, and returns early. Otherwise it branches on capability byte `[0x006d4024+0x114250]` to choose between a richer path that pushes fixed property blocks `0x0b` and `0x18`, emits one extra descriptor through slot `+0x94` on property `0x11`, raises node property `0x2c4`, and binds `[this+0x265f]` on property `0x28`, or a fallback path that raises property `0x1c4` and binds `[this+0x265f]` on property `0x20`. After that it walks the same `0x2d`-stride batch records, refreshes slot `0` through `0x00545520`, conditionally clears slot `1` when the fallback path is active, emits batch ranges through variant-bank entry `[this+0x31ab + batch*4]` into node slot `+0x11c`, marks visited bytes, follows the same per-batch next-link selectors, clears property groups `0x0d/0x0e`, and finally restores node property `0x152`. Current grounded callers are the setup-side layout-state owner branches `0x0052c46c` and `0x0052c49a`, so this is the safest current read for the `0x265f`-backed capability-variant batch owner rather than a generic descriptor upload body.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + capability-variant correlation"
0x0054bab0,89,layout_state_bind_segment_record_table,bootstrap,thiscall,inferred,ghidra-headless,4,Binds the current 32-byte segment-record table at [this+0x2643] onto the presentation node if it changed since the last bind. The helper drives node property 0x112 through vtable slots +0x130 and +0x14c with record size 0x20 and clears the local dirty byte at [this+0x263b].,ghidra + rizin + llvm-objdump
0x0054bb10,90,layout_state_bind_alternate_segment_record_table_0x263f,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small sibling to `0x0054bab0` in the same layout-state family. The helper binds alternate `0x20`-byte segment-record table `[this+0x263f]` onto property `0x112` of the bound presentation node `[this+0x25df]` when that table differs from cached field `[this+0x2637]`, then clears local dirty dword `[this+0x263b]`. Current grounded caller is the nearby owner branch `0x00528885`, so this is the safest current read for the alternate segment-record table bind rather than a broader batch owner.","objdump + caller inspection + local disassembly + layout-state correlation + segment-record correlation"
0x0054bb70,90,layout_state_bind_vertex24_table,bootstrap,thiscall,inferred,ghidra-headless,4,Binds the current 24-byte vertex24 table at [this+0x2647] onto the presentation node if it changed since the last bind. The helper drives node property 0x142 through vtable slots +0x130 and +0x14c with record size 0x18 and clears the local dirty byte at [this+0x263b].,ghidra + rizin + llvm-objdump
0x0054bbd0,22,layout_state_bind_vertex24_table_0x264f_and_publish_property_0x154_from_0x2653,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny wrapper into `0x005471f0` in the layout-state family. The helper binds the `0x18`-byte table `[this+0x264f]` onto the bound presentation node and forwards companion dword `[this+0x2653]` through property `0x154`. Current grounded callers are the neighboring owner branches `0x0052b8be` and `0x0052b94b`, so this is the safest current read for the `0x264f/0x2653` bind-and-publish wrapper rather than a generic thunk.","objdump + caller inspection + local disassembly + layout-state correlation + table-bind correlation"
0x0054bbf0,22,layout_state_bind_vertex24_table_0x2647_and_publish_property_0x154_from_0x264b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny sibling wrapper into `0x005471f0` in the same layout-state family. The helper binds the `0x18`-byte table `[this+0x2647]` onto the bound presentation node and forwards companion dword `[this+0x264b]` through property `0x154`. Current grounded callers are the nearby owner branches `0x0052ae2b` and `0x0054e30b`, so this is the safest current read for the `0x2647/0x264b` bind-and-publish wrapper rather than a generic thunk.","objdump + caller inspection + local disassembly + layout-state correlation + table-bind correlation"
0x0054bc10,592,shell_init_layout_state_defaults,bootstrap,thiscall,inferred,ghidra-headless,4,Initializes the large subordinate layout-state object allocated by 0x0055e2b0; seeds default float and flag fields points [this+0x83c] at a shell-bundle template block near 0x006d4024+0x11468a optionally copies a 0x72c-byte preset table and notifies the shell bundle service at [0x006d4024+0x28].,ghidra + rizin
0x0054be60,52,layout_state_export_preset_table_0x840_to_global_defaults_and_refresh,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small export-and-refresh helper in the shell layout-state family. The function copies the full `0x72c`-byte preset table from `[this+0x840]` into global default cache `0x00ccbb68`, raises global dirty byte `0x00ccd820`, refreshes the surrounding layout-state side through `0x0054a190`, and clears shell controller pointer field `[0x006d4024+0x0c]` through `shell_controller_store_pointer_field_0x0c` `0x0051eff0(0)`. Current grounded callers are the small and broad layout-state release bodies `0x0055dd9a` and `0x0055e29d`, so this is the safest current read for exporting preset table `0x840` into the global defaults and refreshing the shell-side cache rather than a generic memcpy helper.","objdump + caller inspection + local disassembly + layout-state correlation + default-cache correlation"
0x0054bea0,1399,layout_state_blend_two_preset_rows_into_local_pose_color_and_dispatch_presentation_update,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader interpolated-pose owner above `0x0054a280` in the layout-state family. The helper takes two preset-row indices plus a blend scalar from the caller, treats the preset table at `[this+0x840]` as `0x33`-byte rows, and blends the paired rows into local scalar bands `[this+0x24f0/+0x24f4/+0x24f8/+0x24fc/+0x2500/+0x2504/+0x2508/+0x250c]`, derived pose scalars `[this+0x2513/+0x2517/+0x251b/+0x251f]`, and RGB bytes `[this+0x2510..+0x2512]` with extra amplitude terms from `[this+0x25af/+0x25fb/+0x2603]`. It first reuses the same `0x265b/0x112` bind and property-gate strip as the neighboring batch owners, then tests node slot `+0x128` with handle `[this+0x265f]` and the caller pair for a special early descriptor path. When that test fails, it branches on capability byte `[0x006d4024+0x114250]` to choose between a richer property path that raises `0x2c4` and binds `[this+0x265f]` on property `0x28`, or a fallback path that raises `0x1c4` and binds the same handle on property `0x20`. The tail builds one stack descriptor through node slot `+0xb0`, stores packed RGB in `[this+0x25a3]`, and then finishes by re-entering `0x0054a280` to publish the resulting presentation properties. Current grounded callers are the shell-side and setup-side branches `0x0043ac22` and `0x0052c189`, so this is the safest current read for blending two preset rows into one local pose or color state and dispatching the presentation update rather than a generic interpolation helper.","objdump + caller inspection + local disassembly + layout-state correlation + preset-table correlation + interpolation correlation + presentation-dispatch correlation"
0x0054c420,1119,layout_state_run_timed_vertex24_batch_stream_with_one_shot_bound_pair_publish,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader timed owner in the same layout-state family, grounded one layer above `0x0054c880/0x0054c8f0`. The helper clears local counters `[this+0x370d/+0x3711]`, resets presentation node slots `+0x90/+0x88/+0x8c/+0x3c`, refreshes the local property strip through `0x00547e30`, clears stale property `0x16` when flag byte `[this+0x254a]` is live, lowers property `0x89`, and rebinds vertex24 table `[this+0x2647]` onto property `0x142` when cached selector `[this+0x2637]` changes. It then reads one `0x2800`-byte block from handle `[this+0x2647]`, materializes a fixed `0x28`-entry stack batch with repeated color and scalar lanes, and enters a timed loop that repeatedly drives `0x00545520` over `0xc80`-byte chunks, commits each chunk through node slot `+0x118`, optionally bumps local counter `[this+0x370d]` plus node slot `+0xf4` when guard block `[this+0x2593]` reports a live entry, and runs until about `1000` ms have elapsed. The tail derives one elapsed-work ratio, publishes bound pair `[this+0x2607/+0x260b]` once through node slot `+0x7c` when guard byte `[this+0x254c]` was still clear, re-raises property `0x89` from template byte `[this+0x83c+0x22]`, forces property `0x07 = 1`, releases the temporary handle from `0x0053c000`, and returns the computed ratio as `st(0)`. Current grounded callers are the paired outer owner branches `0x0055e9ba` and `0x0055e9c7`, so this is the safest current read for the timed vertex24 batch-stream owner with one-shot bound-pair publish rather than a generic frame loop.","objdump + caller inspection + local disassembly + layout-state correlation + timed-loop correlation + vertex24-table correlation + batch-stream correlation"
0x0054c880,99,layout_state_refresh_local_count_0x19_from_base_count_0x15_and_scalar_0x36a0,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small count-refresh helper beneath `0x0054c420` in the same layout-state family. The helper seeds local count `[this+0x19]` from base count `[this+0x15]`, then, when scalar `[this+0x36a0]` exceeds threshold `0x005c88e0`, subtracts one scaled excess term through `* 0x005cb4a8`, rounds the result through `0x005a10d0`, and clamps the refreshed count to the range `[ [this+0x15] >> 1, 0xff ]`. Current grounded caller is `0x0052bb3d`, so this is the safest current read for refreshing the local count field from the base count and one live scalar rather than a generic clamp helper.","objdump + caller inspection + local disassembly + layout-state correlation + count-field correlation"
0x0054c8f0,4,layout_state_query_local_count_0x19,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny getter for local count field `[this+0x19]` in the same layout-state family. Current grounded callers include `0x0043ac15`, `0x00523d9d`, `0x005242f6`, `0x00524402`, `0x005265b9`, `0x005288fd`, `0x00528a59`, `0x00528c40`, `0x0052c16d`, `0x0052c17c`, and `0x0052c1b7`, which consistently treat it as a shared count query beneath the broader layout-state owners rather than a standalone calculation path.","objdump + caller inspection + local disassembly + layout-state correlation + count-field correlation"
0x0054c900,1795,layout_state_service_local_slot_band_0x4ad_generate_record_strip_and_commit_through_subordinate_state,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader service owner immediately below `0x0054c420` in the same layout-state family. The function first gates on refreshed local count `[this+0x19]` and active-slot counter `[this+0x22b57]`, resets subordinate layout-state `[this+0x2d]` through `0x005467e0`, `0x00545080`, and `0x00547320(1)`, derives one live scalar from the current count, and maintains a shared timer or RNG strip through globals `0x00d93828..0x00d93834`. It then services the `0x10`-entry local slot band rooted at `[this+0x4ad]` with stride `0x31a`: inactive slots are allocated and seeded with countdown, state bytes, and starting coordinates; live slots can attach to indexed external records from the caller table `[arg+0x40c]` through `0x00554210`, `0x005545d0`, `0x005543a0`, `0x00554340`, `0x005542c0`, and `0x005543f0`; and every active slot expands into repeated `0x18`-byte records appended to the local strip while advancing counters `[this+0x71/+0x75]` and setting dirty byte `[this+0x3747]`. After the per-slot pass it commits or clears the resulting generated strip through subordinate layout-state `[this+0x2d]` using `0x00545520`, `0x00545c50`, `0x00544f30`, `0x005450a0`, and `0x005467a0`, then returns. Current grounded caller is the shell-side owner branch `0x0054e32e`, so this is the safest current read for servicing local slot band `0x4ad`, generating the transient record strip, and committing it through the subordinate layout-state rather than a generic particle or UI loop.","objdump + caller inspection + local disassembly + layout-state correlation + local-slot-band correlation + subordinate-state correlation + generated-strip correlation"
0x0054d810,2836,layout_state_service_local_slot_band_0x4ad_generate_jittered_record_strip_variant_and_commit_through_subordinate_state,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Sibling service owner to `0x0054c900` over the same `0x10`-entry local slot band rooted at `[this+0x4ad]` with stride `0x31a`. When refreshed local count `[this+0x19]` drops below `0x80`, the helper first clears every live slot by forwarding any attached external record from `[arg+0x40c]` into `0x00554210`, then resets each slot owner id at `[slot+0x4b3]` to `-1` and returns. Otherwise it lazily seeds one global jitter table at `0x00d8d830`, refreshes subordinate layout-state `[this+0x2d]` through `0x0054bb70`, `0x00544360`, `0x005457c0(0)`, `0x00545000`, and `0x00546890`, and then, when mode byte `[this+0x3692]` is clear, builds another generated `0x18`-byte record strip by combining the jitter table, local origin scalars `[this+0x369c/+0x36a0/+0x36a4]`, one time-derived color band from the `0x00545a10d0` path, and per-slot state bytes and countdowns. Like `0x0054c900`, it advances local counters `[this+0x71/+0x75]`, writes back per-slot state under `[slot+0x4b1..+0x4c3]`, and commits or clears the resulting strip through subordinate layout-state `[this+0x2d]` using `0x00545520`, `0x00545c50`, and the same property-reset helpers. Current grounded callers are the paired owner branches `0x0052cabf` and `0x0052cbb2`, so this is the safest current read for the jittered slot-band variant and subordinate-state commit path rather than a generic math-heavy loop.","objdump + caller inspection + local disassembly + layout-state correlation + local-slot-band correlation + jitter-table correlation + subordinate-state correlation + generated-strip correlation"
0x0055ddc0,664,shell_seed_layout_state_probe_snapshot_handles_by_resolution_tier,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Setup-side probe owner for the shell layout-state family. The helper first chooses a small resolution tier, `4` or `5`, from shell dimensions `[0x006d4024+0x11423b/+0x11423f]`, then programs a sequence of fixed slot-triplet patterns into subordinate layout state `[this+0x2d]` through `0x005455e0/0x005456d0`, snapshotting each resulting slot table through `0x005454c0` and storing the returned handles into local probe fields `[this+0x35/+0x39/+0x3d/+0x41/+0x45/+0x49/+0x4d/+0x51/+0x55/+0x59]`. After that it seeds all live slots to the fixed `(1,2,1)` pattern through `0x00548820`, clears shell capability byte `[0x006d4024+0x114251]`, probes several of the stored snapshot handles through `layout_state_run_texture_for_tests_binding_probe` `0x005489f0`, mutates one fallback probe record at `[this+0x4d]` when the first pass fails, and finally mirrors the resulting booleans into shell capability bytes `[0x006d4024+0x114250/+0x114251]`. Current grounded caller is the layout-state constructor `shell_create_layout_state` `0x0055e2b0`, so this is the safest current read for seeding the layout-state probe snapshots by resolution tier rather than a generic table initializer.","objdump + caller inspection + local disassembly + layout-state correlation + capability-probe correlation + resolution-tier correlation"
0x0055dd80,50,shell_release_layout_state_field_0x2d_if_present,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small layout-state teardown sibling over owner field `[this+0x2d]`. The helper first refreshes and drops the live layout-state side through `0x00547610` and `0x00542c10`, then, when `[this+0x2d]` is nonnull, releases that subordinate layout-state object through `0x0054be60` and `0x0053b080` before clearing the field back to null. Current grounded callers are the broader layout-state rebuild owner `0x00565110` and the local branch at `0x00520008`, so this is the safest current read for the direct layout-state field release helper rather than a generic object free.","objdump + caller inspection + local disassembly + layout-state correlation + teardown correlation"
0x0055e060,587,shell_release_layout_state_owner_resources_and_subordinate_handles,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader release body in the same shell layout-state owner family. When activation dword `[this+0x01]` is live, the helper first shuts down subordinate payload `[this+0x5d]`, refreshes and drops layout-state side `[this+0x2d]` through `0x00547610` and `0x00542c10`, and then walks a long owned-handle strip rooted at `[this+0x65]`, `[this+0x79..+0x8d]`, `[this+0x95..+0xa5]`, `[this+0x364d]`, and `[this+0x3651..+0x3665]`, releasing each live entry through the corresponding local family helper plus `0x0053b080` or `0x0053c000`. The tail also clears several cached layout-owned pointers and finally releases the subordinate layout-state object at `[this+0x2d]` through `0x0054be60`. Current grounded caller is the shell-side owner branch at `0x0051ffee`, which frees `[owner+0x18]` through this helper when the higher-level teardown flag is set, so this is the safest current read for the full layout-state owner release body rather than a small field reset.","objdump + caller inspection + local disassembly + layout-state correlation + owner-release correlation"
0x0055e9f0,97,layout_state_subobject_vtable_0x5de2a8_init,shell,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for one `0x5de2a8` shell-side subobject family that sits beside the layout-state owner. The helper zeroes scalar and pointer fields `[this+0xa2/+0xa6/+0xaa/+0xae/+0xb2/+0xbe/+0xd6/+0xe6/+0xea/+0xf2/+0xfe/+0x102/+0x106]`, seeds dword `[this+0xda] = 1`, and stores fixed half-size word `[this+0x06] = 0x80`. Current grounded direct caller is constructor-side owner `0x0055ecb0`, so this is the safest current read for the family initializer rather than a broader setup pass.","objdump + local disassembly + object-family correlation"
0x0055ea60,416,layout_state_subobject_vtable_0x5de2a8_service_table_driven_payload_into_cached_surface,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Primary service owner for the same `0x5de2a8` shell-side subobject family. The helper lazily ensures one cached helper object in global `0x00d97984` through `0x00541970`, then either calls import thunk `0x005c8384` once over payload root `[this+0xf2]` and writes the returned block into the cached surface object `[this+0xe6]`, or, when row count `[payload+0x04]` and column count `[this+0xe2]` are both live, iterates a two-dimensional table by scaling the current row through `0x005a10d0`, indexing the payload dword array, and copying the selected values into the cached surface root. When no block was produced it republishes the cached surface through `0x005438d0`. Current grounded callers are the sibling owner branches `0x0055f3d3` and `0x0055f545`, so this is the safest current read for the table-driven payload service into the cached surface rather than a generic blit or loop.","objdump + caller inspection + local disassembly + object-family correlation + cached-surface correlation + table-service correlation"
0x0055ec00,174,layout_state_subobject_vtable_0x5de2a8_query_or_ensure_cached_surface_from_dims_and_mode_table,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Query-or-ensure helper for the same `0x5de2a8` family. When cached surface root `[this+0xe6]` is null, the helper stores caller dimensions into `[this+0xde/+0xe2]`, allocates one `0xec`-byte surface owner through `0x0053b070`, initializes it through `0x00543980(0, width, height, 1)`, materializes a zeroed RGBA backing buffer through `0x00541970(0, 0, 0)`, and publishes that buffer through `0x005438d0`. After that it consults mode table `0x0062583b` indexed by `[this+0xea] << 4`, and when the selected byte is nonzero it also triggers global helper `0x0053f000(0, 0, 0)` through root `0x00ccbb20`. The helper returns cached surface root `[this+0xe6]`. Current grounded caller is owner `0x0055f2f0`, so this is the safest current read for querying or ensuring the cached surface from stored dimensions and a mode-table gate rather than a generic getter.","objdump + caller inspection + local disassembly + object-family correlation + cached-surface correlation"
0x0055ecb0,134,create_layout_state_subobject_vtable_0x5de2a8_from_resource_0x87,shell,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Constructor-side owner for the `0x5de2a8` family. The helper runs base-side init through `0x00558580`, installs vtable `0x005de2a8`, re-enters `0x0055e9f0`, bumps global counter `0x00d9797c`, loads resource `0x87` through the `0x005a125d -> 0x0053b7c0 -> 0x00557f80` strip, copies five resource-derived dimension or range dwords from offsets `+0x5f..+0x6f` into `[this+0xa2/+0xa6/+0xaa/+0xae/+0xb2]`, then releases the temporary resource handle through `0x005a1145`. Current grounded caller is `0x0053fcdb`, so this is the safest current read for creating the `0x5de2a8` subobject from resource `0x87` rather than a generic allocator.","objdump + caller inspection + local disassembly + object-family correlation + resource-correlation"
0x0055ed40,76,layout_state_subobject_vtable_0x5de2a8_release_cached_surface_and_clear_global_gate_byte,shell,thiscall,inferred,objdump + local disassembly,2,"Release-side helper for the same `0x5de2a8` family. When cached surface root `[this+0xe6]` is live, the helper releases it through `0x00542c90` and `0x0053b080`, clears the root to null, clears global cached helper `0x00d97984`, and rewrites shell byte `[0x006d4024+0x114227]` to keep bit `0x01` set while clearing the `0x0e` band. This is the safest current read for releasing the cached surface side and clearing the associated global gate rather than a broader object destructor.","objdump + local disassembly + object-family correlation + cached-surface correlation + global-gate correlation"
0x0055ed90,206,layout_state_subobject_vtable_0x5de2a8_release_payload_and_optional_handles,shell,stdcall,inferred,objdump + local disassembly,2,"Broader release owner in the same `0x5de2a8` family. The helper clears global latch `0x00d97980` and a shell-side mirrored dword at `[0x006d4024+0x114746]`, optionally notifies shell helper `0x0051eea0`, releases payload root `[this+0xf2]` through import thunk `0x005c8380`, conditionally triggers global helper `0x0053f000(1, 0, 0)` from mode table `0x00625834`, and, when the caller requests the full teardown, also releases optional handle `[this+0xfe]` through `0x0053afd0`, optional handle `[this+0xbe]` through `0x005a1145`, and then re-enters `0x0055ed40`. Current grounded caller is `0x0055ee70`, so this is the safest current read for releasing the payload and optional handles of the `0x5de2a8` family rather than a generic branch cleanup.","objdump + local disassembly + object-family correlation + payload-release correlation"
0x0055ee60,23,layout_state_subobject_vtable_0x5de2a8_ensure_payload_loaded_or_trigger_release,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small guard helper for the `0x5de2a8` family. The function queries readiness through `0x00558670`, and when that check fails it re-enters `0x0055ed90(1)` to release payload-side state before returning. Current grounded caller is the larger owner body at `0x0055ee80`, so this is the safest current read for ensuring payload readiness or triggering the release path rather than a generic boolean query.","objdump + local disassembly + caller inspection + object-family correlation"
0x0055ee80,547,layout_state_subobject_vtable_0x5de2a8_service_timed_payload_cursor_and_dispatch_completion,shell,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Timed payload-cursor service owner for the same `0x5de2a8` family. The helper first gates on readiness through `0x00558670`, global latch `0x00d97970`, and payload root `[this+0xf2]`, then either advances the live payload cursor from `[payload+0x10]` toward the end bound `[payload+0x08]` according to elapsed ticks `0x0051d890` and the duration or rate pair `[payload+0x14/+0x18]`, or, when the cursor is exhausted, consults mode-table bytes `0x00625836/0x0062583a` from `[this+0xea] << 4` to seed or restart the payload through import thunks `0x005c836c` and `0x005c837c`. While advancing it re-enters thunks `0x005c8370`, `0x005c8374`, and `0x005c8378` to step the payload and retry completion up to three times, then stores the refresh tick back into `[this+0x102]`. On the terminal path it also flips local completion latches `[this+0xda/+0xae/+0x106]`, can re-enter `0x0055ed90(1)`, and optionally invokes callback slot `[this+0xd6]`. Current grounded callers are setup owner `0x0055f0b0` and render owner `0x0055f4e0`, so this is the safest current read for servicing the timed payload cursor and dispatching completion rather than a generic update loop.","objdump + caller inspection + local disassembly + object-family correlation + payload-cursor correlation + mode-table correlation"
0x0055f0b0,828,layout_state_subobject_vtable_0x5de2a8_bind_mode_table_payload_create_cached_surface_and_prime_service,shell,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Broader setup owner for the `0x5de2a8` family. The function first tears down prior payload state through `0x0055ed90(0)`, stores selector dword `[this+0xea]`, clears timer tick `[this+0x102]`, and then resolves one mode-table-backed payload root by formatting a first or fallback resource name from table `0x00625830` with descriptors `0x005de2fc` and `0x005de2e8` before loading it through import thunk `0x005c8368`. Once a payload is live, it caches that root globally in `0x00d9796c`, derives power-of-two surface dimensions into `[this+0xb6/+0xba]` capped by shell dimensions `[0x006d4024+0x11423b/+0x11423f]`, optionally allocates one auxiliary staging slab into `[this+0xbe]`, ensures cached surface `[this+0xe6]` through `0x0055ec00`, computes local aspect or scale floats into `[this+0x13/+0x17]` from payload dimensions and shell resolution tables, primes the timed payload service through `0x0055ee80(1)`, and then fills the cached surface through `0x0055ea60` before setting completion latch `[this+0xda] = 1`. Current grounded caller is registered-message dispatcher `0x0055f3f0`, so this is the safest current read for binding the mode-table payload, creating the cached surface, and priming the family service path rather than a generic constructor.","objdump + caller inspection + local disassembly + object-family correlation + payload-load correlation + cached-surface correlation + mode-table correlation"
0x0055f3f0,175,layout_state_subobject_vtable_0x5de2a8_handle_registered_message_strip,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Registered-message dispatcher for the `0x5de2a8` family. The helper switches over a compact message band normalized around ids `0x80..0xa5`, validates the target instance id against word `[this+0x04]`, and then dispatches into four concrete local paths: store callback slot `[this+0xd6]` and re-enter `0x00558a10`, run the broader payload-bind setup owner `0x0055f0b0`, force full payload release through `0x0055ed90(1)` before re-entering `0x00558a10`, or opportunistically release payload state when dimension dword `[this+0xa2]` is still zero. Current grounded caller is the surrounding registration family that forwards shell-side control messages into this object, so this is the safest current read for the registered-message strip rather than a generic wndproc.","objdump + caller inspection + local disassembly + object-family correlation + message-dispatch correlation"
0x0055f4e0,1222,layout_state_subobject_vtable_0x5de2a8_service_payload_and_render_cached_surface_overlay,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Primary live service and render owner for the `0x5de2a8` family. After gating on readiness through `0x00558670` and global latch `0x00d97970`, the helper refreshes the timed payload cursor through `0x0055ee80` and repopulates cached surface `[this+0xe6]` through `0x0055ea60` when mode-table byte `0x00625837` is set. When no payload is present it falls back to drawing one fixed-color world overlay marker through `0x0054f710`; when payload and cached surface are both live it derives normalized width or height ratios from `[this+0xde/+0xe2]` and the payload dimensions, clamps those ratios to `1.0`, renders the cached surface through `0x0054f640`, publishes the resulting world overlay through `0x0051f460`, and conditionally emits one or two additional marker sprites through `0x0054f9f0` based on controller mask `[0x006d401c+0xc79]` and local scalar band `[this+0x1b..+0x27]`. Current grounded callers are the surrounding shell-side presentation walkers that service this object family every frame, so this is the safest current read for servicing the payload and rendering the cached-surface overlay rather than a generic draw helper.","objdump + caller inspection + local disassembly + object-family correlation + cached-surface correlation + overlay-render correlation"
0x0055f9b0,49,layout_state_subobject_vtable_0x5de2a8_destruct_and_release_self,shell,stdcall,inferred,objdump + local disassembly,2,"Destructor-side wrapper for the `0x5de2a8` family. The helper reinstalls vtable `0x005de2a8`, re-enters full release owner `0x0055ed90(1)`, decrements global live-family counter `0x00d9797c`, runs base cleanup through `0x00558000`, and optionally frees the object storage through `0x0053b080` when caller flag bit `0` is set. This is the safest current read for the destructor and optional self-free wrapper rather than a broader owner teardown.","objdump + local disassembly + object-family correlation + destructor correlation"
0x0055f9f0,251,layout_state_subobject_vtable_0x5de318_init,shell,thiscall,inferred,objdump + local disassembly,2,"Initializer for the adjacent shell-side subobject family rooted at vtable `0x005de318`. The helper zeroes the local record or handle bands spanning `[this+0xa2..+0x102]` and `[this+0x172..+0x1e6]`, seeds selector word `[this+0x06] = 0x08`, stores sentinel `-1` into `[this+0x192]` and `[this+0x1d6]`, and seeds active-state dword `[this+0x172] = 1`. Current grounded callers are constructors `0x0055fcc0` and `0x0055ff70`, so this is the safest current read for the family initializer rather than a broader setup owner.","objdump + local disassembly + object-family correlation"
0x0055faf0,139,layout_state_subobject_vtable_0x5de318_refresh_active_state_and_notify_optional_handle_0x19a,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small active-state refresh helper for the `0x005de318` family. The function derives one local enable bit from the current range or selector relation between `[this+0x1da]`, `[this+0xa2]`, `[this+0xea]`, and status byte `[this+0x33]`, optionally forwards the resulting span length into optional handle `[this+0x19a]` through `0x0055a640`, and when active-state dword `[this+0x172]` changes it dispatches either `0x00558980(3, 0, 0)` or `0x005588b0(3)` on the same optional handle. This is the safest current read for refreshing the family active-state bit and notifying the optional handle rather than a generic flag setter.","objdump + local disassembly + caller inspection + object-family correlation + handle-notify correlation"
0x0055fb80,17,layout_state_subobject_vtable_0x5de318_query_row_field_0x08_by_index,shell,stdcall,inferred,objdump + local disassembly,2,"Tiny indexed query over the family row table rooted at `[this+0x176]` with stride `0x20`. The function returns dword field `+0x08` from the selected row index. This is the safest current read for the row-field query rather than a more specific semantic name.","objdump + local disassembly + object-family correlation + row-table correlation"
0x0055fba0,19,layout_state_subobject_vtable_0x5de318_query_selected_row_field_0x08,shell,thiscall,inferred,objdump + local disassembly,2,"Selected-row sibling to `0x0055fb80`. The helper resolves current selected row index `[this+0x1d6]`, indexes the same `0x20`-byte row table rooted at `[this+0x176]`, and returns row field `+0x08`. This is the safest current read for querying the selected row field rather than a more specific UI name.","objdump + local disassembly + object-family correlation + row-table correlation + selected-row correlation"
0x0055fbc0,65,layout_state_subobject_vtable_0x5de318_query_row_chain_has_terminal_zero_field_0x10,shell,stdcall,inferred,objdump + local disassembly,2,"Chain-walk query over the same row table. Starting from one caller row index, the helper follows link field `+0x14` while current field `+0x10` stays nonzero and returns `1` when it reaches a terminal row whose field `+0x10` is zero; otherwise it returns `0`. This is the safest current read for the row-chain terminal-field predicate rather than a more semantic ownership claim.","objdump + local disassembly + object-family correlation + row-table correlation + chain-walk correlation"
0x0055fc10,51,layout_state_subobject_vtable_0x5de318_count_row_chain_length,shell,stdcall,inferred,objdump + local disassembly,2,"Counting sibling to `0x0055fbc0`. The helper walks the row-chain through link field `+0x14` while current field `+0x10` remains nonzero and returns the number of traversed rows. This is the safest current read for counting the linked row chain rather than a more semantic list size name.","objdump + local disassembly + object-family correlation + row-table correlation + chain-walk correlation"
0x0055fc50,75,layout_state_subobject_vtable_0x5de318_release_optional_handle_0x1a8_and_clear_control_tokens,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Release-side helper for one optional effect or presentation handle in the `0x005de318` family. When handle `[this+0x1a8]` is live, the helper first runs `0x0045ea20(7, 0.5f)`, then forwards the current owner through `0x0053fe00`, clears matching status tokens for child control id `[this+0x04]` through `0x00538840`, and finally clears `[this+0x1a8]` back to null. This is the safest current read for releasing the optional handle and clearing the paired control tokens rather than a generic reset.","objdump + caller inspection + local disassembly + object-family correlation + token-clear correlation"
0x0055fcc0,160,create_layout_state_subobject_vtable_0x5de318_from_resource_0x12f,shell,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Constructor-side owner for the `0x005de318` family. The helper runs base-side init through `0x00558580`, installs vtable `0x005de318`, re-enters `0x0055f9f0`, loads resource `0x12f` through the `0x005a125d -> 0x0053b7c0 -> 0x00557f80` strip, reinitializes the object once more, and then copies `0x34` dwords from resource offset `+0x5f` into local field band `[this+0xa2..+0x16d]` before releasing the temporary resource handle through `0x005a1145`. This is the safest current read for creating the family from resource `0x12f` rather than a generic allocator.","objdump + caller inspection + local disassembly + object-family correlation + resource-correlation"
0x0055ff70,56,create_layout_state_subobject_vtable_0x5de318_from_caller_payload_record,shell,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Alternate constructor for the same `0x005de318` family. The helper runs base-side init through `0x00558580`, installs vtable `0x005de318`, re-enters `0x0055f9f0`, and then copies `0x34` dwords from caller record offset `+0x5f` directly into local field band `[this+0xa2..+0x16d]` before returning. This is the safest current read for creating the family from a caller-supplied payload record rather than a resource load.","objdump + caller inspection + local disassembly + object-family correlation + payload-record correlation"
0x0055ffb0,65,layout_state_subobject_vtable_0x5de318_round_normalized_scalar_0xb6_to_current_view_height,shell,thiscall,inferred,objdump + local disassembly,2,"Small scalar helper in the `0x005de318` family. The function multiplies normalized scalar `[this+0xb6]` by the current view-height dword from `[0x006d4024+0x34 + [0x006d4024+0x11421e]*0x15 + 0x04]`, rounds that product through `0x005a10d0`, adds `0.5`, and divides back by the same height. This is the safest current read for rounding normalized scalar `0xb6` onto the current view-height grid rather than a generic math helper.","objdump + local disassembly + object-family correlation + scalar-rounding correlation"
0x00560000,700,layout_state_subobject_vtable_0x5de318_build_descriptor_object_from_local_bounds_and_attach_to_owner,shell,thiscall,inferred,objdump + local disassembly,2,"Broader owner above the `0x005de318` helper strip. When inhibit dword `[this+0x126]` is clear and status byte `[this+0x33]` does not force the skip path, the function assembles one `0x38`-byte stack descriptor from local field bands `[this+0xa2..+0x11a]`, owner-relative coordinate floats, optional payload root `[this+0xf2]`, and the current owner or child ids from `[this+0x08/+0x09/+0x43/+0x47]`. It then allocates one `0x1b9`-byte descriptor object through `0x0053b070`, initializes it through `0x0055ab50`, stores the resulting handle into `[this+0x19a]`, binds it to owner `[this+0x86]` through `0x0053f9c0`, releases temporary resources, seeds fallback color dword `[this+0xf6] = 0xffffff00` when unset, and finally re-enters `0x0055faf0` to refresh the family active-state latch. This is the safest current read for building the family descriptor object from local bounds and attaching it to the owner rather than a generic constructor.","objdump + local disassembly + object-family correlation + descriptor-build correlation + owner-attach correlation"
0x005602c0,57,layout_state_subobject_vtable_0x5de318_count_nonterminal_row_chains_up_to_limit,shell,stdcall,inferred,objdump + local disassembly,2,"Counting helper over the family row table. For each row index below the caller limit, the function re-enters `0x0055fbc0`; whenever that row-chain predicate returns `0`, it increments the result counter. This is the safest current read for counting nonterminal row chains up to the caller limit rather than a more semantic inventory name.","objdump + local disassembly + object-family correlation + row-table correlation + chain-walk correlation"
0x00560300,72,layout_state_subobject_vtable_0x5de318_find_index_of_nth_nonterminal_row_chain,shell,stdcall,inferred,objdump + local disassembly,2,"Selector sibling to `0x005602c0`. Given one ordinal input, the helper scans the first `[this+0x1d2]` rows, re-entering `0x0055fbc0` on each row; whenever that predicate returns `0`, it advances a local counter, and when the requested ordinal is reached it returns the current row index. Input `-1` short-circuits to `-1`. This is the safest current read for finding the index of the Nth nonterminal row chain rather than a more semantic selector name.","objdump + local disassembly + object-family correlation + row-table correlation + chain-walk correlation"
0x00560350,135,layout_state_subobject_vtable_0x5de318_query_world_anchor_pair_from_local_offsets_and_normalized_height,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"World-anchor query helper in the `0x005de318` family. The function rounds normalized scalar `[this+0xb6]` against the current view-height grid, then combines owner origin `[this+0x86]`, local float offsets `[this+0xa6/+0xaa/+0xb2]`, base coordinate floats `[this+0x0b/+0x0f]`, and one caller scale input to write an `(x, y)` anchor pair into the two caller output pointers. Current grounded callers are the later family owners under `0x560c66/0x560c83/0x560ca7/0x5610c6/0x5610f8/0x56237a/0x5623bb/0x5624c9/0x5625e0`, so this is the safest current read for the local world-anchor pair query rather than a generic projection helper.","objdump + caller inspection + local disassembly + object-family correlation + world-anchor correlation"
0x005603e0,2043,layout_state_subobject_vtable_0x5de318_service_row_table_and_render_overlay_strip,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Primary live service owner for the `0x005de318` family. When readiness `0x00558670` passes, the function splits into two main modes. If descriptor handle `[this+0x126]` is live, it renders the bound descriptor object and several selected-row overlays by forwarding names or ids through `0x0053de00`, `0x00552560`, and `0x005519f0`. Otherwise it iterates the local row table for up to two passes, derives world-relative anchor and span data from owner origin `[this+0x86]`, local offset bands `[this+0xa6..+0xb6]` and `[this+0xc6..+0xda]`, the row-chain helpers `0x005602c0/0x00560300`, and optional cached surface `[this+0xe6]`, then emits row or marker overlays through `0x0054f710` and a callback slot `[this+0x1ce]` when present. Selected-row branches also consult optional style or label fields `[this+0x11e/+0x12e/+0x132/+0x146..+0x15a]`, optional effect handle `[this+0x1a8]`, and current selected row `[this+0x1d6]`. Current grounded caller is `0x0056178e`, so this is the safest current read for servicing the family row table and rendering its overlay strip rather than a generic draw loop.","objdump + caller inspection + local disassembly + object-family correlation + row-table correlation + overlay-render correlation"
0x00560e50,496,layout_state_subobject_vtable_0x5de318_refresh_callback_row_cache_and_dispatch_band,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Refresh owner for the callback-driven side of the `0x005de318` family. When callback slots `[this+0x1c6]` or `[this+0x1ca]` are present and inhibit dword `[this+0x182]` is clear, the helper first drains the old callback row cache in `[this+0x18a/+0x18e]` through callback slot `[this+0x1c6]`, rebuilds the cache length from `[this+0x1de]`, allocates a new dword array into `[this+0x18e]`, fills that cache by re-entering `0x560300` over row indices `[this+0x1e2..]`, and then dispatches each cached row id plus derived float offsets through callback slot `[this+0x1ca]`. The service uses rounded normalized scalar `[this+0xb6]`, local offsets `[this+0xa6/+0xaa/+0xae/+0xb2]`, and row-table field `+0x08` as the main derived inputs. This is the safest current read for refreshing the callback row cache and dispatch band rather than a generic postprocess loop.","objdump + caller inspection + local disassembly + object-family correlation + callback-cache correlation + row-table correlation"
0x00561150,68,layout_state_subobject_vtable_0x5de318_refresh_callback_cache_and_maybe_advance_row_origin,shell,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Small refresh wrapper above `0x560e50` in the same `0x005de318` family. The helper re-enters `0x560e50`, refreshes the family active-state through `0x55faf0`, and, when status flag bit `0x0100` in `[this+0x33]` is set and the caller requests advancement, copies rollover dword `[this+0x1e6]` into `[this+0x1e2]` while also decrementing one countdown in optional handle `[this+0x19a]+0x185`. This is the safest current read for refreshing the callback cache and conditionally advancing the row-origin band rather than a generic tick function.","objdump + caller inspection + local disassembly + object-family correlation + callback-cache correlation + row-origin correlation"
0x005615f0,328,layout_state_subobject_vtable_0x5de318_destruct_release_rows_and_clear_registered_handles,shell,thiscall,inferred,objdump + local disassembly,2,"Destructor-side owner for the `0x005de318` family. When live handle `[this+0x1a8]` exists, the helper first runs `0x45ea20(7, 0.5f)`, forwards the object through `0x53fe00`, and clears matching control-status tokens via `0x538840`. It then detaches descriptor handle `[this+0x19a]` from owner `[this+0x86]` through `0x53f860`, drains cached callback rows via slot `[this+0x1c6]`, releases every per-row string and payload handle in the row table `[this+0x176]`, frees the row-table slab itself, clears owner-side registration pointer `[0x006d401c+0xc75]` when it points at this object, re-enters `0x560e50`, and finally falls through base cleanup `0x558000`. This is the safest current read for the family destructor and registered-handle release owner rather than a generic teardown.","objdump + local disassembly + object-family correlation + destructor correlation + row-table correlation"
0x00561740,144,layout_state_subobject_vtable_0x5de318_render_active_overlay_and_optional_markers,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Live render wrapper over `0x5603e0` for the `0x005de318` family. The helper derives one four-value integer view box from owner origin `[this+0x86]` plus local float bands `[this+0x0b..+0x17]`, forwards that box into `0x5603e0`, and then, when controller mask `[0x006d401c+0xc79]` admits it and readiness `0x00558670` passes, emits one or two additional marker sprites through `0x0054f9f0` using the same local float bands `[this+0x1b..+0x27]`. Current grounded caller is the live presentation walker at `0x56178e`, so this is the safest current read for the family render wrapper and optional marker strip rather than a generic projection helper.","objdump + caller inspection + local disassembly + object-family correlation + overlay-render correlation"
0x00561840,591,layout_state_subobject_vtable_0x5de318_set_selected_row_clamped_refresh_callbacks_and_signal_input,shell,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Selected-row setter for the `0x005de318` family. The helper clamps the caller row index to `[-1, this->1e6]`, mirrors the resulting row id through optional outputs `[this+0x1b2]` and `[this+0x1b6]`, conditionally recenters the visible row window by re-entering `0x561840`, updates current selected row `[this+0x1d6]`, optionally notifies local style helper `0x45ea20` and callback slots `[this+0x1be]` and `[this+0x1c2]`, and finally enqueues a shell-input event record of type `0xce` through `0x54e9c0` carrying child control id `[this+0x04]` and the resolved selected row value. Current grounded caller is the hotkey-list rebuild path `0x004fec60`, so this is the safest current read for setting the selected row, refreshing callbacks, and signalling shell input rather than a generic setter.","objdump + caller inspection + local disassembly + object-family correlation + selected-row correlation + callback-correlation + input-event correlation"
0x005618f0,752,layout_state_subobject_vtable_0x5de318_append_row_record_grow_table_and_refresh_state,shell,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Append owner for the same `0x005de318` family. The helper copies an incoming `0x20`-byte row record, canonicalizes its two string fields through `0x51d820`, sets row flag `+0x1c` when the incoming third dword is nonzero, grows row-table slab `[this+0x176]` by one row, appends the copied record, updates counts `[this+0x1d2/+0x1da/+0x1de/+0x1e6]`, re-enters chain predicate `0x55fbc0` to decide whether rollover tracking should advance, refreshes the callback side through `0x560e50`, and refreshes the family active-state through `0x55faf0`. When a rollover happened and status flag bit `0x0100` in `[this+0x33]` is set, it also copies `[this+0x1e6]` back into `[this+0x1e2]` and decrements the countdown in optional handle `[this+0x19a]+0x185`. This is the safest current read for appending one row record, growing the row table, and refreshing state rather than a generic vector push.","objdump + caller inspection + local disassembly + object-family correlation + row-table correlation + append-correlation"
0x00561c30,28,layout_state_subobject_vtable_0x5de318_destruct_and_optionally_free_self,shell,stdcall,inferred,objdump + local disassembly,2,"Thin destructor wrapper for the `0x005de318` family. The helper re-enters full teardown owner `0x5615f0`, and when caller flag bit `0` is set it also frees the object storage through `0x53b080`. This is the safest current read for the destructor-and-free wrapper rather than a broader teardown path.","objdump + local disassembly + object-family correlation + destructor correlation"
0x00561c50,488,layout_state_subobject_vtable_0x5de318_remove_row_by_index_repair_window_and_selection,shell,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Row-removal owner for the `0x005de318` family. Given one row index below `[this+0x1d2]`, the helper checks the row-chain predicate `0x55fbc0`, remaps that row through `0x5602c0`, adjusts window or rollover state `[this+0x1e2/+0x1e6/+0x1da/+0x1de/+0x192]`, releases the row's owned string and payload handles, compacts the remaining `0x20`-byte row records leftward inside `[this+0x176]`, and then repairs current selected row `[this+0x1d6]` through `0x5618f0` or by emitting vtable message `0x66` when the deleted row was selected. The tail refreshes callback state through `0x560e50` and family activity through `0x55faf0`. Current grounded callers are the outer message paths at `0x5628a8` and `0x56267a`, so this is the safest current read for removing one row and repairing selection and window state rather than a generic delete.","objdump + caller inspection + local disassembly + object-family correlation + row-table correlation + deletion correlation + selection-repair correlation"
0x00561e40,231,layout_state_subobject_vtable_0x5de318_set_row_flag_0x18_recount_nonterminal_rows_and_repair_selection,shell,stdcall,inferred,objdump + local disassembly,2,"Per-row flag update helper for the same `0x005de318` family. The function writes one caller-supplied value into row field `+0x18`, then recounts nonterminal rows into `[this+0x1da]` by re-entering `0x55fbc0`, refreshes visible-count dword `[this+0x1de]`, and, when the current selected row no longer lands on a valid terminal chain, recenters or resets selection through `0x5618f0` before re-entering `0x55faf0`. This is the safest current read for setting row flag `0x18`, recounting the nonterminal band, and repairing selection rather than a more semantic toggle name.","objdump + local disassembly + object-family correlation + row-table correlation + selection-repair correlation"
0x00561f30,175,layout_state_subobject_vtable_0x5de318_handle_navigation_message_strip_and_maybe_fill_event_ca,shell,thiscall,inferred,objdump + local disassembly,2,"Compact message helper for the `0x005de318` family. When the family is active and row count `[this+0x1d2]` is nonzero, the function interprets a narrow command band from the caller event record, derives a next candidate row through `0x560300` or direct decrement or increment rules, and either updates current selection through `0x5618f0` or fills the caller event record with a synthesized `0xca` message carrying child control id `[this+0x04]`, the current selected row, and the corresponding row field `+0x08`. This is the safest current read for the local navigation-message strip rather than a generic event filter.","objdump + local disassembly + object-family correlation + row-table correlation + navigation correlation"
0x00562540,268,layout_state_subobject_vtable_0x5de318_auto_scroll_visible_window_from_pointer_proximity,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Timed auto-scroll helper for the `0x005de318` family. The function rate-limits on tick `[this+0x17e]`, samples current pointer coordinates through `0x51f0b0`, and when the pointer crosses the top or bottom bounds derived from owner origin plus local vertical bands `[this+0x0f/+0xaa/+0xb6]`, it shifts visible window origin `[this+0x1e2]` by one row through `0x561840`, refreshes callback state through `0x560e50`, and then reselects the top or bottom visible row through `0x5618f0`. This is the safest current read for the family auto-scroll owner rather than a generic timer callback.","objdump + caller inspection + local disassembly + object-family correlation + auto-scroll correlation + selection-correlation"
0x00562650,68,layout_state_subobject_vtable_0x5de318_clear_all_rows_then_refresh_callbacks,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Full-clear helper for the `0x005de318` family. The function temporarily raises inhibit dword `[this+0x182]`, repeatedly re-enters row-removal owner `0x561c50` until row count `[this+0x1d2]` reaches zero, restores the inhibit dword, and tails into callback refresh owner `0x560e50`. This is the safest current read for clearing all rows and refreshing callbacks rather than a generic reset.","objdump + caller inspection + local disassembly + object-family correlation + row-table correlation + full-clear correlation"
0x005626a0,1348,layout_state_subobject_vtable_0x5de318_handle_registered_message_dispatch,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Primary registered-message dispatcher for the `0x005de318` family. The helper switches over a message band rooted at `0xca`, validates child control id `[this+0x04]`, and then routes to the local owners that set or clear visible-window callbacks `[this+0x1ba/+0x1be/+0x1c2/+0x1c6/+0x1ca/+0x1ce]`, release handle `[this+0x1a8]` through `0x55fc50`, clear all rows through `0x562650`, remove one row through `0x561c50`, append one row through `0x561aa0`, refresh callbacks through `0x560e50`, and update selection through `0x5618f0`. One branch also mirrors the object back into the broader shell registration path when shell global `0x006d3b4c` and selected-child id `0x00622b34` match. This is the safest current read for the registered-message dispatcher rather than a generic wndproc.","objdump + caller inspection + local disassembly + object-family correlation + message-dispatch correlation"
0x00562d30,99,layout_state_subobject_vtable_0x5de360_init,shell,thiscall,inferred,objdump + local disassembly,2,"Initializer for the adjacent shell-side subobject family rooted at vtable `0x005de360`. The helper seeds selector word `[this+0x06] = 0x10`, clears callback or timing dwords `[this+0xa2/+0xce/+0xd2/+0xd6]`, initializes range or delay dword `[this+0xa6] = 0x1f4`, and zeroes the four watched child-control words `[this+0xaa..+0xb8]`. Current grounded callers are constructors `0x563120` and `0x563210`, so this is the safest current read for the family initializer rather than a broader setup owner.","objdump + local disassembly + object-family correlation"
0x00562da0,158,layout_state_subobject_vtable_0x5de360_render_optional_marker_pair,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small render helper for the `0x005de360` family. After readiness `0x00558670` and controller mask `[0x006d401c+0xc79]` admit the object, the helper emits one or two marker sprites through `0x0054f9f0` using owner origin `[this+0x86]`, local float bands `[this+0x0b..+0x27]`, and the same shell cue byte `[this+0x2d]` used elsewhere in this family. Current grounded caller is the later render-side owner `0x00563670`, so this is the safest current read for the optional marker-pair render helper rather than a generic projection routine.","objdump + local disassembly + caller inspection + object-family correlation + marker-render correlation"
0x00562e40,108,layout_state_subobject_vtable_0x5de360_dispatch_optional_callback_and_service_base_update,shell,stdcall,inferred,objdump + local disassembly,2,"Update helper for the same `0x005de360` family. The function snapshots elapsed ticks into `[this+0xce/+0xd2]` through `0x0051d890`, optionally invokes callback slot `[this+0x9e]` with owner-relative local coordinates derived from `[this+0x86]` and `[this+0x0b/+0x0f]`, and then tails into base-side service `0x00558760`. This is the safest current read for dispatching the optional callback and running the shared base update rather than a generic timer tick.","objdump + local disassembly + object-family correlation + callback-dispatch correlation"
0x00562ed0,432,layout_state_subobject_vtable_0x5de360_handle_registered_message_strip,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Registered-message dispatcher for the `0x005de360` family. The helper switches over a sparse message band, validates readiness through vtable slots `+0x30` and `+0x20`, updates local callback slot `[this+0xd6]`, and compares incoming child-control ids against the four watched words `[this+0xb2/+0xb4/+0xb6/+0xb8]`. Matching rows can trigger shell cue `0x45ea20`, synthesize a `0xca` event carrying child id `[this+0x04]`, or resolve a target window through `shell_find_registered_window_containing_child_control_id` `0x00538810` before forwarding the paired words `[this+0xae/+0xb0]` into that window. Every live path exits through `0x00558a10` with the original message. This is the safest current read for the family message strip rather than a generic wndproc.","objdump + caller inspection + local disassembly + object-family correlation + message-dispatch correlation"
0x00563120,192,create_layout_state_subobject_vtable_0x5de360_from_resource_0x8b,shell,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Constructor-side owner for the `0x005de360` family. The helper runs base-side init through `0x00558580`, installs vtable `0x005de360`, re-enters `0x00562d30`, loads resource `0x8b` through the `0x005a125d -> 0x0053b7c0 -> 0x00557f80` strip, and then copies eleven dwords or words from resource offset `+0x5f` into local field band `[this+0xa2..+0xb8]` before releasing the temporary resource handle through `0x005a1145`. This is the safest current read for creating the family from resource `0x8b` rather than a generic allocator.","objdump + caller inspection + local disassembly + object-family correlation + resource-correlation"
0x005631e0,36,layout_state_subobject_vtable_0x5de360_destruct_and_optionally_free_self,shell,stdcall,inferred,objdump + local disassembly,2,"Thin destructor wrapper for the `0x005de360` family. The helper reinstalls vtable `0x005de360`, falls through base cleanup `0x00558000`, and optionally frees object storage through `0x0053b080` when caller flag bit `0` is set. This is the safest current read for the destructor-and-free wrapper rather than a broader teardown path.","objdump + local disassembly + object-family correlation + destructor correlation"
0x00563210,58,create_layout_state_subobject_vtable_0x5de360_from_caller_payload_record,shell,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Alternate constructor for the same `0x005de360` family. The helper runs base-side init through `0x00558580`, installs vtable `0x005de360`, re-enters `0x00562d30`, and then copies eleven dwords from caller record offset `+0x5f` directly into local field band `[this+0xa2..+0xb8]`. This is the safest current read for creating the family from a caller-supplied payload record rather than a resource load.","objdump + caller inspection + local disassembly + object-family correlation + payload-record correlation"
0x00563250,11,shell_clear_global_child_control_filter_id_0x625a94,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny shell-global helper that resets filter dword `0x00625a94` back to `-1`. Current grounded callers are higher shell descriptor owners like `0x004e2abb`, `0x0050a5e0`, `0x0050a670`, `0x0050a6a0`, `0x0050c0cb`, and `0x0050c130`, so this is the safest current read for clearing one global child-control filter id rather than a broader mode reset.","objdump + local disassembly + caller inspection + global-filter correlation"
0x00563260,42,shell_update_global_child_control_filter_id_0x625a94,shell,stdcall,inferred,objdump + local disassembly + caller inspection,2,"Small update helper for the same shell-global filter dword `0x00625a94`. When the incoming toggle is clear and the caller id matches the current filter, the helper resets the filter to `-1`; otherwise, when the toggle is nonzero, it stores the caller id. Current grounded caller is the shared shell child-control descriptor owner `0x00563290`, which installs this helper as the follow-on callback for kind `0x7b`.","objdump + local disassembly + caller inspection + global-filter correlation + descriptor-callback correlation"
0x00563290,521,shell_window_ensure_child_control_from_world_anchor_text_and_dispatch_descriptor_0x7b,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared shell child-control owner beneath several detail and report families. The helper first formats one text or callout payload through `shell_publish_text_callout_presentation` `0x005519f0`, then tries to resolve the target child control through `shell_window_find_registered_child_control_by_id` `0x0053f830`. When no matching child exists, it builds one `0xda`-byte payload block on the stack, allocates a new child object through `0x0053b070`, initializes it through `create_layout_state_subobject_vtable_0x5de360_from_caller_payload_record` `0x00563210`, registers it on the owning window through `0x0053f9c0`, and finally dispatches a kind-`0x7b` shell descriptor through `0x0053fe90` with callback `0x00563260`. Current grounded callers include `LoadScreen.win`, stock-buy, and several report-side renderers, so this is the safest current read for ensuring one anchored child control and dispatching the follow-on descriptor rather than a window-family-local helper.","objdump + caller inspection + local disassembly + child-control correlation + descriptor-dispatch correlation + shared-shell-owner correlation"
0x005634e0,99,layout_state_subobject_vtable_0x5de3b0_init,shell,thiscall,inferred,objdump + local disassembly,2,"Initializer for the adjacent shell-side subobject family rooted at vtable `0x005de3b0`. The helper seeds selector word `[this+0x06] = 0x20`, clears local scalar or handle bands `[this+0xa2..+0xd8]`, and zeroes the optional text root `[this+0xb2]` plus state dword `[this+0xcc]`. Current grounded callers are constructors `0x00563c00` and `0x00563d70`, so this is the safest current read for the family initializer rather than a broader setup owner.","objdump + local disassembly + object-family correlation"
0x00563550,272,layout_state_subobject_vtable_0x5de3b0_refresh_localized_label_and_mode_specific_offsets,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Refresh helper for the `0x005de3b0` family. The function resolves optional localized string id `[this+0xb6]` into text root `[this+0xb2]`, seeds shell cue byte `[this+0x2d]` from toggle dword `[this+0xc8]` when needed, and then applies several mode- and control-id-specific vertical offset bumps to local float bands `[this+0x13]` and `[this+0xc0]` under shell mode `0x006d3c84` and capability gate `0x0051b6f0`. Current grounded caller is the family render owner `0x00563670`, so this is the safest current read for refreshing the localized label and the mode-specific offset strip rather than a generic scalar setter.","objdump + local disassembly + caller inspection + object-family correlation + localized-label correlation"
0x00563670,730,layout_state_subobject_vtable_0x5de3b0_render_label_callout_card_and_optional_markers,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Primary live render owner for the `0x005de3b0` family. After readiness `0x00558670` passes, the helper can emit an upper label through `0x0053de00 -> 0x00552560` using local text root `[this+0x92]`, then renders the main body or callout through `shell_publish_text_callout_presentation` `0x005519f0` using text root `[this+0xb2]`, style bytes `[this+0x2b/+0x2c]`, optional color bands `[this+0xcc..+0xd8]`, and owner-relative float bands `[this+0xa2..+0xc4]`. When the object is selected it brightens the active color channels, clamps projected span bands, and finally emits one or two additional marker sprites through `0x0054f9f0` based on controller mask `[0x006d401c+0xc79]` and the usual local marker floats `[this+0x13..+0x27]`. This is the safest current read for rendering the family label or callout card and optional markers rather than a generic projection helper.","objdump + caller inspection + local disassembly + object-family correlation + callout-render correlation + marker-render correlation"
0x00563950,510,layout_state_subobject_vtable_0x5de3b0_handle_registered_message_strip,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Registered-message dispatcher for the `0x005de3b0` family. The helper switches over a sparse message band, validates child control id `[this+0x04]`, updates local text root `[this+0xb2]`, and services interactive state through `[this+0xc8/+0xcc]`. One branch copies a new caller string into `[this+0xb2]`; the activation path validates readiness through vtable slots `+0x30` and `+0x20`, toggles the active selection dword `[this+0xcc]`, restyles sibling control `0x93` through `0x00540120`, optionally emits shell cue `0x45ea20`, and can synthesize a `0xca` event carrying the current active value. Every live path exits through `0x00558a10` with the original message. This is the safest current read for the family message strip rather than a generic wndproc.","objdump + caller inspection + local disassembly + object-family correlation + message-dispatch correlation"
0x00563c00,281,create_layout_state_subobject_vtable_0x5de3b0_from_resource_0xa1,shell,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Constructor-side owner for the `0x005de3b0` family. The helper runs base-side init through `0x00558580`, installs vtable `0x005de3b0`, re-enters `0x005634e0`, loads resource `0xa1` through the `0x005a125d -> 0x0053b7c0 -> 0x00557f80` strip, and then copies the resource payload band rooted at `+0x5f` into local fields `[this+0xa2..+0xd8]`, including an optional fallback text root loaded through `0x0053cb10(0xbc1)`. This is the safest current read for creating the family from resource `0xa1` rather than a generic allocator.","objdump + caller inspection + local disassembly + object-family correlation + resource-correlation"
0x00563d20,67,layout_state_subobject_vtable_0x5de3b0_destruct_and_optionally_free_self,shell,stdcall,inferred,objdump + local disassembly,2,"Thin destructor wrapper for the `0x005de3b0` family. The helper releases optional text root `[this+0xb2]` through `0x005a1145`, reinstalls vtable `0x005de3b0`, falls through base cleanup `0x00558000`, and optionally frees the object storage through `0x0053b080` when caller flag bit `0` is set. This is the safest current read for the destructor-and-free wrapper rather than a broader teardown path.","objdump + local disassembly + object-family correlation + destructor correlation"
0x00563d70,80,create_layout_state_subobject_vtable_0x5de3b0_from_caller_payload_record,shell,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Alternate constructor for the same `0x005de3b0` family. The helper runs base-side init through `0x00558580`, installs vtable `0x005de3b0`, re-enters `0x005634e0`, copies the caller payload band rooted at `+0x5f` into local fields `[this+0xa2..+0xd8]`, and duplicates the caller string root at `+0x6f` into `[this+0xb2]`. Current grounded callers span several report and detail-window renderers, so this is the safest current read for creating the family from a caller-supplied payload record rather than a resource load.","objdump + caller inspection + local disassembly + object-family correlation + payload-record correlation"
0x00563e30,84,ensure_callback_registration_handle_with_context_outparam,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small ensure-owner over one compact callback-registration helper object. When live flag `[this+0x0c]` is still clear, the function first releases any old imported handle at `[this+0x04]` through the release pair at `0x005c81c4/0x005c81c8`, then allocates or registers a new handle through import `0x005c81c0` using callback `0x00563dd0`, context `this`, and outparam slot `[this+0x08]`, stores the returned handle in `[this+0x04]`, and marks `[this+0x0c] = 1`. Current grounded caller is `0x00521c64`, so this is the safest current read for the lazy ensure path rather than a broader shell owner.","objdump + caller inspection + local disassembly + callback-registration correlation"
0x00563e90,51,callback_registration_handle_destruct_release_handle_and_clear_live_flag,shell,thiscall,inferred,objdump + local disassembly,2,"Release-side helper for the same compact callback-registration handle family. The function reinstalls vtable `0x005d1248`, releases any live handle at `[this+0x04]` through the same imported release pair at `0x005c81c4/0x005c81c8`, clears `[this+0x04]`, and resets live flag `[this+0x0c] = 0`. This is the safest current read for the direct destructor of the callback-registration handle object rather than a higher-level shell teardown.","objdump + local disassembly + callback-registration correlation + handle-release correlation"
0x00563ed0,60,runtime_object_release_all_entries_in_list_field_0x8d_via_0x5544b0,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared cleanup helper over owned list root `[this+0x8d]` in the same broader runtime-object branch. The function rewinds that intrusive queue through `0x00556ef0/0x00556f00`, then repeatedly releases each live payload through `0x005544b0(-1, 1)` until the iterator is exhausted. Current grounded caller is `shell_audio_backend_change_follow_on_refresh` `0x004fe160`, so this is the safest current read for the direct release sweep over owned list `[+0x8d]` rather than a broader settings owner.","objdump + caller inspection + local disassembly + owned-list correlation"
0x00563f10,11,runtime_object_remove_payload_from_list_field_0x8d,map,thiscall,inferred,objdump + local disassembly + intrusive-queue correlation,2,"Tiny removal helper over owned intrusive queue root `[this+0x8d]`. The function forwards the caller payload directly into `0x00556e80` on that list root. This is the safest current read for the direct remove-from-list companion to the broader `[+0x8d]` service strip rather than a generic tail-call stub.","objdump + local disassembly + intrusive-queue correlation + owned-list correlation"
0x00563f20,1061,runtime_object_refresh_nearby_presentation_and_border_overlay_lists_within_cell_radius,map,thiscall,inferred,objdump + caller inspection + local disassembly + field correlation,2,"Broader cell-radius refresh owner in the same runtime-object branch. The function clears the `0x1000`-byte visited or marker band rooted at `[world+0x47c]` down to preserved bit `0x80`, derives clamped tile bounds from the caller center and radius through `0x00533970/0x00533980`, clears owned list `[this+0x79]` through `0x005570b0`, then walks every cell in the resulting rect. For each cell it resolves the nearby-presentation queue through `0x00533ba0`, appends every live payload into `[this+0x79]` through `0x00556e10`, marks the corresponding `[world+0x47c]` byte with bit `0x01`, resolves the border-overlay chunk queue through `0x00533c50`, and for each live payload ensures active state through `0x005544b0`, records or refreshes owner marker `[entry+0x13d]`, and appends first-seen entries into owned list `[this+0x8d]` through `0x00556e10`. After the rect walk it iterates existing entries in `[this+0x8d]` again and removes or deactivates any payload whose cached owner marker no longer matches `[this+0x05]`. Current grounded caller is `0x0052c313`, so this is the safest current read for the nearby-presentation plus border-overlay membership refresh within one cell radius rather than a narrower subtype label.","objdump + caller inspection + local disassembly + field correlation + cell-table correlation + owned-list correlation"
0x005641f0,137,resource_bank_load_heap_copy_by_key_or_fallback_and_return_size,shell,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Small banked-resource heap-copy helper rooted at global bank owner `0x006d4020`. The function hashes or canonicalizes the caller key through `0x0053b5c0`, checks whether that key is present through `0x0053b590`, falls back to the caller backup string when the key is absent, resolves payload length through `0x0053c9c0`, opens the corresponding stream or row through `0x0053bd40`, allocates one heap buffer through `0x005a125d(length)`, copies the payload into that buffer through `0x0053b7c0`, optionally stores the resolved length through the caller outparam, and returns the heap copy. Current grounded callers are `0x00564419` and `0x0056446b`, so this is the safest current read for loading one heap-owned payload copy by key-or-fallback from the shared resource bank rather than a generic string helper.","objdump + caller inspection + local disassembly + banked-resource correlation + heap-copy correlation"
0x00564280,143,resource_text_cache_release_owned_entries_tables_and_buffers,shell,thiscall,inferred,objdump + local disassembly + field correlation,2,"Release or reset owner for the adjacent resource-text cache object. When count `[this+0x10]` is nonzero, the function first iterates table `[this+0x04]` through `0x0053db20` with callback `0x005641d0`, resets that table through `0x0053d8a0`, releases and frees owned descriptor `[this+0x00]` through `0x0053dcb0 + 0x0053b080`, releases and frees table root `[this+0x04]` through `0x0053dbe0 + 0x0053b080`, releases and frees vector or pool root `[this+0x08]` through `0x0053d6f0 + 0x0053b080`, and then clears local counters `[this+0x0c/+0x10/+0x14]` plus byte flag `[this+0x24]`. This is the safest current read for the cache reset or destructor-side owner above `0x005641f0` rather than a generic cleanup helper.","objdump + local disassembly + field correlation + cache-release correlation"
0x00564310,128,resource_text_cache_evict_top_scored_entry_and_return_freed_payload_size,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Eviction helper for the same resource-text cache family. The function pops the top-scored entry from heap `[this+0x08]` through `0x0053d540`, frees that entry's owned payload buffer `[entry+0x10]`, removes the entry from hash table `[this+0x04]` through `0x0053d9e0`, conditionally relinks the entry into the auxiliary intrusive list rooted under `[this+0x00]`, increments local eviction counter `[this+0x20]`, and returns freed payload size `[entry+0x04]`; when the auxiliary list window rejects the entry it frees the entry instead. Current grounded caller is the cache-backed load owner `0x00564390`, so this is the safest current read for the scored-eviction path rather than a generic heap pop wrapper.","objdump + local disassembly + caller inspection + cache-eviction correlation + scored-heap correlation"
0x00564390,454,resource_text_cache_query_or_load_payload_copy_with_optional_metadata_out,shell,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Primary cache-backed load owner for the same resource-text cache family. The function first builds a lookup key in local scratch by prepending optional prefix string `[this+0x24]` to the caller stem when that prefix is nonempty. When cache-capacity dword `[this+0x14]` is zero it bypasses the cache and falls straight into `resource_bank_load_heap_copy_by_key_or_fallback_and_return_size` `0x005641f0`. Otherwise it hashes the composed key through `0x0053dae0` against table `[this+0x04]`; on miss it loads the payload through `0x005641f0`, repeatedly evicts entries through `0x00564310` until payload length fits under byte budget `[this+0x10]`, allocates a fresh cache record through `0x004143e0`, seeds its metadata band from the constant block at `0x00d9798c`, inserts it into scored heap `[this+0x08]` and hash table `[this+0x04]`, and increments local miss count `[this+0x1c]`. On hit it reuses the cached payload pointer and increments hit count `[this+0x18]`. In both cases it can copy the nine-dword metadata band out through the optional caller buffer and then returns a fresh heap-owned payload copy of size `[entry+0x10]`. Current grounded callers are `0x0056a4e4` and `0x0056ac29`, so this is the safest current read for the cache-backed payload-copy owner rather than a narrower text-only label.","objdump + caller inspection + local disassembly + cache-correlation + banked-resource correlation + metadata-band correlation"
0x00564560,5,resource_text_cache_destruct_release_owned_entries_tables_and_buffers,shell,thiscall,inferred,objdump + local disassembly,1,"Tiny destructor thunk for the same resource-text cache family. The function tail-calls directly into `resource_text_cache_release_owned_entries_tables_and_buffers` `0x00564280`.","objdump + local disassembly + cache-release correlation"
0x00564570,240,resource_text_cache_init_with_capacity_and_clear_prefix,shell,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Constructor or reset owner for the same resource-text cache family. The function first re-enters `0x00564280` when a prior cache is live. When caller capacity is null it clears all roots, counters, and prefix byte `[this+0x24]` and returns failure. Otherwise it allocates the three owned helper roots at `[this+0x04]`, `[this+0x00]`, and `[this+0x08]`, allocates one `0x15e0`-byte pool for the vector root through `0x005a125d`, initializes that pool through `0x0053dcf0`, initializes the scored heap at `[this+0x08]` through `0x0053d740(0x64)`, initializes the hash-table root at `[this+0x04]` through `0x0053dbf0(0x11, 0x64)`, stores byte-budget `[this+0x10] = capacity`, clears counters `[this+0x18/+0x1c/+0x20]`, clears current-offset `[this+0x0c]`, and zeroes prefix byte `[this+0x24]`. Current grounded callers are `0x005321e6` and `0x00532219`, so this is the safest current read for constructing the resource-text cache with one caller-supplied capacity rather than a generic allocator.","objdump + caller inspection + local disassembly + cache-constructor correlation"
0x00564660,603,layout_state_build_six_vertex_gradient_primitive_from_record,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Geometry-builder helper beneath the same layout-state branch. The function reads one compact caller record containing two projected corners, one packed color dword, one scalar multiplier, and one destination rect band; normalizes the rect ordering, clamps the scalar multiplier into the same fixed range used elsewhere in this strip, rescales the packed RGB lanes while preserving the alpha byte, and writes a `6`-record `0x18`-byte primitive block to the caller output buffer before storing primitive count `6` through the caller outparam. Current grounded callers are `0x00564e4e` and `0x00565007`, so this is the safest current read for the six-vertex primitive builder rather than a higher-level render owner.","objdump + caller inspection + local disassembly + primitive-builder correlation + layout-state correlation"
0x005648c0,1355,layout_state_build_three_vertex_gradient_primitive_from_record,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Sibling geometry-builder helper to `0x00564660` in the same layout-state branch. The function reads a larger caller record carrying three packed color lanes with three scalar multipliers plus a destination point band, rescales each packed RGB lane while preserving its alpha byte, and writes a `3`-record `0x18`-byte primitive block to the caller output buffer before storing primitive count `3` through the caller outparam. Current grounded callers are `0x00564e78` and `0x00565017`, so this is the safest current read for the three-vertex primitive builder rather than a broader owner-body label.","objdump + caller inspection + local disassembly + primitive-builder correlation + layout-state correlation"
0x00564c70,1095,layout_state_service_record_queue_emit_primitives_and_refresh_mode_toggles,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader queue-service owner above the adjacent primitive builders. The function clears current optional item binding through `0x00545520(0, 0)`, lowers one mode gate through `0x00546760(0)`, then walks the caller-supplied intrusive queue through `0x00556ef0/0x00556f00`. During that sweep it tracks current optional binding dword `[this+0x365d]`, refreshes low-nibble mode byte `[this+0x374d]` through `0x00547320`, `0x00547300`, `0x00547380`, and `0x005472a0`, and dispatches record-type cases through two families: direct subordinate-state calls `0x005474a0` or `0x005473c0`, and the primitive-build paths `0x00564660` or `0x005648c0` fed from temporary buffers allocated through `0x00523cf0`. It accumulates emitted primitive count into `[this+0x71]`, re-enters `0x00523d30(1)` after each record, and restores the trailing subordinate-state mode gate on exit. Current grounded caller is `0x00565212`, so this is the safest current read for the queue-driven primitive-emission and mode-toggle service owner rather than a narrower per-record handler.","objdump + caller inspection + local disassembly + queue-service correlation + layout-state correlation + primitive-builder correlation"
0x00564ee0,621,layout_state_service_record_list_emit_primitives_refresh_dual_mode_nibbles_and_finalize_tail,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Sibling list-service owner to `0x00564c70` in the same layout-state family. The function first resolves the current optional item binding from the caller override or the shell capability branch, reapplies that binding through `0x00545520`, then walks the caller intrusive list through `0x00556ef0/0x00556f20`. During that sweep it compares both low and high nibbles of per-record mode byte `[record+0x5d]` against local state bytes `[this+0x374d/+0x374e]`, refreshing the low side through `0x00547320`, `0x00547300`, `0x00547380`, and `0x005472a0`, and the high side through `0x00546760`. Records then dispatch into three families: direct routed payload push through `0x005669d0`, direct subordinate-state calls `0x005473c0` or `0x005474a0`, and the adjacent primitive-build paths `0x00564660` or `0x005648c0` fed from one `0x400`-byte temporary buffer from `0x00523cf0`. It accumulates emitted primitive count into `[this+0x71]`, enforces hard ceiling `0x0000fbe8`, re-enters `0x00523d30(1)` after each serviced record, and finalizes one last tail state from the last deferred direct record type before returning. Current grounded callers are `0x005652cd` and `0x005652f2`, so this is the safest current read for the list-driven primitive and routed-payload service owner rather than a generic buffer walk.","objdump + caller inspection + local disassembly + list-service correlation + layout-state correlation + primitive-builder correlation"
0x00564150,18,support_clear_0x100_dword_table,support,thiscall,inferred,objdump + local disassembly,1,"Tiny table-clear helper. The function zeroes exactly `0x100` dwords starting at the caller pointer and returns that same pointer. This is the safest current read for the fixed-size clear primitive rather than a broader owner.","objdump + local disassembly + fixed-size-table correlation"
0x00564170,1,support_noop_return,support,cdecl,inferred,objdump + local disassembly,1,"Tiny support stub that immediately returns without side effects.","objdump + local disassembly"
0x00564180,10,support_set_indexed_byte_true,support,stdcall,inferred,objdump + local disassembly,1,"Small byte-table helper. The function stores byte value `1` into the caller-selected indexed slot and returns.","objdump + local disassembly + byte-table correlation"
0x00564190,10,support_set_indexed_byte_false,support,stdcall,inferred,objdump + local disassembly,1,"Small byte-table helper. The function stores byte value `0` into the caller-selected indexed slot and returns.","objdump + local disassembly + byte-table correlation"
0x005641a0,11,support_query_indexed_byte,support,stdcall,inferred,objdump + local disassembly,1,"Small byte-table getter. The function returns the byte stored in the caller-selected indexed slot.","objdump + local disassembly + byte-table correlation"
0x005641b0,29,support_copy_c_string_into_local_field_0x24,support,stdcall,inferred,objdump + local disassembly,1,"Small local string-copy helper. The function copies the caller NUL-terminated string into local field `[this+0x24]` and writes the trailing NUL. This is the safest current read for the direct local-prefix setter used by the adjacent cache family rather than a broader formatter.","objdump + local disassembly + string-copy correlation"
0x005641d0,32,resource_text_cache_release_entry_owned_payload_when_present,shell,fastcall,inferred,objdump + local disassembly + callback correlation,1,"Small callback helper used by the adjacent resource-text cache release path. When the caller flag in `EDX` is zero, the function frees owned payload pointer `[entry->owner+0x10]` through `0x005a1145` and clears that field before returning `0`; other flag values skip the release. Current grounded caller is `resource_text_cache_release_owned_entries_tables_and_buffers` `0x00564280`, which passes this helper into `0x0053db20` while draining table `[this+0x04]`.","objdump + local disassembly + callback correlation + cache-release correlation"
0x0054e3a0,528,shell_controller_window_message_dispatch,shell,stdcall,inferred,objdump + import table + callsite inspection + local disassembly,4,"Primary window-message ingress for the active shell controller window. The dispatcher branches over low window lifecycle messages, handles `WM_KEYDOWN` and `WM_KEYUP` by first updating the shell controller through `0x0051f0c0` or `0x0051f0d0` and then forwarding the transition into `shell_input_apply_window_key_transition` `0x0054f290` on the shell input object rooted at `0x006d4018`, routes `WM_COMMAND` through `0x0054eb10`, routes mouse messages in the `0x0200..0x0208` family through `0x0054ee50`, and falls back to `DefWindowProcA` for unhandled cases. One broader branch in the same wndproc family now grounds the live layout-state side more tightly: it prepares subordinate layout-state `[this+0x2d]` through `0x00547300`, `0x0054bbf0`, and `0x00545c00(0x96, [this+0x75], 0)`, dispatches the local slot-band service owner `0x0054c900`, then re-enters `0x00545020` and refreshes current external record `[arg+0x40c]` through `0x005545d0`, `0x005543f0(0)`, and `0x00554450` when mode byte `[this+0x3692]` is clear. This is the first grounded shell-side input and live layout-state ingest path rather than only a generic message drain.","objdump + import table + callsite inspection + local disassembly + layout-state correlation + subordinate-state correlation"
0x0054e5d0,88,shell_drain_pending_window_messages,shell,cdecl,inferred,objdump + analysis-context,4,Shared pending-message drain that loops on `PeekMessageA` with remove mode 1 and feeds each dequeued record through `TranslateMessage` and `DispatchMessageA` until the queue is empty. Shell modal waits layout rebuild paths mouse-cursor frame work and the keyboard-toggle helpers all reuse this routine so it sits below the real input handlers rather than serving as the input dispatcher itself.,objdump + analysis-context + import table
0x0054e710,110,shell_input_state_init,shell,thiscall,inferred,objdump + analysis-context,3,Initializes the standalone shell input-state object later stored at 0x006d4018. It zeroes the 0xaa8-byte state block resets counters and flags under +0xa88 through +0xa9c caches host metrics through `GetSystemMetrics` and `GetDoubleClickTime` and clears the per-key state storage that later window-message handlers update.,objdump + analysis-context + import table
0x0054e880,305,shell_input_service_pointer_proximity_event_record_and_queue_followon,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Processes one queued 12-dword shell-input event record from the ring rooted at `[this+0x128]` as a pointer-proximity or timeout update. The helper classifies input record types `6`, `8`, and `10` into one of three local slot bands under `[this+0x104]`, `[this+0x110]`, and `[this+0x11c]`, measures the absolute pointer delta against the controller-selected view size from `[0x006d4024+0x34 + selector*0x15]`, compares that against the shared radius threshold, and either snapshots the current pointer coordinates plus deadline tick into the chosen slot or clones the record into a follow-on event with rewritten type `0x1e`, `0x20`, or `0x22` before requeueing it through `0x0054e9c0`. Current grounded callers are the queue wrappers `0x0054e9c0`, `0x0054f5b0`, and `0x0054eb10`, so this is the safest current read for the pointer-proximity event service owner rather than another generic ring-buffer helper.","objdump + caller inspection + local disassembly + event-ring correlation + pointer-proximity correlation"
0x0054e9c0,79,shell_input_enqueue_event_record_and_run_pointer_followon,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small queue wrapper over the shell-input event ring at `[this+0x128]`. The helper appends one caller-supplied 12-dword record into the ring, rewrites ring index `[this+0xa88]` from `0x32` back to `0x31` when needed, increments that index, and immediately tails into `0x0054e880` on the same record. Current grounded callers are `shell_input_apply_window_key_transition` `0x0054f290`, `shell_input_enqueue_window_event_record_and_signal_dispatch` `0x0054f5b0`, and `shell_input_handle_window_command_and_toggle_messages` `0x0054eb10`.","objdump + caller inspection + local disassembly + event-ring correlation"
0x0054ea20,229,shell_input_pop_next_event_record_with_type2_coalescing,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Dequeues the next 12-dword shell-input event record from the same ring at `[this+0x128]` into one caller output buffer. When more than one event is pending and nested dispatch latch `[this+0xa90]` is clear, the helper compacts the ring forward, decrements the event count, and performs one special coalescing pass for adjacent type-`2` records when no key-state byte at `[this+0x100]` is active. Current grounded caller is `shell_input_snapshot_dispatch_state` `0x0054f4d0`, which uses this helper to pull one filtered dispatch record at a time.","objdump + caller inspection + local disassembly + event-ring correlation + coalescing correlation"
0x005708c0,11,refcounted_object_vtable_0x5deba0_query_current_matrix_pointer,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny current-entry pointer helper for the `0x5deba0` object family. The function resolves and returns the current `0x40`-byte matrix entry at `[this+0x08 + [this+0x0c]*0x40]`.","objdump + local disassembly + object-family correlation + matrix-row correlation"
0x005708ce,36,aligned_alloc_with_trailing_pad_byte,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small aligned-allocation helper reused by the `0x5deba0` object family. The function allocates `requested_size + 0x10` bytes through `0x0053b070`, rounds the returned pointer up to the next 16-byte boundary, stores the applied back-offset in byte `[aligned_ptr-1]`, and returns that aligned pointer. Current grounded caller is `0x0057091d`, which uses this helper for `0x40`-byte matrix-row blocks.","objdump + local disassembly + allocation correlation + alignment correlation"
0x005708f2,22,aligned_free_with_trailing_pad_byte,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Free-side sibling to `0x005708ce`. When the incoming aligned pointer is nonnull, the helper reads the stored back-offset byte at `[ptr-1]`, reconstructs the original allocation base, and frees it through `0x0053b080`. Current grounded callers are destructor `0x00570908` and the `0x5deba0` growth path.","objdump + local disassembly + allocation correlation + alignment correlation"
0x00570908,21,refcounted_object_vtable_0x5deba0_destruct_and_release_row_block,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small destructor-side helper for the `0x5deba0` object family. The function reinstalls vtable `0x005deba0`, releases optional row-block pointer `[this+0x08]` through `0x005708f2`, and returns. Current grounded caller is the release wrapper `0x005709da`, so this is the safest current read for destructing the object and dropping its row block rather than a broader owner teardown.","objdump + local disassembly + object-family correlation + row-block correlation"
0x0057091d,108,refcounted_object_vtable_0x5deba0_reserve_0x40_byte_row_capacity,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Reserve owner for the same `0x5deba0` object family. The helper allocates one aligned row block sized as `requested_count << 6`, fills it from fixed `0x40`-byte template `0x0056cd2c`, stores the resulting pointer into `[this+0x08]`, stores requested row capacity into `[this+0x04]`, clears live row count `[this+0x0c]`, and then dispatches one object-specific follow-on through vtable slot `+0x14`. Current grounded caller is the create-and-reserve wrapper `0x00570fbd(0x10)`, so this is the safest current read for reserving `0x40`-byte row capacity rather than a generic allocator.","objdump + caller inspection + local disassembly + object-family correlation + row-capacity correlation"
0x0057098b,77,refcounted_object_vtable_0x5deba0_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for the `0x5deba0` object family. The helper accepts exactly two interface ids: `IUnknown` `{00000000-0000-0000-C000-000000000046}` from `0x005eaaec` and one custom IID rooted at `0x005c8520`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + object-family correlation + COM-correlation"
0x005709da,26,refcounted_object_vtable_0x5deba0_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for the `0x5deba0` object family. The helper re-enters destructor `0x00570908`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`. Current grounded caller is refcount helper `0x00570fa1`, which invokes this path when refcount `[this+0x10]` reaches zero.","objdump + local disassembly + object-family correlation + refcount correlation"
0x005709f6,180,refcounted_object_vtable_0x5deba0_grow_row_capacity_and_append_duplicate_last_row,bootstrap,thiscall,inferred,objdump + local disassembly,2,"First growth owner above `0x0057091d` in the same `0x5deba0` object family. The helper increments live row count `[this+0x0c]`, doubles row capacity `[this+0x04]` and reallocates the `0x40`-byte row block when the new count would exceed capacity, then duplicates the previous `0x40`-byte row into the new last slot. This is the safest current read for growing row capacity and appending a duplicate of the last row rather than a generic vector push.","objdump + local disassembly + object-family correlation + row-capacity correlation + row-block correlation"
0x00570aac,95,refcounted_object_vtable_0x5deba0_set_current_matrix_to_identity,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small current-entry seed helper for the `0x5deba0` object family. The function resolves the current `0x40`-byte entry at `[this+0x08 + [this+0x0c]*0x40]`, zeroes all sixteen float lanes, and then writes `1.0` into offsets `0x00`, `0x14`, `0x28`, and `0x3c`, producing an identity 4x4 matrix. This is the safest current read for seeding the current matrix to identity rather than a generic clear helper.","objdump + local disassembly + object-family correlation + matrix-row correlation"
0x00570b0d,29,refcounted_object_vtable_0x5deba0_store_current_matrix_from_caller_block,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Direct current-entry store helper for the `0x5deba0` object family. The function copies one caller-supplied `0x40`-byte block into the current entry at `[this+0x08 + [this+0x0c]*0x40]`. This is the safest current read for storing the current matrix from a caller block rather than a generic memcpy wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation"
0x00570b2c,72,refcounted_object_vtable_0x5deba0_compose_current_matrix_with_caller_matrix_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Current-entry composition helper for the `0x5deba0` object family. The function materializes one composed `0x40`-byte matrix through `0x0056d3cd(temp, current, caller)` and writes the resulting block back into the current entry at `[this+0x08 + [this+0x0c]*0x40]`. This is the safest current read for composing the current matrix with one caller matrix on the right-hand side rather than a generic temp-buffer wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + composition correlation"
0x00570b76,72,refcounted_object_vtable_0x5deba0_compose_caller_matrix_with_current_matrix_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling composition helper to `0x00570b2c` in the same `0x5deba0` object family. The function materializes one composed `0x40`-byte matrix through `0x0056d3cd(temp, caller, current)` and writes the result back into the current entry. This is the safest current read for composing the caller matrix with the current matrix on the right-hand side rather than another generic temp-buffer wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + composition correlation"
0x00570bc0,108,refcounted_object_vtable_0x5deba0_build_helper_matrix_56df7d_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Helper-generated composition owner in the `0x5deba0` object family. The function first builds one temporary `0x40`-byte matrix through `0x0056df7d` from the caller pointer plus one float scalar, then composes that helper matrix with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56df7d`-generated right-side composition path rather than a generic stack-buffer owner.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570c2f,108,refcounted_object_vtable_0x5deba0_build_helper_matrix_56df7d_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570bc0` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte helper matrix through `0x0056df7d`, then composes it on the left through `0x0056d3cd(temp, helper, current)` and stores the result back into the current entry. This is the safest current read for the left-side `0x56df7d` composition path rather than another generic stack-buffer owner.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570c9e,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56e1a8_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Three-scalar helper-generated composition owner in the `0x5deba0` object family. The function first builds one temporary `0x40`-byte matrix through `0x0056e1a8` from three caller float scalars, then composes that helper matrix with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56e1a8`-generated right-side composition path rather than a generic float wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570d1a,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56e1a8_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570c9e` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte matrix through `0x0056e1a8` from three caller float scalars, composes it on the left through `0x0056d3cd(temp, helper, current)`, and stores the result back into the current entry. This is the safest current read for the left-side `0x56e1a8` composition path rather than another generic float wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570d96,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dc9a_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Three-scalar helper-generated composition owner in the same `0x5deba0` family, but using helper `0x0056dc9a`. The function materializes one temporary `0x40`-byte matrix from three caller float scalars, then composes it with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56dc9a`-generated right-side composition path rather than a generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570e12,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dc9a_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570d96` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte matrix through `0x0056dc9a`, composes it on the left through `0x0056d3cd(temp, helper, current)`, and writes the result back into the current entry. This is the safest current read for the left-side `0x56dc9a` composition path rather than another generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570e8e,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dd2a_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Three-scalar helper-generated composition owner in the same `0x5deba0` family, but using helper `0x0056dd2a`. The function materializes one temporary `0x40`-byte matrix from three caller float scalars, then composes it with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56dd2a`-generated right-side composition path rather than a generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570f0a,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dd2a_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570e8e` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte matrix through `0x0056dd2a`, composes it on the left through `0x0056d3cd(temp, helper, current)`, and writes the result back into the current entry. This is the safest current read for the left-side `0x56dd2a` composition path rather than another generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570f86,27,refcounted_object_vtable_0x5deba0_init,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for one 0x14-byte refcounted object family. The helper installs vtable `0x005deba0`, clears dwords `[this+0x04/+0x08/+0x0c]`, and seeds refcount `[this+0x10] = 1`. Current grounded direct caller is the create-and-reserve wrapper `0x00570fbd`, so this is the safest current read for initializing the `0x5deba0` object family rather than a wider bootstrap owner.","objdump + local disassembly + object-family correlation"
0x00570fa1,26,refcounted_object_vtable_0x5deba0_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for the `0x5deba0` object family. The function decrements refcount `[this+0x10]`, returns the remaining count when it stays positive, and otherwise tail-calls release wrapper `0x005709da(1)` to destroy and free the object. This is the safest current read for the direct refcount decrement path rather than a generic counter helper.","objdump + local disassembly + object-family correlation + refcount correlation"
0x00570fbd,86,create_refcounted_object_vtable_0x5deba0_and_reserve_block_0x10,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Small create-and-reserve wrapper for the same `0x5deba0` object family. The helper validates the caller out-pointer, allocates one `0x14`-byte object through `0x0053b070`, initializes it through `0x00570f86`, asks the new object to reserve or materialize one `0x10`-byte block through `0x0057091d(0x10)`, releases the object through vtable slot `+0x08` on failure, and stores the live pointer through the caller outparam on success. Current grounded caller is the setup-side layout-state owner `0x0054a0c0`, which uses this helper to seed optional handle `[layout+0x33ab]`, so this is the safest current read for creating the refcounted `0x5deba0` object and reserving its first `0x10`-byte block rather than a generic allocator.","objdump + caller inspection + local disassembly + object-family correlation + allocation correlation"
0x0057ad20,58,refcounted_object_vtable_0x5def30_destruct_release_resource_fields_and_attached_object,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side owner for sibling object family `0x005def30`. The helper reinstalls vtable `0x005def30`, conditionally tears down resource field `[this+0x48]` through `0x00580bb9/0x00580bdc`, frees optional heap block `[this+0x08]` through import thunk `0x005c8058`, and releases attached object `[this+0x4c]` through its vtable slot `+0x08`. This is the safest current read for destructing the `0x5def30` object family and releasing its owned fields rather than a generic cleanup body.","objdump + local disassembly + object-family correlation + resource-field correlation"
0x0057ad5a,11,refcounted_object_vtable_0x5def30_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny addref helper for object family `0x005def30`. The function increments refcount `[this+0x04]` and returns the new count.","objdump + local disassembly + object-family correlation + refcount correlation"
0x0057ad67,91,refcounted_object_vtable_0x5def30_bind_resource_field_attach_object_and_copy_15_dword_payload,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Primary setup owner for object family `0x005def30`. When both caller inputs are nonnull, the helper initializes resource field `[this+0x48]` through `0x0058123c`, allocates payload block `[this+0x08]` through import thunk `0x005c8054`, stores attached object `[this+0x4c]` with an addref, and copies one `0x0f`-dword payload block into `[this+0x0c]`. Otherwise it returns `0x8876086c`. This is the safest current read for binding the resource field, attaching the sibling object, and copying the fixed payload block rather than a generic constructor fragment.","objdump + local disassembly + object-family correlation + payload-copy correlation"
0x0057add4,21,refcounted_object_vtable_0x5def30_get_attached_object_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for object family `0x005def30`. The helper writes attached object `[this+0x4c]` through the caller outparam and addrefs it through vtable slot `+0x04`, returning `0x8876086c` only when the caller outparam is null.","objdump + local disassembly + object-family correlation + attached-object correlation"
0x0057adfb,18,refcounted_object_vtable_0x5def30_copy_15_dword_payload_out,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small payload-copy helper for object family `0x005def30`. The function copies the fixed `0x0f`-dword payload block from `[this+0x0c]` into the caller destination and returns `0x8876086c` only when the destination pointer is null.","objdump + local disassembly + object-family correlation + payload-copy correlation"
0x0057ae0f,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_5809c7,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny pass-through wrapper over resource field `[this+0x48]` in object family `0x005def30`. The helper forwards directly into `0x005809c7`.","objdump + local disassembly + object-family correlation + resource-field correlation"
0x0057ae1e,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_580a54,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny sibling wrapper to `0x0057ae0f` in the same `0x5def30` family. The helper forwards resource field `[this+0x48]` directly into `0x00580a54`.","objdump + local disassembly + object-family correlation + resource-field correlation"
0x0057ae2d,35,refcounted_object_vtable_0x5def30_dispatch_resource_and_payload_call_580d29_mode0,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Broader pass-through owner for object family `0x005def30`. The helper forwards resource field `[this+0x48]`, payload block `[this+0x08]`, five caller arguments, and fixed mode flag `0` into `0x00580d29`.","objdump + local disassembly + object-family correlation + resource-field correlation + payload-block correlation"
0x0057ae53,35,refcounted_object_vtable_0x5def30_dispatch_resource_and_payload_call_580d29_mode1,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Mode-`1` sibling to `0x0057ae2d` in the same `0x5def30` family. The helper forwards resource field `[this+0x48]`, payload block `[this+0x08]`, five caller arguments, and fixed mode flag `1` into `0x00580d29`.","objdump + local disassembly + object-family correlation + resource-field correlation + payload-block correlation"
0x0057ae79,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_580a84,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny pass-through wrapper over resource field `[this+0x48]` in object family `0x005def30`. The helper forwards directly into `0x00580a84`.","objdump + local disassembly + object-family correlation + resource-field correlation"
0x0057ae88,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_580aff,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny sibling wrapper to `0x0057ae79` in the same `0x5def30` family. The helper forwards resource field `[this+0x48]` directly into `0x00580aff`.","objdump + local disassembly + object-family correlation + resource-field correlation"
0x0057ae97,66,refcounted_object_vtable_0x5def30_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for object family `0x005def30`. The helper accepts exactly `IUnknown` from `0x005eaaec` plus one custom IID rooted at `0x005c8500`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + object-family correlation + COM-correlation"
0x0057aedb,22,refcounted_object_vtable_0x5def30_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for object family `0x005def30`. The function decrements refcount `[this+0x04]`, returns the remaining count when it stays positive, and otherwise tail-calls release wrapper `0x00571016(1)` to destroy and free the object.","objdump + local disassembly + object-family correlation + refcount correlation"
0x0057aef3,27,refcounted_object_vtable_0x5def30_init,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for object family `0x005def30`. The helper installs vtable `0x005def30`, seeds refcount `[this+0x04] = 1`, and clears optional fields `[this+0x08]`, `[this+0x48]`, and `[this+0x4c]`.","objdump + local disassembly + object-family correlation"
0x0057af0e,64,refcounted_object_vtable_0x5def5c_destruct_release_optional_target_and_two_handles,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side owner for sibling object family `0x005def5c`. The helper reinstalls vtable `0x005def5c`, and when target field `[this+0x08]` is live it conditionally releases optional handles `[this+0x14]` and `[this+0x10]` through target vtable slot `+0xe0` before releasing the target itself through slot `+0x08`. This is the safest current read for destructing the `0x5def5c` object family and releasing its optional target-side handles rather than a generic cleanup body.","objdump + local disassembly + object-family correlation + target-handle correlation"
0x0057af4e,11,refcounted_object_vtable_0x5def5c_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny addref helper for sibling object family `0x005def5c`. The function increments refcount `[this+0x04]` and returns the new count.","objdump + local disassembly + object-family correlation + refcount correlation"
0x0057af5b,115,refcounted_object_vtable_0x5def5c_attach_target_and_derive_cached_flag_pair,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Primary setup owner for sibling object family `0x005def5c`. The helper stores one caller target object into `[this+0x08]` with addref, queries two target-side flag blocks through vtable slots `+0x1c` and `+0x24`, and derives cached booleans `[this+0x1c]` and `[this+0x18]` from the observed flag bits before returning success. When the incoming target pointer is null it returns `0x8876086c`. This is the safest current read for attaching the target and deriving the cached flag pair rather than a generic constructor fragment.","objdump + local disassembly + object-family correlation + target-flag correlation"
0x0057afd0,36,refcounted_object_vtable_0x5def5c_get_target_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for sibling object family `0x5def5c`. The helper writes target field `[this+0x08]` through the caller outparam and addrefs it through vtable slot `+0x04`, returning `0x8876086c` only when the caller outparam is null.","objdump + local disassembly + object-family correlation + target-object correlation"
0x0057aff6,40,refcounted_object_vtable_0x5def5c_release_handle_0x10_once,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small one-shot release helper for sibling object family `0x5def5c`. When live flag `[this+0x0c]` is nonzero, the function asks target `[this+0x08]` to release handle `[this+0x10]` through vtable slot `+0xd8`, then clears `[this+0x0c]` back to `0`; otherwise it returns `0x80004005`. This is the safest current read for releasing handle `0x10` once rather than a generic boolean guard.","objdump + local disassembly + object-family correlation + target-handle correlation"
0x0057b021,61,refcounted_object_vtable_0x5def5c_clear_optional_handles_0x14_and_0x10,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small clear-side sibling to `0x0057aff6` in the `0x5def5c` family. When target field `[this+0x08]` is live, the helper conditionally releases optional handles `[this+0x14]` and `[this+0x10]` through target vtable slot `+0xe0`, then clears both fields back to `0`.","objdump + local disassembly + object-family correlation + target-handle correlation"
0x0057b060,3,refcounted_object_vtable_0x5def5c_return_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Literal zero-return stub in the `0x5def5c` helper strip.","objdump + local disassembly + object-family correlation"
0x0057b065,66,refcounted_object_vtable_0x5def5c_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for object family `0x5def5c`. The helper accepts exactly `IUnknown` from `0x005eaaec` plus one custom IID rooted at `0x005c84f0`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + object-family correlation + COM-correlation"
0x0057b0a9,22,refcounted_object_vtable_0x5def5c_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for sibling object family `0x5def5c`. The function decrements refcount `[this+0x04]`, returns the remaining count when it stays positive, and otherwise tail-calls release wrapper `0x00571032(1)` to destroy and free the object.","objdump + local disassembly + object-family correlation + refcount correlation"
0x0057b0c1,1074,refcounted_object_vtable_0x5def5c_seed_target_handles_publish_property_strip_and_latch_ready,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Broader service owner for sibling object family `0x5def5c`. The helper rejects re-entry when ready latch `[this+0x0c]` is already set, then, when optional handle `[this+0x10]` is still null, queries the target at `[this+0x08]` through slots `+0xd0`, `+0x130`, `+0x94`, `+0xc8`, `+0xfc`, and `+0xd4` to seed the two handle lanes `[this+0x10/+0x14]`, publish one fixed property strip, and optionally build one target-derived matrix when cached flag `[this+0x1c]` is clear. The tail always replays target slot `+0xdc` for `[this+0x10]`, target slot `+0xd8` for `[this+0x14]`, conditionally emits one more target-derived matrix through slot `+0x94`, and finally marks ready latch `[this+0x0c] = 1`. This is the safest current read for seeding target handles, publishing the fixed property strip, and latching the object ready rather than a generic virtual wrapper.","objdump + local disassembly + object-family correlation + target-handle correlation + property-strip correlation"
0x0057b4fd,213,target_object_build_local_transform_block_from_optional_anchor_pairs_angle_and_scale_and_dispatch_slot_0x18,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Broader target-side geometry owner immediately above the `0x5def5c` service strip. The helper conditionally lifts up to three optional caller anchor pairs into local vec2-plus-scalar records, derives one temporary transform block through `0x0056e1bf` from those optional anchors plus caller angle and scale inputs, and then forwards that finished block into the target object through vtable slot `+0x18` with the caller's dispatch pair. This is the safest current read for building one local transform block from optional anchor pairs, angle, and scale before dispatching slot `+0x18`, rather than a generic float wrapper.","objdump + local disassembly + target-object correlation + transform-block correlation"
0x0057b5d4,976,target_service_build_rect_normalized_vertex_strip_from_optional_view_rect_and_dispatch_slot_0x120,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Broader target-service draw owner immediately above the `0x5def5c` helper strip. The routine queries the live target surface bounds through object slot `+0x38`, validates or synthesizes one caller view rect, classifies the active format tag against several packed and `DXT` cases, ensures target-service helper `[service+0x08]` is ready through slots `+0x10`, `+0xf4`, and `+0xc8`, converts the accepted rect into normalized float bounds, builds either four `0x1c`-byte or four `0x18`-byte local vertex records, optionally projects them through caller matrix helper `0x0056cdda`, applies the local `-0.5f` pixel-center bias, and finally dispatches the finished strip through slot `+0x120`. This is the safest current read for building one normalized rect vertex strip from an optional caller rect and dispatching it through the target-service draw slot, rather than a generic viewport wrapper.","objdump + local disassembly + target-service correlation + rect-normalization correlation + vertex-strip correlation + draw-dispatch correlation"
0x0057b9a7,198,shader_assembly_context_init_vector_bands_string_log_and_global_singleton,bootstrap,thiscall,inferred,objdump + local disassembly + string correlation,2,"Constructor-style initializer for the shader-assembly context family rooted at vtable `0x005def5c`. The helper seeds that vtable and refcount, initializes seven embedded dword-vector records at `[this+0x14..+0x74]` plus one string-vector log at `[this+0x84]`, clears the surrounding parse-state dwords `[this+0x98..+0xa4]`, and publishes the new context through global singleton `0x00db89d8`. Current evidence is strongest for the assembly-context root used by the later opcode, mask, swizzle, register, and error-log helpers.","objdump + local disassembly + object-family correlation + shader-assembly correlation + vector-family correlation"
0x0057ba6e,148,shader_assembly_context_destruct_release_vector_bands_and_string_log,bootstrap,thiscall,inferred,objdump + local disassembly + string correlation,2,"Destructor-side owner for the same shader-assembly context family. The helper releases the embedded string-vector log at `[this+0x84]`, then walks the seven embedded dword-vector records at `[this+0x14..+0x74]` in reverse order, releases each through `0x005812c1`, and finally tears down the outer object through `0x0058138c`. This is the safest current read for the assembly-context destructor rather than a generic vector cleanup body.","objdump + local disassembly + object-family correlation + shader-assembly correlation + vector-family correlation"
0x0057bafd,310,shader_assembly_context_append_formatted_error_to_log_with_version_and_constant_special_cases,bootstrap,stdcall,inferred,objdump + local disassembly + string correlation,2,"Shared error-log owner in the shader-assembly context family. The helper copies one caller token or source-line fragment into a local `0x100`-byte buffer, chooses one of the grounded assembly-error format strings `%s(%d) : (Assembly Error) %s`, `%s(%d) : (Assembly Error) statement incomplete`, `%s(%d) : (Assembly Error) constant definition in shader body`, or `%s(%d) : (Assembly Error) shader version expected` from the current context fields `[this+0x1d0/+0x1d4/+0x3d8..+0x3e4]` plus the copied token, formats the final line into a second local buffer, appends that owned string into log vector `[this+0x84]`, increments error count `[this+0xa4]`, and marks the context dirty through `[this+0x98] = 1`. This is the safest current read for the shared formatted shader-assembly error helper rather than a statement-specific leaf.","objdump + local disassembly + string correlation + shader-assembly correlation + error-log correlation + version-rule correlation"
0x0057bc33,790,shader_assembly_parse_opcode_mnemonic_and_modifier_suffixes_into_fields_0x1c8_0x1cc,bootstrap,thiscall,inferred,objdump + local disassembly + string correlation,2,"Primary opcode parser in the shader-assembly context family. The helper splits one caller token around underscore-delimited suffixes, recognizes grounded shader mnemonics such as `nop`, `mov`, `add`, `sub`, `mad`, `mul`, `dp3`, `dp4`, `frc`, `cnd`, `cmp`, `texld`, `texkill`, `texcoord`, and the `texm3x*` family, maps those mnemonics onto encoded opcode field `[this+0x1c8]`, parses the grounded modifier suffixes `sat`, `x2`, `x4`, `d2`, `d4`, and `d8` into modifier mask field `[this+0x1cc]`, and raises local error `0x109` on invalid combinations. This is the safest current read for parsing one shader assembly opcode token into the context opcode and modifier fields rather than a generic string switch.","objdump + local disassembly + string correlation + shader-assembly correlation + opcode-parser correlation"
0x0057c34a,167,shader_assembly_parse_destination_write_mask_token,bootstrap,thiscall,inferred,objdump + local disassembly + string correlation,2,"Destination write-mask parser in the shader-assembly context family. The helper accepts the grounded channel letters `r/g/b/a` and their `x/y/z/w` aliases, packs the resulting four two-bit selectors into one encoded mask word, treats an empty token as the default full-mask code `0x000f0000`, and reports invalid input through the local `invalid mask '%s'` formatter before marking the context dirty. This is the safest current read for the destination write-mask parser rather than a generic swizzle helper.","objdump + local disassembly + string correlation + shader-assembly correlation + write-mask correlation"
0x0057c3f3,159,shader_assembly_parse_source_swizzle_token,bootstrap,thiscall,inferred,objdump + local disassembly + string correlation,2,"Source-swizzle parser in the shader-assembly context family. The helper accepts up to four grounded channel letters `r/g/b/a` and their `x/y/z/w` aliases, packs the resulting two-bit selectors into one encoded swizzle word, treats an empty token as the default identity-style code `0x00e40000`, and reports invalid input through the local `invalid swizzle '%s'` formatter before marking the context dirty. This is the safest current read for the source-swizzle parser rather than a generic mask helper.","objdump + local disassembly + string correlation + shader-assembly correlation + swizzle correlation"
0x0057c494,926,shader_assembly_parse_register_token_optional_source_modifier_and_index_form,bootstrap,thiscall,inferred,objdump + local disassembly + string correlation,2,"Register parser in the shader-assembly context family. The helper trims leading whitespace, isolates the alphabetic register stem, recognizes the grounded register families `c`, `v`, `t`, `a`, `oPos`, `oFog`, and `oPts`, optionally parses grounded source-modifier suffixes `_da`, `_dw`, `_db`, `_dz`, `_x2`, `_bx2`, and `_bias`, accepts either plain numeric indexes or the relative forms reported by the local error strings `invalid register '%s[%d]'` and `invalid register '%s[a0.x + %d]'`, and returns one encoded register word with the parsed class, index, and modifier bits combined. Invalid tokens route through the matching `invalid register` formatters and mark the context dirty. This is the safest current read for the shader-assembly register parser rather than a generic token decoder.","objdump + local disassembly + string correlation + shader-assembly correlation + register-parser correlation"
0x0057c835,167,shader_assembly_emit_constant_definition_register_and_vec4_payload,bootstrap,thiscall,inferred,objdump + local disassembly + string correlation,2,"Constant-definition emitter in the shader-assembly context family. The helper accepts one parsed register token plus one caller vec4 payload, rejects non-constant or relative-register forms through the local `invalid constant` formatter, and then appends the grounded constant-definition record into one embedded dword-vector stream: in the vertex-shader path it emits token `0x51`, the register token with the full write mask forced on, and the four caller vec4 lanes; in the alternate path it emits the fixed `0x82000000 | register-index` token plus the same four payload dwords. The helper also advances byte counter `[this+0x9c]` accordingly. This is the safest current read for emitting one parsed constant-definition record rather than a generic vector append helper.","objdump + local disassembly + string correlation + shader-assembly correlation + constant-definition correlation"
0x0057c8de,214,shader_assembly_emit_pending_comment_text_chunk_if_live,bootstrap,thiscall,inferred,objdump + local disassembly + string correlation,2,"Comment-emission owner in the shader-assembly context family. When pending-comment latch `[this+0xb0]` is live, the helper measures the buffered comment span `[this+0xb8..+0xc4]`, appends one sized chunk header plus FourCC `TEXT` into output dword-vector `[this+0x74]`, copies the buffered bytes into the same stream with dword padding, and advances output-byte counter `[this+0xa0]` by the emitted chunk size. This is the safest current read for flushing one pending comment block into the assembly output stream rather than a generic string copy helper.","objdump + local disassembly + string correlation + shader-assembly correlation + comment-chunk correlation"
0x0057c9b4,374,shader_assembly_emit_file_and_line_chunks_when_source_location_changes,bootstrap,thiscall,inferred,objdump + local disassembly + string correlation,2,"Source-location emission owner in the shader-assembly context family. The helper compares current file name `[this+0x1d4]` against the last emitted file copy at `[this+0x2d8]`, and when they differ it appends a sized `FILE` chunk plus the current file string into output dword-vector `[this+0x74]`. It then compares current line number `[this+0x1d0]` against last emitted line `[this+0x2d4]`, and when they differ it appends a fixed `LINE` chunk carrying the new line number. The helper updates byte counter `[this+0xa0]` and the two cached last-emitted location fields on success. This is the safest current read for emitting file and line records when the assembly source location changes rather than a generic metadata logger.","objdump + local disassembly + string correlation + shader-assembly correlation + source-location correlation"
0x0057cb2b,1814,shader_assembly_scan_next_token_skip_comments_and_handle_line_directives,bootstrap,thiscall,inferred,objdump + local disassembly + string correlation,2,"Main lexical scanner for the shader-assembly context family. The routine walks source window `[this+0xbc..+0xc4]`, skips spaces and newlines while maintaining current line `[this+0x1d0]`, strips both `;` line comments and `/* ... */` block comments, recognizes the grounded preprocessor directive `#line`, rejects other preprocessor directives through the local `preprocessor directives are not supported` formatter, tokenizes identifiers and numeric spans into scratch buffer `[this+0xc8]`, updates the current line-file context fields `[this+0x1d0/+0x1d4]`, and returns grounded token or status codes including `ps`, `vs`, `def`, end-of-file `0x10c`, and the parser-side error codes around `0x101..0x10b`. Invalid or truncated directives route through the local `comment extends past end-of-file` and `Internal assembler error! %d` formatters and mark the context dirty. This is the safest current read for the shared lexer and directive scanner beneath the later statement compiler rather than a generic text loop.","objdump + local disassembly + string correlation + shader-assembly correlation + lexer correlation + directive correlation"
0x0057d043,2108,shader_assembly_compile_statement_token_into_output_streams_and_validate_version_rules,bootstrap,thiscall,inferred,objdump + local disassembly + string correlation,2,"Primary statement compiler in the shader-assembly context family. Given one lexer token kind, the routine dispatches across the grounded statement classes through its local jump table: version declarations seed profile and version fields `[this+0xac/+0xb4]`; constant-definition statements route through the grounded register and constant emitters; comment, file, and line records flow through the chunk emitters rooted at `[this+0x74]`; arithmetic and texture opcodes emit opcode and modifier dwords from `[this+0x1c8/+0x1cc]`; operand parsing re-enters the destination-mask helper `0x0057c34a` plus register parser `0x0057c494`; and scalar or string operands are staged through the embedded vector bands `[this+0x14..+0x54]` before being copied into the output stream. The same owner enforces the grounded profile-specific rules reported by its local strings, including `invalid version`, `constant modifiers not supported in ps.1.4`, `coissue not supported in vertex shaders`, `complement not supported in vertex shaders`, `complement cannot be used with other modifiers`, `negate and divide modifiers cannot be combined`, `illegal register number`, `illegal register in index expression`, and `a0.x can only appear once in an index expression`. This is the safest current read for the main shader-assembly statement compiler and validator rather than a generic jump-table body.","objdump + local disassembly + string correlation + shader-assembly correlation + statement-compiler correlation + version-rule correlation"
0x0057d97a,1013,shader_assembly_run_shift_reduce_parse_loop_and_invoke_statement_compiler,bootstrap,cdecl,inferred,objdump + local disassembly + string correlation,2,"Broader parser owner above the shader-assembly lexer and statement compiler. The routine initializes the parser stacks and scratch globals rooted at `0x00db85d0`, `0x00db89c0`, `0x00db89c4`, `0x00db89c8`, `0x00db89cc`, and `0x00db89d8`, repeatedly requests a fresh lookahead token through lexer `0x0057cb2b` when the cached token is invalid, walks the grammar action and goto tables rooted at `0x006265a0..0x00626a68`, invokes statement compiler `0x0057d043` on reductions `0..0x32`, and pushes the resulting parser states plus semantic values back onto the two stacks. The same owner handles syntax recovery by reporting grounded errors such as `statement expected` and `yacc stack overflow` through the shared error helper, keeping the local three-token recovery countdown, and returning once the grammar accepts or the parser overflows. This is the safest current read for the shift-reduce parser driver rather than a generic dispatch loop.","objdump + local disassembly + string correlation + shader-assembly correlation + parser-driver correlation + grammar-table correlation"
0x0057de38,1212,shader_assembly_compile_source_span_to_shader_blob_optional_constant_table_and_error_text,bootstrap,thiscall,inferred,objdump + local disassembly + string correlation + caller inspection,2,"Top-level compile owner above the shader-assembly lexer and parser family. The helper records the caller source span under `[this+0xb8..+0xc4]`, seeds the option and location fields `[this+0xb0/+0x1d0/+0x1d4]`, emits the grounded banner `D3DX8 Shader Assembler Version 0.91` when no explicit file name is supplied, invokes parser `0x0057d97a`, optionally materializes the assembled output stream from vector band `[this+0x64]` into one refcounted blob-style object, optionally builds and returns the adjacent constant-table-style object rooted at `[this+0xa0]`, and when the error log is nonempty joins that log through `0x005814ac` into the caller output text object. The same owner probes the grounded registry-side policy keys under `0x005df51c`, `0x005df530`, `0x005dec20`, and `0x005dec3c` before choosing which optional outputs to materialize. This is the safest current read for compiling one shader-assembly source span into shader blob, optional constant table, and optional error text rather than a lower-level parser leaf.","objdump + local disassembly + string correlation + caller inspection + shader-assembly correlation + compile-owner correlation"
0x0057e300,262,math_seed_function_table_with_x87_geometry_quaternion_and_matrix_family,bootstrap,cdecl,inferred,objdump + local disassembly + sibling correlation,2,"Small table-seeding helper immediately after the shader-assembly owner family. Given one caller function-table record, the helper writes the x87-era geometry, quaternion, projection, plane, and matrix entrypoints into the fixed slot layout rooted at offsets like `[table+0x00]`, `[+0x04]`, `[+0x08]`, `[+0x70]`, and `[+0xb0..+0xd8]`. The seeded targets include the already-grounded x87 helpers `0x00581690`, `0x00581db0`, `0x00581f90`, `0x00582820`, `0x005829b0`, `0x00582aa0`, `0x00582c30`, `0x00582d10`, `0x00582da0`, `0x00582e40`, `0x00582eb0`, and `0x00582fd0`. This is the safest current read for seeding one math function table with the x87 or scalar geometry family rather than a generic memcpy-style initializer.","objdump + local disassembly + function-table correlation + x87-math-family correlation + sibling correlation"
0x0057e410,288,math_seed_function_table_with_packed_geometry_quaternion_and_matrix_family,bootstrap,cdecl,inferred,objdump + local disassembly + sibling correlation,2,"Packed or SSE-style sibling to `0x0057e300`. Given one caller function-table record, the helper writes the later packed geometry, quaternion, projection, and matrix entrypoints into the same fixed slot layout, reusing a few shared low-dimensional helpers while swapping in packed rows such as `0x005830a0`, `0x00583160`, `0x00583320`, `0x005833e0`, `0x00583530`, `0x00583600`, `0x005836e0`, `0x00583b00`, `0x00583bb0`, `0x00583c30`, `0x00583cc0`, `0x00583d90`, `0x00583e80`, `0x00584010`, `0x005840f0`, and `0x00584210`. This is the safest current read for seeding the packed or vectorized math function-table variant rather than a subsystem-specific constructor.","objdump + local disassembly + function-table correlation + packed-math-family correlation + sibling correlation"
0x0057e520,213,math_query_cpuid_feature_mask_for_mmx_and_amd_extended_simd_paths,bootstrap,cdecl,inferred,objdump + local disassembly + string correlation,2,"Small CPUID feature probe that returns one local bitmask for the adjacent MMX or 3DNow math-table seeders. The routine checks basic and extended CPUID availability, captures the vendor triplet into a local buffer, compares it against the grounded AMD vendor string, and folds selected feature bits into one return mask with flags like `0x20`, `0x80`, `0x100`, and `0x200` according to the available MMX and AMD extended SIMD capabilities. This is the safest current read for the local CPU-feature mask owner rather than overclaiming one exact public API name.","objdump + local disassembly + string correlation + cpuid correlation + feature-mask correlation + AMD-vendor correlation"
0x0057e5f5,550,math_seed_function_table_with_mmx_3dnow_family_when_cpuid_mask_allows,bootstrap,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Broader SIMD table-seeding owner above the later MMX or 3DNow math family. The helper first queries the local CPUID mask through `0x0057e520`, requires the MMX plus AMD-extended capability bits before proceeding, and then writes a broad function table of vector, quaternion, projection, and matrix entrypoints such as `0x0058a0b8`, `0x005895fa`, `0x0058a379`, `0x00585a7c`, `0x00584b22`, `0x00584baf`, `0x00584c41`, `0x00584ca5`, `0x00584d4c`, `0x00584df1`, `0x005860f2`, and `0x00588eb2`. When the stronger capability bits are present, the tail patches a smaller set of slots to faster siblings like `0x00589f65`, `0x00588bd0`, `0x0058603d`, `0x00587a7c`, and `0x005846a5`. This is the safest current read for seeding the MMX or 3DNow-style math function table rather than a generic feature gate.","objdump + local disassembly + cpuid correlation + function-table correlation + MMX-correlation + 3DNow-correlation"
0x0057e81b,105,math_apply_2d_basis_rows_and_translation_to_vec4_x87_dispatch_seed_variant,support,cdecl,inferred,objdump + local disassembly + sibling correlation,2,"Small x87 low-dimensional transform helper in the local dispatch-seed strip. The function multiplies one caller XY pair by the first two rows of one caller `4x4` basis block, adds translation row `[basis+0x30]`, and writes the resulting full vec4 through the caller output. This is the safest current read for the local x87 2D basis-plus-translation-to-vec4 variant matching the already-grounded family around `0x0056f210` and `0x00581690`.","objdump + local disassembly + x87 arithmetic inspection + matrix-transform correlation + sibling correlation"
0x0057e884,53,math_apply_2d_basis_rows_to_vec2_x87_dispatch_seed_variant,support,cdecl,inferred,objdump + local disassembly + sibling correlation,2,"Translation-free x87 2D basis helper in the same dispatch-seed strip. The function multiplies one caller XY pair by the first two rows of one caller basis block, sums the two product bands, and writes the resulting vec2 through the caller output. This is the safest current read for the local x87 2D basis-only variant matching the older `0x0056f2fb` and later `0x00581730` family.","objdump + local disassembly + x87 arithmetic inspection + matrix-transform correlation + sibling correlation"
0x0057e8b9,234,math_apply_3d_basis_rows_and_translation_to_vec4_x87_dispatch_seed_variant,support,cdecl,inferred,objdump + local disassembly + sibling correlation,2,"Broader x87 3D basis-plus-translation helper in the same dispatch-seed strip. The function multiplies one caller XYZ triple by the first three rows of one caller `4x4` basis block, adds translation row `[basis+0x30]`, and writes the resulting full vec4 through the caller output. This is the safest current read for the local x87 3D basis-plus-translation variant rather than a subsystem-specific owner.","objdump + local disassembly + x87 arithmetic inspection + matrix-transform correlation + sibling correlation"
0x0057e944,153,math_apply_3d_basis_rows_to_vec3_x87_dispatch_seed_variant,support,cdecl,inferred,objdump + local disassembly + sibling correlation,2,"Translation-free x87 3D basis helper in the same dispatch-seed strip. The function multiplies one caller XYZ triple by the first three rows of one caller basis block, sums the three product bands, and writes the resulting vec3 through the caller output. This is the safest current read for the local x87 3D basis-only variant matching the broader family of low-dimensional transform helpers.","objdump + local disassembly + x87 arithmetic inspection + matrix-transform correlation + sibling correlation"
0x0057ea3c,202,math_normalize_vec3_or_zero_fast_table_assisted_x87_variant,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection + table correlation,2,"Fast x87 vec3 normalize-or-zero helper in the local dispatch-seed strip. The function computes squared length from the caller XYZ triple, returns a zero vec3 when that length is zero, copies the input unchanged when the length is already near `1.0f`, and otherwise derives one reciprocal-square-root scale from the small lookup tables rooted at `0x00626c80/0x00626c84` before scaling the caller vector into the output. This is the safest current read for a fast table-assisted vec3 normalize-or-zero variant rather than a subsystem-specific owner.","objdump + local disassembly + x87 arithmetic inspection + normalization correlation + lookup-table correlation + sibling correlation"
0x0057eb06,227,math_multiply_4x4_matrices_alias_safe_row_write_x87_variant,support,cdecl,inferred,objdump + local disassembly + sibling correlation,2,"Alias-safe x87 `4x4` matrix multiply variant in the local dispatch-seed strip. The helper detects when the output aliases either caller matrix, uses one stack-local `0x40`-byte temporary when needed, then evaluates the standard row-by-column product and writes the resulting matrix through the caller output in contiguous row order. This is the safest current read for one alias-safe row-write `4x4` multiply sibling rather than overclaiming a public API name.","objdump + local disassembly + x87 arithmetic inspection + matrix-multiply correlation + alias-safety correlation + sibling correlation"
0x0057ebe9,278,math_multiply_4x4_matrices_alias_safe_column_stride_write_x87_variant,support,cdecl,inferred,objdump + local disassembly + sibling correlation,2,"Column-stride x87 sibling to `0x0057eb06`. The helper again detects output aliasing, uses one stack-local `0x40`-byte temporary when needed, evaluates the same `4x4` row-by-column multiply, and writes the results through the caller output with one `0x10`-byte stride between successive stored scalars rather than the contiguous row-order pattern used by `0x0057eb06`. This is the safest current read for the local alias-safe column-stride `4x4` multiply sibling rather than assigning a more semantic matrix-layout name than the current evidence supports.","objdump + local disassembly + x87 arithmetic inspection + matrix-multiply correlation + alias-safety correlation + sibling correlation"
0x0057ec77,60,math_seed_function_table_with_local_x87_low_dimension_and_matrix_strip,bootstrap,cdecl,inferred,objdump + local disassembly + sibling correlation,2,"Small local table-seeding helper for the adjacent x87 transform strip. Given one caller function-table record, the helper installs the local low-dimensional and matrix siblings `0x0057e81b`, `0x0057e884`, `0x0057e8b9`, `0x0057e944`, `0x0057ea3c`, `0x0057eb06`, and `0x0057ebe9` into the eight fixed slots starting at `[table+0x00]`. This is the safest current read for seeding one compact x87 helper table rather than a generic pointer copy.","objdump + local disassembly + function-table correlation + x87-math-family correlation + sibling correlation"
0x0057ecb3,76,surface_expand_rgb565_word_to_vec4_with_unit_alpha,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Shared `RGB565` expansion helper in the adjacent `DXT` color-block family. The routine extracts the caller endpoint word into one `5:6:5` integer triplet, scales red and blue through the local `1/31` constant plus green through the local `1/63` constant, writes the resulting float RGB triplet into the caller vec4 output, and stores `1.0f` in the alpha lane. This is the safest current read for expanding one `RGB565` word into vec4 with unit alpha rather than naming a broader palette owner.","objdump + local disassembly + caller inspection + DXT-correlation + RGB565-correlation + palette-build correlation"
0x00580867,75,target_service_init_clear_entry_bands_and_aux_fields,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for the target-service object family wrapped by `0x005def30`. The helper seeds refcount `[this] = 1`, clears the target, attached-object, embedded entry-band roots, ready byte, service handles, auxiliary handle roots, and list link at `[this+0xac]`, and leaves the object ready for the later constructor-side owner `0x00580be8`.","objdump + local disassembly + target-service-family correlation + constructor correlation"
0x005808b2,249,target_service_destruct_release_handles_entry_bands_and_unlink_global_cache,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side owner for the same target-service family. The helper releases the two target-bound service handles `[this+0x64/+0x68]` through target slot `+0xe0`, walks and releases the two embedded eight-entry bands rooted at `[this+0x10]` and `[this+0x30]`, drops attached object `[this+0x0c]` and target `[this+0x04]`, tears down the auxiliary handle family rooted at `[this+0x6c]`, `[this+0x98]`, `[this+0x9c]`, and `[this+0xa8]` through the imported `0x005c8030/0x005c803c/0x005c8058` helpers, and finally unlinks the object from the global cache chain rooted at `0x00db89e4`. This is the safest current read for the full target-service destructor rather than a generic cleanup body.","objdump + local disassembly + target-service-family correlation + destructor correlation + global-cache correlation"
0x005809ab,28,target_service_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for the target-service family. The helper re-enters destructor `0x005808b2`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`. Current grounded caller is refcount helper `0x00580bdc`.","objdump + local disassembly + target-service-family correlation + refcount correlation"
0x005809c7,141,target_service_seed_handles_0x64_0x68_and_latch_ready_0x60,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Activation-side owner for the next target-service family beneath the `0x5def30` wrappers. When ready byte `[this+0x60]` is still clear, the helper ensures service handles `[this+0x64]` and `[this+0x68]` through target `[this+0x04]` vtable slots `+0xd0` and `+0xd4`, invokes attached object `[this+0x0c]` through slot `+0x10`, republishes those two handles back into the target through slots `+0xdc` and `+0xd8`, and finally marks `[this+0x60] = 1`. This is the safest current read for seeding the two service handles and latching the service live rather than a generic query helper.","objdump + local disassembly + target-service-family correlation + handle-seed correlation"
0x00580a54,48,target_service_release_handle_0x64_and_clear_ready_0x60,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Clear-side sibling to `0x005809c7` in the same target-service family. When ready byte `[this+0x60]` is nonzero, the helper asks target `[this+0x04]` to release handle `[this+0x64]` through vtable slot `+0xd8`, notifies attached object `[this+0x0c]` through slot `+0x1c`, and clears `[this+0x60]` back to `0`.","objdump + local disassembly + target-service-family correlation + handle-release correlation"
0x00580a84,123,target_service_release_handles_and_reset_embedded_entry_bands,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Broader release owner for the same target-service family. The helper tears down target-side handle state through target `[this+0x04]`, attached object `[this+0x0c]`, and the optional handles rooted at `[this+0x64]` and `[this+0x68]`, then iterates the two embedded eight-entry bands under `[this+0x10]` and `[this+0x30]` to clear their per-entry pointers and counters. This is the safest current read for releasing the bound handles and resetting the embedded entry bands rather than a generic cleanup fragment.","objdump + local disassembly + target-service-family correlation + embedded-entry-band correlation"
0x00580aff,186,target_service_build_embedded_entry_bands_from_mode_variant_and_dispatch_slot_0x3c,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Setup-side owner immediately above the clear strip in the same target-service family. When entry root `[this+0x10]` is still null, the helper branches on local mode byte `[this+0x50]` to choose one of two fixed parameter triples, seeds control scalars `[this+0x54]`, `[this+0x58]`, and `[this+0x5c]` through `0x00570669` and `0x00570691`, iterates the embedded entry bands rooted at `[this+0x10]` and dispatches each live per-entry object through slot `+0x3c`. This is the safest current read for building the embedded entry bands from the mode variant and dispatching their setup slot rather than a generic initializer.","objdump + local disassembly + target-service-family correlation + embedded-entry-band correlation"
0x00580bb9,35,target_service_release_aux_handle_band_if_live,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small auxiliary release helper for the same target-service family. When optional band flag `[this+0x6c]` is live, the helper walks the pointer band rooted at `[this+0xa8]`, releases it through import thunk `0x005c803c`, and clears the associated slots back to `0`.","objdump + local disassembly + target-service-family correlation + auxiliary-handle correlation"
0x00580bdc,12,target_service_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny refcount-drop helper for the same target-service family. The function decrements refcount `[this]` and when it reaches zero tail-calls release wrapper `0x005809ab(1)`.","objdump + local disassembly + target-service-family correlation + refcount correlation"
0x00580be8,321,target_service_init_seed_mode_scalars_build_entry_bands_and_bind_aux_handles,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Constructor-side owner for the target-service family wrapped by the `0x5def30` object. The helper stores caller target `[this+0x04]`, derives mode byte `[this+0x50]` from target-side flags, seeds the fixed scalar triple `[this+0x54] = 0x15`, `[this+0x58] = 0x40`, `[this+0x5c] = 0x10`, invokes embedded-band builder `0x00580aff`, initializes the later service roots under `[this+0x70..]`, and allocates or binds the auxiliary handle family rooted at `[this+0x6c]`, `[this+0x98]`, and `[this+0x9c]`. This is the safest current read for initializing the target-service object, seeding its mode scalars, building the entry bands, and binding the auxiliary handles rather than a generic constructor fragment.","objdump + local disassembly + target-service-family correlation + constructor correlation"
0x00580d29,1299,target_service_dispatch_payload_block_with_mode_variant_and_target_callbacks,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Primary target-service owner beneath the `0x0057ae2d/0x0057ae53` wrappers. The helper accepts the target-service object, the caller payload block, five caller arguments, and a fixed mode variant flag from the wrapper, then branches across local bounds, anchor, and callback conditions while using service handle `[this+0x6c]` plus external callbacks rooted at `0x005c81e4`, `0x005c8248`, and `0x005c824c`. Current static evidence is strong enough to ground this as the main payload-dispatch and layout-style service body for the target-service family, while the exact user-facing meaning of every branch remains open.","objdump + local disassembly + target-service-family correlation + payload-block correlation + callback correlation"
0x0058123c,117,target_service_cache_or_create_for_target_and_return_via_outparam,bootstrap,cdecl,inferred,objdump + local disassembly,2,"Factory-side helper above the target-service family. The function walks the global cache chain rooted at `0x00db89e4` looking for an existing target-service object whose target field `[entry+0x04]` matches the caller target. On a hit it increments the service refcount and returns the cached object through the caller outparam. Otherwise it allocates one `0xb0`-byte object through `0x0053b070`, initializes it through `0x00580867`, runs constructor owner `0x00580be8`, and on failure releases it through `0x005809ab(1)`. This is the safest current read for the cache-or-create factory for the target-service family rather than a generic resource wrapper constructor.","objdump + local disassembly + target-service-family correlation + global-cache correlation + factory correlation"
0x005812b1,16,dword_pointer_vector_reset_4dwords,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny reset helper for one four-dword vector-style record. The function clears fields `[this+0x00]`, `[this+0x04]`, `[this+0x08]`, and `[this+0x0c]` back to zero.","objdump + local disassembly + container-helper correlation"
0x005812c1,14,dword_pointer_vector_release_storage_if_nonnull,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small release helper for the same four-dword vector record. When storage pointer `[this+0x00]` is nonnull, the helper frees it through `0x0053b080`.","objdump + local disassembly + container-helper correlation"
0x005812cf,110,dword_pointer_vector_push_value_grow_by_0x10,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Growable dword-pointer vector append helper. The function checks count `[this+0x04]` against capacity `[this+0x08]`, grows the backing dword array at `[this+0x00]` by `0x10` entries through `0x0053b070` when full, preserves existing contents, writes the caller dword into the next slot, increments the count, and stores allocation failure `0x8007000e` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + dynamic-array correlation"
0x0058133d,52,dword_pointer_vector_pop_last_optional_outparam,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small pop helper for the same dword-pointer vector. When count `[this+0x04]` is nonzero it decrements the count and optionally writes the removed last dword through the caller outparam; when empty it zeros the outparam if present and stores `0x80004005` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + dynamic-array correlation"
0x00581371,8,dword_pointer_vector_take_and_clear_status,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny status helper for the same dword-pointer vector. The function returns status dword `[this+0x0c]` and then clears that field back to zero.","objdump + local disassembly + container-helper correlation"
0x00581379,19,string_pointer_vector_reset_5dwords,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny reset helper for one five-dword string-pointer vector record. The function clears storage pointer, count, capacity, status, and accumulated-byte counter fields `[this+0x00..+0x10]`.","objdump + local disassembly + container-helper correlation + string-vector correlation"
0x0058138c,49,string_pointer_vector_release_storage_and_owned_strings,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release helper for the string-pointer vector record. When storage `[this+0x00]` is live, the helper walks all counted string pointers, frees each owned string through `0x0053b080`, then frees the pointer array itself through the same allocator shim.","objdump + local disassembly + container-helper correlation + string-vector correlation"
0x005813bd,179,string_pointer_vector_push_copy_or_null_grow_by_0x10,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Growable string-pointer vector append helper. The function grows the pointer array at `[this+0x00]` by `0x10` entries when count reaches capacity, then either stores a null pointer for a null caller string or allocates and copies a private NUL-terminated copy of the caller string, updates accumulated-byte counter `[this+0x10]`, stores the resulting pointer in the next slot, increments the count, and records allocation failure `0x8007000e` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + string-vector correlation"
0x00581470,52,string_pointer_vector_pop_last_optional_outparam,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small pop helper for the same string-pointer vector. When count `[this+0x04]` is nonzero it decrements the count and optionally writes the removed last string pointer through the caller outparam; when empty it zeros the outparam if present and stores `0x80004005` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + string-vector correlation"
0x005814a4,8,string_pointer_vector_take_and_clear_status,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny status helper for the same string-pointer vector. The function returns status dword `[this+0x0c]` and then clears that field back to zero.","objdump + local disassembly + container-helper correlation + string-vector correlation"
0x005814ac,232,string_pointer_vector_build_newline_joined_text_object,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Primary owner above the string-pointer vector helper strip. When accumulated-byte count `[this+0x10]` is nonzero, the helper allocates one `0x10`-byte text object through `0x0053b070`, initializes it through `0x00581673`, asks that object to allocate a text buffer sized for total string bytes plus one newline per stored string plus the trailing NUL through vtable slot `+0x18`, and then copies each stored string from the vector into the owned buffer separated by literal `0x0a` bytes before returning the object through the caller outparam. This is the safest current read for building one newline-joined text object from the stored string vector rather than a generic vector wrapper.","objdump + local disassembly + string-vector correlation + text-object correlation"
0x00581594,21,text_object_vtable_0x5e0bd8_destruct_release_owned_buffer,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side helper for the small text object family rooted at vtable `0x005e0bd8`. The helper reinstalls that vtable and frees owned text buffer `[this+0x0c]` through `0x0053b080` when it is live.","objdump + local disassembly + text-object correlation"
0x005815a9,38,text_object_vtable_0x5e0bd8_allocate_owned_buffer,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Allocation helper for the same text object family. The function stores the requested byte length in `[this+0x08]`, allocates that many bytes through `0x0053b070`, writes the result to `[this+0x0c]`, and returns either `0` or allocation failure `0x8007000e`.","objdump + local disassembly + text-object correlation"
0x005815cf,11,text_object_vtable_0x5e0bd8_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny addref helper for the same text object family. The function increments refcount `[this+0x04]` and returns the new count.","objdump + local disassembly + text-object correlation + refcount correlation"
0x005815dc,30,text_object_vtable_0x5e0bd8_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for the same text object family. The function decrements refcount `[this+0x04]`, and when it reaches zero tail-calls release wrapper `0x00581610(1)`.","objdump + local disassembly + text-object correlation + refcount correlation"
0x005815fc,18,text_object_vtable_0x5e0bd8_get_owned_buffer,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for the same text object family. The function returns owned text buffer pointer `[this+0x0c]`.","objdump + local disassembly + text-object correlation"
0x00581606,8,text_object_vtable_0x5e0bd8_get_buffer_length,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for the same text object family. The function returns stored buffer length `[this+0x08]`.","objdump + local disassembly + text-object correlation"
0x00581610,26,text_object_vtable_0x5e0bd8_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for the same text object family. The helper re-enters destructor `0x00581594`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + text-object correlation + refcount correlation"
0x0058162c,71,text_object_vtable_0x5e0bd8_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for the same text object family. The helper accepts exactly `IUnknown` from `0x005eaaec` plus one custom IID rooted at `0x005c8510`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + text-object correlation + COM-correlation"
0x00581673,24,text_object_vtable_0x5e0bd8_init,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for the same text object family. The helper installs vtable `0x005e0bd8`, seeds refcount `[this+0x04] = 1`, and clears buffer-length `[this+0x08]` plus owned-buffer pointer `[this+0x0c]`.","objdump + local disassembly + text-object correlation"
0x00581690,64,math_apply_2d_basis_rows_and_translation_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small SSE helper over one caller output buffer, one XY input pair, and one basis or translation block. The function multiplies the input X and Y scalars by the first two 16-byte rows at `[basis+0x00]` and `[basis+0x10]`, adds translation row `[basis+0x30]`, and stores the full 16-byte vector result to the caller output. This is the safest current read for the shared 2D-basis-plus-translation vec4 builder rather than a gameplay-specific transform.","objdump + local disassembly + SSE arithmetic inspection"
0x005816d0,96,math_apply_2d_basis_rows_translation_and_project_xy_by_reciprocal_lane3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Projective sibling to `0x00581690`. The helper builds the same intermediate 4-lane vector from the caller XY pair and basis or translation rows, then derives a reciprocal from lane 3 and uses it to scale the vector before storing only the low 64 bits through the caller output. Current evidence is strongest for a shared transform-plus-project helper that returns projected XY rather than a gameplay-specific projection owner.","objdump + local disassembly + SSE arithmetic inspection"
0x00581730,57,math_apply_2d_basis_rows_to_vec2_without_translation,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small translation-free sibling to `0x00581690`. The helper multiplies the caller XY pair by the first two 16-byte basis rows at `[basis+0x00]` and `[basis+0x10]`, sums the lanes, and stores only the low 64 bits to the caller output. This is the safest current read for the shared 2D basis-to-vec2 helper rather than another owner-specific math body.","objdump + local disassembly + SSE arithmetic inspection"
0x00581770,192,math_apply_3d_basis_rows_to_vec3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small 3D SSE transform helper over one caller output buffer, one XYZ input triple, and one basis block. The function multiplies the input X, Y, and Z scalars by the first three 16-byte rows at `[basis+0x00]`, `[basis+0x10]`, and `[basis+0x20]`, sums the lanes, and stores the resulting XYZ triple through the caller output. It uses a separate fast path when the basis pointer is 16-byte aligned, but both legs preserve the same semantics.","objdump + local disassembly + SSE arithmetic inspection"
0x00581830,192,math_apply_3d_basis_rows_and_translation_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Translation-bearing sibling to `0x00581770`. The helper multiplies the caller XYZ triple by the first three 16-byte basis rows, adds translation row `[basis+0x30]`, and stores the full 16-byte vector result to the caller output. As with the sibling, the body has aligned and unaligned load paths but the same observable transform semantics.","objdump + local disassembly + SSE arithmetic inspection"
0x005818f0,256,math_apply_3d_basis_rows_translation_and_project_vec3_by_reciprocal_lane3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Projective 3D sibling to `0x00581830`. The helper builds the same 4-lane transformed vector from the caller XYZ triple and basis or translation rows, derives a reciprocal from lane 3, scales the vector by that reciprocal, and stores the resulting XYZ triple through the caller output. Both the aligned and unaligned legs preserve the same transform-plus-project semantics.","objdump + local disassembly + SSE arithmetic inspection"
0x005819f0,192,math_apply_4d_basis_rows_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small 4D SSE transform helper over one caller output buffer, one XYZW input vector, and one 4x4 basis block. The function multiplies each input lane by the corresponding 16-byte row at `[basis+0x00]`, `[basis+0x10]`, `[basis+0x20]`, and `[basis+0x30]`, sums the lanes, and stores the full vec4 result through the caller output. The body preserves the same semantics across aligned and unaligned basis-pointer paths.","objdump + local disassembly + SSE arithmetic inspection"
0x00581ab0,336,math_apply_4d_basis_rows_to_four_vec4_rows,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Batch sibling to `0x005819f0`. The helper takes one 4x4 source row block, applies the same 4-row basis block to each of its four input vec4 rows, and writes the four transformed vec4 rows to the caller output block at offsets `+0x00`, `+0x10`, `+0x20`, and `+0x30`. This is the safest current read for the shared four-row 4D basis application helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection"
0x00581c00,208,math_normalize_vec3_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small vec3 normalization helper. The function computes squared length from the caller XYZ triple, compares it against a tiny epsilon table under `0x00dbc000`, returns a zero vector when the length is too small, and otherwise applies one Newton-refined reciprocal-square-root scale before writing the normalized XYZ result. This is the safest current read for the shared normalize-or-zero vec3 helper rather than a gameplay-specific metric.","objdump + local disassembly + SSE arithmetic inspection"
0x00581cd0,216,math_normalize_vec4_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00581c00`. The helper computes squared length from the caller XYZW tuple, compares it against a nearby epsilon table under `0x00dbc00c`, returns a zero vec4 when the length is too small, and otherwise applies the same Newton-refined reciprocal-square-root scale before writing the normalized XYZW result. This is the safest current read for the shared normalize-or-zero vec4 helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection"
0x00581db0,1008,math_invert_4x4_matrix_and_optionally_store_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Primary 4x4 matrix inversion helper. The function derives the cofactor bands for the caller source matrix, accumulates the determinant, optionally stores that determinant through the caller outparam, returns failure when the determinant is zero, and otherwise scales the cofactor matrix by the reciprocal determinant before writing the inverse to the caller output. This is the safest current read for the shared invert-4x4 helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection"
0x00582070,352,math_apply_4d_basis_rows_to_four_vec4_rows_transposed_output,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-output sibling to `0x00581ab0`. The helper applies one 4-row basis block to each row of a caller 4x4 source block, then repacks the four transformed vec4 rows into a transposed or column-packed output layout before storing them to the caller destination. This is the safest current read for the shared four-row 4D basis application helper with packed transposed output.","objdump + local disassembly + SSE arithmetic inspection"
0x005821d0,164,math_compute_4d_cross_product_from_three_vec4_inputs,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Standalone 4D vector helper over three caller vec4 inputs. The function computes the alternating-sign generalized cross-product style combination of those three vectors and writes the resulting vec4 through the caller output. The final sign flip through mask `0x00627ce0` is part of the same determinant-style construction, so this is the safest current read for the shared 4D cross-product helper rather than a subsystem-specific owner.","objdump + local disassembly + SSE arithmetic inspection"
0x00582280,160,math_normalize_vec4_unchecked,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Unchecked vec4 normalization helper. The function computes squared length from the caller XYZW tuple, derives one reciprocal-square-root scale with Newton refinement, and writes the normalized vec4 without the small-epsilon zeroing guard used by `0x00581cd0`.","objdump + local disassembly + SSE arithmetic inspection"
0x00582320,176,math_sample_cubic_basis_vec3_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Cubic-basis interpolation helper over one scalar parameter and four caller vec3 control points. The function builds four basis weights from the scalar through the constant tables at `0x00627d10..0x00627d40`, multiplies each control point by its corresponding weight, and writes the blended vec3 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x005823e0,136,math_sample_cubic_basis_vec2_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec2 sibling to `0x00582320`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies them to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x00582470,165,math_sample_cubic_basis_vec4_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00582320`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies them to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x00582520,181,math_sample_alternate_cubic_basis_vec3_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Alternate-basis vec3 interpolation sibling. The helper again derives four weights from the caller scalar parameter, but uses the alternate constant tables at `0x00627d50..0x00627d80` before applying those weights to four caller vec3 control points and writing the blended vec3 result. This is the safest current read for the alternate cubic-basis vec3 sampler rather than a subsystem-specific curve owner.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x005825e0,153,math_sample_alternate_cubic_basis_vec4_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00582520`. The helper derives the same alternate cubic-basis weights from the caller scalar parameter, applies them to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x00582680,133,math_sample_alternate_cubic_basis_vec2_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec2 sibling to `0x00582520`. The helper derives the same alternate cubic-basis weights from the caller scalar parameter, applies them to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x00582710,89,math_blend_vec3_from_origin_and_two_targets_by_two_scalars,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Two-scalar affine blend helper over three caller vec3 points. The function computes `p0 + s*(p1-p0) + t*(p2-p0)` from the caller origin point, two target points, and scalar weights `s` and `t`, then writes the blended vec3 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + affine-blend correlation"
0x00582770,70,math_blend_vec4_from_origin_and_two_targets_by_two_scalars,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00582710`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec4 points and two scalar weights, then writes the blended vec4 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + affine-blend correlation"
0x005827c0,79,math_blend_vec2_from_origin_and_two_targets_by_two_scalars,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec2 sibling to `0x00582710`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec2 points and two scalar weights, then writes the blended vec2 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + affine-blend correlation"
0x00582820,188,math_intersect_plane_vec4_with_vec3_segment,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Geometric intersection helper over one plane vec4 and two caller vec3 endpoints. The function evaluates the plane against both endpoints, derives the affine parameter along the segment between them, returns null when the denominator collapses to zero, and otherwise writes the intersection point `p0 + t*(p1-p0)` through the caller output. This is the safest current read for the shared plane-versus-segment intersection helper rather than a subsystem-specific query.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation"
0x005828e0,203,math_measure_4x4_matrix_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Standalone 4x4 determinant helper. The function forms the required cofactor combinations from the caller matrix rows, contracts them against the first row, and returns the resulting determinant scalar through the x87 return path. Current evidence is strongest for a shared determinant helper paired with the nearby inversion body `0x00581db0`.","objdump + local disassembly + SSE arithmetic inspection + matrix-correlation"
0x005829b0,226,math_build_plane_vec4_from_three_vec3_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Three-point plane builder over caller vec3 inputs. The function forms two edge vectors from the three points, computes their cross product, normalizes that resulting normal, stores the plane normal through output `[+0x00..+0x08]`, and writes the signed plane constant `-dot(normal, p0)` to `[out+0x0c]`. This is the safest current read for the shared plane-from-three-points helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation"
0x00582aa0,392,math_build_4x4_projective_matrix_from_plane_vec4_and_vec4_input,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Shared plane-driven 4x4 matrix builder over one caller plane vec4 and one second vec4 input. The function normalizes the plane against the XYZ-length of its first three lanes, computes one diagonal dot term against the second vec4, combines that term with per-plane outer-product bands, and writes the resulting 4x4 matrix to the caller output. The current formula is tight enough to carry this row as a projective plane-and-vec4 matrix helper.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation + projective-matrix correlation"
0x00582c30,209,math_build_4x4_rotation_matrix_from_quaternion,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion-to-matrix helper. The function normalizes the caller quaternion-like vec4, applies the standard doubled-product combinations through the constant tables at `0x00627e10..0x00627e80`, and writes a 4x4 rotation matrix to the caller output. This is the safest current read for the shared quaternion-to-4x4 rotation-matrix builder rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation"
0x00582d10,130,math_multiply_quaternions,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion product helper over two caller vec4 inputs. The function applies the expected sign-mask and shuffle pattern for Hamilton-product-style quaternion composition and writes the resulting vec4 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation"
0x00582da0,128,math_normalize_quaternion_unchecked,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Unchecked quaternion normalization helper. The function computes the caller quaternion length, derives one reciprocal-square-root scale with Newton refinement, and writes the normalized vec4 without the small-epsilon guard used by the nearby zero-safe normalizers.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation"
0x00582e40,109,math_invert_quaternion_by_conjugate_over_squared_length,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion inverse helper over one caller vec4. The function flips the sign of the spatial XYZ lanes, preserves the scalar W lane, divides that conjugate by the squared quaternion length, and writes the resulting vec4 through the caller output. This is the safest current read for the shared quaternion-inverse helper rather than a subsystem-specific owner.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation"
0x00582eb0,274,math_build_quaternion_from_3x3_rotation_matrix,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Rotation-matrix-to-quaternion helper over one caller 3x3 row block. The function checks the matrix trace, takes the usual positive-trace fast path when possible, otherwise selects the dominant diagonal lane and rebuilds the remaining quaternion components from the expected off-diagonal differences and sums before writing the resulting vec4 to the caller output. This is the safest current read for the shared 3x3-rotation-matrix-to-quaternion builder.","objdump + local disassembly + x87 arithmetic inspection + quaternion correlation"
0x00582fd0,191,math_build_quaternion_from_three_euler_angles_via_half_angle_trig,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Three-angle quaternion builder over caller scalar inputs. The function packs the three caller angles with one zero lane, scales them by `0.5`, routes that half-angle tuple through packed trig helper `0x0058aa70`, and combines the resulting sine and cosine lanes into one quaternion vec4 before storing it through the caller output. Current evidence is sufficient to carry the row as a shared Euler-angle-to-quaternion helper.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation + packed-trig correlation"
0x005830a0,176,math_apply_packed_3x3_basis_to_vec3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row 3D basis helper over one caller vec3 input and one compact 3x3 basis block. The function multiplies the input X, Y, and Z scalars by three packed matrix rows and stores the resulting XYZ triple through the caller output, with aligned and unaligned load paths that preserve the same semantics.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation"
0x00583160,175,math_apply_packed_3x3_basis_and_translation_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row translation-bearing sibling to `0x005830a0`. The helper multiplies one caller vec3 input by three packed basis rows, adds one packed translation row, and stores the resulting full vec4 through the caller output. Both aligned and unaligned load paths preserve the same transform semantics.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation"
0x00583220,243,math_apply_packed_3x3_basis_translation_and_project_vec3_by_reciprocal_lane3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Projective packed-row sibling to `0x00583160`. The helper builds the same transformed 4-lane vector from one caller vec3 input plus packed basis and translation rows, derives a reciprocal from lane 3, scales the vector by that reciprocal, and stores the projected XYZ triple through the caller output. The aligned and unaligned legs preserve the same transform-plus-project behavior.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + projection correlation"
0x00583320,184,math_apply_packed_4x4_basis_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row 4D basis helper over one caller vec4 input and one packed 4x4 row block. The function multiplies each input lane by its corresponding packed row, sums the four products, and stores the resulting vec4 through the caller output, again preserving the same behavior across aligned and unaligned load paths.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation"
0x005833e0,324,math_apply_packed_4x4_basis_to_four_vec4_rows,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Batch packed-row sibling to `0x00583320`. The helper applies one packed 4x4 basis block to each of four caller vec4 rows from a source block and writes the four transformed rows back to the caller output block at offsets `+0x00`, `+0x10`, `+0x20`, and `+0x30`.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation"
0x00583530,196,math_normalize_packed_vec3_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row vec3 normalization sibling to `0x00581c00`. The helper computes squared length from the caller XYZ triple, compares it against the nearby epsilon table under `0x00dbc180`, returns a zero vector when the length is too small, and otherwise applies one Newton-refined reciprocal-square-root scale before writing the normalized XYZ result.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + normalization correlation"
0x00583600,216,math_normalize_packed_vec4_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row vec4 normalization sibling to `0x00581cd0`. The helper computes squared length from the caller XYZW tuple, compares it against the nearby epsilon table under `0x00dbc18c`, returns a zero vec4 when the length is too small, and otherwise applies one Newton-refined reciprocal-square-root scale before writing the normalized XYZW result.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + normalization correlation"
0x005836e0,695,math_invert_packed_4x4_matrix_and_optionally_store_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row 4x4 inversion sibling to `0x00581db0`. The helper expands the packed 4x4 source rows, derives the required cofactor bands and determinant scalar, optionally stores that determinant through the caller outparam, returns failure when the determinant collapses to zero, and otherwise scales the cofactor matrix by the reciprocal determinant before writing the packed inverse to the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + matrix-inversion correlation"
0x005839a0,342,math_apply_packed_4x4_basis_to_four_vec4_rows_transposed_output,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-output batch sibling to `0x005833e0`. The helper applies one packed 4x4 basis block to each of four caller vec4 rows from a source block, then repacks the transformed lanes into a transposed or column-packed output layout before storing the four result rows.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + transposed-output correlation"
0x00583b00,164,math_compute_packed_4d_cross_product_from_three_vec4_inputs,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x005821d0`. The helper takes three caller vec4 inputs, forms the same alternating-sign generalized 4D cross-product style combination through shuffle, multiply, and subtract bands, applies the final sign-mask adjustment under `0x00627ee0`, and writes the resulting vec4 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + 4d-cross-product correlation"
0x00583cc0,201,math_measure_packed_4x4_matrix_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row determinant sibling to `0x005828e0`. The helper expands the packed 4x4 row block, forms the same cofactor combinations as the wider determinant strip, contracts them against the first packed row, and returns the resulting determinant scalar through the x87 return path.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + matrix-determinant correlation"
0x00583bb0,121,math_build_single_angle_packed_4x4_axial_rotation_matrix_variant_a,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Single-angle packed 4x4 rotation-matrix helper above interleaved trig worker `0x0058ac60`. The function broadcasts one caller angle, derives one interleaved sine/cosine tuple through `0x0058ac60`, combines that tuple with fixed identity-row constants, and writes one packed 4x4 axial rotation-matrix variant to the caller output. Current evidence is sufficient to carry the row as a fixed-axis rotation-matrix constructor.","objdump + local disassembly + caller correlation + packed-matrix correlation + trig correlation"
0x00583c30,128,math_build_single_angle_packed_4x4_axial_rotation_matrix_variant_b,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Sibling single-angle packed 4x4 rotation-matrix helper above `0x0058ac60`. Like `0x00583bb0`, it broadcasts one caller angle, derives one interleaved sine/cosine tuple through the shared trig worker, combines that tuple with fixed identity-row constants in a different lane arrangement, and writes one second packed 4x4 axial rotation-matrix variant to the caller output. The safest current read is a second fixed-axis rotation-matrix constructor rather than a tighter axis-specific label.","objdump + local disassembly + caller correlation + packed-matrix correlation + trig correlation"
0x00583d90,226,math_build_plane_vec4_from_three_packed_vec3_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row three-point plane builder sibling to `0x005829b0`. The helper forms two edge vectors from three caller vec3 points, computes their cross product, normalizes that resulting normal, stores the plane normal through the caller output, and writes the signed plane constant to `[out+0x0c]`.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + geometry correlation"
0x00583e80,392,math_build_packed_4x4_projective_matrix_from_plane_vec4_and_vec4_input,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x00582aa0`. The helper normalizes the caller plane vec4 against the XYZ length of its first three lanes, computes one diagonal dot term against the second vec4 input, combines that term with per-plane outer-product bands, and writes the resulting packed 4x4 matrix to the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + geometry correlation + projective-matrix correlation"
0x00584010,209,math_build_packed_4x4_rotation_matrix_from_quaternion,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row quaternion-to-matrix sibling to `0x00582c30`. The helper normalizes the caller quaternion-like vec4, applies the same doubled-product combinations through the packed constant tables at `0x00627f70..0x00627fe0`, and writes a packed 4x4 rotation matrix to the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + quaternion correlation"
0x005840f0,274,math_build_quaternion_from_packed_3x3_rotation_matrix,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Packed-row rotation-matrix-to-quaternion sibling to `0x00582eb0`. The helper checks the packed 3x3 trace, takes the positive-trace fast path when possible, otherwise selects the dominant diagonal lane and rebuilds the remaining quaternion components from the expected packed off-diagonal differences and sums before writing the resulting vec4 to the caller output.","objdump + local disassembly + x87 arithmetic inspection + packed-matrix correlation + quaternion correlation"
0x00584210,191,math_build_quaternion_from_three_euler_angles_via_packed_half_angle_trig,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x00582fd0`. The helper packs three caller angles with one zero lane, scales them by `0.5`, routes that tuple through packed trig helper `0x0058ad50`, and combines the resulting sine and cosine lanes into one quaternion vec4 before storing it through the caller output. Current evidence is sufficient to carry the row as a shared Euler-angle-to-quaternion helper.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + quaternion correlation + packed-trig correlation"
0x005842e0,151,math_multiply_quaternions_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582d10`. The helper loads two caller quaternion-like vec4 inputs, applies the same sign-mask and pairwise multiply-add or subtract pattern used by the SSE quaternion-product strip, and writes the resulting vec4 through the caller output before `femms`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation"
0x00584379,90,math_normalize_vec4_or_zero_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 normalize-or-zero helper. The function computes squared length from the caller vec4, compares it against the nearby epsilon constant at `0x005df610`, and when the length is large enough scales the full vec4 by one reciprocal-square-root refinement before writing it to the caller output; smaller inputs collapse to zero through the same mask path.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation"
0x005843d6,179,math_normalize_vec3_with_optional_length_outparam_and_default_axis_fallback_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec3 normalization helper with two optional outparams. The function computes the squared XYZ length from the caller source block, optionally writes the normalized vec3 through one caller outparam, optionally writes a derived scalar magnitude through another, and when the input collapses below the epsilon threshold falls back to a fixed default-axis vector plus zero magnitude. This is the safest current read for the shared vec3 normalize-with-length helper without overclaiming the exact downstream semantic of the scalar outparam.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation"
0x00584489,1073,math_build_quaternion_from_3x3_rotation_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582eb0`. The helper inspects the same 3x3 rotation-matrix trace and dominant diagonal cases, chooses one of the expected reconstruction branches, and writes the resulting quaternion vec4 through the caller output before `femms`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + matrix-correlation"
0x005848ba,195,math_build_quaternion_from_three_euler_angles_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582fd0`. The helper halves the three caller Euler angles, routes those half angles through scalar trig worker `0x0058b660`, and combines the resulting sine and cosine values into one quaternion vec4 before storing it through the caller output. Current evidence is sufficient to carry the row as a shared Euler-angle-to-quaternion helper.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + trig correlation"
0x0058497f,106,math_build_quaternion_from_axis_vec3_and_angle_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow axis-angle-to-quaternion helper. The function first normalizes one caller axis vec3 through `0x005896d2`, halves the caller angle, routes that half-angle through trig worker `0x0058b660`, scales the normalized axis by the sine-like lane, and writes the resulting quaternion vec4 with the cosine-like scalar lane in `W`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + axis-angle correlation + trig correlation"
0x005849eb,309,math_interpolate_quaternion_slerp_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow quaternion slerp helper over two caller quaternion-like vec4 inputs and one scalar interpolation factor. The function measures the 4D dot product, takes the expected small-angle fast path, otherwise derives one angular term through `0x0058af80` and two sine-weight terms through `0x0058b780`, then writes the weighted combination through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + slerp correlation"
0x00584b22,139,math_blend_three_quaternion_controls_by_two_parameter_nested_slerp_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Two-parameter nested quaternion-slerp helper. The function first forms `u+v`, performs two intermediate slerps from one shared control quaternion to two neighboring controls through `0x005849eb`, derives relative blend weight `v/(u+v)`, and then slerps between those intermediates into the caller output. The safest current read is a barycentric or triangular nested-slerp helper rather than a tighter named spline family.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + nested-slerp correlation"
0x00584baf,144,math_blend_three_quaternion_controls_by_quadratic_nested_slerp_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Quadratic nested quaternion-slerp helper. The function first builds two intermediate slerps at the same parameter `t` through `0x005849eb`, derives the classic quadratic blend scalar `2*t*(1-t)`, and then slerps between those intermediates into the caller output. This is the safest current read for a three-control quaternion curve helper without overclaiming the exact higher-level spline family.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + nested-slerp correlation"
0x00584c41,98,math_invert_quaternion_by_conjugate_over_squared_length_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582e40`. The helper conjugates the caller quaternion by negating `XYZ` while preserving `W`, divides that conjugate by the squared quaternion length, and writes the resulting inverse quaternion through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation"
0x00584ca5,165,math_build_axis_angle_vec4_from_quaternion_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow quaternion-to-axis-angle extractor. The function reads the scalar `W` lane, derives one angular term through `0x0058b080` and `0x0058b780`, conditionally rescales the `XYZ` lanes by the reciprocal sine factor when that angle is not degenerate, and writes the resulting axis-angle-style vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + axis-angle correlation"
0x00584d4c,163,math_build_quaternion_from_scaled_axis_vec3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow scaled-axis-to-quaternion helper. The function measures the length of the caller vec3, routes that magnitude through trig worker `0x0058b660`, conditionally rescales the `XYZ` lanes by the reciprocal magnitude, and writes a quaternion-style vec4 whose `XYZ` lanes hold the scaled axis contribution and whose `W` lane receives the cosine-like scalar result. This is the safest current read for a shared scaled-axis-to-quaternion helper without overclaiming the exact upstream representation.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + axis-angle correlation + trig correlation"
0x00584df1,396,math_build_two_inner_quaternion_spline_controls_from_four_keys_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow quaternion spline-control builder over four caller key quaternions. The helper first aligns neighboring keys onto the same hemisphere by comparing sum-vs-difference norms, then around each interior key converts the two neighboring relative quaternions through the already-grounded inverse, axis-angle, and scaled-axis helpers, averages those tangent-like terms, exponentiates back into a quaternion, and multiplies by the interior key to write two inner control quaternions through the caller output buffer. The safest current read is a four-key inner-control builder for quaternion spline interpolation rather than a tighter spline-family label.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + spline-control correlation"
0x0058584a,559,math_multiply_4x4_matrices_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow 4x4 matrix-multiply owner. The helper first repacks one caller matrix from the split qword row layout used by the neighboring constructors into temporary contiguous rows on the stack, then multiplies a second caller 4x4 matrix by those repacked rows and writes the product through the caller output buffer. The safest current read is a non-alias-staging sibling of the later packed 4x4 multiply family rather than a subsystem-specific API.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + matrix-multiply correlation"
0x00585a7c,207,math_compute_determinant_of_upper_3x3_basis_from_split_4x4_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow scalar determinant helper over one split-layout 4x4 matrix. The function forms the expected 3x3 cofactor bands from the upper basis rows, completes the final cofactor expansion against the remaining basis row, accumulates the result to one scalar lane, and returns that determinant through `st0`. The safest current read is a determinant-of-basis helper rather than a tighter affine-class predicate.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + determinant correlation"
0x00585b4b,80,math_build_4x4_translation_matrix_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow row-major translation-matrix constructor. The helper seeds the three identity rows from `0x005df668` and `0x005df660`, writes the three caller translation scalars into the trailing homogeneous row, and returns the finished 4x4 matrix through the caller output buffer.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation"
0x00585b9b,235,math_build_4x4_projective_matrix_from_plane_vec4_and_vec4_input_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582aa0`. The helper normalizes the caller plane vec4 against the XYZ length of its first three lanes through `0x0058a988`, computes one diagonal dot term against the second vec4 input, combines that dot term with the expected negated outer-product bands, and writes the resulting 4x4 matrix to the caller output. The current formula is tight enough to bound this as the MMX plane-driven projective matrix helper without overclaiming one specific API variant.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + geometry correlation + projective-matrix correlation"
0x00585c86,220,math_build_4x4_reflection_matrix_from_plane_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow plane-reflection matrix helper. The function normalizes the caller plane vec4 through `0x0058a988`, forms the expected `1 - 2*n*n^T` diagonal terms plus the paired `-2*n_i*n_j` off-diagonal bands, and writes the resulting homogeneous 4x4 reflection-style matrix to the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + plane-reflection correlation"
0x00585d62,97,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. The function routes one caller angle through scalar trig worker `0x0058b660`, seeds the fixed identity rows from constants `0x005df668` and `0x005df660`, and writes one axial rotation-matrix variant to the caller output. Current evidence is sufficient to carry the row as a fixed-axis rotation-matrix constructor.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation"
0x00585dc5,94,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Sibling MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. Like `0x00585d62`, it routes one caller angle through `0x0058b660`, combines the resulting sine or cosine lanes with the same identity-row constants in a different layout, and writes one second axial rotation-matrix variant to the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation"
0x00585e23,87,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_c,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Third MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. The function routes one caller angle through `0x0058b660`, seeds the remaining fixed identity rows, and writes one third axial rotation-matrix variant to the caller output. The safest current read is a third fixed-axis rotation-matrix constructor rather than a tighter axis-specific label.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation"
0x00585e7c,67,math_build_4x4_scale_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow diagonal scale-matrix constructor. The helper writes the three caller scalar scale lanes onto the homogeneous 4x4 diagonal, clears the off-diagonal lanes, and seeds the trailing homogeneous `1.0f` row or column from `0x005df660`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + scale correlation"
0x00585ec3,110,math_transpose_or_repack_4x4_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Small MMX or 3DNow 4x4 matrix repack helper. It reads the caller matrix in one split qword layout, unpacks the low and high dword pairs across the four rows, and writes the reordered 4x4 matrix to the caller output. The safest current read is a transpose or row-column repack helper rather than a higher-level owner.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + repack correlation"
0x00585f32,57,math_build_identity_4x4_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly,2,"MMX or 3DNow identity-matrix constructor. The helper seeds the diagonal with `1.0f` from `0x005df590`, clears the off-diagonal lanes, and writes the resulting homogeneous 4x4 identity matrix to the caller output.","objdump + local disassembly + matrix correlation + identity correlation"
0x00585f6b,199,math_build_4x4_rotation_matrix_from_quaternion_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow quaternion-to-4x4 rotation-matrix helper. The function doubles the caller quaternion lanes, forms the expected pairwise product bands, combines them with the fixed `1 - 2*...` diagonal terms from `0x005df5a0`, and writes one 4x4 rotation-matrix layout to the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + matrix correlation"
0x0058603d,181,math_build_4x4_rotation_matrix_from_quaternion_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Sibling MMX or 3DNow quaternion-to-4x4 rotation-matrix helper. It uses the same doubled-lane and pairwise-product construction as `0x00585f6b`, but writes the resulting rotation terms in a second lane layout to the caller output. The safest current read is a second quaternion-to-matrix variant rather than a tighter row- or column-major claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + matrix correlation"
0x005860f2,1655,math_build_4x4_transform_from_optional_translation_base_rotation_pivoted_post_rotation_and_translation_delta_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow transform-matrix owner over one output matrix, one optional base rotation quaternion, one optional base translation vec3, one optional pivot vec3, one optional post-rotation quaternion, and one optional trailing translation delta vec3. The helper builds identity when no base translation is present, otherwise seeds a pure translation matrix or translation-plus-base-rotation matrix, then optionally applies a second quaternion rotation about the caller pivot by subtracting the pivot from the translation row, multiplying through the post-rotation matrix, and adding the pivot back, and finally adds one trailing translation delta when that last pointer is non-null. The safest current read is a shared affine-transform builder rather than a subsystem-specific pose API.","objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation + quaternion correlation + pivot-rotation correlation"
0x0058728a,421,math_build_4x4_rotation_matrix_from_three_angles_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection + constant inspection,2,"MMX or 3DNow three-angle 4x4 rotation-matrix builder. The helper halves the three caller angle scalars through the `0.5f` pair at `0x005df630`, routes those half-angles through trig worker `0x0058b660`, combines the resulting sine or cosine lanes through the same doubled-product and `1 - 2*...` bands used by the nearby quaternion-to-matrix helpers, and writes one 4x4 rotation-matrix layout to the caller output. The safest current read is a three-angle rotation constructor via half-angle trig rather than a tighter Euler-order claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + constant inspection + trig correlation + quaternion-formula correlation + matrix correlation"
0x0058742f,308,math_build_4x4_transform_from_uniform_scale_optional_pivoted_rotation_quaternion_and_translation_delta_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + constant inspection,2,"Broader MMX or 3DNow transform-matrix owner over one output matrix, one uniform scalar scale, one optional pivot vec3, one optional rotation quaternion, and one optional trailing translation delta vec3. The helper first seeds a diagonal scale matrix from the caller scalar plus the fixed homogeneous `1.0f` lane at `0x005df580`, then optionally applies one quaternion rotation about the caller pivot by subtracting the pivot from the translation row, multiplying through the rotation matrix, and adding the pivot back, and finally adds one trailing translation delta when that last pointer is non-null.","objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + constant inspection + matrix correlation + scale correlation + quaternion correlation + pivot-rotation correlation"
0x00587963,281,math_build_4x4_rotation_matrix_from_axis_vec3_and_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow axis-angle 4x4 rotation-matrix helper. The function first normalizes one caller axis vec3 through `0x005896d2`, routes the caller angle through trig worker `0x0058b660`, forms the expected Rodrigues-style `axis*axis*(1-c)`, `axis*s`, and diagonal `c + axis*axis*(1-c)` bands, and writes the resulting 4x4 rotation matrix through the caller output buffer.","objdump + local disassembly + caller-shape inspection + MMX-3DNow arithmetic inspection + axis-angle correlation + trig correlation + matrix correlation"
0x00587a7c,4436,math_build_4x4_transform_from_optional_translation_two_optional_pivoted_rotation_quaternions_and_translation_delta_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow transform-matrix owner over one output matrix, one optional first pivot vec3, one optional first rotation quaternion, one optional base translation vec3, one optional second pivot vec3, one optional second rotation quaternion, and one optional trailing translation delta vec3. The helper builds identity when the base translation is absent, otherwise seeds a pure translation matrix or translation-plus-first-rotation matrix, optionally applies that first rotation about the first caller pivot, then optionally applies a second quaternion rotation about the second caller pivot, and finally adds one trailing translation delta when that last pointer is non-null. The safest current read is a broader shared affine-transform builder with up to two pivoted quaternion stages rather than a subsystem-specific pose API.","objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation + quaternion correlation + pivot-rotation correlation"
0x00588eb2,1013,math_multiply_4x4_matrices_with_alias_safe_rhs_staging_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow 4x4 matrix-multiply owner. The helper first repacks one caller source matrix into a temporary contiguous row layout, multiplies those four rows by the second caller 4x4 matrix, and writes the product through the caller output buffer. When the destination aliases the right-hand input matrix it stages the product in temporary storage and copies it back afterward, so the safest current read is an alias-safe packed 4x4 multiply helper rather than a narrower subsystem API.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + matrix-multiply correlation + alias-staging correlation"
0x00588bd0,738,math_invert_4x4_matrix_variant_b_and_optionally_write_determinant_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Alternate MMX or 3DNow 4x4 matrix inverse helper. Like `0x005892aa`, the function expands the caller matrix into cofactor-like bands, optionally writes one determinant scalar through a caller out-parameter when that pointer is non-null, returns early when that determinant collapses to zero, and otherwise writes the reciprocal-determinant-scaled inverse matrix through the caller output buffer. The safest current read is a second inverse helper variant rather than a tighter matrix-class claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + inverse correlation + determinant correlation"
0x005892aa,820,math_invert_4x4_matrix_and_optionally_write_determinant_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow 4x4 matrix inverse helper. The function expands the caller matrix into the expected cofactor bands, accumulates the determinant into one optional caller scalar out-parameter when that pointer is non-null, returns early when that determinant collapses to zero, and otherwise writes the adjugate scaled by the reciprocal determinant through the caller output buffer.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + inverse correlation + determinant correlation"
0x005895de,28,math_invert_4x4_matrix_and_optionally_write_determinant_mmx_3dnow_wrapper,support,cdecl,inferred,objdump + local disassembly,2,"Tiny FEMMS wrapper around `0x005892aa`. It forwards the three caller parameters unchanged to the broader MMX 4x4 inverse helper and then returns the caller output pointer.","objdump + local disassembly + wrapper correlation"
0x005895fa,112,math_apply_3d_basis_rows_and_translation_to_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581830`. The helper broadcasts the caller XYZ triple, multiplies those broadcasts by the first three rows of one caller 4x4 basis block, adds the translation row at `[basis+0x30]` and `[basis+0x38]`, and stores the resulting full vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation"
0x0058966b,103,math_apply_3d_basis_rows_to_vec3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581770`. The helper broadcasts the caller XYZ triple, multiplies those broadcasts by the first three rows of one caller basis block, sums the three product bands, and stores the resulting XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
0x005896d2,95,math_normalize_vec3_or_zero_below_epsilon_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec3 normalization sibling to `0x00581c00`. The function computes squared length from the caller XYZ triple, compares it against the nearby epsilon constant at `0x005df610`, returns a zero vector when the length is too small, and otherwise applies one reciprocal-square-root refinement before writing the normalized XYZ result.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation"
0x00589731,113,math_blend_vec3_by_two_affine_scalars_from_three_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582710`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec3 control points and two caller scalar weights, then writes the blended XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + affine-blend correlation"
0x005897a2,213,math_sample_cubic_basis_vec3_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582320`. The helper derives four cubic-basis weights from the caller scalar parameter through the same local constant strip, applies those weights to four caller vec3 control points, and writes the blended XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + cubic-basis correlation"
0x00589876,234,math_sample_alternate_cubic_basis_vec3_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582520`. The helper derives the alternate cubic-basis weight family from the caller scalar parameter through the nearby MMX constant strip, applies those weights to four caller vec3 control points, and writes the blended XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + alternate-basis correlation"
0x00589960,140,math_apply_3d_basis_rows_translation_and_project_vec3_by_reciprocal_lane3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005818f0`. The helper builds the same translated four-lane transform result from one caller XYZ triple and one 4x4 basis block, derives a reciprocal from lane `3`, scales the transformed vector by that reciprocal, and stores the resulting XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + projective correlation"
0x005899eb,456,math_apply_4d_basis_rows_to_four_vec4_rows_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581ab0`. The helper applies one caller 4x4 basis block to each of four caller vec4 rows from a source block and writes the four transformed vec4 rows back to the caller output block at offsets `+0x00`, `+0x10`, `+0x20`, and `+0x30`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
0x00589bb2,5,math_apply_3d_basis_rows_translation_and_project_vec3_by_reciprocal_lane3_mmx_3dnow_thunk,support,cdecl,inferred,objdump + local disassembly,2,"Jump thunk into `0x00589960`, the MMX or 3DNow projective vec3 transform helper.","objdump + local disassembly + wrapper correlation"
0x00589bb7,392,math_apply_vec3_through_optional_4x4_chain_and_optional_viewport_map_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection,2,"Broader MMX or 3DNow projective transform owner over one caller vec3, up to three optional 4x4 matrix inputs, and one optional integer viewport-style range block. The helper selects identity, one matrix, or the ordered composition of two or three matrices through `0x005899eb`, applies the resulting chain through `0x00589960`, and when the optional range block is present remaps the projected normalized result into that caller integer range before returning.","objdump + local disassembly + matrix correlation + projective correlation + viewport-range correlation"
0x00589d3f,518,math_apply_vec3_through_optional_inverse_4x4_chain_and_optional_inverse_viewport_map_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection,2,"Inverse-side sibling to `0x00589bb7`. The helper selects identity or the ordered composition of up to three optional 4x4 matrices through `0x005899eb`, inverts the chosen chain through `0x005892aa`, optionally maps one caller integer viewport-style coordinate triple back into the normalized projective range, and then applies the inverse chain through `0x00589960`. The safest current read is an MMX unproject or inverse-projective helper without overclaiming one subsystem-specific API.","objdump + local disassembly + matrix correlation + inverse correlation + projective correlation + viewport-range correlation"
0x00589f67,303,math_apply_vec3_through_optional_inverse_4x4_chain_variant_b_and_optional_inverse_viewport_map_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection,2,"Adjacent inverse-side sibling to `0x00589d3f`. The helper selects identity or the ordered composition of up to three optional 4x4 matrices through `0x005899eb`, routes the chosen chain through inverse helper variant `0x00588bd0`, optionally maps one caller integer viewport-style coordinate triple back into the normalized projective range, and then applies the resulting inverse chain through `0x00589960`. The safest current read is a second MMX unproject or inverse-projective helper variant rather than a tighter API claim.","objdump + local disassembly + matrix correlation + inverse correlation + projective correlation + viewport-range correlation"
0x0058a0b8,79,math_apply_2d_basis_rows_and_translation_to_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581690`. The helper broadcasts the caller XY pair, multiplies those broadcasts by the first two rows of one caller 4x4 basis block, adds the translation row at `[basis+0x30]` and `[basis+0x38]`, and stores the resulting full vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation"
0x0058a10d,55,math_apply_2d_basis_rows_to_vec2_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581730`. The helper broadcasts the caller XY pair, multiplies those broadcasts by the first two rows of one caller basis block, sums the two product bands, and stores the resulting vec2 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
0x0058a146,100,math_apply_2d_basis_rows_translation_and_project_vec2_by_reciprocal_lane3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005816d0`. The helper builds the same translated four-lane transform result from one caller XY pair and one 4x4 basis block, derives a reciprocal from lane `3`, scales the transformed vector by that reciprocal, and stores the resulting vec2 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + projective correlation"
0x0058a1aa,153,math_sample_cubic_basis_vec2_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec2 sibling to `0x005823e0`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies those weights to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + cubic-basis correlation"
0x0058a242,71,math_blend_vec2_by_two_affine_scalars_from_three_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec2 sibling to `0x005827c0`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec2 control points and two caller scalar weights, then writes the blended vec2 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + affine-blend correlation"
0x0058a28b,65,math_normalize_vec2_or_zero_below_epsilon_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec2 normalization sibling to `0x00582320`'s lower-dimensional normalize helpers. The function computes squared length from the caller XY pair, compares it against the nearby epsilon constant at `0x005df610`, returns a zero vec2 when the length is too small, and otherwise applies one reciprocal-square-root refinement before writing the normalized XY result.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation"
0x0058a2ce,172,math_sample_alternate_cubic_basis_vec2_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582680`. The helper derives the alternate cubic-basis weight family from the caller scalar parameter through the nearby MMX constant strip, applies those weights to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + alternate-basis correlation"
0x0058a379,130,math_apply_4d_basis_rows_to_vec4_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow duplicate-layout sibling to `0x0058a9ec`. The helper broadcasts the caller XYZW lanes, multiplies those broadcasts by the four rows of one caller 4x4 basis block, sums the four product bands, and writes the resulting vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
0x0058a3fb,95,math_normalize_vec4_or_zero_below_epsilon_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow four-lane normalization sibling to `0x00584379`. The function computes squared length across all four caller lanes, compares that magnitude against the nearby epsilon constant at `0x005df610`, returns a zero vec4 when the length is too small, and otherwise applies one reciprocal-square-root refinement before writing the normalized vec4 result.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation"
0x0058a45a,306,math_compute_4d_cross_product_from_three_vec4_inputs_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005821d0`. The helper takes three caller vec4 inputs, forms the same alternating-sign generalized 4D cross-product-style combination through paired multiply-subtract bands, and writes the resulting vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + 4d-cross-product correlation + caller correlation"
0x0058a58c,113,math_blend_vec4_by_two_affine_scalars_from_three_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 sibling to the earlier affine blend strip. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec4 control points and two caller scalar weights, then writes the blended vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + affine-blend correlation"
0x0058a5fd,200,math_sample_cubic_basis_vec4_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 sibling to `0x00582470`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies those weights to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + cubic-basis correlation"
0x0058a6c5,223,math_sample_alternate_cubic_basis_vec4_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 sibling to `0x005825e0`. The helper derives the alternate cubic-basis weight family from the caller scalar parameter through the nearby MMX constant strip, applies those weights to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + alternate-basis correlation"
0x0058a7a3,65,math_build_plane_vec4_from_normal_vec3_and_point_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow plane builder over one caller normal vec3 and one point on that plane. The helper copies the incoming normal into the output `XYZ` lanes, computes the signed plane constant as the negated dot product of that normal with the caller point, and writes the resulting plane vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + geometry correlation + plane-correlation"
0x0058a7e6,229,math_build_plane_vec4_from_three_vec3_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005829b0`. The helper forms two edge vectors from three caller vec3 points, computes their cross-product-style normal, normalizes that resulting plane normal, derives the signed plane constant from one source point, and writes the resulting plane vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + geometry correlation + plane-correlation"
0x0058a8ca,190,math_intersect_origin_plane_normal_vec3_with_vec3_segment_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow geometric intersection helper over one plane-normal vec3 and two caller segment endpoints. The function derives the numerator and denominator for the plane-through-origin affine parameter, returns null when the denominator collapses to zero, and otherwise writes the intersection point `p0 + t*(p1-p0)` through the caller output. This is the safest current read for the MMX origin-plane-versus-segment sibling rather than a subsystem-specific query.","objdump + local disassembly + MMX-3DNow arithmetic inspection + geometry correlation + segment-intersection correlation"
0x0058a988,98,math_normalize_vec4_by_xyz_length_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow normalization helper over one caller vec4-like input. The function measures length from the first three lanes only, compares that squared XYZ length against the nearby epsilon constant at `0x005df610`, and when large enough scales the full four-lane payload by one reciprocal-square-root refinement before writing it through the caller output; smaller inputs collapse to zero through the same mask path. Current grounded callers are the broader matrix builders `0x00585b9b` and `0x00585c86`, so this is the safest current read for the shared normalize-by-XYZ-length helper rather than a full XYZW normalizer.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation"
0x0058a9ec,124,math_apply_4d_basis_rows_to_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005819f0`. The helper broadcasts each input XYZW lane, multiplies those broadcasts by the corresponding four rows of one caller 4x4 basis block, sums the four product bands, and stores the resulting vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
0x0058ac60,229,math_compute_interleaved_packed_sine_cosine_lanes_from_angles,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared packed trig helper over one caller vec4 of angles. The function performs sign extraction, range reduction, quadrant selection, and polynomial evaluation through the constant tables at `0x00628320..0x006283f0`, then returns one interleaved sine/cosine-style lane tuple in `xmm0`. Current grounded callers are the single-angle packed axial rotation-matrix builders `0x00583bb0` and `0x00583c30`, so the safest current read is an interleaved packed sine/cosine helper rather than a generic scalar polynomial.","objdump + local disassembly + polynomial-approximation inspection + trig correlation"
0x0058ad50,329,math_compute_packed_sine_and_cosine_vectors_from_angles,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared packed trig helper over one caller vec4 of angles and two caller output buffers. The function performs sign extraction, range reduction, quadrant selection, and dual polynomial evaluation through the constant tables at `0x00628400..0x00628520`, then writes one packed pair of sine/cosine result vectors through the two caller outputs. Current grounded caller is `0x00584210`, the packed Euler-angle-to-quaternion helper, so the safest current read is a packed sin/cos vector generator rather than a subsystem-specific math body.","objdump + local disassembly + polynomial-approximation inspection + trig correlation"
0x0058af80,244,math_compute_scalar_atan2_style_angle_from_y_and_x_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar angle helper over two caller float lanes. The function compares magnitudes, forms one min-over-max style ratio, evaluates a polynomial over that ratio, and then restores quadrant and sign through the constant strip at `0x006285d8..0x00628638`. Current grounded caller is quaternion slerp helper `0x005849eb`, so the safest current read is a scalar `atan2`-style angle worker rather than a narrower subsystem label.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation"
0x0058b080,247,math_compute_scalar_arccos_style_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar inverse-cosine-style helper over one caller float lane. The function clamps or folds the incoming magnitude against the nearby constant strip at `0x006285d8..0x00628638`, evaluates a reciprocal-square-root-assisted polynomial, and restores the correct signed or reflected branch before returning one angle-like scalar in `mm0`. Current grounded caller is quaternion-to-axis-angle helper `0x00584ca5`, so the safest current read is a scalar arccos-style angle worker rather than a tighter half-angle claim.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation"
0x0058b180,226,math_compute_scalar_arccos_style_angle_variant_b_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Adjacent MMX or 3DNow scalar inverse-cosine-style helper over one caller float lane. The body shares the same reciprocal-square-root-assisted polynomial strip as `0x0058b080`, but finishes through a different reflected or complemented angle reconstruction path before returning one scalar in `mm0`. The safest current read is a second arccos-style angle variant rather than a tighter named inverse-trig identity.","objdump + local disassembly + polynomial-approximation inspection + trig correlation"
0x0058b280,233,math_compute_scalar_natural_logarithm_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar logarithm helper over one caller float lane. The function decomposes the input into exponent and mantissa bands, evaluates a polynomial over the reduced mantissa through the constant strip at `0x00628648..0x0062866c`, folds back the exponent contribution, and returns one natural-log-style scalar in `mm0`. The nearby wrapper `0x0058b380` scales this result by `0.434294...`, which is the strongest current evidence for the natural-log interpretation.","objdump + local disassembly + polynomial-approximation inspection + logarithm correlation"
0x0058b380,17,math_compute_scalar_base10_logarithm_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Tiny wrapper over `0x0058b280`. The helper calls the natural-log worker and then scales the result by the float constant at `0x0062868c`, `0.434294...`, before returning; the safest current read is a shared base-10 logarithm helper.","objdump + local disassembly + constant inspection + logarithm correlation"
0x0058b3a0,224,math_compute_scalar_exponential_e_to_x_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection + constant inspection,2,"Shared MMX or 3DNow scalar exponential helper over one caller float lane. The function range-reduces the input through the nearby `log2(e)` and split-`ln(2)` constants at `0x0062863c..0x0062864c`, evaluates the reduced polynomial strip, reconstructs the exponent field by shifting the derived integer part into float-exponent position, and returns one `e^x`-style scalar in `mm0` with the expected overflow and underflow clamps. The safest current read is a scalar natural-exponential worker rather than a subsystem-specific transform helper.","objdump + local disassembly + polynomial-approximation inspection + constant inspection + exponential correlation"
0x0058b480,24,math_compute_scalar_square_root_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Tiny MMX or 3DNow square-root helper over one caller scalar lane. The body seeds one reciprocal-square-root estimate through `pfrsqrt`, refines it with `pfrsqit1` and `pfrcpit2`, multiplies that reciprocal-square-root by the original input, and returns the resulting square-root-style scalar in `mm0`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + square-root correlation"
0x0058b4a0,8,math_clear_scalar_float_sign_bit_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly,2,"Tiny MMX or 3DNow scalar absolute-value helper. The function clears the sign bit of the caller float lane with the mask at `0x00628578` and returns the resulting non-negative scalar in `mm0`.","objdump + local disassembly + constant inspection + absolute-value correlation"
0x0058b4c0,50,math_round_scalar_upward_to_integral_float_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Tiny MMX or 3DNow scalar rounding helper over one caller float lane. The body truncates the input toward zero through `pf2id` and `pi2fd`, detects whether a positive fractional remainder is still present, and adds one low-lane unit from the mixed constant pair at `0x00628558` before returning. The safest current read is a scalar `ceil`-style helper rather than a stricter IEEE-mode claim.","objdump + local disassembly + constant inspection + rounding correlation"
0x0058b500,37,math_round_scalar_downward_to_integral_float_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Tiny MMX or 3DNow scalar rounding helper over one caller float lane. The body truncates the input toward zero through `pf2id` and `pi2fd`, detects whether a negative fractional remainder is still present, and subtracts one low-lane unit from the mixed constant pair at `0x00628558` before returning. The safest current read is a scalar `floor`-style helper rather than a stricter IEEE-mode claim.","objdump + local disassembly + constant inspection + rounding correlation"
0x0058b540,64,math_split_scalar_float_into_normalized_mantissa_and_exponent_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Shared MMX or 3DNow scalar decomposition helper over one caller float lane. The function masks off sign and exponent bits, rebuilds a normalized mantissa lane with fixed exponent bits through the constants at `0x00628540..0x00628588`, derives the unbiased exponent as an integer-float lane, and returns the pair packed in `mm0`. The safest current read is a `frexp`-style mantissa or exponent splitter rather than a tighter ABI claim.","objdump + local disassembly + constant inspection + exponent-mantissa correlation"
0x0058b580,94,math_scale_scalar_float_by_integral_power_of_two_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Shared MMX or 3DNow scalar scaling helper over one caller float lane and one caller integer-like exponent lane. The function extracts the current exponent field, adds the requested exponent delta, reconstructs the float when the result stays in range, and otherwise returns the expected underflow or signed-overflow infinities through the mask strip at `0x00628568..0x00628580`. The safest current read is an `ldexp`-style scalar multiply-by-`2^n` helper.","objdump + local disassembly + constant inspection + exponent-mantissa correlation + scaling correlation"
0x0058b5de,18,math_split_scalar_float_into_fractional_and_integral_float_lanes_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly,2,"Tiny MMX or 3DNow scalar split helper over one caller float lane. The body truncates the input to integer with `pf2id` or `pi2fd`, subtracts that integral part from the original value, and returns the fractional and integral float lanes packed together in `mm0`. The safest current read is a compact `modf`-style split helper rather than a dedicated subsystem formatter.","objdump + local disassembly + split correlation"
0x0058b600,72,math_compute_scalar_fmod_style_remainder_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + arithmetic inspection,2,"Shared MMX or 3DNow scalar remainder helper over one caller dividend lane and one caller divisor lane. When the divisor is non-zero it multiplies the dividend by the reciprocal divisor, truncates that quotient toward zero, keeps only the fractional remainder, rescales by the divisor, and returns the resulting same-sign remainder in `mm0`; a zero divisor falls back to the constant at `0x00628578`. The safest current read is an `fmod`-style remainder helper rather than a tighter IEEE remainder claim.","objdump + local disassembly + arithmetic inspection + remainder correlation"
0x0058b660,280,math_compute_scalar_cosine_and_sine_pair_from_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar trig helper over one caller angle. The function performs sign extraction, range reduction, quadrant handling, and polynomial evaluation through the constant strip at `0x00628558..0x00628694`, then returns one packed cosine/sine-style lane pair in `mm0`. Current grounded callers are the MMX Euler-angle, axis-angle, scaled-axis, and single-angle rotation-matrix helpers, so the safest current read is a scalar cos/sin pair worker rather than a subsystem-specific helper.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation"
0x0058b780,280,math_compute_scalar_sine_lane_from_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar trig helper over one caller angle. The body matches `0x0058b660` through the same range-reduction and polynomial path, but duplicates the sine-like result lane before returning. Current grounded callers are quaternion slerp helper `0x005849eb` and quaternion-to-axis-angle helper `0x00584ca5`, so the safest current read is a scalar sine worker with duplicated output lane.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation"
0x0058b9e0,408,math_compute_scalar_power_x_to_y_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection + constant inspection,2,"Broader MMX or 3DNow scalar power helper over one caller base lane and one caller exponent lane. The function preserves the sign of negative bases only when the exponent truncates to an integer with odd parity, derives the logarithm-like core from the absolute base through the same exponent or mantissa constants used by the adjacent scalar log worker, multiplies that core by the exponent, and then rebuilds the final result through the same exponential-style polynomial and exponent-field reconstruction family used by `0x0058b3a0`. The safest current read is a shared `pow(x, y)`-style helper rather than a narrower transform-specific claim.","objdump + local disassembly + polynomial-approximation inspection + constant inspection + power correlation"
0x005700e2,36,surface_format_descriptor_lookup_by_tag_or_return_default,support,cdecl,inferred,objdump + local disassembly + table correlation,2,"Small table lookup helper over the `0x24`-byte surface-format descriptor array rooted at `0x005de500`. The function scans the active table range `[0x005de528, 0x00625e54)` for one entry whose leading tag dword matches the caller value and returns that entry when found; otherwise it falls back to the default descriptor at `0x005de500`. Current grounded callers are the broader format-selection owners `0x0057033f` and `0x0057017b`, so this is the safest current read for descriptor lookup by tag rather than a codec-specific branch.","objdump + local disassembly + table correlation + surface-format correlation"
0x00570106,117,surface_format_descriptor_score_conversion_cost_against_reference,support,fastcall,inferred,objdump + local disassembly + table correlation,2,"Register-only scoring helper over two `0x24`-byte surface-format descriptors. The function first rejects unsupported descriptor-pair classes through the compatibility table rooted at `0x005deb38`, then walks the five dword lanes `[+0x0c..+0x1c]`, accumulating one asymmetric cost word that penalizes missing dimensions with fixed `0x100/0x01000000` bumps and otherwise folds absolute differences into the low and high halves. When the final high-byte count does not match the number of comparable lanes, it returns `-1`; otherwise it returns the accumulated conversion score. Current grounded caller is the broader selector `0x0057017b`, so this is the safest current read for scoring one candidate descriptor against a reference rather than a generic comparator.","objdump + local disassembly + table correlation + surface-format correlation + scoring correlation"
0x0057017b,226,surface_format_descriptor_select_best_match_for_target_and_tag,support,cdecl,inferred,objdump + local disassembly + caller inspection + table correlation,2,"Best-match selector over the active surface-format descriptor table `[0x005de500, 0x00625e54)`. The helper can query one optional target interface through vtable slots `+0x18`, `+0x1c`, and `+0x20`, then iterates each live descriptor entry, optionally probes target acceptance through slot `+0x28`, honors one exact requested tag when present, and otherwise scores compatible candidates through `0x00570106`, preferring the lowest score and then the smaller secondary rank dword `[entry+0x08]`. It returns the selected descriptor's leading tag dword. Current grounded caller is the broader validation owner `0x0057033f`, so this is the safest current read for selecting the best supported descriptor for one target and requested tag rather than a narrower DXT-only path.","objdump + local disassembly + caller inspection + table correlation + surface-format correlation + target-capability correlation"
0x0057033f,810,surface_format_validate_or_select_descriptor_and_clamp_dims_levels,support,fastcall,inferred,objdump + local disassembly + caller inspection + format-correlation,2,"Broader surface-format validation and selection owner beneath the shared codec path. After validating caller mode and flag bits, the function resolves one requested format descriptor through `0x005700e2` and `0x0057017b` unless mode `3` forces fallback tag `0x15`, normalizes missing width, height, depth, and level counts, queries optional target limits through vtable slot `+0x1c`, clamps those dimensions against the selected descriptor's bands, rounds block-compressed `DXT1..DXT5` widths and heights up to multiples of four, conditionally forces power-of-two sizes when the descriptor and capability flags require it, and then writes the validated width, height, depth, level count, and chosen tag back through the caller out-pointers. Current grounded callers are the mode-`3` wrapper `0x00570669` and the broader target-dispatch owner `0x00570691`, so this is the safest current read for validating or selecting one surface-format descriptor and clamping dimensions or levels rather than a codec-specific decoder.","objdump + local disassembly + caller inspection + surface-format correlation + DXT-correlation + target-capability correlation"
0x00570669,40,surface_format_validate_or_select_descriptor_and_clamp_dims_levels_mode3,support,stdcall,inferred,objdump + local disassembly + wrapper correlation,2,"Small mode-forcing wrapper over `0x0057033f`. The helper forwards the caller's target, dimension, level, and tag pointers while forcing mode `3` and a null reference-tag pointer before tailing into the broader validation owner. Current grounded caller is `0x00570691`, which uses it before dispatching target slot `+0x50`, so this is the safest current read for the mode-`3` validation wrapper rather than a separate selector family.","objdump + local disassembly + wrapper correlation + surface-format correlation"
0x00570691,102,surface_target_validate_mode3_descriptor_and_dispatch_slot_0x50,support,stdcall,inferred,objdump + local disassembly + caller inspection + target-dispatch correlation,2,"Broader target-dispatch owner immediately above the shared mode-`3` format validator. The function rejects null target and null destination pointers, normalizes selector `-1` to `0`, derives validated width, height, depth, level count, and format tag through `0x00570669`, and then dispatches those validated parameters into the caller target through vtable slot `+0x50`. Current grounded callers are the DXT-side materializer `0x005423d0` and the target-service setup branch `0x00580aff`, so this is the safest current read for validating a mode-`3` surface descriptor and dispatching the target create-or-import slot rather than a narrower one-off wrapper.","objdump + local disassembly + caller inspection + target-dispatch correlation + surface-format correlation"
0x005706f7,422,surface_target_try_fast_transfer_or_fallback_decode_materialization,support,stdcall,inferred,objdump + local disassembly + caller inspection + target-dispatch correlation,2,"Follow-on target materialization owner in the same surface-format family. The helper first tries a fast path when the caller-supplied source and destination descriptor bands match, the rect spans agree, and the low format selector is not the excluded special case `5`; in that case it queries one subordinate target object through vtable slot `+0x0c`, temporarily toggles the optional Direct3D `DebugSetMute` callback strip through `0x00571570`, dispatches the transfer through that subordinate object's slot `+0x70`, and releases the temporary reference. When those preconditions fail, it builds one temporary target through `0x00574f53` and falls back to the broader decode or materialization owner `0x0057025d` with the caller rectangles and descriptor band. Current grounded caller is the DXT-side row materializer `0x005423d0`, so this is the safest current read for trying the fast transfer path and otherwise falling back to decode materialization rather than a narrower blit-only label.","objdump + local disassembly + caller inspection + target-dispatch correlation + decode-materialization correlation + fast-path correlation"
0x0057025d,221,surface_decode_payload_through_temp_view_and_fill_materialization_descriptor,support,stdcall,inferred,objdump + local disassembly + caller inspection + target-dispatch correlation,2,"Broader decode or materialization owner beneath `0x005706f7`. The helper rejects null output and source targets, materializes one temporary source-view context through `0x00574f53`, snapshots caller width, height, level, and descriptor-band inputs into one local transfer block, and then dispatches the real decode chain through `0x00574dbb`. On success it fills one caller output descriptor with the chosen decoder-side handles, selected format tag, normalized source and destination rect bands, and the caller's level or selector fields. Current grounded callers are the DXT-side row materializer `0x005423d0` and the fallback branch of `0x005706f7`, so this is the safest current read for decoding one payload through a temporary source view and filling an intermediate materialization descriptor rather than a narrower DXT-only label.","objdump + local disassembly + caller inspection + target-dispatch correlation + decode-materialization correlation + temporary-view correlation"
0x00571600,10,surface_decode_pair_zero_init,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny zero-init helper for the local two-handle decode pair used by `0x0057025d`. The function clears both pointer fields and returns.","objdump + local disassembly + decode-pair correlation"
0x0057160a,30,surface_decode_pair_release_optional_refs,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side sibling to `0x00571600`. The helper releases the optional pair members when present and clears the local two-handle decode pair before returning. Current grounded caller is `0x0057025d`.","objdump + local disassembly + decode-pair correlation + release correlation"
0x00571570,144,surface_runtime_call_optional_d3d8_debug_set_mute_pair,support,stdcall,inferred,objdump + import-table + local disassembly + string-table correlation,2,"Small shared runtime helper used around several surface-target operations. On first use, the function resolves `DebugSetMute` from both `d3d8.dll` and `d3d8d.dll`, caches the resulting callbacks, and then forwards the caller's on or off flag through whichever callbacks are present. Current grounded callers are `0x005706f7` and `0x00574f53`, which use it around temporary view and transfer-side Direct3D work.","objdump + import-table + local disassembly + string-table correlation + D3D8-correlation"
0x0057163e,699,surface_resample_build_weighted_axis_map_table,support,cdecl,inferred,objdump + local disassembly + caller inspection + decode-branch correlation,2,"Shared weighted-axis helper used by the broader resample branches `0x00571947`, `0x00573f02`, `0x005742e8`, and `0x00574a19`. The function takes source and destination span counts plus one mode or edge flag, allocates one variable-length table rooted at a leading count dword, and then emits a sequence of `(source_index, weight)` pairs grouped into per-destination spans. The builder clamps the edge behavior for the no-flag case, quantizes weights through the local x87 rounding helper, and returns the finished table for later refcounted row or slice accumulation. This is the safest current read for building one weighted axis-map table rather than overclaiming one exact filter kernel.","objdump + local disassembly + caller inspection + decode-branch correlation + axis-map correlation + weighted-resample correlation"
0x005718fb,76,surface_resample_release_axis_map_table_with_flags,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection + decode-branch correlation,2,"Release-side sibling for the weighted axis-map tables built by `0x0057163e`. With flag bit `0x02` set, the helper walks the embedded `(count, pairs...)` array through the destructor callback `0x00571635`; with flag bit `0x01` set, it also releases the outer allocation block. Current grounded callers are the broader resample branches `0x00571947`, `0x00574a19`, and `0x005742e8`, where those branches pass flag `3` for full teardown of temporary axis-map tables.","objdump + local disassembly + caller inspection + decode-branch correlation + axis-map correlation + release correlation"
0x00571dbb,397,surface_decode_try_direct_dxt_block_copy,support,thiscall,inferred,objdump + local disassembly + caller inspection + decode-branch correlation,2,"Narrow direct-transfer sibling reached from `0x00572f1e` when the source has no auxiliary descriptor payload. The helper validates that both linked handles expose block-aligned `DXT1..DXT5` tags, derives the bytes-per-block (`8` for `DXT1`, `0x10` for `DXT2..DXT5`), computes the source and destination block offsets from the live row, slice, and pitch bands, and then copies every compressed block row and slice directly from source to destination. This is the safest current read for the direct compressed-block copy branch rather than a generic raw blit.","objdump + local disassembly + caller inspection + decode-branch correlation + DXT-correlation + direct-copy correlation"
0x00571f49,294,surface_downsample_2x2_rgba32_blocks_scalar,support,cdecl,inferred,objdump + local disassembly + arithmetic inspection + caller correlation,2,"Scalar packed-pixel reducer used by the mode-`5` specialized half-resolution family. The helper walks one source rectangle in `2x2` quads, averages four packed 32-bit pixels with the usual mask-and-quarter trick over the `0xff00ff` and `0x3fc03fc0` channel groups, and writes one destination pixel per source quad. Current callers are the CPU-selected downsample wrappers under `0x005722a1` and `0x005722d6`, so this is the safest current read for a scalar `2x2` RGBA32-style box reduction rather than overclaiming one exact channel order.","objdump + local disassembly + arithmetic inspection + half-resolution correlation + packed-pixel correlation + caller correlation"
0x005720a0,232,surface_downsample_2x2_packed32_blocks_scalar_alt_channel_layout,support,cdecl,inferred,objdump + local disassembly + arithmetic inspection + caller correlation,2,"Alternate scalar packed-pixel reducer paired with `0x00571f49` in the same mode-`5` half-resolution family. The helper again walks source pixels in `2x2` quads and averages four packed 32-bit inputs into one destination pixel, but it uses a different mask split rooted at `0xff00ff` and `0x0000ff00`, matching the second CPU-selected reducer slot `0x006263cc`. Current callers are the wrapper `0x00572305` and the dispatch initializer `0x005722d6`.","objdump + local disassembly + arithmetic inspection + half-resolution correlation + packed-pixel correlation + caller correlation"
0x005722a1,48,surface_downsample_init_dispatch_and_call_primary_packed32_reducer,support,cdecl,inferred,objdump + local disassembly + caller inspection + dispatch-correlation,2,"One-time dispatch initializer for the first mode-`5` packed-32 reducer slot at `0x006263c8`. The helper probes the local CPU-feature gate `0x00571269`, seeds both reducer pointers `0x006263c8` and `0x006263cc` to the MMX-capable wrapper `0x00572188` when supported, otherwise seeds `0x006263c8` to scalar reducer `0x00571f49` and `0x006263cc` to alternate scalar reducer `0x005720a0`, then tail-calls the primary reducer slot. Current grounded caller is `0x0057206f`.","objdump + local disassembly + caller inspection + dispatch-correlation + cpu-feature correlation"
0x005722d6,48,surface_downsample_init_dispatch_and_call_secondary_packed32_reducer,support,cdecl,inferred,objdump + local disassembly + caller inspection + dispatch-correlation,2,"Twin dispatch initializer to `0x005722a1` for the secondary packed-32 reducer slot at `0x006263cc`. The helper applies the same CPU-feature selection over `0x00572188`, `0x00571f49`, and `0x005720a0`, then tail-calls the secondary reducer slot. Current grounded caller is `0x00572305`.","objdump + local disassembly + caller inspection + dispatch-correlation + cpu-feature correlation"
0x0057206f,49,surface_decode_try_mode5_dispatch_primary_packed32_half_resolution_reducer,support,thiscall,inferred,objdump + local disassembly + caller inspection + decode-branch correlation,2,"Format-specific front door under the subtype-dispatch arm of `0x0057354d`. The helper forwards source and destination base pointers plus live width, height, and row-pitch bands into the CPU-selected primary packed-32 `2x2` reducer slot at `0x006263c8`. When the dispatch table is still cold, the target slot first resolves through `0x005722a1`. This is the safest current read for the primary packed-32 half-resolution reducer wrapper rather than naming one exact file format.","objdump + local disassembly + caller inspection + decode-branch correlation + half-resolution correlation + dispatch-correlation"
0x00572305,49,surface_decode_try_mode5_dispatch_secondary_packed32_half_resolution_reducer,support,thiscall,inferred,objdump + local disassembly + caller inspection + decode-branch correlation,2,"Sibling front door to `0x0057206f` under the same subtype-dispatch arm of `0x0057354d`. The helper forwards source and destination base pointers plus live width, height, and row-pitch bands into the secondary packed-32 `2x2` reducer slot at `0x006263cc`, which resolves through `0x005722d6` on first use. This is the safest current read for the secondary packed-32 half-resolution reducer wrapper rather than overclaiming one exact channel layout.","objdump + local disassembly + caller inspection + decode-branch correlation + half-resolution correlation + dispatch-correlation"
0x00572188,70,surface_downsample_2x2_packed32_blocks_mmx_or_scalar_by_flag_strip,support,cdecl,inferred,objdump + local disassembly + caller inspection + dispatch-correlation,2,"CPU-selected packed-32 `2x2` reducer wrapper shared by the primary and secondary mode-`5` downsample slots. When the incoming flag byte has either low bit set, the helper falls back to scalar reducer `0x00571f49`; otherwise it runs its own MMX four-pixel average path and writes one destination pixel per source quad. Current grounded callers are the one-time dispatch initializers `0x005722a1` and `0x005722d6`.","objdump + local disassembly + caller inspection + dispatch-correlation + half-resolution correlation + MMX-correlation"
0x00572336,336,surface_downsample_2x2_rgb565_blocks_scalar,support,thiscall,inferred,objdump + local disassembly + arithmetic inspection + decode-branch correlation,2,"Mode-`5` specialized half-resolution reducer for one 16-bit `RGB565`-style source or destination family. The helper walks the source in `2x2` quads, averages four packed 16-bit pixels with the expected `0xf81f` red-blue mask and `0x07e0` green mask, and writes one reduced 16-bit destination pixel per source quad. This is the safest current read for the scalar `RGB565` box-reduction branch rather than overclaiming one exact container subtype.","objdump + local disassembly + arithmetic inspection + decode-branch correlation + half-resolution correlation + rgb565-correlation"
0x00572486,292,surface_downsample_2x2_rgb555_blocks_scalar,support,thiscall,inferred,objdump + local disassembly + arithmetic inspection + decode-branch correlation,2,"Sibling mode-`5` scalar half-resolution reducer over one 16-bit `RGB555`-style pixel family. The helper uses the `0x7c1f` red-blue mask and `0x03e0` green mask to average four packed source pixels into one reduced destination pixel for each `2x2` source quad. This is the safest current read for the scalar `RGB555` box-reduction branch.","objdump + local disassembly + arithmetic inspection + decode-branch correlation + half-resolution correlation + rgb555-correlation"
0x005725aa,335,surface_downsample_2x2_argb1555_blocks_scalar,support,thiscall,inferred,objdump + local disassembly + arithmetic inspection + decode-branch correlation,2,"Sibling mode-`5` scalar half-resolution reducer over one 16-bit `ARGB1555`-style pixel family. The helper uses the combined `0x83e0` and `0x7c1f` mask split to average the `2x2` source quad into one destination pixel while carrying the high alpha bit in the same packed word family. This is the safest current read for the scalar `ARGB1555` box-reduction branch.","objdump + local disassembly + arithmetic inspection + decode-branch correlation + half-resolution correlation + argb1555-correlation"
0x005726f9,339,surface_downsample_2x2_argb4444_blocks_scalar,support,thiscall,inferred,objdump + local disassembly + arithmetic inspection + decode-branch correlation,2,"Sibling mode-`5` scalar half-resolution reducer over one 16-bit `ARGB4444`-style pixel family. The helper uses the expected `0xf0f0` and `0x0f0f` nibble masks to average four packed `4:4:4:4` pixels into one destination pixel for each `2x2` source quad. This is the safest current read for the scalar `ARGB4444` box-reduction branch.","objdump + local disassembly + arithmetic inspection + decode-branch correlation + half-resolution correlation + argb4444-correlation"
0x0057284c,319,surface_downsample_2x2_rgb332_blocks_scalar,support,thiscall,inferred,objdump + local disassembly + arithmetic inspection + decode-branch correlation,2,"Sibling mode-`5` scalar half-resolution reducer over one packed 8-bit `RGB332`-style pixel family. The helper averages four source bytes per `2x2` quad using the expected `0x1c` and `0xe3` mask split for the green and red-blue channel groups, then writes one reduced destination byte. This is the safest current read for the scalar `RGB332` box-reduction branch.","objdump + local disassembly + arithmetic inspection + decode-branch correlation + half-resolution correlation + rgb332-correlation"
0x0057298b,155,surface_downsample_2x2_packed8_blocks_scalar,support,thiscall,inferred,objdump + local disassembly + arithmetic inspection + decode-branch correlation + type-word correlation,2,"Sibling mode-`5` scalar half-resolution reducer over one generic single-byte packed pixel family. The helper averages four source bytes per `2x2` quad into one destination byte without splitting channel masks, matching the specialized jump-table targets for type words `0x1c` and `0x32`. This is the safest current read for the scalar packed-8 box-reduction branch rather than overclaiming one exact palette, luminance, or indexed format family.","objdump + local disassembly + arithmetic inspection + decode-branch correlation + half-resolution correlation + packed8-correlation + type-word correlation"
0x00572a26,332,surface_downsample_2x2_argb8332_blocks_scalar,support,thiscall,inferred,objdump + local disassembly + arithmetic inspection + decode-branch correlation,2,"Sibling mode-`5` scalar half-resolution reducer over one mixed 16-bit alpha-plus-`RGB332` pixel family. The helper averages four source words per `2x2` quad using the expected `0xff1c` and `0x00e3` mask split, preserving one full-byte channel alongside the packed `RGB332` low byte. This is the safest current read for the scalar alpha-plus-`RGB332` box-reduction branch without overclaiming the exact byte order.","objdump + local disassembly + arithmetic inspection + decode-branch correlation + half-resolution correlation + rgb332-correlation"
0x00572b72,288,surface_downsample_2x2_x4r4g4b4_blocks_scalar,support,thiscall,inferred,objdump + local disassembly + arithmetic inspection + decode-branch correlation + type-word correlation,2,"Sibling mode-`5` scalar half-resolution reducer over one 16-bit `X4R4G4B4`-style packed pixel family. The helper averages four source words per `2x2` quad across the low `0x0f0f` nibble pairs and the middle `0x00f0` nibble band, leaving the high unused nibble clear in the destination word. This is the safest current read for the scalar `X4R4G4B4` box-reduction branch.","objdump + local disassembly + arithmetic inspection + decode-branch correlation + half-resolution correlation + x4r4g4b4-correlation + type-word correlation"
0x00572c93,332,surface_downsample_2x2_a8l8_blocks_scalar,support,thiscall,inferred,objdump + local disassembly + arithmetic inspection + decode-branch correlation + type-word correlation,2,"Sibling mode-`5` scalar half-resolution reducer over one 16-bit dual-byte `A8L8`-style pixel family. The helper averages four source words per `2x2` quad by treating the low `0x00ff` and high `0xff00` byte lanes independently, then repacks the averaged byte pair into one destination word. Current dispatch context matches type word `0x33`, so this is the safest current read for the scalar `A8L8` box-reduction branch.","objdump + local disassembly + arithmetic inspection + decode-branch correlation + half-resolution correlation + a8l8-correlation + type-word correlation"
0x00572ddf,319,surface_downsample_2x2_a4l4_blocks_scalar,support,thiscall,inferred,objdump + local disassembly + arithmetic inspection + decode-branch correlation + type-word correlation,2,"Sibling mode-`5` scalar half-resolution reducer over one packed 8-bit `A4L4`-style dual-nibble family. The helper averages four source bytes per `2x2` quad by splitting the low `0x0f` and high `0xf0` nibble lanes independently and then recombining the averaged nibbles into one destination byte. Current dispatch context matches type word `0x34`, so this is the safest current read for the scalar `A4L4` box-reduction branch.","objdump + local disassembly + arithmetic inspection + decode-branch correlation + half-resolution correlation + a4l4-correlation + type-word correlation"
0x00574dbb,280,surface_decode_dispatch_supported_codec_chain_into_decode_pair,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection + decode-chain correlation,2,"Broader decode-branch dispatcher under `0x0057025d`. The helper validates the caller mode word, resolves two decoder-side handles through `0x0057a3f8`, links that pair through `0x00575d9c`, and then tries the supported codec or transfer branches in sequence through `0x00572f1e`, `0x00573056`, `0x00573147`, `0x00573349`, `0x0057354d`, `0x00573970`, `0x00573f02`, `0x005742e8`, `0x00574a19`, and `0x00571947`. On failure it releases both temporary handles before returning the error. Current grounded caller is `0x0057025d`, so this is the safest current read for dispatching the supported codec chain into one local decode pair rather than naming a single codec body.","objdump + local disassembly + caller inspection + decode-chain correlation + handle-pair correlation"
0x00572f1e,312,surface_decode_try_direct_copy_for_matching_layout_and_descriptor,support,thiscall,inferred,objdump + local disassembly + caller inspection + decode-branch correlation,2,"First concrete decode branch under `0x00574dbb`. The helper requires matching descriptor-side width, height, depth, and row-layout fields between the linked source and destination handles, optionally verifies the `0x100`-dword descriptor band at `+0x30`, and then copies the source image rows directly into the destination buffer using the live stride and depth bands rooted at `+0x1050/+0x1054/+0x105c/+0x1060`. When the source has no auxiliary descriptor payload at `[src+0x0c]`, the helper instead falls straight into the narrower direct-transfer sibling `0x00571dbb`. This is the safest current read for the matching-layout direct-copy branch rather than a codec-specific decoder.","objdump + local disassembly + caller inspection + decode-branch correlation + direct-copy correlation"
0x00573056,241,surface_decode_try_rowwise_transfer_via_temporary_0x10_pixel_buffer,support,thiscall,inferred,objdump + local disassembly + caller inspection + decode-branch correlation,2,"Second decode branch under `0x00574dbb`. After requiring matching descriptor-side width, height, and depth bands, the helper allocates one temporary `width * 0x10` byte buffer, then iterates every depth slice and row, pulling one source row through the source handle's slot `+0x04` and pushing it into the destination through the destination handle's slot `+0x08`. On success it frees the temporary row buffer and returns `0`. This is the safest current read for a rowwise transfer branch using one temporary `0x10`-byte-per-pixel buffer rather than overnaming one specific codec.","objdump + local disassembly + caller inspection + decode-branch correlation + row-buffer correlation"
0x00573147,514,surface_decode_try_mode1_transfer_with_two_temp_row_buffers_and_zero_fill,support,thiscall,inferred,objdump + local disassembly + caller inspection + decode-branch correlation,2,"Third decode branch under `0x00574dbb`. The helper requires decode-pair mode byte `[pair+0x08] == 1`, derives the shared minimum width, height, and depth bands between the linked source and destination handles, allocates two temporary row buffers sized from the source and minimum widths, zero-fills those buffers, and then iterates the source or destination row callbacks through slots `+0x04` and `+0x08`. Rows and slices outside the shared minimum bands are emitted with the zero-filled temporary buffer. This is the safest current read for the mode-`1` transfer branch with two temporary row buffers and explicit zero fill rather than overclaiming one exact pixel format.","objdump + local disassembly + caller inspection + decode-branch correlation + row-buffer correlation + zero-fill correlation"
0x00573349,516,surface_decode_try_mode2_fixed_point_resample_with_two_temp_row_buffers,support,thiscall,inferred,objdump + local disassembly + caller inspection + decode-branch correlation,2,"Next decode branch under `0x00574dbb`. The helper requires decode-pair mode byte `[pair+0x08] == 2`, allocates one temporary row buffer for the source width and one for the destination width, derives fixed-point `0x10000` step ratios from the linked source and destination width, height, and depth bands, pulls source rows through slot `+0x04`, and then emits destination rows through slot `+0x08` after rebuilding them from the staged row buffers with fixed-point stepping. This is the safest current read for the mode-`2` fixed-point resample branch using two temporary row buffers rather than overclaiming one exact filter or pixel format.","objdump + local disassembly + caller inspection + decode-branch correlation + fixed-point correlation + row-buffer correlation"
0x0057354d,1014,surface_decode_try_mode5_specialized_half_resolution_dispatch_or_weighted_multirow_fallback,support,thiscall,inferred,objdump + local disassembly + caller inspection + decode-branch correlation,2,"Next decode branch under `0x00574dbb`. The helper requires decode-pair mode byte `[pair+0x08] == 5`, first checks for the half-resolution single-slice shape and, when a subtype bit and type word permit it, dispatches one format-specific specialized path through the jump-table targets `0x57206f`, `0x572305`, `0x572336`, `0x572486`, `0x5725aa`, `0x5726f9`, `0x57284c`, `0x57298b`, `0x572a26`, `0x572b72`, `0x572c93`, and `0x572ddf`. When that fast path is unavailable, it falls back to a broader weighted multirow rebuild using temporary row buffers, paired source-row fetches through slot `+0x04`, and destination writes through slot `+0x08`. This is the safest current read for the mode-`5` specialized half-resolution dispatch or weighted fallback branch rather than overclaiming one exact packed format family.","objdump + local disassembly + caller inspection + decode-branch correlation + subtype-dispatch correlation + weighted-fallback correlation"
0x00573970,1134,surface_decode_try_mode5_general_half_resolution_box_filter_with_four_source_taps,support,thiscall,inferred,objdump + local disassembly + caller inspection + decode-branch correlation,2,"Sibling mode-`5` branch under `0x00574dbb`. The helper again requires half-resolution shape, but unlike `0x0057354d` it enforces a single-slice 2D destination, trims odd source dimensions down to even values when needed, allocates staged source-row bands, and then rebuilds each destination texel from the weighted sum of up to four source taps using the local `0.25f` constant at `0x005deb9c`. Source rows are fetched through slot `+0x04`, destination rows are emitted through slot `+0x08`, and the branch acts as the broader box-filter half-resolution fallback after the more format-specific mode-`5` path. This is the safest current read for the general mode-`5` half-resolution box-filter branch with four source taps rather than overclaiming one exact texture family.","objdump + local disassembly + caller inspection + decode-branch correlation + weighted-resample correlation + half-resolution correlation"
0x00573e02,256,surface_resample_build_dual_tap_axis_map_table_x87,support,cdecl,inferred,objdump + local disassembly + caller inspection + decode-branch correlation,2,"Shared dual-tap axis-map builder used by the mode-`3` weighted resample branches `0x00573f02` and `0x005742e8`. The helper allocates one `dest_count * 0x10` table, derives the source-to-destination step ratio as an x87 float, rounds each destination sample center into a base source index, clamps the two contributing source indices against the current edge policy, and stores one four-field entry `(src0, w0, src1, w1)` per destination sample. This is the safest current read for the lighter x87 dual-tap axis-map builder rather than overclaiming one exact bilinear kernel.","objdump + local disassembly + caller inspection + decode-branch correlation + axis-map correlation + weighted-resample correlation"
0x00573f02,1255,surface_decode_try_mode3_weighted_resample_with_axis_map_tables_and_two_temp_row_sets,support,thiscall,inferred,objdump + local disassembly + caller inspection + decode-branch correlation,2,"Broader weighted resample branch under `0x00574dbb`. The helper requires decode-pair mode byte low byte `3`, builds X and Y axis map tables through `0x573e02`, allocates one temporary source-row set and one destination-row set, then iterates source-row fetches through slot `+0x04` and emits destination rows through slot `+0x08` after rebuilding them from those staged rows with the precomputed axis map weights. This is the safest current read for the first mode-`3` weighted resample branch using axis map tables and two temporary row sets rather than overclaiming one exact interpolation kernel.","objdump + local disassembly + caller inspection + decode-branch correlation + axis-map correlation + weighted-resample correlation"
0x005742e8,1329,surface_decode_try_mode3_weighted_resample_with_axis_map_tables_and_four_temp_row_sets,support,thiscall,inferred,objdump + local disassembly + caller inspection + decode-branch correlation,2,"Heavier sibling weighted resample branch under `0x00574dbb`. The helper again requires decode-pair mode byte low byte `3`, builds X, Y, and Z or slice axis map tables through `0x573e02`, allocates four staged row-set bands, and then rebuilds destination rows through repeated weighted combinations of those staged rows before writing them through destination slot `+0x08`. This is the safest current read for the larger mode-`3` weighted resample branch with four temporary row sets rather than overclaiming one exact 3D or trilinear pixel-format path.","objdump + local disassembly + caller inspection + decode-branch correlation + axis-map correlation + weighted-resample correlation"
0x00574a19,915,surface_decode_try_general_weighted_2d_resample_with_refcounted_axis_map_tables,support,thiscall,inferred,objdump + local disassembly + caller inspection + decode-branch correlation,2,"Broader general-purpose resample branch under `0x00574dbb`. The helper requires both source and destination depth bands to stay at `1`, builds weighted X and Y axis-map tables through `0x0057163e`, allocates one refcounted row-buffer table for the destination height, and then services the source rows through slot `+0x04` while accumulating weighted horizontal and vertical contributions into those temporary rows before flushing completed destination rows through slot `+0x08`. Temporary axis maps are released through `0x005718fb` on exit. This is the safest current read for the general weighted 2D resample branch using refcounted axis-map tables rather than overclaiming one exact interpolation kernel.","objdump + local disassembly + caller inspection + decode-branch correlation + axis-map correlation + weighted-resample correlation + refcounted-row-table correlation"
0x00571947,1140,surface_decode_try_general_weighted_3d_resample_with_refcounted_axis_map_tables,support,thiscall,inferred,objdump + local disassembly + caller inspection + decode-branch correlation,2,"Heaviest general-purpose resample branch under `0x00574dbb`. The helper builds weighted X, Y, and Z axis-map tables through `0x0057163e`, allocates one refcounted slice-table plus zeroed row-buffer blocks for the destination depth and height bands, and then services source rows through slot `+0x04` while accumulating weighted per-row and per-slice contributions before flushing completed destination rows through slot `+0x08`. The temporary axis-map tables are released through `0x005718fb` on exit. This is the safest current read for the general weighted 3D resample branch using refcounted axis-map tables rather than overclaiming one exact volume-format kernel.","objdump + local disassembly + caller inspection + decode-branch correlation + axis-map correlation + weighted-resample correlation + refcounted-slice-table correlation"
0x00574ed5,15,surface_temp_view_context_zero_init,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny zero-init helper for the `0x10`-byte temporary source-view context used by `0x00574f53`. The function clears all four dwords and returns.","objdump + local disassembly + temporary-view correlation"
0x00574ee5,106,surface_temp_view_context_release_optional_subview_and_handles,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Release-side helper for the same temporary source-view context. The function optionally flushes one subordinate transfer path through vtable slot `+0x70`, releases optional handle fields `[+0x08]` and `[+0x0c]`, clears root field `[+0x04]`, and returns. Current grounded callers are the wrapper `0x00574f4e` and the broader temp-view owner `0x00574f53`.","objdump + local disassembly + caller inspection + temporary-view correlation + release correlation"
0x00574f4e,5,surface_temp_view_context_release_optional_subview_and_handles_wrapper,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Thin wrapper that tails directly into `0x00574ee5`. Current grounded callers are `0x0057025d` and `0x005706f7`, which use it for temp-view cleanup.","objdump + local disassembly + wrapper correlation + temporary-view correlation"
0x00574f53,955,surface_target_prepare_temp_view_and_aligned_rect_descriptor,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection + rect-normalization correlation,2,"Broader temporary-view owner beneath the shared surface decode path. The helper first resets and releases the local temp-view context, queries the source target bounds through vtable slot `+0x20`, validates or synthesizes one source rect, optionally acquires one subordinate view through target slot `+0x1c`, aligns the working rect for block-compressed or packed-YUV tags such as `DXT1..DXT5`, `YUY2`, and `UYVY`, and when needed queries one derived subview rectangle through slot `+0x24`. On success it fills the caller output descriptor with the chosen target or subview handle, source tag, normalized rect bands, source dimensions, and caller mode flags. Current grounded callers are `0x0057025d` and `0x005706f7`, so this is the safest current read for preparing one temporary source view and aligned rect descriptor rather than a narrower subrect-only label.","objdump + local disassembly + caller inspection + rect-normalization correlation + target-dispatch correlation + temporary-view correlation"
0x00575366,19,surface_decoder_base_release_optional_aux_staging_row,support,thiscall,inferred,objdump + local disassembly + caller inspection,1,"Tiny shared release helper for the common surface-decoder base. The function resets the active vtable back to `0x005dec4c`, releases optional auxiliary staging row `[obj+0x104c]`, and returns. Current grounded callers are several family-specific destructors including `0x00575b34` descendants and the packed-YUV or block-compressed release strips.","objdump + local disassembly + caller inspection + decoder-base correlation + release correlation"
0x0057537f,747,surface_decoder_build_aux_staging_vec4_row_from_source_packet,support,thiscall,inferred,objdump + local disassembly + caller inspection + staging-row correlation,2,"Shared auxiliary-row builder used when one decoder family needs a peer-format staging view. The helper switches on local mode dword `[obj+0x08]` and cached peer-mode selector `[obj+0x1048]`, then rewrites the `16`-byte-per-sample auxiliary row at `[obj+0x104c]` from the caller source packet, using small float affine transforms over the four source scalars when the current mode pair requires normalization into one staged `vec4` band. This is the safest current read for building the auxiliary staging `vec4` row used by peer-mode mismatch paths rather than overclaiming exact color-space semantics.","objdump + local disassembly + caller inspection + staging-row correlation + mode-pair correlation"
0x00575677,160,surface_decoder_release_nested_aux_tables_and_base,support,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Release-side sibling for the larger decoder families that own nested auxiliary tables under `[obj+0x10b8..+0x10c0]`. The helper walks the optional nested `8`-byte cells referenced through `[obj+0x10c0]` when the live count fields `[obj+0x109c..+0x10a0]` are active, releases the outer auxiliary blocks `[obj+0x10b8]` and `[obj+0x10c0]`, and then tails into the shared base release `0x00575366`. Current grounded callers are the heavier family-specific destructors paired with the `DXT`-side and related decoder constructors.","objdump + local disassembly + caller inspection + decoder-base correlation + nested-table correlation + release correlation"
0x00575717,1017,surface_decoder_decode_dxt_region_into_cached_tile_rows_and_emit_edge_fixed_samples,support,thiscall,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Broader row-decode owner for the `DXT` decoder family built above `0x0057989d`. The helper lazily allocates one cached tile-cell table at `[obj+0x10c0]`, materializes or reuses one per-cell sample block, drives the primary decode kernel through `[obj+0x1084]` over the needed block-compressed region, optionally rebuilds a peer-mode staging row through `0x0057537f`, copies the decoded `16`-byte sample rows into the caller output strip, tracks per-lane coverage bits in the local cell header, and invokes the secondary kernel `[obj+0x1088]` when a tile reaches full `4x4` coverage before possibly releasing stale cached tiles. This is the safest current read for decoding one `DXT` region into cached tile rows with edge-fixup handling rather than overclaiming one exact block algorithm.","objdump + local disassembly + caller inspection + DXT-correlation + cached-tile correlation + edge-fixup correlation"
0x00575b34,246,surface_decoder_base_ctor_from_descriptor_and_aux_mode,support,thiscall,inferred,objdump + local disassembly + caller inspection + decoder-base correlation,2,"Common constructor base reused by several surface-decoder families. The helper seeds one `0x100`-entry `0x10`-byte pattern table at `[obj+0x30]` from clear block `0x57033c`, copies the caller descriptor bands into the object root including payload pointer `[obj+0x18]`, tag `[obj+0x04]`, row or slice strides `[obj+0x1050/+0x1054]`, and extents `[obj+0x1030..+0x1044]`, selects lookup root `[obj+0x2c]` between `0x006263d0` and `0x00626450`, stores auxiliary-mode dword `[obj+0x08]`, and optionally converts packed descriptor color `[arg+0x44]` into float band `[obj+0x1c..+0x28]`. This is the safest current read for the shared decoder-base constructor from one descriptor plus aux-mode selector.","objdump + local disassembly + caller inspection + decoder-base correlation + descriptor-copy correlation + aux-mode correlation"
0x00575e17,204,surface_decoder_run_vtable_pair_against_local_color_vec4_with_temporary_single_sample_state,support,thiscall,inferred,objdump + local disassembly + caller inspection + decoder-base correlation,2,"Small shared helper in the surface-decoder base family. The function snapshots width, sample count, payload pointer, lookup root, and optional mode or clip field, then temporarily rewires the decoder into a one-sample local state rooted at stack `vec4` storage and local color band `[obj+0x1c..+0x28]`. When auxiliary mode `[obj+0x08]` is not `1`, it also temporarily points `[obj+0x104c]` at that local color band and runs the auxiliary staging builder `0x0057537f` once. It then invokes vtable slots `+0x08` and `+0x04` against that single local sample and restores the original decoder state before returning. This is the safest current read for running the decoder's virtual pair against the local color vec4 with temporary single-sample state rather than overclaiming exact format semantics.","objdump + local disassembly + caller inspection + decoder-base correlation + virtual-dispatch correlation + local-color-band correlation"
0x00575ee3,109,surface_decoder_zero_decoded_sample_quads_when_all_four_lanes_exceed_clip_thresholds,support,stdcall,inferred,objdump + local disassembly + caller inspection + clip-threshold correlation,2,"Small post-decode clip helper beneath the shared surface-decoder base. The function walks `0x10`-byte decoded sample quads starting at the caller buffer, compares all four float lanes against clip thresholds `[obj+0x1c..+0x28]`, and zeroes the whole quad only when every lane exceeds its corresponding threshold. Current grounded caller is the packed-YUV output sibling `0x005797f1`, so this is the safest current read for zeroing decoded sample quads by the descriptor clip box rather than a generic clear loop.","objdump + local disassembly + caller inspection + clip-threshold correlation + decoder-base correlation"
0x00575d9c,121,surface_decoder_link_or_refresh_aux_staging_row_for_peer_mode,bootstrap,thiscall,inferred,objdump + local disassembly + caller inspection + decode-chain correlation,2,"Small helper used immediately under `0x00574dbb` after the two decoder-side handles are resolved. When the peer decoder's mode dword `[peer+0x08]` differs from `[this+0x08]`, the helper allocates one `width*0x10` auxiliary staging-row block at `[this+0x104c]`, seeds it from the same `0x57033c` clear pattern used elsewhere in the decode stack, and caches the peer mode dword into `[this+0x1048]`. When the mode already matches, it returns success without rebuilding that row. This is the safest current read for linking or refreshing one auxiliary staging row for peer mode mismatches rather than overclaiming exact decoder subtype semantics.","objdump + local disassembly + caller inspection + decode-chain correlation + staging-row correlation"
0x00578ed3,26,surface_decoder_ctor_tag_0x14_variant_vtable_0x5dec9c_auxmode1_stride0x18,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x14` with auxiliary mode `1` and sample stride `0x18`, then installs subtype vtable `0x005dec9c`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00578eef,245,surface_decoder_ctor_packed_yuv422_base_with_evenized_width_and_shift_select,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,2,"Shared constructor base for the packed-YUV `4:2:2` decoder family reached from the format-tag factory. The helper seeds the common decoder base through `0x00575b34`, evenizes the horizontal span, allocates one `16`-byte-per-sample auxiliary row table at `[obj+0x106c]`, and then selects the paired byte-lane shift fields `[obj+0x1094/+0x1098]` according to whether the incoming tag is `UYVY` (`0x59565955`) or the alternate sibling handled through the same base. This is the safest current read for the packed-YUV-422 base constructor rather than naming one specific output swizzle too narrowly.","objdump + local disassembly + caller inspection + tag-dispatch correlation + packed-yuv correlation"
0x00578fe7,26,surface_decoder_release_tag_0x14_variant_vtable_0x5dec9c,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x14` subtype vtable `0x005dec9c`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579008,28,surface_decoder_ctor_tag_0x15_variant_vtable_0x5decbc_auxmode1_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x15` with auxiliary mode `1` and sample stride `0x20`, then installs subtype vtable `0x005decbc` and returns.","objdump + local disassembly + caller inspection + tag-dispatch correlation + decoder-base correlation"
0x00579024,26,surface_decoder_release_tag_0x15_variant_vtable_0x5decbc,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x15` subtype vtable `0x005decbc`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579045,28,surface_decoder_ctor_tag_0x16_variant_vtable_0x5deccc_auxmode1_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x16` with auxiliary mode `1` and sample stride `0x20`, then installs subtype vtable `0x005deccc` and returns.","objdump + local disassembly + caller inspection + tag-dispatch correlation + decoder-base correlation"
0x00579061,26,surface_decoder_release_tag_0x16_variant_vtable_0x5deccc,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x16` subtype vtable `0x005deccc`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579082,28,surface_decoder_ctor_tag_0x17_variant_vtable_0x5decdc_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x17` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005decdc`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x0057909e,491,surface_decoder_flush_live_packed_yuv422_aux_samples_back_to_payload_window,support,thiscall,inferred,objdump + local disassembly + caller inspection + packed-yuv correlation,2,"Reverse cached-window owner in the packed-YUV-422 decoder family. When live decoded state `[obj+0x108c]` and cached output bounds `[obj+0x1090]` are present, the helper walks the auxiliary sample table `[obj+0x106c]`, converts the float sample lanes back into clamped packed channel values, reapplies lane shifts `[obj+0x1094/+0x1098]`, writes the merged words back into the payload window rooted at `[obj+0x18]`, and then clears the live-dirty flag. This is the safest current read for flushing live packed-YUV-422 auxiliary samples back into the payload window rather than a generic pixel loop.","objdump + local disassembly + caller inspection + packed-yuv correlation + cached-window correlation + reverse-writeback correlation"
0x005792ab,26,surface_decoder_ctor_tag_0x18_variant_vtable_0x5ded0c_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x18` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005ded0c`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x005792c7,26,surface_decoder_release_tag_0x18_variant_vtable_0x5ded0c,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x18` subtype vtable `0x005ded0c`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x005792e8,26,surface_decoder_ctor_tag_0x19_variant_vtable_0x5ded1c_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x19` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005ded1c`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579304,26,surface_decoder_release_tag_0x19_variant_vtable_0x5ded1c,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x19` subtype vtable `0x005ded1c`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579325,717,surface_decoder_refresh_packed_yuv422_cached_window_and_build_aux_sample_band,support,stdcall,inferred,objdump + local disassembly + caller inspection + packed-yuv correlation,2,"Primary cached-window owner beneath the packed-YUV-422 row-decode siblings. The function validates the requested `(x,y)` against cached bounds `[obj+0x1074..+0x1084]`, rebuilds the source window through `0x0057909e` when needed, updates those bounds, and when the caller requests materialization it walks the live payload words, applies lane shifts `[obj+0x1094/+0x1098]`, expands paired packed channels into float tuples, and writes one `0x20`-byte-per-sample auxiliary band into `[obj+0x106c]`. This is the safest current read for refreshing the packed-YUV-422 cached window and building the auxiliary sample band rather than a generic pixel loop.","objdump + local disassembly + caller inspection + packed-yuv correlation + cached-window correlation"
0x005795f6,26,surface_decoder_ctor_tag_0x1a_variant_vtable_0x5ded40_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1a` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005ded40`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579612,26,surface_decoder_release_tag_0x1a_variant_vtable_0x5ded40,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x1a` subtype vtable `0x005ded40`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579633,26,surface_decoder_ctor_tag_0x1b_variant_vtable_0x5ded50_auxmode1_stride0x8,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1b` with auxiliary mode `1` and sample stride `0x08`, then installs subtype vtable `0x005ded50`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x0057964f,26,surface_decoder_release_tag_0x1b_variant_vtable_0x5ded50,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x1b` subtype vtable `0x005ded50`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579670,26,surface_decoder_ctor_tag_0x1c_variant_vtable_0x5ded60_auxmode1_stride0x8,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1c` with auxiliary mode `1` and sample stride `0x08`, then installs subtype vtable `0x005ded60`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x0057968c,26,surface_decoder_release_tag_0x1c_variant_vtable_0x5ded60,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x1c` subtype vtable `0x005ded60`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x005796ad,26,surface_decoder_ctor_tag_0x1d_variant_vtable_0x5ded70_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1d` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005ded70`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x005796c9,26,surface_decoder_release_tag_0x1d_variant_vtable_0x5ded70,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x1d` subtype vtable `0x005ded70`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x005796ea,26,surface_decoder_ctor_tag_0x1e_variant_vtable_0x5ded80_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1e` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005ded80`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579706,26,surface_decoder_release_tag_0x1e_variant_vtable_0x5ded80,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x1e` subtype vtable `0x005ded80`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579727,139,surface_decoder_decode_packed_yuv422_row_into_aux_samples,support,thiscall,inferred,objdump + local disassembly + caller inspection + packed-yuv correlation,2,"Primary row-decode owner in the packed-YUV-422 family above `0x00578eef`. The helper optionally rebuilds one peer-mode staging row through `0x0057537f`, resolves the requested source position through local helper `0x00579325`, copies one decoded sample row from the auxiliary table `[obj+0x106c]` into the caller output strip, and marks `[obj+0x108c]` live. This is the safest current read for decoding one packed-YUV-422 row into auxiliary sample storage rather than overclaiming one exact swizzle path.","objdump + local disassembly + caller inspection + packed-yuv correlation + staging-row correlation"
0x005797f1,109,surface_decoder_copy_packed_yuv422_aux_row_to_output_and_optionally_clip,support,thiscall,inferred,objdump + local disassembly + caller inspection + packed-yuv correlation,2,"Sibling output helper in the packed-YUV-422 family. The helper resolves the requested source position through `0x00579325`, copies one already-decoded auxiliary sample row from `[obj+0x106c]` into the caller output buffer, and when the decoder exposes a non-null mode or clip field at `[obj+0x10]` it follows with clip or zero-side cleanup through `0x00575ee3`. This is the safest current read for copying one packed-YUV auxiliary row to output with optional clip cleanup.","objdump + local disassembly + caller inspection + packed-yuv correlation + output-copy correlation + clip correlation"
0x005797b4,26,surface_decoder_ctor_tag_0x1f_variant_vtable_0x5ded90_auxmode1_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x1f` with auxiliary mode `1` and sample stride `0x20`, then installs subtype vtable `0x005ded90`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x005797d0,26,surface_decoder_release_tag_0x1f_variant_vtable_0x5ded90,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x1f` subtype vtable `0x005ded90`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579860,26,surface_decoder_ctor_tag_0x20_variant_vtable_0x5deda0_auxmode1_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x20` with auxiliary mode `1` and sample stride `0x20`, then installs subtype vtable `0x005deda0`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x0057987c,26,surface_decoder_release_tag_0x20_variant_vtable_0x5deda0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x20` subtype vtable `0x005deda0`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x0057989d,493,surface_decoder_ctor_dxt_base_select_block_size_and_decode_kernels,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,2,"Shared constructor base for the block-compressed `DXT1..DXT5` decoder family reached from `0x0057a3f8`. After seeding the common decoder base through `0x00575b34`, the helper derives two small state selectors from descriptor dwords `[arg+0x18]` and `[arg+0x1c]`, chooses the per-format block-byte count at `[obj+0x1080]` and the paired decode-kernel callbacks `[obj+0x1084/+0x1088]` according to tag `DXT1..DXT5`, aligns the working extents to four-pixel block boundaries, and stores the derived block-grid extents under `[obj+0x1090..+0x10ac]`. This is the safest current read for the `DXT` base constructor that selects block size and decode kernels.","objdump + local disassembly + caller inspection + tag-dispatch correlation + DXT-correlation + block-grid correlation"
0x00579a8f,26,surface_decoder_ctor_tag_0x28_variant_vtable_0x5dedb0_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x28` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005dedb0`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579aab,26,surface_decoder_release_tag_0x28_variant_vtable_0x5dedb0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x28` subtype vtable `0x005dedb0`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579acc,26,surface_decoder_ctor_tag_0x29_variant_vtable_0x5dedc0_auxmode1_stride0x8,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x29` with auxiliary mode `1` and sample stride `0x08`, then installs subtype vtable `0x005dedc0`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579ae8,26,surface_decoder_release_tag_0x29_variant_vtable_0x5dedc0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x29` subtype vtable `0x005dedc0`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579b09,26,surface_decoder_ctor_tag_0x32_variant_vtable_0x5dedd0_auxmode1_stride0x8,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x32` with auxiliary mode `1` and sample stride `0x08`, then installs subtype vtable `0x005dedd0`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579b25,26,surface_decoder_release_tag_0x32_variant_vtable_0x5dedd0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x32` subtype vtable `0x005dedd0`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579b46,26,surface_decoder_ctor_tag_0x33_variant_vtable_0x5dede0_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x33` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005dede0`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579b62,26,surface_decoder_release_tag_0x33_variant_vtable_0x5dede0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x33` subtype vtable `0x005dede0`. The helper re-enters broader nested-table `DXT`-style release `0x00575677`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + nested-table correlation + tag-dispatch correlation"
0x00579b9f,26,surface_decoder_ctor_tag_0x34_variant_vtable_0x5dedf0_auxmode1_stride0x8,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x34` with auxiliary mode `1` and sample stride `0x08`, then installs subtype vtable `0x005dedf0`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579bbb,26,surface_decoder_release_tag_0x34_variant_vtable_0x5dedf0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x34` subtype vtable `0x005dedf0`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579bdc,257,surface_decoder_quantize_threshold_vec4_with_tag_dependent_scale,support,thiscall,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Small post-constructor helper in the `DXT` decoder neighborhood. The function selects one tag-dependent scalar into `[obj+0x106c]` and its reciprocal into `[obj+0x1070]`, then quantizes the descriptor threshold vec4 `[obj+0x1c..+0x28]` through those scale factors and stores the rounded results back into the same four lanes. Current evidence is strongest that `DXT2` and `DXT3` take one scale branch while the other nearby subtypes take the alternate branch, so this is the safest current read for tag-dependent threshold quantization rather than naming one exact alpha policy.","objdump + local disassembly + caller inspection + DXT-correlation + threshold correlation + quantization correlation"
0x00579cdd,26,surface_decoder_ctor_tag_0x3c_variant_vtable_0x5dee00_auxmode2_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x3c` with auxiliary mode `2` and sample stride `0x10`, then installs subtype vtable `0x005dee00`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579cf9,26,surface_decoder_release_tag_0x3c_variant_vtable_0x5dee00,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x3c` subtype vtable `0x005dee00`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579d1a,26,surface_decoder_ctor_tag_0x3d_variant_vtable_0x5dee10_auxmode2_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x3d` with auxiliary mode `2` and sample stride `0x10`, then installs subtype vtable `0x005dee10`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579d36,26,surface_decoder_release_tag_0x3d_variant_vtable_0x5dee10,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x3d` subtype vtable `0x005dee10`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579d57,26,surface_decoder_ctor_tag_0x3e_variant_vtable_0x5dee20_auxmode2_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x3e` with auxiliary mode `2` and sample stride `0x20`, then installs subtype vtable `0x005dee20`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579d73,26,surface_decoder_release_tag_0x3e_variant_vtable_0x5dee20,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x3e` subtype vtable `0x005dee20`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579d94,26,surface_decoder_ctor_tag_0x3f_variant_vtable_0x5dee30_auxmode3_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x3f` with auxiliary mode `3` and sample stride `0x20`, then installs subtype vtable `0x005dee30`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579db0,26,surface_decoder_release_tag_0x3f_variant_vtable_0x5dee30,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x3f` subtype vtable `0x005dee30`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579dd1,26,surface_decoder_ctor_tag_0x40_variant_vtable_0x5dee40_auxmode2_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x40` with auxiliary mode `2` and sample stride `0x20`, then installs subtype vtable `0x005dee40`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579ded,26,surface_decoder_release_tag_0x40_variant_vtable_0x5dee40,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x40` subtype vtable `0x005dee40`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579e0e,26,surface_decoder_ctor_tag_0x41_variant_vtable_0x5dee50_auxmode2_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x41` with auxiliary mode `2` and sample stride `0x20`, then installs subtype vtable `0x005dee50`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579e2a,26,surface_decoder_release_tag_0x41_variant_vtable_0x5dee50,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x41` subtype vtable `0x005dee50`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579e4b,26,surface_decoder_ctor_tag_0x43_variant_vtable_0x5dee60_auxmode2_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x43` with auxiliary mode `2` and sample stride `0x20`, then installs subtype vtable `0x005dee60`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579e67,26,surface_decoder_release_tag_0x43_variant_vtable_0x5dee60,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x43` subtype vtable `0x005dee60`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579e88,26,surface_decoder_ctor_tag_0x46_variant_vtable_0x5dee70_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x46` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005dee70`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579ea4,26,surface_decoder_release_tag_0x46_variant_vtable_0x5dee70,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x46` subtype vtable `0x005dee70`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579ec5,26,surface_decoder_ctor_tag_0x31545844_variant_vtable_0x5dee80_auxmode1_stride0x10,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x31545844` with auxiliary mode `1` and sample stride `0x10`, then installs subtype vtable `0x005dee80`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x00579ee1,26,surface_decoder_release_tag_0x31545844_variant_vtable_0x5dee80,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x31545844` subtype vtable `0x005dee80`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x0057ecff,126,surface_vec4_block_unpremultiply_rgb_by_alpha_with_clamp,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Shared vec4-block postprocess helper in the `DXT2` and `DXT4` decode path. The helper walks sixteen caller output vec4s, clamps each alpha lane to `[0,1]`, zeros RGB when alpha is nonpositive, divides RGB by alpha when `0 < alpha < 1` with per-channel saturation at `1`, and otherwise leaves the sample unchanged. This is the safest current read for unpremultiplying one vec4 block's RGB by alpha with clamp rather than naming a higher-level format owner.","objdump + local disassembly + caller inspection + DXT-correlation + alpha-correlation + block-postprocess correlation"
0x0057ed7d,48,surface_vec4_block_premultiply_rgb_by_alpha,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Shared vec4-block preprocess helper in the `DXT2` and `DXT4` encode path. The helper walks sixteen caller input vec4s, copies alpha through unchanged, and writes a second vec4 block with RGB multiplied by alpha. This is the safest current read for premultiplying one vec4 block's RGB by alpha rather than naming a higher-level format owner.","objdump + local disassembly + caller inspection + DXT-correlation + alpha-correlation + block-preprocess correlation"
0x0057edad,38,math_set_x87_rounding_mode_and_save_control_word_global_0xdb89e0,support,cdecl,inferred,objdump + local disassembly + caller inspection,1,"Tiny x87 control-word helper. The function snapshots the current x87 control word into global `0x00db89e0`, forces the rounding-control bits to `0x0c00`, and reloads the patched control word. This is the safest current read for setting one x87 rounding mode while saving the prior control word globally rather than naming one specific caller policy.","objdump + local disassembly + caller inspection + x87-control-word correlation"
0x0057edd0,250,surface_pack_rgb565_word_from_clamped_vec3_with_saved_x87_rounding_mode,support,thiscall,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Shared RGB565 quantizer immediately beneath the block-compressed surface helpers. The function clamps the caller RGB float triplet to `[0,1]`, temporarily forces the x87 rounding mode through `0x0057edad`, scales the red and blue lanes to five-bit range and the green lane to six-bit range, rounds those three integers, restores the saved control word from `0x00db89e0`, and returns the packed word `(r<<11) | (g<<5) | b` in `EAX`. This is the safest current read for packing one clamped vec3 into RGB565 rather than naming a higher-level tile owner.","objdump + local disassembly + caller inspection + x87-control-word correlation + RGB565-correlation + quantization correlation"
0x0057eeca,772,surface_encode_select_two_alpha_endpoints_for_dxt45_block_from_16_scalar_samples,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Shared alpha-endpoint fitter in the `DXT4/5` block encoder family. The helper chooses one of two alpha-ladder weight tables based on caller mode `6` versus `8`, scans the sixteen caller scalar samples to seed one endpoint pair, and then iteratively reassigns samples onto the ladder, accumulates weighted sums, and solves two refined endpoint values up to eight times before clamping both results back into `[0,1]`. This is the safest current read for selecting the two interpolated-alpha endpoints for one `DXT4/5` block rather than naming a broader tile owner.","objdump + local disassembly + caller inspection + DXT-correlation + alpha-correlation + endpoint-fit correlation"
0x0057f1cf,1387,surface_encode_select_two_color_endpoints_for_dxt1_family_block_from_16_vec3_samples,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Shared color-endpoint fitter beneath the `DXT1`-family block encoders. The helper scans sixteen caller vec3 samples for a bounding box, early-outs to that box when the extent is effectively degenerate, otherwise normalizes the samples around the box center, accumulates directional moments to choose one dominant axis, and then iteratively reassigns samples onto the caller-selected `3`-color or `4`-color ladder, solving refined endpoint vec3s up to eight times before clamping them back into `[0,1]`. This is the safest current read for selecting the two color endpoints for one `DXT1`/`DXT2`/`DXT3`/`DXT4`/`DXT5` color block rather than naming a broader tile owner.","objdump + local disassembly + caller inspection + DXT-correlation + color-correlation + endpoint-fit correlation"
0x0057f73a,2043,surface_encode_dxt1_family_color_block_from_vec4_samples_with_optional_transparent_mode,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Primary color-block owner in the `DXT1` encoder family. The helper optionally inspects the sixteen caller alpha lanes to choose between the transparent `3`-color and opaque `4`-color policy, handles the all-transparent fast path, accumulates quantized and floating color statistics for the sixteen vec4 samples, invokes `0x0057f1cf` to fit float endpoint colors, quantizes those endpoints through `0x0057edd0`, expands them back through `0x0057ecb3`, orders them to match the chosen `DXT1` policy, and writes the final selector bits into the caller output block. This is the safest current read for encoding one shared `DXT1`-family color block from vec4 samples rather than overclaiming one higher-level format wrapper.","objdump + local disassembly + caller inspection + DXT-correlation + RGB565-correlation + block-encode correlation"
0x00579f02,679,surface_decoder_build_or_refresh_dxt_cached_tile_strip_and_copy_region_to_output,support,thiscall,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Broader cached-output owner in the `DXT` decoder family. The helper lazily allocates the cached tile strip at `[obj+0x10b8]`, tracks the aligned cached block origin under `[obj+0x10b0/+0x10b4]`, and when that origin changes it rebuilds the strip by walking the needed block rows and invoking the primary decode kernel `[obj+0x1084]` into one `0x10`-byte-per-sample cache. It then copies the requested region from that cache into the caller output buffer, and when clip state `[obj+0x10]` is live it quantizes and checks each output vec4 against thresholds `[obj+0x1c..+0x28]`, zeroing the whole vec4 when every lane exceeds its threshold. This is the safest current read for building or refreshing one cached `DXT` tile strip and copying the requested region to output rather than overclaiming one exact block algorithm.","objdump + local disassembly + caller inspection + DXT-correlation + cached-strip correlation + clip-threshold correlation"
0x0057ff3e,318,surface_decoder_build_dxt1_color_palette_vec4x4_from_two_rgb565_words,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Shared `DXT1` color-core helper in the block-compressed decoder family. The function expands the two caller `RGB565` endpoint words into temporary float vec4 colors through `0x0057ecb3`, then builds the four-entry color palette written to the caller output block. When endpoint `0 <= 1`, it emits the midpoint color as the third entry and a zero vec4 as the fourth; otherwise it emits the standard two weighted interpolants between the endpoints. This is the safest current read for building one `DXT1` color palette vec4x4 from two `RGB565` words rather than naming a higher-level tile owner.","objdump + local disassembly + caller inspection + DXT-correlation + RGB565-correlation + palette-build correlation"
0x0058007c,131,surface_decoder_decode_dxt23_block_explicit_alpha_and_color_core,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Shared explicit-alpha block core for the `DXT2` and `DXT3` decoder family. The helper first builds the four-entry color palette from the trailing color block through `0x0057ff3e`, then decodes the leading two `u32` alpha-nibble words into sixteen normalized alpha floats and writes them into the caller output's `.w` lanes. This is the safest current read for the shared `DXT2/3` explicit-alpha and color decode core rather than overclaiming one premultiplication policy.","objdump + local disassembly + caller inspection + DXT-correlation + explicit-alpha correlation + palette-build correlation"
0x005800ff,315,surface_decoder_decode_dxt45_block_interpolated_alpha_and_color_core,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Shared interpolated-alpha block core for the `DXT4` and `DXT5` decoder family. The helper first builds the four-entry color palette from the trailing color block through `0x0057ff3e`, then decodes the leading alpha-endpoint and selector bytes into one alpha ladder and applies those interpolated alpha values across the sixteen caller output vec4s. This is the safest current read for the shared `DXT4/5` interpolated-alpha and color decode core rather than overclaiming one premultiplication policy.","objdump + local disassembly + caller inspection + DXT-correlation + interpolated-alpha correlation + palette-build correlation"
0x0058023b,24,surface_decoder_encode_dxt1_block_from_vec4_samples,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Secondary block-write kernel in the `DXT1` family. The helper is a thin wrapper over shared block encoder `0x0057f73a` with the caller flag set for the `DXT1` policy branch. This is the safest current read for encoding one `DXT1` block from vec4 samples rather than naming a broader tile owner.","objdump + local disassembly + caller inspection + DXT-correlation + wrapper correlation + block-encode correlation"
0x00580253,275,surface_decoder_encode_dxt23_explicit_alpha_block_from_vec4_samples,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Shared block-write kernel in the `DXT2` and `DXT3` encoder family. The helper packs the sixteen caller alpha lanes into the leading explicit-alpha block as two nibble-coded dwords, then re-enters shared color encoder `0x0057f73a` on the trailing color half with the non-`DXT1` policy flag. This is the safest current read for encoding one `DXT2/3` explicit-alpha block from vec4 samples rather than overclaiming one premultiplication policy.","objdump + local disassembly + caller inspection + DXT-correlation + explicit-alpha correlation + block-encode correlation"
0x00580367,1105,surface_decoder_encode_dxt45_interpolated_alpha_block_from_vec4_samples,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Shared block-write kernel in the `DXT4` and `DXT5` encoder family. The helper scans the sixteen caller alpha lanes, chooses alpha endpoints and selector ladders for the leading compressed-alpha block, writes that block, and then re-enters the shared color encoder on the trailing color half. This is the safest current read for encoding one `DXT4/5` interpolated-alpha block from vec4 samples rather than overclaiming one premultiplication policy.","objdump + local disassembly + caller inspection + DXT-correlation + interpolated-alpha correlation + block-encode correlation"
0x005807b9,35,surface_decoder_decode_dxt2_block_then_unpremultiply_rgb_by_alpha,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Thin `DXT2` wrapper above the shared `DXT2/3` explicit-alpha block core `0x0058007c`. After the core decode succeeds, the helper re-enters `0x0057ecff` on the caller output block to unpremultiply RGB by alpha with clamp before returning success. This is the safest current read for the dedicated `DXT2` decode wrapper rather than naming a broader tile owner.","objdump + local disassembly + caller inspection + DXT-correlation + explicit-alpha correlation + unpremultiply correlation"
0x005807dc,35,surface_decoder_decode_dxt4_block_then_unpremultiply_rgb_by_alpha,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Thin `DXT4` wrapper above the shared `DXT4/5` interpolated-alpha block core `0x005800ff`. After the core decode succeeds, the helper re-enters `0x0057ecff` on the caller output block to unpremultiply RGB by alpha with clamp before returning success. This is the safest current read for the dedicated `DXT4` decode wrapper rather than naming a broader tile owner.","objdump + local disassembly + caller inspection + DXT-correlation + interpolated-alpha correlation + unpremultiply correlation"
0x005807ff,52,surface_decoder_encode_dxt2_block_via_premultiply_then_dxt23_core,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Thin `DXT2` block-write wrapper above shared explicit-alpha encoder `0x00580253`. The helper first re-enters `0x0057ed7d` to premultiply one caller vec4 block into a temporary stack buffer, then passes that temporary block through the shared `DXT2/3` encoder core. This is the safest current read for encoding one `DXT2` block via premultiply then shared `DXT2/3` core rather than naming a broader tile owner.","objdump + local disassembly + caller inspection + DXT-correlation + premultiply correlation + wrapper correlation"
0x00580833,52,surface_decoder_encode_dxt4_block_via_premultiply_then_dxt45_core,support,cdecl,inferred,objdump + local disassembly + caller inspection + DXT-correlation,2,"Thin `DXT4` block-write wrapper above shared interpolated-alpha encoder `0x00580367`. The helper first re-enters `0x0057ed7d` to premultiply one caller vec4 block into a temporary stack buffer, then passes that temporary block through the shared `DXT4/5` encoder core. This is the safest current read for encoding one `DXT4` block via premultiply then shared `DXT4/5` core rather than naming a broader tile owner.","objdump + local disassembly + caller inspection + DXT-correlation + premultiply correlation + wrapper correlation"
0x0057ab70,26,surface_decoder_release_tag_0x23250714_packed_yuv422_variant_vtable_0x5def10,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the packed-YUV-422 custom-tag subtype reached from factory tag `0x23250714` and vtable `0x005def10`. The helper re-enters the shared packed-YUV-422 base release `0x0057a37f`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + packed-yuv correlation + tag-dispatch correlation"
0x0057ab91,26,surface_decoder_release_yuy2_packed_yuv422_variant_vtable_0x5def20,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the `YUY2` packed-YUV-422 subtype vtable `0x005def20`. The helper re-enters the shared packed-YUV-422 base release `0x0057a37f`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + packed-yuv correlation + tag-dispatch correlation"
0x0057abb2,18,mapped_file_view_context_init_closed_handle_sentinels_and_clear_view_fields,support,thiscall,inferred,objdump + local disassembly + local field inspection,2,"Tiny initializer for the local `0x10`-byte mapped-file view context used by `0x0057abc4`. The helper seeds file and mapping handles `[this+0x00/+0x04]` to `-1` and clears mapped-view pointer `[this+0x08]` plus size field `[this+0x0c]` to `0`.","objdump + local disassembly + local field inspection + mapped-file correlation"
0x0057abc4,270,mapped_file_view_context_open_path_create_readonly_mapping_and_map_full_view,support,thiscall,inferred,objdump + local disassembly + import-call correlation + local field inspection,2,"Broader open owner for the same `0x10`-byte mapped-file view context. The helper validates the caller path, optionally converts it through one local wide-path scratch branch when the second caller pointer is present, opens the file for read access through one of the paired import thunks, creates a read-only file mapping, maps the full file view, queries file size, and stores the resulting file handle, mapping handle, view pointer, and file size into `[this+0x00/+0x04/+0x08/+0x0c]`. On failure it tears the partially built state back down and returns the corresponding error code.","objdump + local disassembly + import-call correlation + local field inspection + mapped-file correlation"
0x0057acd4,65,mapped_file_view_context_unmap_view_close_mapping_and_file,support,thiscall,inferred,objdump + local disassembly + import-call correlation + local field inspection,2,"Release-side owner for the same mapped-file view context. The helper unmaps live view `[this+0x08]`, closes mapping handle `[this+0x04]`, closes file handle `[this+0x00]`, resets the two handles back to `-1`, clears the view pointer, and returns `0`.","objdump + local disassembly + import-call correlation + local field inspection + mapped-file correlation"
0x0057ad15,10,mapped_file_view_context_release_if_file_handle_live,support,thiscall,inferred,objdump + local disassembly + caller inspection + mapped-file correlation,2,"Tiny conditional-release wrapper for the mapped-file view context. When primary file handle `[this+0x00]` is not `-1`, the helper re-enters `0x0057acd4`; otherwise it returns immediately.","objdump + local disassembly + caller inspection + mapped-file correlation"
0x0057a1ab,26,surface_decoder_ctor_tag_0x36314c41_variant_vtable_0x5dee90_auxmode1_stride0x20,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x36314c41` with auxiliary mode `1` and sample stride `0x20`, then installs subtype vtable `0x005dee90`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x0057a1c7,26,surface_decoder_release_tag_0x36314c41_variant_vtable_0x5dee90,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x36314c41` subtype vtable `0x005dee90`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x0057a1e8,26,surface_decoder_ctor_tag_0x36315220_variant_vtable_0x5deea0_auxmode1_stride0x30,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x36315220` with auxiliary mode `1` and sample stride `0x30`, then installs subtype vtable `0x005deea0`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x0057a204,26,surface_decoder_release_tag_0x36315220_variant_vtable_0x5deea0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x36315220` subtype vtable `0x005deea0`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x0057a225,26,surface_decoder_ctor_tag_0x36315241_variant_vtable_0x5deeb0_auxmode1_stride0x40,support,thiscall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin descriptor-driven subtype wrapper above shared decoder base `0x00575b34`. The helper forwards the caller descriptor for factory tag `0x36315241` with auxiliary mode `1` and sample stride `0x40`, then installs subtype vtable `0x005deeb0`. Current static evidence is sufficient to carry the row by factory tag, aux mode, and stride.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x0057a241,26,surface_decoder_release_tag_0x36315241_variant_vtable_0x5deeb0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation + tag-dispatch correlation,1,"Thin release wrapper for the factory tag `0x36315241` subtype vtable `0x005deeb0`. The helper re-enters shared base release `0x00575366`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + decoder-base correlation + tag-dispatch correlation"
0x0057a262,22,surface_decoder_ctor_dxt1_variant,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,1,"Thin `DXT1` constructor wrapper under `0x0057a3f8`. The helper forwards the caller descriptor through the shared `DXT` base constructor `0x0057989d`, then installs subtype vtable `0x005deec0` and returns the constructed decoder object.","objdump + local disassembly + caller inspection + tag-dispatch correlation + DXT1-correlation"
0x0057a27a,26,surface_decoder_release_dxt_variant_vtable_0x5deec0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation,1,"Thin release wrapper for `DXT1` subtype vtable `0x005deec0`. The helper re-enters the broader `DXT` family release `0x00575677`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + DXT-correlation"
0x0057a29b,22,surface_decoder_ctor_dxt2_variant,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,1,"Thin `DXT2` constructor wrapper under `0x0057a3f8`. The helper forwards the caller descriptor through the shared `DXT` base constructor `0x0057989d`, then installs subtype vtable `0x005deed0` and returns.","objdump + local disassembly + caller inspection + tag-dispatch correlation + DXT2-correlation"
0x0057a2b3,26,surface_decoder_release_dxt_variant_vtable_0x5deed0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation,1,"Thin release wrapper for `DXT2` subtype vtable `0x005deed0`. The helper re-enters the broader `DXT` family release `0x00575677`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + DXT-correlation"
0x0057a2d4,22,surface_decoder_ctor_dxt3_variant,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,1,"Thin `DXT3` constructor wrapper under `0x0057a3f8`. The helper forwards the caller descriptor through the shared `DXT` base constructor `0x0057989d`, then installs subtype vtable `0x005deee0` and returns.","objdump + local disassembly + caller inspection + tag-dispatch correlation + DXT3-correlation"
0x0057a2ec,26,surface_decoder_release_dxt_variant_vtable_0x5deee0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation,1,"Thin release wrapper for `DXT3` subtype vtable `0x005deee0`. The helper re-enters the broader `DXT` family release `0x00575677`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + DXT-correlation"
0x0057a30d,22,surface_decoder_ctor_dxt4_variant,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,1,"Thin `DXT4` constructor wrapper under `0x0057a3f8`. The helper forwards the caller descriptor through the shared `DXT` base constructor `0x0057989d`, then installs subtype vtable `0x005deef0` and returns.","objdump + local disassembly + caller inspection + tag-dispatch correlation + DXT4-correlation"
0x0057a325,26,surface_decoder_release_dxt_variant_vtable_0x5deef0,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation,1,"Thin release wrapper for `DXT4` subtype vtable `0x005deef0`. The helper re-enters the broader `DXT` family release `0x00575677`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + DXT-correlation"
0x0057a346,22,surface_decoder_ctor_dxt5_variant,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,1,"Thin `DXT5` constructor wrapper under `0x0057a3f8`. The helper forwards the caller descriptor through the shared `DXT` base constructor `0x0057989d`, then installs subtype vtable `0x005def00` and returns.","objdump + local disassembly + caller inspection + tag-dispatch correlation + DXT5-correlation"
0x0057a35e,26,surface_decoder_release_dxt_variant_vtable_0x5def00,support,stdcall,inferred,objdump + local disassembly + caller inspection + wrapper correlation,1,"Thin release wrapper for `DXT5` subtype vtable `0x005def00`. The helper re-enters the broader `DXT` family release `0x00575677`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + caller inspection + wrapper correlation + DXT-correlation"
0x0057a37f,73,surface_decoder_release_packed_yuv422_base_flush_live_aux_and_release_storage,support,thiscall,inferred,objdump + local disassembly + caller inspection + packed-yuv correlation,2,"Release-side owner for the shared packed-YUV-422 base family. The helper first flushes live auxiliary sample state through `0x0057909e`, releases the optional auxiliary sample table `[obj+0x106c]`, and then tails into shared base release `0x00575366`. This is the safest current read for releasing the packed-YUV-422 base while preserving pending writeback rather than a generic destructor stub.","objdump + local disassembly + caller inspection + packed-yuv correlation + release correlation + reverse-writeback correlation"
0x0057a3c8,22,surface_decoder_ctor_tag_0x23250714_packed_yuv422_variant,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,1,"Thin packed-YUV-422 constructor wrapper under `0x0057a3f8` for custom FourCC-like tag `0x23250714`. The helper forwards the caller descriptor through shared base constructor `0x00578eef`, then installs subtype vtable `0x005def10` and returns. Current evidence is sufficient to carry the row at the shared packed-YUV base and custom-tag level.","objdump + local disassembly + caller inspection + tag-dispatch correlation + packed-yuv correlation"
0x0057a3dd,3,surface_decoder_return_this_after_packed_yuv422_variant_ctor,support,stdcall,inferred,objdump + local disassembly + caller inspection,1,"Tiny shared epilogue fragment reached by the packed-YUV-422 variant constructors at `0x0057a3c8` and `0x0057a3e0`. The code simply returns the constructed object pointer in `eax`. It is grounded here only because it appears as a stable shared tail entry in the local decoder-factory strip.","objdump + local disassembly + caller inspection"
0x0057a3e0,22,surface_decoder_ctor_yuy2_packed_yuv422_variant,support,thiscall,inferred,objdump + local disassembly + caller inspection + tag-dispatch correlation,1,"Thin `YUY2` packed-YUV-422 constructor wrapper under `0x0057a3f8`. The helper forwards the caller descriptor through shared base constructor `0x00578eef`, then installs subtype vtable `0x005def20` and returns.","objdump + local disassembly + caller inspection + tag-dispatch correlation + YUY2-correlation + packed-yuv correlation"
0x0057a3f5,3,surface_decoder_enter_format_tag_factory_tail,support,stdcall,inferred,objdump + local disassembly + caller inspection,1,"Tiny shared tail entry immediately before the broader format-tag decoder factory `0x0057a3f8`. The code serves only as the final return edge of the preceding packed-YUV-422 constructor wrapper strip. It is recorded here to keep the local seam closed, not because it carries standalone subsystem semantics.","objdump + local disassembly + caller inspection"
0x0057a3f8,2847,surface_decoder_factory_create_by_format_tag_and_run_post_init,support,stdcall,inferred,objdump + local disassembly + caller inspection + decode-chain correlation + tag-dispatch correlation,2,"Broader tag-dispatch factory used by `0x00574dbb` to materialize one decoder-side object from the caller descriptor at `[arg+0x04]`. The helper switches over the numeric and FourCC-like format tags, allocates one subtype object of size `0x106c`, `0x109c`, or `0x10c4`, forwards the original descriptor into one subtype-specific constructor strip such as `0x578ed3`, `0x579008`, `0x57a1ab`, `0x57a225`, `0x57a262`, `0x57a29b`, `0x57a2d4`, `0x57a30d`, `0x57a346`, `0x57a3c8`, or `0x57a3e0`, and then invokes vtable slot `+0x0c` when the constructed object exposes a non-null field at `[obj+0x10]`. This is the safest current read for creating one decoder object by format tag and running its post-init step rather than naming any one subtype family prematurely.","objdump + local disassembly + caller inspection + decode-chain correlation + tag-dispatch correlation + object-factory correlation"
0x00571016,26,refcounted_object_vtable_0x5def30_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for object family `0x005def30`. The helper re-enters destructor `0x0057ad20`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`. Current grounded caller is refcount helper `0x0057aedb`.","objdump + local disassembly + object-family correlation + refcount correlation"
0x00571032,26,refcounted_object_vtable_0x5def5c_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for sibling object family `0x005def5c`. The helper re-enters destructor `0x0057af0e`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + object-family correlation + refcount correlation"
0x00571493,210,math_dispatch_table_0x625c88_initialize_or_reset_from_seed_0x625d70_and_patch_feature_variants,bootstrap,cdecl,inferred,objdump + local disassembly + caller inspection,3,"One-time initializer and reset helper for the shared x87 or feature-dispatch math table rooted at `0x00625c88`. When caller flag `0` is passed, the helper copies `0x39` dwords from seed table `0x00625d70` into the live dispatch table and resets state word `0x00625e5c` to `0xffff`. On the first live-use path with caller flag `1`, it copies the same seed table, runs the local feature probes through `0x0057ec77`, `0x005711e8`, and `0x005713df`, and then patches selected dispatch slots in place so wrapper entries like `0x0056c890`, `0x0056c948`, `0x0056ca21`, `0x0056cacd`, `0x0056cba5`, `0x0056cca0`, `0x0056cf7f`, `0x0056d07a`, and `0x0056d197` can tail into faster implementations instead of the default x87 fallbacks.","objdump + local disassembly + caller inspection + cpu-feature correlation + dispatch-table correlation + x87-fallback correlation"
0x0054eb10,376,shell_input_handle_window_command_and_toggle_messages,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Processes one shell window-command or toggle-style input message into the shell-input ring. The helper tracks the last packed command or coordinate tuple under `[this+0xa94/+0xa98/+0xa9c]`, iterates eight local branch families, toggles selected state bits in `[this+0xa8c]`, synthesizes 12-dword records with types such as `1`, `2`, `5`, `6`, `7`, `8`, `9`, `10`, and `11`, and enqueues those records through `0x0054e880`. Current grounded caller is the `WM_COMMAND` branch in `shell_controller_window_message_dispatch` `0x0054e3a0`, so this is the safest current read for the shell-input command or toggle message owner rather than a generic control callback.","objdump + caller inspection + local disassembly + event-ring correlation + command-message correlation"
0x0054ee50,544,shell_input_handle_window_mouse_message_and_enqueue_events,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Primary shell mouse-message handler for the `0x0200..0x0208` window-message family. The helper first deduplicates repeated `WM_MOUSEMOVE` coordinates against globals `0x0062545c/0x00625460`, then routes the live message through the shared shell-input command or toggle worker `0x0054eb10` and the surrounding pointer-state branches. Current evidence grounds this as the mouse-message ingress owner beneath `shell_controller_window_message_dispatch` `0x0054e3a0`, with local state updates flowing into the event-ring helpers `0x0054e880`, `0x0054e9c0`, and `0x0054ea20`.","objdump + caller inspection + local disassembly + mouse-message correlation + event-ring correlation"
0x0054f290,480,shell_input_apply_window_key_transition,shell,thiscall,inferred,objdump + analysis-context,4,Normalizes one `WM_KEYDOWN` or `WM_KEYUP` transition for the shell input object at 0x006d4018. The helper samples `GetKeyboardState` optionally derives an ASCII byte through `ToAscii` updates the 256-byte per-key table starting at [this+0x100] and maps selected keyboard scan codes into packed modifier flags at [this+0xa8c]: 0x1d sets or clears bit 0x4 Control 0x2a sets or clears bit 0x2 Left Shift 0x36 sets or clears bit 0x1 Right Shift and 0x38 sets or clears bit 0x20 Alt. It then forwards the synthesized event record through 0x0054e9c0 for later shell consumers. The shell controller window dispatcher at 0x0054e3a0 is the grounded caller.,objdump + analysis-context + import table + callsite inspection
0x0054f4d0,109,shell_input_snapshot_dispatch_state,shell,thiscall,inferred,objdump + analysis-context,3,Captures one filtered snapshot of the current shell input object state into a 0x30-byte caller buffer while temporarily zeroing the nested-dispatch counter at [this+0xa90]. Several shell and cursor consumers use this as the read-side companion to shell_input_apply_window_key_transition optionally passing the snapshot through the callback hook stored at 0x006d4008 before consuming it.,objdump + analysis-context + caller xrefs
0x0054f5b0,140,shell_input_enqueue_window_event_record_and_signal_dispatch,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Queues one 12-dword shell-input event record into the rotating ring rooted at `[this+0x128]`. The helper copies six caller-supplied dwords into one local 12-dword scratch record, rewrites ring index `[this+0xa88]` from `0x32` back to `0x31` when needed, writes the record into slot `[this+0x128 + index*0x30]`, increments the ring index, and then signals the downstream dispatch path through `0x0054e880`. Current grounded caller is the shell window-message dispatcher `0x0054e3a0` on the low-message branch that synthesizes event id `0xcd`, so this is the safest current read for the shell-input event enqueue-plus-signal helper rather than another keyboard-state primitive.","objdump + caller inspection + local disassembly + ring-buffer correlation"
0x0054f540,111,shell_input_cursor_inside_active_view,shell,cdecl,inferred,objdump + analysis-context,3,Returns whether the current cursor position should count as being inside the active shell controller view. When controller byte [0x006d4024+0x114226] is already set it returns true immediately; otherwise it samples the host cursor through `GetCursorPos` converts it into client coordinates for the active controller window through `ScreenToClient` and checks that point against the current view bounds selected from the shell controller table at [0x006d4024+0x34] and [0x006d4024+0x11421e]. Current grounded callers are the mouse-cursor mode helper at 0x0053f450 and the shell camera action helper at 0x004e0780 which suggests later world-relative cursor work still reuses the same shell controller path rather than a separate gameplay-only input object.,objdump + analysis-context + import table + caller xrefs
0x0054f640,83,shell_step_global_presentation_phase_scalar,shell,cdecl,inferred,ghidra-headless,2,Steps the shared presentation-phase scalar stored at 0x00d93850 downward by a small constant then clamps the returned value against fixed lower-bound constants. Callout-marker world-anchor and other presentation helpers use this as a common time-varying scalar after one of the nearby setters has seeded the global phase.,ghidra + rizin + llvm-objdump
0x0054f6a0,11,shell_set_global_presentation_phase_scalar_constant_0x3b30f27c,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Tiny fixed-value setter for the shared presentation-phase scalar at `0x00d93850`. The helper stores literal float bit-pattern `0x3b30f27c` and returns immediately. Current grounded caller is shell-side branch `0x00538b72`, so this is the safest current read as one alternate fixed phase seed in the same strip as `0x0054f640` and `0x0054f700`.","objdump + caller inspection + local disassembly + presentation-phase correlation"
0x0054f6b0,11,shell_set_global_presentation_phase_scalar_constant_0x3baa64c3,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Second tiny fixed-value setter for the shared presentation-phase scalar at `0x00d93850`. The helper stores literal float bit-pattern `0x3baa64c3` and returns immediately. Current grounded callers are shell-side branches `0x0052819d` and `0x0052b9f8`, so this is the safest current read as another alternate fixed phase seed beside `0x0054f6a0`, `0x0054f6c0`, and `0x0054f700`.","objdump + caller inspection + local disassembly + presentation-phase correlation"
0x0054f6c0,11,mouse_cursor_set_primary_motion_scalar_default,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Tiny `MouseCursor.cpp` helper that seeds global float `0x00d93850` with the fixed default scalar `0x3951b717`. Current grounded caller is the per-frame mouse-cursor updater `0x0053f4e0`, which uses this as one of its reset-side scalar leaves before the later cursor-presentation pass.","objdump + caller inspection + local disassembly + mouse-cursor correlation"
0x0054f6d0,11,mouse_cursor_snapshot_primary_motion_scalar_into_saved_slot,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Tiny `MouseCursor.cpp` helper that copies the current primary motion scalar from `0x00d93850` into saved slot `0x00625464`. Current grounded caller is the per-frame mouse-cursor updater `0x0053f4e0`.","objdump + caller inspection + local disassembly + mouse-cursor correlation"
0x0054f6e0,21,mouse_cursor_restore_primary_motion_scalar_from_saved_slot_and_clear_saved_slot,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Tiny `MouseCursor.cpp` helper that restores global motion scalar `0x00d93850` from saved slot `0x00625464` and then clears the saved slot back to `-1.0f`. Current grounded caller is the per-frame mouse-cursor updater `0x0053f4e0`, where it acts as the tail-side restore companion to `0x0054f6d0`.","objdump + caller inspection + local disassembly + mouse-cursor correlation"
0x0054f700,12,shell_set_global_presentation_phase_scalar,shell,cdecl,inferred,ghidra-headless,3,Stores one caller-supplied float into the shared presentation-phase scalar at 0x00d93850. Mouse-cursor geographic-label and other presentation helpers seed this global before later batch or marker helpers consume it through 0x0054f640.,ghidra + rizin + llvm-objdump
0x0054f710,729,shell_queue_callout_segment_marker,shell,cdecl,inferred,ghidra-headless,2,Queues one short world-space callout segment or marker packet using the shell zoom table rooted at [0x006d4024+0x11421e] and [0x006d4024+0x34]. The helper derives scaled endpoint deltas from the caller inputs applies flag-controlled clamps from arg_14h and emits three type-0x01 deferred messages through shell_enqueue_deferred_message_type1.,ghidra + rizin + llvm-objdump
0x0054f9f0,281,shell_queue_callout_frame_segments,shell,cdecl,inferred,ghidra-headless,4,Builds a four-segment callout frame around one projected extent box. The helper samples the same shell zoom and reciprocal scale tables under 0x006d4024 computes the four box legs from the caller extent inputs and emits each side through shell_queue_callout_segment_marker.,ghidra + rizin + llvm-objdump
0x0054fb10,699,shell_queue_callout_leader_path,shell,cdecl,inferred,ghidra-headless,3,Builds one longer world-space callout leader path between two points. It derives slope and angle terms from the caller inputs recursively reuses itself or 0x0054f710 for shorter segments chooses style branches from distance and flag tests and enqueues the resulting type-0x01 deferred messages. shell_publish_text_callout_presentation uses this helper for text-associated leader geometry.,ghidra + rizin + llvm-objdump
0x0054fdd0,256,shell_queue_presentation_batch_pair,shell,cdecl,inferred,ghidra-headless,2,Queues a two-record presentation batch through the shell deferred-message path. One branch emits a single trailing type-0x04 record while the other brackets two type-0x04 payload posts with direct type-0x05 and type-0x06 begin-end records; both legs seed their animated scalar through shell_step_global_presentation_phase_scalar before routing through the shell bundle at 0x006d4024.,ghidra + rizin + llvm-objdump
0x0054fed0,440,shell_queue_presentation_batch_quad,shell,cdecl,inferred,ghidra-headless,2,Queues a four-record presentation batch through the same deferred-message family. It posts a type-0x05 begin record emits four type-0x04 payload records with refreshed phase scalars from shell_step_global_presentation_phase_scalar and finally closes the batch with a type-0x06 end record. The current high-level callers build this from four related point or extent tuples.,ghidra + rizin + llvm-objdump
0x005519f0,902,shell_publish_text_callout_presentation,shell,cdecl,inferred,ghidra-headless,3,Publishes one styled text or callout presentation payload through the active shell bundle at 0x006d4024. It accepts text placement and style inputs conditionally emits a leader path through 0x0054fb10 allocates backing text resources through 0x0051f0b0 and 0x00543c10 sets presentation flags from the mode arguments and finalizes the payload through 0x0051fc20. Geographic-label text and mouse-cursor presentation both feed this helper.,ghidra + rizin + llvm-objdump + strings
0x00552160,56,world_anchor_measure_projected_half_width,shell,cdecl,inferred,ghidra-headless,3,Measures one absolute projected half-width-like extent from the caller world-anchor object. It chooses the X or Z span depending on orientation byte [this+0x24] scales by the owner coefficients at +0x2e or +0x32 multiplies by local width scalar [this+0x1c] and returns the absolute result for later cursor or marker placement code.,ghidra + rizin + llvm-objdump
0x005521a0,56,world_anchor_measure_projected_half_height,shell,cdecl,inferred,ghidra-headless,3,Measures one absolute projected half-height-like extent from the caller world-anchor object. It chooses the complementary axis span using the same orientation byte [this+0x24] scales by owner coefficients at +0x2e or +0x32 multiplies by local height scalar [this+0x20] and returns the absolute result for later cursor or marker placement code.,ghidra + rizin + llvm-objdump
0x005521e0,894,world_anchor_project_screen_extent_pair,shell,cdecl,inferred,ghidra-headless,3,Projects one world-anchor object into a paired screen-space extent result. The helper samples the shell zoom table under 0x006d4024 computes integer-scaled axis spans from the anchor geometry converts them through multiple clamp or reciprocal stages and writes two output integers through the caller pointers before later marker builders use the results for anchor presentation sizing.,ghidra + rizin + llvm-objdump
0x00552560,916,shell_queue_world_anchor_marker,shell,cdecl,inferred,ghidra-headless,3,Builds one world-anchor marker packet from the caller point object and optional scale or style inputs. It samples anchor extents from the object fields converts them through 0x0053dde0 0x0053ddf0 and world_anchor_project_screen_extent_pair consults the shell zoom table rooted at [0x006d4024+0x11421e] and [0x006d4024+0x34] and finally enqueues one type-0x01 deferred message through shell_enqueue_deferred_message_type1. mouse_cursor_update_frame_state uses it for one branch of cursor world-relative presentation.,ghidra + rizin + llvm-objdump
0x00552900,1304,shell_queue_projected_world_anchor_quad,shell,cdecl,inferred,ghidra-headless,3,Builds one oriented projected quad around the caller world-anchor object. It derives four projected corner points from the anchor extents and orientation computes edge and diagonal lengths through 0x0051db80 samples the shared presentation phase through shell_step_global_presentation_phase_scalar refines screen-space bounds through world_anchor_project_screen_extent_pair and finally emits two type-0x04 deferred-message posts through shell_enqueue_deferred_message_type4.,ghidra + rizin + llvm-objdump
0x00552f30,109,shell_map_bundle_codec_context_read_bytes_and_publish_progress,shell,fastcall,inferred,objdump + caller inspection + local disassembly,2,"Callback-side read helper used by the map-bundle codec wrappers rooted at `0x00553000` and `0x00553120`. The helper resolves the active source span from global context `0x00d93984`, copies up to the caller-requested byte count into the destination pointer in `ECX`, advances source offset `[ctx+0x04]`, and when progress callback `0x00d93988` is live publishes the scaled percentage derived from `[ctx+0x04] / [ctx+0x08]`. Current grounded callers are the two codec families `0x0056be10/0x0056bfe0` and `0x0056c3e0/0x0056c630`, which use this as their shared source callback rather than a generic file reader.","objdump + caller inspection + local disassembly + callback correlation + bundle-codec correlation + progress-callback correlation"
0x00552fa0,65,shell_map_bundle_codec_context_write_bytes_to_allocated_output,shell,fastcall,inferred,objdump + caller inspection + local disassembly,2,"Callback-side write helper paired with `0x00552f30` under the same map-bundle codec wrappers. The helper resolves the active destination slab from global context `0x00d93984`, copies the caller byte span from `ECX` into `[ctx+0x0c] + [ctx+0x10]`, clamps against destination capacity `[ctx+0x14]`, advances the written-byte counter `[ctx+0x10]`, and returns. Current grounded callers are the same `0x0056be10/0x0056bfe0` and `0x0056c3e0/0x0056c630` codec families, which use this as their shared sink callback rather than a broad stream writer.","objdump + caller inspection + local disassembly + callback correlation + bundle-codec correlation"
0x00553000,277,shell_map_bundle_encode_payload_with_selector_0x91_or_0x92_into_allocated_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Bundle-side encode wrapper for the two callback-stream codec families used by the companion-payload and tagged-surface rewrite paths. The helper allocates one destination slab sized to source bytes `[src+0x10] + 0x10`, seeds the shared callback context at `0x00d93984`, then dispatches selector `[this+0x00] == 0x91` to `0x0056bfe0` or selector `0x92` to `0x0056c3e0` using the context callbacks `0x00552f30/0x00552fa0`. On success it publishes the allocated destination pointer and used byte count; on failure it frees the slab and returns one negative status. Current grounded callers are the companion-payload rewrite owners `0x004427c0/0x00442900`, the preview transport submitter `0x00469d30`, and the tagged surface-row exporter `0x005428c0`.","objdump + caller inspection + local disassembly + bundle-codec correlation + companion-payload correlation + tagged-surface correlation"
0x00553120,277,shell_map_bundle_decode_payload_with_header_0x91_or_0x92_into_allocated_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Bundle-side decode wrapper paired with `0x00553000`. The helper validates leading magic `0xbabe`, allocates the destination slab from stored decoded-size dword `[record+0x08]`, seeds shared callback context `0x00d93984`, and dispatches codec word `[record+0x0e] == 0x91` to `0x0056be10` or `0x92` to `0x0056c630` using the same context callbacks `0x00552f30/0x00552fa0`. On success it publishes the allocated output pointer and decoded byte count; on failure it frees the slab and returns one negative status. Current grounded caller is `surface_row_import_tagged_baba_babb_babe_payload_to_rgba_buffer` `0x00541c30`, which uses this wrapper to recover the tagged bands before repacking them into the live row.","objdump + caller inspection + local disassembly + bundle-codec correlation + tagged-payload correlation + callback correlation"
0x00553760,665,world_serialize_fixed_grid_header_mask_planes_secondary_raster_and_overlay_chunks_into_bundle,map,thiscall,inferred,objdump + caller inspection + local disassembly + bundle-tag correlation,4,"Broader fixed-band save owner beneath `world_serialize_runtime_grid_and_secondary_raster_tables_into_bundle` `0x00449520`. The helper first derives one companion resource stem from the caller path, chooses one of two literal suffixes from shell flag `[0x006d4024+0x11471a]`, and forwards that derived stem plus the caller selector into `0x00534c80`. It then emits chunk family `0x2af9/0x2afa/0x2afc` for the primary world-size and float-grid band rooted at `[this+0x15d9/+0x15d5/+0x1605]`, chunk family `0x2ced/0x2cee/0x2d51/0x2d4a/0x2cf2/0x2cf3/0x2afd` for the one-byte mask and secondary-raster companion planes rooted at `[this+0x1655/+0x1659/+0x165d/+0x1661/+0x1665/+0x162d]`, and then walks the coarse overlay-chunk table `[this+0x1685]` in `16x16` blocks, writing one presence byte per chunk and serializing each present chunk through `secondary_overlay_chunk_serialize_header_and_present_local_pages_to_stream` `0x0056b510`. It closes that coarse-chunk phase with tags `0x2afe` and `0x2b02`. Current grounded caller is the early package-save branch inside `0x00449520`, so this is the safest current read for the fixed grid-header, mask-plane, secondary-raster, and coarse-overlay-chunk serializer rather than a generic path helper.","objdump + caller inspection + local disassembly + bundle-tag correlation + coarse-overlay correlation + mask-plane correlation"
0x0051db80,32,math_measure_float_xy_pair_distance,support,cdecl,inferred,objdump + caller xrefs + callsite inspection,4,"Tiny shared float distance helper. It subtracts one caller-supplied X or Y point pair from the other, squares both deltas, sums them, and returns the Euclidean distance `sqrt(dx*dx + dy*dy)`. Current grounded callers include the city-connection chooser at `0x00402cb0`, the route-entry search family at `0x0049bd40` and `0x0049d380`, several company and world-side scoring branches, and shell presentation helpers such as `shell_queue_projected_world_anchor_quad` `0x00552900`. This now grounds `0x0051db80` as a generic float XY distance primitive rather than another opaque quality helper.","objdump + caller xrefs + callsite inspection + arithmetic inspection"
0x0051dbb0,32,math_measure_float_xy_pair_distance_squared,support,cdecl,inferred,objdump + caller xrefs + arithmetic inspection,4,"Tiny squared-distance sibling of `math_measure_float_xy_pair_distance` `0x0051db80`. It subtracts one caller-supplied float X or Y pair from the other, squares both deltas, sums them, and returns that raw squared Euclidean distance without the final `sqrt`. Current grounded callers include the region-cell nearest-assignment pass `world_region_collection_clear_cell_region_word_and_assign_nearest_region_ids` `0x00421730` and the weighted auxiliary route-entry tracker metric family around `0x004a5280`, where the unsquared ordering is enough and the exact root would be wasted work. This now grounds `0x0051dbb0` as the generic float XY squared-distance primitive rather than another opaque scoring helper.","objdump + caller xrefs + arithmetic inspection + squared-distance correlation"
0x0051dbe0,32,math_measure_int_xy_pair_distance_squared,support,fastcall,inferred,objdump + caller xrefs + arithmetic inspection,4,"Small integer squared-distance helper. It takes one integer XY pair in `ECX/EDX`, subtracts the caller-supplied comparison pair from the stack, squares both integer deltas, sums them, and returns that raw squared distance without `sqrt`. Current grounded callers include `company_query_min_linked_site_distance_to_xy` `0x00405920`, where it ranks linked sites before the winning integer distance is later converted back to `float`, so the safest current read is a compact integer XY squared-distance primitive rather than another gameplay-specific metric.","objdump + caller xrefs + arithmetic inspection + company-distance correlation"
0x0051dc00,96,math_lookup_precomputed_abs_xy_distance_or_exact_euclidean_u16,support,fastcall,inferred,objdump + caller xrefs + arithmetic inspection,4,"Small radial-distance helper. It first converts the caller's two coordinate pairs into absolute X and Y deltas. When both deltas are below `0x418`, it indexes the precomputed `u16` distance table at `0x006d9098` using row stride `0x418` and returns that cached value. Otherwise it falls back to the exact Euclidean distance path by squaring both deltas, summing them, taking `sqrt`, rounding through `0x005a10d0`, and returning that integer result. Current grounded callers include the composed world-scalar query `0x0044afa0`, several world-side sample or scan branches around `0x0044d5b0..0x0044db34`, multiple placed-structure or specialization branches at `0x00452290`, `0x004524bf`, `0x0045bb97`, and `0x0045bbe2`, and later route-side callers around `0x00494a48` and `0x004a8a7f`, so this now reads as a shared precomputed-or-exact XY radial distance primitive rather than a one-off lookup table wrapper.","objdump + caller xrefs + arithmetic inspection + precomputed-distance-table correlation"
0x0051dd60,114,support_trim_ascii_spaces_and_optional_newlines_in_place,support,fastcall,inferred,objdump + caller xrefs + local disassembly,3,"In-place ASCII trimming helper over one mutable NUL-terminated string. Starting from the end, the helper removes trailing spaces unconditionally and also strips trailing CR or LF when caller flag `EDX` is nonzero; it then removes leading spaces by shifting the remaining payload left through `0x005a20b0`. Current grounded callers include shell-side status, profile, and filename formatting branches around `0x004317d7`, `0x00444cfa`, `0x0048923d`, `0x004acc13`, `0x004dcf85`, and the lower text helper at `0x005176d3`, so this is the safest current read for the shared ASCII trim-in-place helper rather than a file-family-specific normalizer.","objdump + caller xrefs + local disassembly + string-trim correlation"
0x0051dde0,46,support_copy_string_stem_before_first_dot,support,fastcall,inferred,objdump + caller xrefs + local disassembly,3,"Small string-stem copier. The helper copies bytes from source `ECX` into destination `EDX` until it reaches either NUL or the first literal `'.'`, then writes one terminating NUL and returns. Current grounded callers include save/load and runtime-bundle text branches around `0x00441fac`, `0x00442076`, `0x0044211f`, and `0x00443cf4`, where it is used to derive extensionless stems before appending localized suffixes or looking up sibling resources. This now reads as the shared copy-until-dot stem helper rather than a gameplay-specific formatter.","objdump + caller xrefs + local disassembly + stem-copy correlation"
0x0051de10,303,support_blend_packed_rgba_dwords_by_float_weight,support,thiscall,inferred,objdump + caller xrefs + local disassembly + color-packing correlation,3,"Packed-color blend helper over two caller-supplied 32-bit RGBA-like dwords in `ECX` and `EDX`. The function derives the complementary blend weight `1.0 - weight`, unpacks all four byte lanes from both colors, blends each lane independently through the caller float weight, rounds each blended lane through `0x005a10d0`, and repacks the result into one 32-bit return value. Current grounded caller is `world_build_transport_pricing_preview_surface_from_secondary_raster` `0x0044f840`, where it blends the fixed fallback colors `0x5f040566` and `0x96586131` into the five seeded palette entries rather than manipulating a general-purpose image buffer directly.","objdump + caller xrefs + local disassembly + color-packing correlation + preview-palette correlation"
0x0051df50,55,support_query_or_round_down_to_power_of_two,support,fastcall,inferred,objdump + caller xrefs + local disassembly,3,"Small power-of-two helper. Given one positive integer in `ECX`, it first finds the least power of two greater than or equal to that value. If the input is already an exact power of two it returns the input unchanged; if it is not exact and caller flag `EDX` is zero, it returns the next lower power of two; otherwise it returns `0`. Current grounded caller is the resource-side sizing branch at `0x005327eb/0x005327fa`, which passes `EDX = 0` to clamp two dimensions down to usable power-of-two texture sizes before later minimum-size enforcement. This now reads as a generic exact-or-round-down power-of-two helper rather than a texture-only magic-constant block.","objdump + caller xrefs + local disassembly + power-of-two correlation + resource-sizing correlation"
0x0051df90,39,support_strip_extension_in_place_from_last_dot,support,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small in-place extension stripper. The helper walks to the end of the caller-owned NUL-terminated string, scans backward for the last literal `'.'`, and when found overwrites that dot with NUL; strings without any dot are left unchanged. Current grounded callers include `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0` and several save/load or scenario-text formatting branches around `0x004427df`, `0x00445d53`, `0x00461847`, `0x004f0b78`, and `0x00553784`, where it is used to normalize display labels from extension-bearing resource names. This now reads as the shared strip-extension-in-place helper rather than another file-family-specific normalizer.","objdump + caller xrefs + local disassembly + extension-strip correlation"
0x0051dfc0,522,support_remap_clamped_unit_scalar_into_piecewise_packed_preview_color,support,cdecl,inferred,objdump + caller xrefs + local disassembly + color-ramp correlation,3,"Piecewise scalar-to-color helper over one caller float. The function first clamps the input into the unit interval `[0,1]`, then derives one remapped scalar and its complement through a piecewise curve with explicit breakpoints around `0.25`, `0.5`, and `0.75`. It finally packs those remapped values into one `0xcf`-alpha 32-bit preview color, with a small mode switch keyed by `[0x006d4024+0x11474e]` deciding whether the packed result duplicates one grayscale lane or preserves a two-lane split. Current grounded callers include world-side preview and overlay branches around `0x0045092e`, `0x00450b0f`, `0x00450cc9`, and `0x00450ddd`, plus several route-style and runtime-object presentation branches at `0x0048a860`, `0x0048e033`, `0x00493048`, `0x004b2a24`, and `0x004bd379`, so the safest current read is a shared clamped scalar-to-packed-preview-color ramp rather than a single-family palette helper.","objdump + caller xrefs + local disassembly + color-ramp correlation + preview-color correlation"
0x0051e1d0,591,support_remap_clamped_unit_scalar_into_alternate_piecewise_preview_color_when_mode0,support,cdecl,inferred,objdump + caller xrefs + local disassembly + color-ramp correlation,3,"Alternate sibling of `0x0051dfc0` over one caller float. When display-runtime mode dword `[0x006d4024+0x11474e]` is nonzero the helper jumps back into the ordinary packed preview-color ramp at `0x0051dfc0`; otherwise it applies a different piecewise remap with extra breakpoints around `0.2`, `0.4`, `0.6`, and `0.8`, then packs one `0xcf`-alpha preview color with several grayscale or two-lane output modes. Current grounded caller is the presentation branch at `0x0048dc3f`, so the safest current read is a mode-`0` alternate scalar-to-preview-color ramp rather than a generic palette helper.","objdump + caller xrefs + local disassembly + color-ramp correlation + preview-color correlation"
0x0051e430,79,support_query_path_is_openable_for_read,support,thiscall,inferred,objdump + caller xrefs + local disassembly + import correlation,3,"Small file-openability probe over one caller path string. The helper copies the incoming path into a stack buffer, opens it through the local file-open wrapper `0x005a4c57`, and when that succeeds immediately closes the handle through `CloseHandle` before returning `1`; failures return `0`. Current grounded callers include branches at `0x00446064`, `0x004b8af1`, `0x004dd305`, `0x004dd33a`, and `0x0053d18b`, so this is the safest current read for the shared `can this path be opened for read` probe rather than another family-specific file test.","objdump + caller xrefs + local disassembly + import correlation + file-open correlation"
0x0051e480,95,support_query_file_size_by_path_or_zero,support,thiscall,inferred,objdump + caller xrefs + local disassembly + import correlation,3,"Small file-size probe over one caller path string. The helper copies the incoming path into a stack buffer, opens it through the same local file-open wrapper used by `0x0051e430`, seeks to end through `SetFilePointer(handle, 0, 0, FILE_END)`, closes the handle, and returns the resulting size; open failures return `0`. Current grounded caller is the resource-side branch at `0x0053c758`, where it supplies a missing file-size value when the incoming cached size is `-1`.","objdump + caller xrefs + local disassembly + import correlation + file-size correlation"
0x0051e4e0,113,support_publish_ascii_text_to_clipboard_if_available,support,cdecl,inferred,objdump + caller xrefs + local disassembly + import correlation,3,"Shared ASCII clipboard-export helper. The function opens the clipboard, empties it, allocates a movable global block, copies the caller text into that block through `lstrcpyA`, unlocks it, and publishes the handle through `SetClipboardData(CF_TEXT)` before closing the clipboard. Current grounded callers are neighboring text-edit or widget branches at `0x0055c2b0` and `0x0055c772`, so this is the safest current read for the bounded clipboard publish helper.","objdump + caller xrefs + local disassembly + import correlation + clipboard correlation"
0x0051e560,98,support_copy_clipboard_text_into_buffer_bounded,support,cdecl,inferred,objdump + caller xrefs + local disassembly + import correlation,3,"Shared ASCII clipboard-import helper. The function opens the clipboard, queries `CF_TEXT` through `GetClipboardData`, locks the returned handle, bounded-copies the clipboard contents into the caller buffer through `lstrcpynA`, forces a trailing NUL, unlocks the block, and closes the clipboard. Current grounded caller is the neighboring text-edit branch at `0x0055be56`, so this is the safest current read for the bounded clipboard pull helper.","objdump + caller xrefs + local disassembly + import correlation + clipboard correlation"
0x0051e6e0,62,support_query_string_is_nonempty_ascii_digits_only,support,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Small string predicate over one caller-owned NUL-terminated buffer. The helper rejects null pointers and empty strings, then scans every byte and succeeds only when each character is ASCII `'0'..'9'`. Current grounded callers are text-entry validation branches at `0x004acd01` and `0x004ae817`, so this is the safest current read for the nonempty digits-only predicate rather than a broader parser.","objdump + caller xrefs + local disassembly + text-validation correlation"
0x0051e720,29,support_set_active_debug_log_filename_and_clear_init_flags,support,thiscall,inferred,objdump + caller xrefs + local disassembly + string correlation,3,"Small debug-log filename setter over one caller string. The helper copies up to `0x64` bytes into global buffer `0x006d3ca8`, clears byte `0x006d3d0c`, and clears dword `0x006d3d10`. Current grounded callers are the neighboring bootstrap leaves at `0x0051cff5` and `0x0051d02b`, which seed the default names `rt3_debug.txt` and `language_debug.txt`, so this is the safest current read for the active debug-log filename setter plus init-flag clear.","objdump + caller xrefs + local disassembly + string correlation + debug-log correlation"
0x0051e740,197,support_open_or_create_active_debug_log_and_append_separator_once,support,cdecl,inferred,objdump + caller xrefs + local disassembly + string correlation,3,"Debug-log bootstrap helper over the active global filename at `0x006d3ca8`. The function gates on byte `0x006d3ca0`, uses dword `0x006d3d10` as an in-progress latch, seeds the default filename when needed, formats the path `.\\data\\log\\%s`, opens or creates the target stream through the local file wrapper, appends the fixed separator line `------------------\\n`, closes the stream, and clears the in-progress latch. Current grounded callers are `0x0051cffa` and `0x00521089`, so this is the safest current read for the active debug-log open-or-create plus one-time separator writer.","objdump + caller xrefs + local disassembly + string correlation + debug-log correlation"
0x0051e810,363,shell_mouse_cursor_adjust_showcursor_refcount_and_sync_screen_position_if_live,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + import correlation + source-string correlation,3,"Shared mouse-cursor visibility and position helper beneath the live shell family. The function adjusts global refcount `0x00624b20` up or down from one caller boolean, repeatedly calls `ShowCursor` until the OS cursor visibility count crosses the desired state, and when the live shell bundle exists plus `0x0051f0b0` says the cursor service is active, it derives current screen coordinates from the display tuple via `0x0051f100` and `0x00543c10` and may call `SetCursorPos` when `0x0051f1a0` passes. The grounded source string `\\RT3\\exe\\Src\\Engine\\MouseCursor.cpp` and callers around `0x0053f075`, `0x0053f146`, `0x0053f208`, `0x0053f2af`, `0x0053f480`, `0x0053f492`, and `0x0051e9b7` make this the safest current read for the mouse-cursor ShowCursor-refcount and live-position sync helper.","objdump + caller xrefs + local disassembly + import correlation + source-string correlation + mouse-cursor correlation"
0x0051e980,246,shell_publish_warning_modal_once_and_force_cursor_visible,shell,cdecl,inferred,objdump + caller xrefs + local disassembly + import correlation + string correlation,3,"Guarded warning-modal publisher. The helper uses dword `0x006d3d18` as a reentrancy latch, flips shell byte `[0x006d4024+0x57]` when the live shell bundle exists, forces cursor visibility through `0x0051e810(1, \"\\\\RT3\\\\exe\\\\Src\\\\Engine\\\\Misc.cpp\", 0x110)`, formats the warning body through `0x0051d680`, and shows the shared `MessageBoxA` warning box with localized text and caption ids `0x44/0x45`. Current grounded callers include `0x0040cd70` and many neighboring shell, runtime-object, and setup-warning branches, so this is the safest current read for the shared guarded warning-modal publisher rather than a one-off formatter.","objdump + caller xrefs + local disassembly + import correlation + string correlation + warning-modal correlation"
0x0044bd10,152,world_query_region_category_byte_at_world_coords,map,thiscall,inferred,objdump + caller xrefs + local disassembly + region-raster correlation,3,"Small world-grid lookup helper over the per-cell region word family rooted at `[world+0x212d]`. The function converts caller float coordinates into rounded cell indices through the world-cell scale at `0x005c8568`, clamps those indices to live dimensions `[world+0x214d/+0x2151]`, resolves the current cell record from `[world+0x212d] + cell*4`, and treats the record as a mixed byte-or-word id: when the trailing `u16` lane at `+1` is nonzero it uses that wider id, otherwise it falls back to the first byte. It then resolves the resulting region or city entry through collection `0x0062bae0` and returns entry dword `[entry+0x272]`, with fixed fallback `5` when no entry resolves. Current grounded callers include the structure-side formatter at `0x00403ba7` and the StationPlace world-surface branches at `0x00508b80`, `0x00508d59`, and `0x0050a4e6`, where this helper feeds the current selected-site category latch `0x00622af0`.","objdump + caller xrefs + local disassembly + region-raster correlation + StationPlace category correlation"
0x0044b160,936,world_try_bulldoze_near_coords_and_format_failure_message,map,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng strings,3,"Shared bulldoze-side chooser and commit helper beneath the TrackLay and sibling world-surface bulldoze lanes. The function first clears the caller-owned failure-text buffer and one output slot, validates the supplied company id through the live company collection `0x0062be10`, and on the ordinary non-editor path formats RT3.lng `419` `You can't bulldoze without a company.` when no valid company is available. It then performs two grounded passes over nearby runtime collections around the caller's world coordinates and radius: the early pass estimates or selects the best current bulldoze target while tracking the strongest nearby route-entry distance split, and the later pass performs the actual delete-or-commit branches. The target-family split is now real too. It scans the live route-entry collection `0x006cfca8`, the city-or-region collection `0x0062bae0`, the broader structure collection `0x006cea50`, linked placed structures in `0x0062b26c`, the route-side blocker collection `0x0062ba84`, and the live placed-structure collection `0x006cec20`, repeatedly sampling coordinates through `0x00455800/0x00455810`, `0x0048a1a0/0x0048a1c0`, `0x0047ded0/0x0047df00`, and the radial helper `0x0051db80`. The rejection ladder is now grounded by string ids: mismatched building ownership formats `421` `You can't bulldoze this building - it's owned by another railroad!`, mismatched track ownership formats `422`, nearby rolling-stock blockage formats `423`, and the placed-structure blocker lane localizes the two colliding structure stems through `0x0051c920` before formatting `424` `You can't bulldoze that track - it's too close to a %1. Try bulldozing the %2 first.`. The cost gate is grounded too: on the ordinary company path it reads the company treasury through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0` on stat family `0x2329` mode `0x0d`, formats `420` when the chosen bulldoze cost exceeds available cash, and otherwise commits the cost through `company_apply_bulldoze_or_local_action_cost_scalar` `0x0042a080`. On success the helper dispatches the actual bulldoze branch through the selected owner family: route-entry and route-anchor targets commit through `0x004937f0`, `0x004941a0`, and `0x0048abf0`, while building or linked-site targets commit through the surrounding placed-structure virtual slot `+0x58` and neighboring collection erases. Current grounded direct callers are the TrackLay bulldoze branches at `0x0050d83e` and `0x0050d8fc` plus the neighboring world-surface branches at `0x00473050` and `0x004b8685`, so this is the safest current read for the shared bulldoze chooser-plus-failure-message helper rather than a generic proximity scan.","objdump + caller xrefs + local disassembly + RT3.lng strings + TrackLay bulldoze correlation + rejection-ladder correlation"
0x0044bdb0,107,world_count_neighbor_cells_in_secondary_raster_class_set_2_4_5,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Eight-neighbor count helper over the secondary-raster class subset owned by `world_secondary_raster_query_cell_class_in_set_2_4_5` `0x00534ec0`. Starting from one caller cell coordinate pair, the helper walks the shared `0x00624b28/0x00624b48` offset tables across the eight immediate neighbors, bounds-checks each neighbor against world dimensions `[world+0x2155/+0x2159]`, and increments the result only when `0x00534ec0` reports that the neighbor cell belongs to class set `2/4/5`. Current grounded callers are the neighboring secondary-raster service branches at `0x0044bf9d`, `0x0044bfc8`, `0x0044c0d5`, `0x0044c348`, and `0x0044c37b`, so this is the safest current read for the local class-subset neighbor counter rather than another generic lattice scan.","objdump + caller xrefs + local disassembly + secondary-raster correlation + 8-neighbor offset-table correlation"
0x0044be20,992,world_secondary_raster_walk_connected_class_2_4_5_component_and_refresh_edge_flags,map,thiscall,inferred,objdump + local disassembly + internal caller correlation,3,"Recursive connected-component walker beneath the late secondary-raster neighborhood service band. The helper first widens dirty min/max bounds `[this+0x21ad..+0x21b9]` to include the current cell, marks the temporary visit bitmap at `0x0062c128`, resolves the current 3-byte raster cell through `world_secondary_raster_resolve_cell_record_ptr` `0x00534f40`, and writes one 3-bit orientation lane into the companion word using the lookup table at `0x005ee5cc` plus the caller-supplied direction index and polarity. It then walks all eight bounded neighbors through the shared offset tables `0x00624b28/0x00624b48`, keeps only neighbors in secondary-raster class set `2/4/5` through `0x00534ec0`, tracks local degree and visitation in two caller-local byte rings, and on admissible neighbors recurses back into itself while setting the same temporary visit bitmap. The admissibility split is tighter too: when world mode gate `[this+0x21bd]` is clear and the current or neighbor cell carries byte-2 flag `0x20`, it re-enters `world_count_neighbor_cells_in_secondary_raster_class_set_2_4_5` `0x0044bdb0` and rejects neighbors with degree `>= 3`. After the recursive walk it clears edge bits `0x04/0x08` in the current cell byte-1 lane, conditionally restores one of those bits for sparse interior cells, and on the byte-2 `0x20` family may rewrite the companion-word orientation lane again from the surviving neighbor pattern. Current grounded direct callers are the internal owner paths at `0x0044c029`, `0x0044c3ea`, and `0x0044c422`, all inside the same connected-component owner `0x0044c200`, so this is the safest current read for the recursive class-`2/4/5` component walker rather than a generic flood fill.","objdump + local disassembly + internal caller correlation + secondary-raster component correlation + edge-flag update correlation"
0x0044c200,592,world_seed_secondary_raster_class_2_4_5_component_walk_from_cell,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Connected-component owner beneath the late secondary-raster neighborhood service band. The helper first validates the caller seed cell through `world_secondary_raster_query_cell_class_in_set_2_4_5` `0x00534ec0`; when that test fails it returns immediately. On success it snapshots shell input flag bit `0x4` from `[0x006d4018+0xa8c]` into world dword `[this+0x21bd]`, seeds dirty min/max bounds `[this+0x21ad..+0x21b9]` from the starting cell, allocates a temporary visited-cell bitmap of `width*height` bytes through `0x005a125d`, clears it, and marks the seed cell. It then resolves the seed raster cell through `0x00534f40`, derives one starting direction index from the seed cell header byte via the remap table at `0x005ee5d4`, and walks the eight immediate neighbors through `0x00624b28/0x00624b48`. Every bounded neighbor that remains in class set `2/4/5`, passes the same byte-2 `0x20` plus degree filter used by `0x0044be20`, and survives the local turn-distance test is forwarded into `world_secondary_raster_walk_connected_class_2_4_5_component_and_refresh_edge_flags` `0x0044be20` with the derived direction index and one branch-polarity flag. After the first fan-out it re-enters that same recursive walker once more on the seed cell itself with the final surviving direction and polarity, then releases the temporary visit bitmap through `0x005a1145`. Current grounded caller is the later mutation branch at `0x0044e796`, so this is the safest current read for the seed-and-own wrapper of the connected class-`2/4/5` walk rather than another one-shot scan.","objdump + caller xrefs + local disassembly + secondary-raster correlation + connected-component owner correlation"
0x00554d70,248,billboard_item_build_anchor_point_cache,bootstrap,thiscall,inferred,ghidra-headless,3,Builds or refreshes the cached point list for one billboard item at [this+0x1dd]. When source points exist at [this+0x10] it transforms them through the owner object matrix near [this+0x0c]+0xce; otherwise it seeds a one-point fallback from the baked vector at [this+0xfe..0x106].,ghidra + rizin + llvm-objdump
0x00554e70,680,shell_emit_ranked_sprite_billboard_item,bootstrap,thiscall,inferred,ghidra-headless,4,Emits one ranked sprite-billboard item into the current vertex24 span. The helper computes a distance-weighted fade against shell and world state stores the derived scalar at [item+0xdc] and then walks either the item's linked child list at [item+0x4] or the cached anchor list at [item+0x1dd] to write textured quad geometry through 0x005662a0.,ghidra + rizin + llvm-objdump
0x00555740,49,billboard_item_refresh_child_sprite_colors,bootstrap,thiscall,inferred,ghidra-headless,3,Refreshes packed child-sprite colors for one billboard item by iterating the linked child list at [this+0x4] recomputing each child color through 0x005554f0 and storing the 24-bit result at [child+0x70].,ghidra + rizin + llvm-objdump
0x00555780,1739,sprite_billboard_spawn_particle_instance,bootstrap,thiscall,inferred,ghidra-headless,4,Builds one emitted sprite-billboard instance from the template item. It randomizes local offsets through fields [this+0x7c..0x90] optionally samples anchor points from the owner matrix or cached path data chooses atlas uv bounds from [this+0x110..0x124] applies scale and fade terms from [this+0x94..0x108] recomputes packed colors through 0x005554f0 and finalizes the instance through 0x00565e80 and 0x00565f40.,ghidra + rizin + llvm-objdump
0x00555e50,1808,sprite_billboard_update_particle_emitter,bootstrap,thiscall,inferred,ghidra-headless,4,Advances one sprite-billboard emitter template and spawns new instances through 0x00555780. The routine updates emitter clocks and travel bounds in [this+0x68..0xc8] applies burst or repeat controls through [this+0x1ed..0x1f9] walks up to [this+0x34] spawn lanes resolves anchor positions from cached or owner-derived points and refreshes the active emitter origin at [this+0xc0] and [this+0xc4].,ghidra + rizin + llvm-objdump
0x0055d430,6,system_get_total_physical_memory_bytes,support,cdecl,inferred,ghidra-headless,4,Returns the cached total physical-memory byte count from the shared MEMORYSTATUS block at 0x00d9754c. The graphics preset bundle uses this value as one of its coarse runtime capability probes after the cache has been refreshed through GlobalMemoryStatus nearby.,ghidra + rizin + llvm-objdump
0x0055d440,17,system_refresh_available_physical_memory_bytes,support,cdecl,inferred,ghidra-headless,4,Refreshes the shared MEMORYSTATUS block at 0x00d97548 through GlobalMemoryStatus and returns the resulting available physical-memory byte count from dwAvailPhys. This is the active memory-availability probe companion to 0x0055d430.,ghidra + rizin + llvm-objdump + strings
0x0055d460,81,os_is_non_nt_platform,support,cdecl,inferred,ghidra-headless,4,Calls GetVersionExA and returns true only when the platform id is not VER_PLATFORM_WIN32_NT. The graphics preset bundle inverts this result into an NT-family capability flag before finalizing several display-runtime bytes under 0x006d4024.,ghidra + rizin + llvm-objdump + strings
0x0055d8d0,138,display_get_primary_adapter_descriptor,support,cdecl,inferred,ghidra-headless,4,Enumerates display devices through USER32.EnumDisplayDevicesA until it finds the primary adapter flag then copies the adapter DeviceString field into the global buffer at 0x00d97448 and returns that buffer. When enumeration fails it leaves the descriptor empty and still returns the same shared buffer pointer. The graphics preset matcher at 0x00484a60 consumes this descriptor text directly.,ghidra + rizin + llvm-objdump + strings
0x005a63b8,18,math_apply_x87_control_mask_0x10000_0x30000,support,cdecl,inferred,llvm-objdump + local disassembly,2,"Tiny x87 control-state helper. The routine forwards value `0x10000` and mask `0x30000` into the local floating-point control-word setter at `0x005b0809`, then returns. Current grounded caller is the older legacy math bootstrap `0x005a10b9`.","llvm-objdump + local disassembly + x87-control correlation"
0x005a63ca,64,math_local_processor_feature0_fallback_probe_by_arithmetic_residual_test,support,cdecl,inferred,llvm-objdump + local disassembly,2,"Local boolean fallback probe used when `KERNEL32!IsProcessorFeaturePresent` is unavailable. The helper evaluates one fixed double-precision arithmetic residual from constants at `0x005e2938/0x005e2940`, compares the result against zero, and returns `1` only when the residual test passes. Current grounded caller is the legacy math bootstrap fallback path `0x005a640a`.","llvm-objdump + local disassembly + arithmetic-probe correlation"
0x005a640a,41,math_query_kernel32_isprocessorfeaturepresent0_or_fallback_local_probe,support,cdecl,inferred,llvm-objdump + local disassembly + import-string correlation,3,"Queries processor feature id `0` through a dynamic `KERNEL32!IsProcessorFeaturePresent` lookup. The helper resolves `KERNEL32` and symbol `IsProcessorFeaturePresent`, calls that API with argument `0` when available, and otherwise falls back to the local arithmetic probe `0x005a63ca`. Current grounded caller is the one-shot legacy math bootstrap `0x005a10b9`.","llvm-objdump + local disassembly + import-string correlation + processor-feature correlation"
0x005b0809,22,math_apply_floating_point_control_word_value_and_mask_with_bit0x80000_cleared,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Small floating-point control-word setter in the older CRT math family. The helper clears bit `0x00080000` from the requested control value, forwards that sanitized value plus the caller mask into `0x005b07d7`, and returns. Current grounded caller is `math_apply_x87_control_mask_0x10000_0x30000` `0x005a63b8`, so this is the narrow masked-control setter beneath the legacy math bootstrap.","llvm-objdump + local disassembly + caller correlation + x87-control correlation"
0x005a7480,103,math_dispatch_unary_x87_special_case_via_fxam_state_table,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Table-driven unary special-case dispatcher in the older x87 math family. The helper saves one derived control word, classifies the current `st(0)` value through `fxam`, maps the resulting class bits through the state table at `0x0062a4bc`, and then jumps through a descriptor-specific case table rooted at the caller descriptor in `EDX`. Current grounded caller is the stack-based fallback body `0x005a7a51`, so this is the safest current read for the common unary x87 exceptional-case dispatcher rather than a function-specific body.","llvm-objdump + local disassembly + caller correlation + x87-special-case correlation"
0x005a74e7,140,math_dispatch_binary_x87_special_case_via_fxam_state_table,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Table-driven binary special-case dispatcher in the same older x87 math family. The helper classifies both current x87 operands through `fxam`, combines the two mapped classes into one selector byte through the same table at `0x0062a4bc`, and then jumps through a descriptor-specific case table rooted at the caller descriptor in `EDX`. Current grounded caller is the older binary fallback family beside `0x005a1b60`, so this is the safest current read for the shared binary x87 exceptional-case dispatcher rather than overclaiming one exact operator.","llvm-objdump + local disassembly + caller correlation + x87-special-case correlation"
0x005a7650,21,math_exp2_x87_from_split_integer_and_fractional_parts,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Tiny x87 exponent rebuild helper. The routine rounds `st(0)` to its integral part, subtracts that integral component back out to get the fractional residue, applies `f2xm1 + 1`, rescales through `fscale`, and drops the temporary integral lane. Current grounded caller is the x87 `pow` fallback owner `0x005a1b60`, where this helper materializes the final `2^x` stage after the earlier `fyl2x` transform.","llvm-objdump + local disassembly + caller correlation + x87-exp2 correlation"
0x005a7665,23,math_load_x87_control_word_with_saved_rounding_and_masked_exceptions,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Loads one derived x87 control word while preserving the caller rounding-control bits. The helper masks the incoming word down to `0x300`, ORs in `0x7f`, writes the result to a local word slot, and loads it through `fldcw`. Current grounded callers are the x87 `acos` and neighboring scalar helpers that briefly force the masked-exception computation mode before resuming the saved control word path.","llvm-objdump + local disassembly + caller correlation + x87-control correlation"
0x005a7695,67,math_load_f64_or_promote_special_to_x87_extended,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Loads one caller `f64` into the x87 stack, promoting non-finite values into an extended-precision temporary form first. The helper tests the raw exponent field in the caller double, loads ordinary finite values directly through `fldl`, and otherwise synthesizes a 10-byte extended temporary on the stack before `fldt`. Current grounded callers are the x87 `acos` and `tan` wrappers at `0x005a2f70` and `0x005a3040`.","llvm-objdump + local disassembly + caller correlation + x87-load correlation"
0x005a76d8,22,math_extract_f64_exponent_field_or_preserve_special_high_dword,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Extracts the raw `f64` exponent field from one caller double, but preserves the original high dword for non-finite inputs. The helper masks the incoming high dword with `0x7ff00000`, returns that masked exponent for ordinary finite values, and returns the unmasked original high dword when the input is already non-finite. Current grounded callers are the x87 `acos` and `tan` wrappers at `0x005a2f70` and `0x005a3040`.","llvm-objdump + local disassembly + caller correlation + exponent-field correlation"
0x005a76ee,14,math_restore_saved_x87_control_word_if_nondefault,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Tiny restore-side helper for the older x87 math error path. The routine compares the saved control word on the stack against the default `0x027f`, reloads it through `fldcw` only when it differs, then pops the saved helper register slot and returns. Current grounded callers are the x87 `acos`, `tan`, and related status-report exits.","llvm-objdump + local disassembly + caller correlation + x87-control correlation"
0x005a76fb,42,math_restore_control_word_or_report_precision_exception,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Checks whether the saved x87 control state can be restored directly or whether a pending precision exception must be reported first. If the saved control word is already the default or precision exceptions are masked or clear, the helper simply restores the caller control word; otherwise it raises error code `8` through `math_report_error_with_saved_operands_and_restore_control_word` `0x005a77f7`. Current grounded callers are the older x87 `pow` fallback and the scalar-trig support strip beside it.","llvm-objdump + local disassembly + caller correlation + x87-precision correlation"
0x005a77e0,23,math_report_error_with_two_saved_aux_operands_and_restore_control_word,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Small wrapper that forwards one math error code plus two extra saved operand words into the common report owner `0x005a77f7`, then restores the caller x87 control word before returning. Current grounded caller is the special overflow-or-underflow branch in the older x87 `pow` fallback strip.","llvm-objdump + local disassembly + caller correlation + math-error-report correlation"
0x005a77f7,60,math_report_error_with_saved_operands_and_restore_control_word,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Common older x87 math-error report owner. The helper stores the caller error code, preserved operand slots, and report-context pointers into a local record, forwards that record into the wider report body `0x005b08ba`, reloads the original floating result, restores the saved x87 control word when it differs from the default `0x027f`, and returns. Current grounded callers include the shared precision-exception gate `0x005a76fb`, the older x87 `pow` fallback `0x005a1b60`, and the `acos` or `tan` error exits.","llvm-objdump + local disassembly + caller correlation + math-error-report correlation"
0x005a787e,61,math_unary_x87_special_case_fallback_from_st0_and_finalize,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Unary older-x87 fallback body that starts from the current `st(0)` operand. The helper snapshots the caller control word, optionally stores the incoming operand into the local extended-precision operand slot, re-enters the shared unary special-case dispatcher `0x005a7480`, and then finalizes the result or report path through `0x005a790a`. Current grounded caller is `math_exp_x87_with_fastpath_probe` `0x005a2ee0`, so this is the safest current read for the older unary fallback body reached when the SSE2 path is unavailable or unsuitable.","llvm-objdump + local disassembly + caller correlation + x87-special-case correlation"
0x005a790a,326,math_finalize_x87_special_case_result_or_report,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Shared finalization owner for the older x87 special-case family. The helper inspects the staged status byte and saved control word in the caller frame, decides whether the current result can be returned directly, whether one scaled underflow or overflow adjustment must be applied, or whether a full math-error report must be emitted through `0x005b08ba`, then restores the saved x87 control word and returns the final x87 result. Current grounded callers are the unary fallback bodies `0x005a787e` and `0x005a7a51`.","llvm-objdump + local disassembly + caller correlation + x87-special-case correlation + math-error-report correlation"
0x005a7a51,51,math_unary_x87_special_case_fallback_from_stack_f64_and_finalize,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Unary older-x87 fallback body that starts from one caller `f64` passed on the stack. The helper loads that argument through `0x005a7a84`, snapshots the control word, re-enters the shared unary special-case dispatcher `0x005a7480`, and then finalizes the result or report path through `0x005a7903/0x005a790a`. Current grounded caller is `math_exp_x87_with_fastpath_probe` `0x005a2ee0`, which reaches this path when it needs the older stack-based fallback body rather than the direct `st(0)` variant.","llvm-objdump + local disassembly + caller correlation + x87-special-case correlation"
0x005a7a84,60,math_load_stack_f64_or_promote_special_to_x87_extended,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Loads one caller `f64` from stack argument pairs into the x87 stack, promoting non-finite values into an extended-precision temporary form first. The helper checks the raw exponent field for the incoming high dword, loads ordinary finite values directly through `fldl`, and otherwise synthesizes a 10-byte temporary before `fldt`. Current grounded caller is the stack-based unary fallback body `0x005a7a51`, so this is the stack-argument analogue of `0x005a7695`.","llvm-objdump + local disassembly + caller correlation + x87-load correlation"
0x005a6649,43,heap_region_query_descriptor_for_pointer,startup,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Tiny local heap-region lookup over one caller pointer. The helper walks the fixed region-descriptor array rooted at globals `0x00dbb8a8/0x00dbb8ac`, compares the caller pointer against each region base at `[desc+0x0c]`, and returns the first descriptor whose `ptr - base` offset stays below `0x100000`; otherwise it returns `0`. Current grounded caller is `heap_query_allocation_size_for_pointer_with_local_heap_fastpath` `0x005ac9e7`, which uses this descriptor fast path before falling back to `KERNEL32!HeapSize`.","llvm-objdump + local disassembly + caller correlation + local-heap correlation"
0x005aad20,25,math_pow_f64_sse2_wrapper_from_x87_pair,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Tiny x87-to-SSE bridge for the optimized floating-point power path. The helper realigns the stack, stores the two caller doubles from `st(0)` and `st(1)`, and forwards them into `math_pow_f64_sse2_core` `0x005aad39`. Current grounded caller is the clean-state fastpath branch in `math_pow_f64_with_fastpath_probe_and_x87_special_case_ladder` `0x005a1b60`.","llvm-objdump + local disassembly + caller correlation + sse2-pow correlation"
0x005aad39,1735,math_pow_f64_sse2_core,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Optimized SSE2 floating-point power core beneath `math_pow_f64_with_fastpath_probe_and_x87_special_case_ladder` `0x005a1b60`. The body unpacks caller doubles into SSE registers, splits sign and exponent fields, handles range and exceptional-lattice cases, and then runs the polynomial and table-driven logarithm or exponent stages that correspond to the ordinary `pow(base, exponent)` fast path when MXCSR and x87 control masks are both clean. Current grounded entry is the x87 bridge `0x005aad20`.","llvm-objdump + local disassembly + caller correlation + sse2-pow correlation"
0x005a0d00,608,stream_cipher_init_rc4_state_from_key_bytes,support,stdcall,inferred,llvm-objdump + local disassembly + caller inspection,3,"Initializes one `0x102`-byte RC4-style stream-cipher state block from caller key bytes. The helper fills the leading `0x100`-byte permutation with `0..255`, clears the two state bytes at offsets `+0x100/+0x101`, and then runs one cyclic key-schedule pass over all `0x100` permutation entries using caller key pointer `ECX`, caller key length `EDX`, and the output state block passed on the stack. Current grounded caller is `multiplayer_transport_handle_transport_text_pair_record_mode3` `0x0059ae20`, which seeds the paired text-stream cipher states at `[transport+0x242]` and `[transport+0x140]`.","llvm-objdump + local disassembly + caller inspection + stream-cipher correlation + multiplayer-transport correlation"
0x005a0f70,209,stream_cipher_xor_in_place,support,cdecl,inferred,rizin,4,Applies one stateful stream-cipher pass in place over the caller buffer in ECX for the caller byte count in EDX using the 0x102-byte cipher state block passed on the stack. The helper mutates the two state bytes at offsets `+0x100` and `+0x101` and uses the 0x100-byte permutation table at the start of the state block to XOR every byte in the buffer. Current grounded callers are the multiplayer transport text-stream receive and send paths.,rizin + llvm-objdump
0x005a1050,46,buffer_xor_in_place_with_repeating_nul_terminated_key,support,stdcall,inferred,llvm-objdump + local disassembly + caller inspection,3,"XORs one caller buffer in place against a repeating NUL-terminated key string. The helper walks the target buffer in `ECX` for caller byte count `EDX`, XORs each byte with the current key byte from the key-string pointer passed on the stack, and wraps back to the start of that key string whenever it reaches the terminating NUL. Current grounded caller is `multiplayer_transport_handle_transport_text_pair_record_mode3` `0x0059ae20`, which applies the same repeating-key XOR against both caller strings using the fixed key band rooted at `[transport+0x564]`.","llvm-objdump + local disassembly + caller inspection + multiplayer-transport correlation + repeating-key-XOR correlation"
0x005a1081,56,math_seed_legacy_dispatch_table_0x62a360_with_x87_entrypoints,support,cdecl,inferred,llvm-objdump + local disassembly,2,"Seeds the older five-slot legacy math dispatch table rooted at `0x0062a360`. The helper writes the fixed x87-side entrypoints `0x005a6367`, `0x005a5fe1`, `0x005a6046`, `0x005a5fa5`, and `0x005a602c` into globals `0x0062a360..0x0062a374`. Current grounded caller is the one-shot init wrapper `0x005a10b9`.","llvm-objdump + local disassembly + legacy-math-dispatch correlation"
0x005a10b9,23,math_init_legacy_dispatch_table_probe_processor_feature0_and_set_x87_control_state,support,cdecl,inferred,llvm-objdump + local disassembly + import-string correlation,3,"One-shot bootstrap wrapper above the older legacy math dispatch table. The helper first seeds the table at `0x0062a360` through `0x005a1081`, then resolves and calls `KERNEL32!IsProcessorFeaturePresent` with feature id `0` through `0x005a640a` or falls back to the local arithmetic probe at `0x005a63ca`, stores that boolean result into global `0x00dba008`, and finally applies the local x87 control-state setup through `0x005a63b8` before clearing pending exceptions with `fnclex`.","llvm-objdump + local disassembly + import-string correlation + legacy-math-dispatch correlation + x87-control correlation"
0x005a10d0,117,math_round_st0_to_signed_qword_with_current_x87_mode,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Shared x87 rounding helper returning one signed integer in `EDX:EAX` from the floating input in `st(0)`. The helper first converts through `fistp` into a temporary signed qword, reconstructs the residual fractional part, and then applies one sign-aware correction step before returning the adjusted integer pair. Current grounded callers use the low dword as a general rounding primitive, including `secondary_overlay_chunk_init_quantized_origin_and_clear_4x4_local_page_table` `0x0056af70`, `runtime_object_publish_current_position_triplet_with_height_bias` `0x00455a70`, and the broader overlay, region, and layout-state quantization strips already rooted through `0x005a10d0`.","llvm-objdump + local disassembly + caller correlation + x87-rounding correlation"
0x005a18a0,292,string_copy_bounded_zerofill,support,cdecl,inferred,ghidra-headless,4,Shared bounded string-copy helper that copies up to count bytes from source to destination stops after the first NUL byte and zero-fills the remaining span before returning the destination pointer. The graphics preset matcher uses it to stage the primary adapter descriptor into a local probe buffer before substring token scans,ghidra + rizin + llvm-objdump
0x005a19c4,87,string_format_varargs_into_bounded_buffer_and_force_nul,support,cdecl,inferred,llvm-objdump + caller correlation + local disassembly,3,"Shared bounded formatting helper above the local varargs formatter `0x005aa249`. The routine forwards one caller destination buffer, format string, and varargs pack into that formatter with a `0x7fffffff` logical ceiling, then guarantees that the destination is NUL-terminated even on truncation or failure before returning the formatter result. Current grounded callers include the GameSpy query-response builder `0x0058c3e0`, the StationPlace preview formatter `0x00508730`, and the selector-`0x59` transport formatting strip `0x00472290`.","llvm-objdump + caller correlation + local disassembly + string-format correlation"
0x005a1a1c,233,buffered_stream_read_elements_unlocked,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Unlocked buffered stream-read owner over one FILE-like object passed as arg3. The helper multiplies caller element size by element count, drains any buffered bytes rooted at `[stream+0x00/+0x04]` when flags `[stream+0x0c] & 0x10c` are live, reads larger aligned chunks through `0x005a48c5` using handle `[stream+0x10]` and block size `[stream+0x18]`, falls back to single-byte fetches through `0x005a9279` for short tails, sets stream flag `0x10` on zero-byte or EOF-like completion and `0x20` on `-1` error returns, and finally returns the number of fully completed elements rather than raw bytes. Current grounded caller is the lock-scoped wrapper `0x005a1b05`, and previously grounded file import or rewrite owners `0x00441f70` and `0x004427c0` reach it through that wrapper.","llvm-objdump + local disassembly + caller correlation + buffered-stream correlation"
0x005a1b05,91,buffered_stream_read_elements_with_lock_scope,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Scoped public wrapper over `buffered_stream_read_elements_unlocked` `0x005a1a1c`. The helper installs a local SEH frame through `0x005a7124`, acquires the caller FILE-like lock through `0x005a91d5`, forwards the same four arguments into `0x005a1a1c`, then releases the lock through `0x005a9227` before returning the completed element count. Current grounded callers include the companion-image import owner `0x00441f70` and the companion-payload rewrite owner `0x004427c0`.","llvm-objdump + local disassembly + caller correlation + stream-lock correlation"
0x005a1b60,656,math_pow_f64_with_fastpath_probe_and_x87_special_case_ladder,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Primary floating-point power helper. When global gate `0x00dbb8c8` is live and both MXCSR and x87 control state remain at the clean default masks, the helper jumps straight into optimized fast paths `0x005aad39` or `0x005aad20`; otherwise it runs the older x87 fallback. That fallback checks for NaN, infinity, zero, and negative-base cases, uses `math_classify_st0_as_noninteger_odd_integer_or_even_integer` `0x005a1dc2` to decide whether a negative base is legal and whether the result sign flips, computes the ordinary case through `fyl2x` plus the downstream exponent helpers rooted at `0x005a7650/0x005a7739/0x005a77e0`, and also falls back to the slower saved-state branch at `0x005abae1` when the exponent lattice needs the broader special-case handler. Current grounded caller is the company share-price or public-support body `0x00424fd0`, which uses this helper for the `(shares / 20000)^0.33` growth term.","llvm-objdump + local disassembly + caller correlation + x87-pow correlation"
0x005a1dc2,46,math_classify_st0_as_noninteger_odd_integer_or_even_integer,support,cdecl,inferred,llvm-objdump + local disassembly + constant inspection,3,"Tiny x87 integer-parity classifier over the floating input in `st(0)`. The helper first tests whether `st(0)` is exactly integral through `frndint`; when it is, the helper multiplies the value by `0.5` through constant `0x00629fd0` and repeats the exact-integer test to distinguish odd integers from even integers. It returns the resulting class in `CL` as `0 = non-integer`, `1 = odd integer`, or `2 = even integer`. Current grounded caller is the older x87 `pow`-family special-case owner rooted at `0x005a1b60`.","llvm-objdump + local disassembly + constant inspection + x87-parity correlation"
0x005a1df0,45,string_find_last_char_pointer,support,cdecl,inferred,llvm-objdump + local disassembly,2,"Shared reverse character search helper over one NUL-terminated string. The routine first scans to the terminating NUL, then searches backward for the caller byte and returns a pointer to the last matching character or `0` when the character does not occur. This is the standard `strrchr`-style support helper rather than a file-family-specific parser.","llvm-objdump + local disassembly + reverse-search correlation"
0x005a1e1d,136,string_parse_signed_decimal_with_locale_space_skip_core,support,cdecl,inferred,llvm-objdump + local disassembly,3,"Core locale-aware signed-decimal parser. The helper consults the active locale or ctype tables through `0x005abcd8` and `0x005a35f5`, skips leading bytes classified with mask `0x08`, accepts one optional `+` or `-`, accumulates consecutive ASCII decimal digits into a base-10 signed integer, and returns the final value. Thin wrapper `0x005a1ea5` is the public entry already used by transport and support-family text normalization paths.","llvm-objdump + local disassembly + locale-table correlation + signed-decimal correlation"
0x005a1ea5,5,string_parse_signed_decimal_with_locale_space_skip,support,cdecl,inferred,llvm-objdump + caller correlation + local disassembly,3,"Thin wrapper into the wider signed-decimal parser at `0x005a1e1d`. The parser skips leading locale-space bytes, accepts one optional `+` or `-`, accumulates consecutive ASCII decimal digits, and returns the resulting signed integer. Current grounded callers include the text normalization helper `0x0059aed0` and later support-family parse strips that consume bounded numeric text fields.","llvm-objdump + caller correlation + local disassembly + signed-decimal correlation"
0x005a1eb0,320,string_append_bounded_nul_terminated_and_return_dest,support,cdecl,inferred,llvm-objdump + local disassembly,3,"Shared bounded append helper over two NUL-terminated strings. The routine first scans to the end of the caller destination string, then copies bytes from the caller source string until it reaches either the caller count limit or the first source NUL, and always writes one trailing NUL before returning the original destination pointer. The implementation uses aligned dword fast paths when the pointers permit, so this is the support-family `strncat` analogue rather than a domain-specific text helper.","llvm-objdump + local disassembly + bounded-append correlation"
0x005a1ff0,134,string_find_substring_pointer,support,cdecl,inferred,llvm-objdump + caller correlation + local disassembly,3,"Shared substring search helper. The function returns the first pointer in the caller haystack where the caller pattern begins, returns the haystack itself when the pattern is empty, and returns null when no match exists. The implementation fast-paths one- and two-byte pattern heads before continuing the full compare. Current grounded callers include provider-name search `0x005694f0` and multiple shell-side token or descriptor scans that treat the result as a standard substring pointer.","llvm-objdump + caller correlation + local disassembly + substring-search correlation"
0x005a2076,56,string_parse_float64_with_locale_space_skip,support,cdecl,inferred,llvm-objdump + local disassembly,3,"Locale-aware floating-point text parser returning one `f64` in `st(0)`. The helper skips leading locale-space bytes through `0x005a546b`, prepares two null default arguments through `0x005abe90`, forwards the parse into `0x005abdf4` with one local scratch record, and finally loads the parsed double result from `[record+0x10]`. This is the wider support-family `strtod`-style wrapper rather than a gameplay-specific numeric helper.","llvm-objdump + local disassembly + locale-space correlation + floating-parse correlation"
0x005a20b0,425,memory_move_bytes_overlap_safe,support,cdecl,inferred,llvm-objdump + caller correlation + local disassembly,3,"Shared overlap-safe byte move primitive. The helper copies the caller byte span from source to destination, automatically choosing a forward or backward path when the ranges overlap and using aligned dword moves when possible before finishing any trailing bytes. Current grounded callers include the growable text-buffer prefix consumer `0x0059c640`, the shared ASCII trim helper `0x0051dd60`, and several CRT- or parser-style support strips in the same support family.","llvm-objdump + caller correlation + local disassembly + overlap-safe-move correlation"
0x005a2a06,184,string_find_char_pointer,support,cdecl,inferred,llvm-objdump + caller correlation + local disassembly,3,"Shared character search helper over one NUL-terminated string. The routine scans unaligned lead bytes first, then uses the usual dword-wide zero-byte and equality masks to search for the caller byte in aligned four-byte chunks, returning a pointer to the first matching byte or `0` when the string terminates first. Current grounded caller is the substring helper `0x005a1ff0`, which uses this function for the one-byte-pattern fast path. This is the support-family `strchr` analogue rather than a domain-specific token scan.","llvm-objdump + caller correlation + local disassembly + character-search correlation"
0x005a2abe,276,string_lowercase_in_place_locale_aware,support,cdecl,inferred,llvm-objdump + caller correlation + local disassembly,3,"Locale-aware lowercase normalizer over one mutable NUL-terminated string. When the active locale or codepage band reports no extended mapping table at `[locale+0x14]`, the helper lowercases ASCII `A..Z` in place directly; otherwise it first queries the converted length through the wider locale conversion helper rooted at `0x005ac579`, allocates one temporary aligned buffer, materializes the lowercase-mapped string into that buffer, copies it back over the original caller buffer through `0x005ac3b0`, and frees the temporary block. Current grounded caller is `shell_input_binding_parse_modifier_fragment_to_compact_mode_code` `0x0045ecd0`, which normalizes localized modifier fragments before token comparisons.","llvm-objdump + caller correlation + local disassembly + locale-lowercase correlation"
0x005a2bd2,94,buffered_stream_vformat_with_lock_scope,support,cdecl,inferred,llvm-objdump + local disassembly,3,"Scoped varargs stream-format wrapper over one FILE-like object. The helper installs a local SEH frame, acquires the caller stream lock through `0x005a91d5`, snapshots one stream-side formatting state through `0x005ac935`, forwards the stream, format string, and varargs pack into the shared formatter `0x005aa249`, restores the saved stream state through `0x005ac9bd`, and finally releases the stream lock through `0x005a9227` before returning the formatter result. This is the CRT-style formatted-stream analogue of the adjacent buffered read wrapper `0x005a1b05`.","llvm-objdump + local disassembly + stream-lock correlation + varargs-stream-format correlation"
0x005a2c30,128,crt_append_onexit_callback_to_global_table_unlocked,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,3,"Unlocked append helper for the global CRT on-exit callback table rooted at `0x00dbb8dc/0x00dbb8d8`. The helper queries the current table span through `0x005ac9e7`, grows the backing buffer through `0x005a5922` when the next callback would exceed current capacity, updates the begin and end roots after any reallocation, stores the caller callback pointer into the next free slot, and advances the live end pointer. Current grounded caller is the lock-scoped wrapper `0x005a2cd8`, and the adjacent init owner `0x005a2cb0` seeds the first table buffer before startup reaches `crt_init_exit_handlers` `0x005a2d64`.","llvm-objdump + local disassembly + startup correlation + onexit-table correlation"
0x005a2cb0,40,crt_init_global_onexit_callback_table,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,3,"Initializes the global CRT on-exit callback table at `0x00dbb8dc/0x00dbb8d8`. The helper allocates the initial `0x80`-byte callback buffer through `0x005a125d`, zeroes the first slot, sets both begin and end roots to that new buffer, and returns `0` on success or `0x18` on allocation failure. Current grounded callers are the broader registration helpers `0x005a2c30/0x005a2cd8`, and later startup-side owner `0x005a2d64` depends on the same table.","llvm-objdump + local disassembly + startup correlation + onexit-table correlation"
0x005a2cd8,56,crt_append_onexit_callback_to_global_table_with_lock_scope,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,3,"Lock-scoped wrapper over `crt_append_onexit_callback_to_global_table_unlocked` `0x005a2c30`. The helper acquires the local CRT lock through `0x005a2d52`, forwards the caller callback into `0x005a2c30`, then releases the same lock through `0x005a2d5b` before returning the stored callback pointer or failure result. Current grounded caller is the boolean wrapper `0x005a2d10`, and the same table is initialized by `0x005a2cb0` before `crt_init_exit_handlers` `0x005a2d64`.","llvm-objdump + local disassembly + startup correlation + onexit-table correlation"
0x005a2d10,16,crt_register_onexit_callback_return_success_bool,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,3,"Tiny boolean wrapper over `crt_append_onexit_callback_to_global_table_with_lock_scope` `0x005a2cd8`. The helper forwards one caller callback, normalizes the result into `1` on success or `0` on failure, and returns that boolean without mutating any other startup state. This is the narrow public success-or-failure entry above the same global on-exit callback table used by `crt_init_exit_handlers` `0x005a2d64`.","llvm-objdump + local disassembly + startup correlation + onexit-table correlation"
0x005a2d22,48,crt_call_optional_mscoree_corexitprocess_then_exitprocess,startup,cdecl,inferred,llvm-objdump + literal inspection + local disassembly,3,"Startup-side exit bridge that first tries to honor the CLR shutdown path when `mscoree.dll` is present. The helper resolves module string `mscoree.dll`, looks up export `CorExitProcess`, calls that export with the caller exit code when available, and then unconditionally falls through to the normal process-exit import. This is the optional .NET-aware exit bridge immediately above the CRT exit-handler setup strip.","llvm-objdump + literal inspection + local disassembly + CLR-exit correlation"
0x005a2d52,9,crt_lock_onexit_callback_table_slot8,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,2,"Tiny lock wrapper that acquires CRT lock slot `8` through `0x005a65d0`. Current grounded caller is the on-exit table registration wrapper `0x005a2cd8`.","llvm-objdump + local disassembly + startup correlation + CRT-lock correlation"
0x005a2d5b,9,crt_unlock_onexit_callback_table_slot8,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,2,"Tiny unlock wrapper that releases CRT lock slot `8` through `0x005a653c`. Current grounded caller is the on-exit table registration wrapper `0x005a2cd8`.","llvm-objdump + local disassembly + startup correlation + CRT-lock correlation"
0x005a2dc9,211,crt_run_exit_cleanup_tables_and_optionally_terminate_process,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,3,"Shared CRT exit owner behind the four public exit variants. The helper acquires CRT lock slot `8`, guards recursive exit state through globals `0x00dba050/0x00dba04c/0x00dba048`, optionally walks the global on-exit callback table at `0x00dbb8dc/0x00dbb8d8` in reverse order plus the fixed callback tables `0x005ed038..0x005ed04c`, and then either releases the lock and returns to the caller or marks the process as exiting and falls through `crt_call_optional_mscoree_corexitprocess_then_exitprocess` `0x005a2d22`. Current grounded callers are the four thin wrappers `0x005a2e9c`, `0x005a2ead`, `0x005a2ebe`, and `0x005a2ecd`.","llvm-objdump + local disassembly + startup correlation + exit-cleanup correlation"
0x005a2e9c,17,crt_exit_run_cleanup_and_terminate_process,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,2,"Thin wrapper around `crt_run_exit_cleanup_tables_and_optionally_terminate_process` `0x005a2dc9` with arguments `(exit_code, run_cleanup = 1, return_to_caller = 0)`. This is the strongest current fit for the ordinary process-terminating CRT exit path.","llvm-objdump + local disassembly + startup correlation + exit-variant correlation"
0x005a2ead,17,crt_exit_skip_cleanup_and_terminate_process,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,2,"Thin wrapper around `crt_run_exit_cleanup_tables_and_optionally_terminate_process` `0x005a2dc9` with arguments `(exit_code, run_cleanup = 0, return_to_caller = 0)`. This is the strongest current fit for the terminate-without-cleanup CRT exit variant.","llvm-objdump + local disassembly + startup correlation + exit-variant correlation"
0x005a2ebe,15,crt_exit_run_cleanup_and_return_to_caller,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,2,"Thin wrapper around `crt_run_exit_cleanup_tables_and_optionally_terminate_process` `0x005a2dc9` with arguments `(0, run_cleanup = 1, return_to_caller = 1)`. This is the strongest current fit for the cleanup-and-return CRT exit variant.","llvm-objdump + local disassembly + startup correlation + exit-variant correlation"
0x005a2ecd,19,crt_exit_skip_cleanup_and_return_to_caller,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,2,"Thin wrapper around `crt_run_exit_cleanup_tables_and_optionally_terminate_process` `0x005a2dc9` with arguments `(0, run_cleanup = 0, return_to_caller = 1)`. This is the strongest current fit for the skip-cleanup-and-return CRT exit variant.","llvm-objdump + local disassembly + startup correlation + exit-variant correlation"
0x005a2ee0,144,math_exp_x87_with_fastpath_probe,support,cdecl,inferred,llvm-objdump + local disassembly + literal inspection,3,"Scalar x87 natural-exponential helper family. The entry probes the same clean-state fastpath gate rooted at `0x00dbb8c8` used by the adjacent math strip; when the default MXCSR/x87 masks are intact it jumps into optimized entries `0x005acb08/0x005acaf0`, and otherwise it falls back to the shared x87 report or compute bodies `0x005a7a51/0x005a787e` with symbol string `exp` rooted at `0x0062aa1a`. This is the older x87 exponential seam immediately before the now-grounded `acos` and `tan` helpers.","llvm-objdump + local disassembly + literal inspection + x87-exp correlation"
0x005a2f70,208,math_acos_x87,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Scalar x87 arccosine helper. The wrapper stores the caller double, classifies it through the local exponent helper strip at `0x005a76d8/0x005a7695`, and then runs the body at `0x005a2f8d` without the SSE fastpath used by the neighboring `exp` entry. That body handles the ordinary `acos(x)` case through `atan2(sqrt((1+x)*(1-x)), x)`, returns `0` or `pi` for exact `+1/-1`, and routes domain errors outside `[-1, 1]` into the shared x87 status-report path rooted at `0x005a76ee/0x005a77f7`. Current grounded caller is `math_build_scaled_axis_vec4_from_quaternion_x87` `0x0056eb05`, which uses this helper to derive the angle term before `fsin`.","llvm-objdump + local disassembly + caller correlation + x87-acos correlation"
0x005a3040,178,math_tan_x87,support,cdecl,inferred,llvm-objdump + local disassembly,3,"Scalar x87 tangent helper. The wrapper stores the caller double, classifies it through the same local exponent helper strip at `0x005a76d8/0x005a7695`, and then runs the body at `0x005a305d` without the SSE fastpath used by the neighboring `exp` entry. That body uses direct `fptan` for the ordinary range, reduces larger arguments through repeated `fprem1` against the local constant at `0x005e2b2a`, and routes domain or status handling into the shared x87 report path rooted at `0x005a76ee/0x005a77f7`.","llvm-objdump + local disassembly + x87-tan correlation"
0x005a57cf,105,string_compare_casefolded_current_locale_nul_terminated,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Broader current-locale casefolded NUL-terminated string comparator. The helper resolves the active locinfo through `0x005abcd8` and `0x005a35f5`, falls back to plain byte comparator `0x005b0040` when locale field `[locinfo+0x14]` is null, and otherwise compares the two caller strings one code unit at a time after normalizing each byte or DBCS pair through `0x005a5838`. It returns the conventional signed difference at the first mismatch or `0` on equality. Current grounded callers span older locale selection, banked-slot name lookup, multiplayer text parsing, and many shell-side stem or token matches, so this is the safest current read for the shared locale-aware casefolded `strcmp` analogue.","llvm-objdump + local disassembly + caller correlation + locale-compare correlation"
0x005a5838,200,string_casefold_one_byte_or_dbcs_pair_via_current_locinfo,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Per-character locale-aware casefold helper beneath the older compare family. The helper takes one caller byte or packed DBCS value plus one current locinfo pointer, consults the active multibyte tables at `[locinfo+0x48]`, and when locale mapping is enabled routes the input through `locale_map_multibyte_string_via_lcmapstringw_or_lcmapstringa_fallback` `0x005ac579` with mapping flag `0x100`, returning either one folded byte or one folded two-byte packed value. When no locale mapping is active it falls back to plain ASCII `A..Z -> a..z` lowering. Current grounded callers are the two shared casefolded compare owners `0x005a57cf` and `0x005a5f26`, plus the one-byte current-locale wrapper `0x005a5900`.","llvm-objdump + local disassembly + caller correlation + locale-compare correlation + dbcs-correlation"
0x005a5900,34,string_casefold_one_signed_byte_via_current_locinfo,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Tiny current-locale wrapper around `string_casefold_one_byte_or_dbcs_pair_via_current_locinfo` `0x005a5838`. The helper resolves the active locinfo through `0x005abcd8` and `0x005a35f5`, forwards one caller signed byte into `0x005a5838`, and returns the folded result. Current grounded callers include the older numeric text helpers and string-hash builders that normalize one byte at a time.","llvm-objdump + local disassembly + caller correlation + locale-compare correlation"
0x005a5f26,127,string_compare_casefolded_current_locale_bounded,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Bounded sibling to `string_compare_casefolded_current_locale_nul_terminated` `0x005a57cf`. The helper resolves the current locinfo through `0x005abcd8` and `0x005a35f5`, returns zero immediately when the caller count is zero, falls back to plain bounded comparator `0x005b0100` when locale field `[locinfo+0x14]` is null, and otherwise compares the two caller strings one normalized code unit at a time through `0x005a5838` until the count is exhausted, a folded mismatch appears, or either folded unit reaches zero. It returns the conventional signed difference or zero on bounded equality. Current grounded callers are the older locale-enumeration callbacks around `0x005ae5d2/0x005ae7f2` plus several shell and multiplayer text filters, so this is the safest current read for the locale-aware casefolded `strncmp` analogue.","llvm-objdump + local disassembly + caller correlation + locale-compare correlation"
0x005a5fa5,60,string_insert_active_decimal_separator_before_exponent_marker_in_place,support,cdecl,inferred,llvm-objdump + local disassembly + correlation with global tri-string record,2,"In-place scientific-notation normalizer beneath the older legacy math dispatch table. The helper scans forward until it finds one exponent marker `e/E` under current-locale casefolding through `0x005a5900` or another terminating nondigit through `0x005a53f2`, then inserts the active decimal-separator byte `0x0062acf4` before that exponent marker by shifting the remaining suffix right by one byte. Current grounded caller pressure comes from the legacy math dispatch-table seed `0x005a1081`, which installs this helper into one of the fixed text-normalization slots at `0x0062a360..0x0062a374`.","llvm-objdump + local disassembly + legacy-math-dispatch correlation + decimal-text correlation"
0x005a5fe1,75,string_trim_trailing_zeros_and_optional_decimal_separator_before_exponent_or_nul,support,cdecl,inferred,llvm-objdump + local disassembly + correlation with global tri-string record,2,"Companion in-place numeric-text normalizer beneath the same legacy dispatch table. The helper finds the active decimal separator byte `0x0062acf4`, scans forward to exponent marker `e/E` or string end, then walks backward over trailing ASCII `0` digits and the decimal separator itself when present, finally shifting the exponent suffix or terminating NUL left to remove the redundant tail. Current grounded caller pressure comes from the legacy math dispatch-table seed `0x005a1081`, which installs this helper as the paired trim-side text normalizer.","llvm-objdump + local disassembly + legacy-math-dispatch correlation + decimal-text correlation"
0x005a602c,26,math_query_input_double_ge_zero,support,cdecl,inferred,llvm-objdump + local disassembly + literal correlation,1,"Tiny x87 predicate over one caller `f64` pointer. The helper compares the input against fixed scalar `0.0` at `0x005c8608` and returns `1` when the ordered compare is greater than or equal to zero, else `0`. Current grounded caller pressure comes from the older five-slot legacy math dispatch table rooted at `0x0062a360`.","llvm-objdump + local disassembly + literal correlation + legacy-math-dispatch correlation"
0x005a6046,61,legacy_numeric_dispatch_parse_ascii_text_to_single_or_pair_integer_output,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Small legacy dispatch-table entry above the older decimal parser. When caller selector arg0 is nonnull, the helper parses the caller ASCII numeric text through `decimal_parse_ascii_and_convert_to_two_dword_integer_pair` `0x005b0485` and writes the resulting pair to the caller output buffer; otherwise it routes through `decimal_parse_ascii_and_convert_to_single_dword_integer` `0x005b04c8` and writes the single-dword result. Current grounded caller pressure comes from the five-slot legacy math dispatch table rooted at `0x0062a360`.","llvm-objdump + local disassembly + caller correlation + legacy-math-dispatch correlation + decimal-record correlation"
0x005a60a1,174,math_format_scientific_ascii_from_float_record_with_optional_uppercase_exponent,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Scientific-notation formatting helper beneath the older floating-format strip. The helper emits an optional leading sign, uses `decimal_record_materialize_rounded_significand_digits_into_ascii_buffer` `0x005b050b` to build the mantissa digits, inserts the active decimal separator `0x0062acf4` after the first digit when precision is positive, appends fixed suffix `e+000` from `0x005e292c`, optionally uppercases the exponent marker to `E`, and finally writes the signed decimal exponent from float-record field `[record+0x04]`. Current grounded callers are `0x005a614f` and the general-format owner `0x005a62c7`.","llvm-objdump + local disassembly + caller correlation + decimal-record correlation + ascii-format correlation"
0x005a614f,272,math_format_scientific_ascii_from_x87_extended,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Broader scientific-notation owner above the older float-record strip. The helper materializes one local float record and digit buffer from the caller x87 extended input through `math_materialize_float_record_and_digit_buffer_from_x87_extended` `0x005b063c`, then forwards that record into `math_format_scientific_ascii_from_float_record_with_optional_uppercase_exponent` `0x005a60a1` using the caller precision and uppercase-mode flag. Current grounded caller is the legacy format dispatcher `0x005a6367`.","llvm-objdump + local disassembly + caller correlation + x87-extended correlation + ascii-format correlation"
0x005a61c3,156,math_format_fixed_ascii_from_float_record,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Fixed-point formatting helper beneath the same older floating-format strip. The helper emits an optional leading sign, places the decimal separator `0x0062acf4` according to float-record exponent `[record+0x04]`, emits leading or trailing zero padding when the decimal point falls outside the stored digit band, and copies the significand digits from the float record into the caller buffer. Current grounded callers are the fixed-format owner `0x005a625f` and the general-format owner `0x005a62c7`.","llvm-objdump + local disassembly + caller correlation + decimal-record correlation + ascii-format correlation"
0x005a625f,104,math_format_fixed_ascii_from_x87_extended,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Broader fixed-point owner above the older float-record strip. The helper materializes one local float record and digit buffer from the caller x87 extended input through `math_materialize_float_record_and_digit_buffer_from_x87_extended` `0x005b063c`, then formats the result through `math_format_fixed_ascii_from_float_record` `0x005a61c3` using the caller precision and trim-mode flag. Current grounded caller is the legacy format dispatcher `0x005a6367`.","llvm-objdump + local disassembly + caller correlation + x87-extended correlation + ascii-format correlation"
0x005a62c7,160,math_format_general_ascii_from_x87_extended,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"General-format owner above the older float-record strip. The helper materializes one local float record and digit buffer through `math_materialize_float_record_and_digit_buffer_from_x87_extended` `0x005b063c`, uses exponent and digit-count thresholds from that record to choose between fixed and scientific presentation, optionally trims the mantissa tail when the fixed branch leaves redundant zeros, and then dispatches into `math_format_fixed_ascii_from_float_record` `0x005a61c3` or `math_format_scientific_ascii_from_float_record_with_optional_uppercase_exponent` `0x005a60a1`. Current grounded caller is the legacy format dispatcher `0x005a6367`.","llvm-objdump + local disassembly + caller correlation + x87-extended correlation + ascii-format correlation"
0x005a6367,81,math_format_ascii_from_x87_extended_by_style_code_eEfGg,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Style-dispatch owner for the older x87 ASCII-format strip. The helper switches on caller format code `e/E/f` and the remaining general-format path, routing into `math_format_scientific_ascii_from_x87_extended` `0x005a614f`, `math_format_fixed_ascii_from_x87_extended` `0x005a625f`, or `math_format_general_ascii_from_x87_extended` `0x005a62c7`. Current grounded caller pressure comes from the five-slot legacy math dispatch table rooted at `0x0062a360`.","llvm-objdump + local disassembly + caller correlation + legacy-math-dispatch correlation + ascii-format correlation"
0x005ad0c4,73,startup_query_program_name_tail_from_command_line,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,3,"Startup helper over the raw command-line pointer at `0x00dbb8d0`. The function walks the leading quoted or unquoted program-name token, falls back to the default empty string at `0x005c87a8` when no command line is present, and returns the first character after the executable path. This is the safest current read for the common program-name-tail extractor used by the CRT startup argument path.","llvm-objdump + local disassembly + startup correlation + command-line parsing correlation"
0x005ad524,870,locale_build_primary_text_record_b8_from_thread_lcid_and_user_default_lcid,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Builds one `0xb8`-byte primary locale text record. The helper reads the current-thread locale words from `0x00dba366/0x00dba368`, then repeatedly materializes locale-info fields through `locale_materialize_numeric_byte_or_allocated_multibyte_info_field` `0x005b1a42`, storing a dense band of owned multibyte strings at offsets `+0x00..+0xb0`, one copied locale word at `+0xac`, and several numeric-byte fields via the mode-`0` calls. The first large run uses the primary locale word for `LCTYPE` values `0x2a..0x4f` plus `0x28/0x29`, while the trailing fields switch to the secondary locale word for `0x1f/0x20/0x1003/0x1009`. The function returns `0` on success and `-1` when any field-materialization step fails. Current grounded caller is the global refresh owner `0x005ada1b`.","llvm-objdump + local disassembly + caller correlation + locale-record correlation + locale-info correlation"
0x005ad88b,400,locale_release_primary_text_record_b8_owned_string_fields,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Release helper for the primary `0xb8`-byte locale text record built by `0x005ad524`. The function walks the owned pointer fields across offsets `+0x00..+0xa8`, freeing each string through `0x005a1145` while leaving the inline numeric-byte and copied-locale-word slots untouched. Current grounded callers are the failed build cleanup path inside `0x005ada1b` and sibling locale refresh owners in the same CRT family.","llvm-objdump + local disassembly + caller correlation + locale-record correlation"
0x005ada1b,94,locale_refresh_global_primary_text_record_or_fallback_static_record,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Global refresh owner for the primary locale text record globals `0x0062abe0` and `0x00dba2f8`. When feature flag `0x00dba338` is set, the helper allocates one `0xb8`-byte record through `0x005a5714`, builds it through `locale_build_primary_text_record_b8_from_thread_lcid_and_user_default_lcid` `0x005ad524`, and stores the finished record pointer into both globals. On build failure it releases the partially-built record through `0x005ad88b`, frees the block, and returns `1`. When the feature flag is clear it instead points `0x0062abe0` at the static fallback record `0x0062abe8` and clears `0x00dba2f8`.","llvm-objdump + local disassembly + caller correlation + locale-record correlation + global-state correlation"
0x005ada7a,95,locale_release_active_or_dynamic_tri_string_record_preserving_static_defaults,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Release helper for the narrow three-string locale record rooted at `0x0062acd4`. The function examines the three owned string pointers in the caller `0x30`-byte record and frees each one only when it is neither the currently active record field in `0x0062acd4` nor the corresponding static fallback string at `0x0062aca4/0x0062aca8/0x0062acac`. Current grounded caller is the matching refresh owner `0x005adad9`.","llvm-objdump + local disassembly + caller correlation + locale-record correlation"
0x005adad9,461,locale_refresh_global_tri_string_record_and_digit_map,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Refreshes the active three-string locale record at `0x0062acd4` plus the associated digit-map side state. When both feature flags `0x00dba334` and `0x00dba330` are clear, the helper releases prior dynamic state, falls back to the static tri-string record at `0x0062aca4`, clears globals `0x00dba76c/0x00dba770/0x00dba2fc`, and finishes by publishing the first byte of the active primary string into `0x0062acf4`. Otherwise it allocates one `0x30`-byte record and one four-byte side block, materializes locale strings for `LCTYPE 0x0e/0x0f/0x10` through `0x005b1a42`, normalizes the third string in place from ASCII digits and `';'` separators into packed digit bytes, and stores the finished blocks into globals `0x0062acd4`, `0x00dba76c`, `0x00dba770`, and `0x00dba2fc`. Current grounded caller pressure comes from the surrounding CRT locale refresh strip that seeds the active multibyte classification tables.","llvm-objdump + local disassembly + caller correlation + locale-record correlation + digit-map correlation"
0x005adca6,217,locale_release_secondary_text_record_30_owned_fields_preserving_static_defaults,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Release helper for the secondary `0x30`-byte locale text record rooted at `0x0062acd4` offset band `+0x0c..+0x24`. The function frees each owned pointer in the caller record only when it differs from both the currently active record field and the matching static fallback strings at `0x0062acb0..0x0062acc8`. Current grounded caller is the matching refresh owner `0x005add7f`.","llvm-objdump + local disassembly + caller correlation + locale-record correlation"
0x005add7f,574,locale_refresh_global_secondary_text_record_and_multibyte_leadbyte_tables,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Refreshes the secondary locale text and multibyte-leadbyte support globals around `0x0062acd4`, `0x00dba768`, `0x00dba76c`, and `0x00dba2fc`. When both feature flags `0x00dba330` and `0x00dba334` are clear, the helper falls back to the static record at `0x0062aca4`, clears the dynamic side globals, and returns success. Otherwise it allocates one `0x30`-byte record and one four-byte companion block, materializes locale strings and numeric-byte fields for `LCTYPE 0x14..0x19`, `0x1a`, and `0x50..0x57` through `0x005b1a42`, normalizes the semicolon-delimited digit string at field `+0x1c`, copies the primary tri-string fields from the previously active record, publishes the finished record through `0x0062acd4` and `0x00dba2fc`, and stores the side block in `0x00dba768`. This same pass also seeds the multibyte classification tables later consumed by the DBCS-aware locale helpers.","llvm-objdump + local disassembly + caller correlation + locale-record correlation + multibyte-classification correlation"
0x005adfbe,450,locale_build_active_codepage_char_type_tables_or_ascii_fallback,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"Older CRT codepage bootstrap owner above the multibyte classification globals `0x0062abd8`, `0x00dba760`, `0x00dba764`, and `0x0062acf0`. When active-codepage seed `0x00dba32c` is clear, the helper falls back to the static table at `0x005e6f12` and clears the dynamic side globals. Otherwise it ensures current codepage `0x00dba33c` is populated, allocates one identity byte map of size `0x101`, one word classification table of size `0x202`, and one small side block, queries `GetCPInfo` for the active codepage, stores `MaxCharSize` in `0x0062acf0`, clears lead-byte ranges in the byte map, materializes the corresponding word classification table through `locale_query_character_types_multibyte_with_getstringtypew_or_getstringtypea_fallback` `0x005aec88`, stamps lead-byte slots with bit `0x8000`, and publishes the finished tables through the globals above. Current grounded sibling users include the later codepage-table rebuild strip `0x005b0db0` and the locale snapshot copier around `0x005a3cc1`.","llvm-objdump + import correlation + local disassembly + caller correlation + locale-correlation + codepage-table correlation"
0x005ae278,96,string_binary_search_alias_pair_table_and_export_replacement_ptr,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation + rdata correlation,2,"Binary-search helper over one sorted alias table of `(alias,replacement)` string pairs. The caller supplies the table base, upper bound, and one pointer-to-string slot; the helper compares the current string against each midpoint alias through `0x005a57cf`, and on the first exact match rewrites the caller slot to the paired replacement pointer before returning `1`. When no alias matches it leaves the caller slot untouched and returns `0`. Current grounded caller is the older locale selector `0x005ae9d5`, which uses this helper over alias table `0x005e7a30` to normalize incoming locale-name strings before `EnumSystemLocalesA` validation.","llvm-objdump + local disassembly + caller correlation + rdata correlation + string-alias correlation"
0x005ae2d8,25,locale_seed_user_default_lcid_pair_and_mark_global_locale_flags_0x104,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,2,"Tiny older-CRT locale seed helper. The routine ORs global flag word `0x00dba300` with `0x0104`, queries `GetUserDefaultLCID`, and stores that same LCID into both `0x00dba304` and `0x00dba308`. Current grounded caller is the fallback branch inside the broader locale-selector owner `0x005ae9d5`.","llvm-objdump + import correlation + local disassembly + caller correlation + locale-correlation"
0x005ae2f2,124,locale_parse_codepage_from_keyword_or_locale_info_string,support,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + string correlation,3,"Parses one codepage selector string into a numeric codepage `u16`. When caller string `ECX` is null or empty, the helper queries the current secondary locale through function pointer `0x00dba320` with `LCTYPE 0x1004`. Otherwise it recognizes the fixed keywords `ACP` and `OCP`, mapping them to `LCTYPE 0x1004` and `0x000b` respectively, and falls back to direct decimal parsing for all other strings. The resulting text is then parsed through the locale-aware signed-decimal core `0x005a1e1d`. Current grounded caller is the export tail of `0x005ae9d5`, which feeds the validated codepage word back into the caller locale triple.","llvm-objdump + local disassembly + caller correlation + string correlation + locale-correlation + codepage-correlation"
0x005ae36e,30,locale_query_lcid_in_static_special_case_allowlist_0x5e7a1c,support,cdecl,inferred,llvm-objdump + local disassembly + rdata correlation + caller correlation,2,"Tiny allowlist probe over the static `0x14`-entry LCID table at `0x005e7a1c`. The helper returns `0` when the caller `LCID` appears in that fixed table and `1` otherwise. Current grounded callers are the fallback-acceptance branches in `0x005ae4c1`, `0x005ae5d2`, and the broader locale-selector owner `0x005ae9d5`.","llvm-objdump + local disassembly + rdata correlation + caller correlation + locale-correlation"
0x005ae38c,227,locale_query_locale_info_from_static_lcid_table_or_getlocaleinfoa,support,stdcall,inferred,llvm-objdump + import correlation + local disassembly + rdata correlation,3,"Static-locale-table bridge beneath the older locale-selector family. The helper binary-searches the fixed `0x1a`-record table at `0x005e7448`, where each `0x2c`-byte row carries an LCID plus the neighboring locale-name, language, country, OEM-codepage, and ANSI-codepage strings. For `LCType` values `1`, `4`, `8`, `12`, `0x1002`, `0x1003`, and `0x1004`, it returns the corresponding static string field directly into the caller buffer; otherwise it falls back to `GetLocaleInfoA`. Current grounded caller is the broader locale-selector owner `0x005ae9d5`, which installs this helper as the active locale-info backend when the process is not in the direct Win32 locale path.","llvm-objdump + import correlation + local disassembly + rdata correlation + locale-correlation + static-table correlation"
0x005ae4c1,152,locale_enum_callback_match_secondary_name_or_allowlisted_lcid,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"`EnumSystemLocalesA` callback used by the older single-name secondary-locale path. The helper parses the enumerated locale string into one LCID through `0x005ae46f`, queries one locale field through backend `0x00dba320` using `LCTYPE 0x1002` or `0x0007` depending keyword-mode flag `0x00dba310`, and compares the result against selector string `0x00dba314`. When the text matches, or when the LCID lands in the special-case allowlist `0x005e7a1c`, it sets selector bit `0x4` in `0x00dba300` and stores the chosen LCID into both `0x00dba304` and `0x00dba308`. The callback returns `0` to stop enumeration on success and `1` to continue otherwise. Current grounded caller is `0x005ae8c3`.","llvm-objdump + import correlation + local disassembly + caller correlation + enumsystemlocalesa correlation + locale-correlation"
0x005ae5d2,541,locale_enum_callback_match_primary_and_secondary_names_and_store_lcid_pair,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,4,"Broader `EnumSystemLocalesA` callback beneath the two-name selector branch. The helper parses the enumerated locale string into one LCID through `0x005ae46f`, first queries the secondary locale text through backend `0x00dba320` using `LCTYPE 0x1002` or `0x0007` according to `0x00dba310`, and then queries the primary locale text through `LCTYPE 0x1001` or `0x0003` according to `0x00dba30c`. The two results are matched against selector strings `0x00dba314` and `0x00dba31c` through `0x005a57cf` or the bounded compare helper `0x005a5f26`, using comparison-length latch `0x00dba318` and the allowlist probe `0x005ae36e` for the fallback branches. On the successful paths it sets selector bits `0x1`, `0x2`, and `0x4` in `0x00dba300` as needed and stores the selected primary and secondary LCIDs into `0x00dba304/0x00dba308`. The callback returns `0` to stop enumeration on success and `1` to continue when the current locale does not satisfy the selector state. Current grounded caller is `0x005ae8fa`.","llvm-objdump + import correlation + local disassembly + caller correlation + enumsystemlocalesa correlation + locale-correlation + selector-state correlation"
0x005ae7f2,206,locale_enum_callback_match_primary_name_and_store_lcid_pair,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"Primary-name-only `EnumSystemLocalesA` callback in the older selector family. The helper parses the enumerated locale string into one LCID through `0x005ae46f`, queries the primary locale text through backend `0x00dba320` using `LCTYPE 0x1001` or `0x0003` according to keyword-mode flag `0x00dba30c`, and matches that text against selector string `0x00dba31c` either exactly or through bounded compare `0x005a5f26` when comparison-length latch `0x00dba318` is live. On success it sets selector bit `0x4` in `0x00dba300` and stores the chosen LCID into both `0x00dba304` and `0x00dba308`. The callback returns `0` to stop enumeration on success and `1` to continue otherwise. Current grounded caller is `0x005ae980`.","llvm-objdump + import correlation + local disassembly + caller correlation + enumsystemlocalesa correlation + locale-correlation"
0x005ae8c3,55,locale_enumerate_system_locales_from_primary_name_and_seed_keyword_mode_flag,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,2,"Small locale-enumeration seed helper for the older selector family. The routine compares the primary locale-name string at `0x00dba314` against decimal `3`, stores the resulting keyword-mode flag in `0x00dba310`, then runs `EnumSystemLocalesA` with callback `0x005ae4c1`. If the callback path fails to set bit `0x4` in `0x00dba300`, the helper clears the whole selector flag word. Current grounded caller is the primary-name-only branch in `0x005ae9d5`.","llvm-objdump + import correlation + local disassembly + caller correlation + locale-correlation"
0x005ae8fa,134,locale_enumerate_system_locales_from_primary_and_secondary_names,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"Broader two-name locale-enumeration seed helper in the older selector family. The routine derives the primary and secondary keyword-mode flags `0x00dba30c/0x00dba310` from the strings at `0x00dba31c/0x00dba314`, seeds the comparison-length latch `0x00dba318`, clears `0x00dba304`, and enumerates `EnumSystemLocalesA` through callback `0x005ae5d2`. Success requires the callback path to populate both the high selector bits and one of the low acceptance bits in `0x00dba300`; otherwise the helper clears the selector state back to zero. Current grounded caller is the branch in `0x005ae9d5` where both primary and secondary locale-name strings are present.","llvm-objdump + import correlation + local disassembly + caller correlation + locale-correlation + enumeration correlation"
0x005ae980,85,locale_enumerate_system_locales_from_primary_name_only,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,2,"Primary-name-only sibling of `0x005ae8fa` in the older locale-selector family. The helper derives keyword-mode flag `0x00dba30c` and comparison-length latch `0x00dba318` from primary locale-name string `0x00dba31c`, enumerates `EnumSystemLocalesA` through callback `0x005ae7f2`, and succeeds only when that callback sets selector bit `0x4` in `0x00dba300`. Current grounded callers are the one-name branches in `0x005ae9d5`.","llvm-objdump + import correlation + local disassembly + caller correlation + locale-correlation + enumeration correlation"
0x005ae9d5,437,locale_select_validate_and_export_locale_lcid_pair_and_codepage_triplet,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation + rdata correlation,4,"Broader older-CRT locale selector beneath the startup and locale-refresh family. On first entry the helper installs active locale-info backend `0x00dba320`, using direct `GetLocaleInfoA` when process mode word `0x00dba010 == 2` and static-table bridge `0x005ae38c` otherwise. It then stores caller primary and secondary locale-name pointers into `0x00dba31c/0x00dba314`, expands selected aliases through binary-search helper `0x005ae278` against the alias table at `0x005e7a30`, clears selector flags `0x00dba300`, and chooses one of four seed paths: `0x005ae8fa` when both names are present, `0x005ae980` when only the primary name is present, `0x005ae8c3` when only the secondary name is present, or `0x005ae2d8` when neither name is provided. On success it parses the caller codepage selector text at `[arg0+0x80]` through `0x005ae2f2`, validates the resulting codepage and LCID pair through `IsValidCodePage` and `IsValidLocale`, optionally exports the selected locale triple `(primary LCID, secondary LCID, codepage)` to the caller output record, and when a second output buffer is provided it re-materializes the canonical primary name, secondary name, and decimal codepage text through backend `0x00dba320` plus decimal formatter `0x005b1bb1`. Current grounded caller is the startup-side locale-option path at `0x005a3796`, so this is the safest current read for the old locale string selection, validation, and export owner rather than a narrower enum-only helper.","llvm-objdump + import correlation + local disassembly + caller correlation + rdata correlation + locale-correlation + startup correlation"
0x005ae190,91,support_fill_memory_with_repeated_byte,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,1,"Generic byte-fill helper equivalent to `memset(dst, byte, len)`. The function aligns the destination when profitable, replicates the low byte across a dword for the fast path, fills full dwords with `rep stosd`, and then writes any trailing bytes. Current grounded callers span the older CRT, locale bootstrap, and shell support strips.","llvm-objdump + local disassembly + caller correlation + memory-fill correlation"
0x005ae1f0,136,string_compare_nul_terminated_ascii,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,1,"Generic NUL-terminated byte-string comparator equivalent to `strcmp`. The function uses aligned dword comparisons when possible, falls back to byte or word steps for misaligned prefixes, and returns `0` on equality or `-1/+1` according to the first differing byte. Current grounded callers span the CRT locale and parser strips.","llvm-objdump + local disassembly + caller correlation + string-compare correlation"
0x005ae46f,53,string_parse_ascii_hex_u32,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,1,"Parses one NUL-terminated ASCII hexadecimal string into a 32-bit accumulator. The helper accepts digits `0..9` and letters `A..F/a..f`, multiplies the running value by `0x10`, adds the next nibble value, and stops at the first NUL terminator. Current grounded callers are the adjacent locale and numeric-parse strips around `0x005ae4c1`, `0x005ae5d2`, and `0x005ae7f2`.","llvm-objdump + local disassembly + caller correlation + hex-parse correlation"
0x005ae4a4,28,string_count_leading_ascii_alpha_bytes,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,1,"Counts the number of contiguous leading ASCII alphabetic bytes in one NUL-terminated string. The helper advances while the current byte is in `A..Z` or `a..z` and returns the resulting prefix length. Current grounded callers are the adjacent locale or numeric-parse strips that first classify a leading alpha token before the later numeric conversion stages.","llvm-objdump + local disassembly + caller correlation + string-scan correlation"
0x005aec88,441,locale_query_character_types_multibyte_with_getstringtypew_or_getstringtypea_fallback,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"Character-type query bridge beneath the older CRT locale and codepage-table builders. On first entry the helper probes `GetStringTypeW` availability, caching wide mode `1` or ANSI fallback mode `2` in `0x00dba344`. In wide mode it defaults a missing codepage to `0x00dba33c`, converts the caller multibyte byte span to UTF-16 through `MultiByteToWideChar`, and then materializes the caller word-type output through `GetStringTypeW`. In fallback mode it derives the destination ANSI codepage through `locale_query_default_ansi_codepage_from_lcid` `0x005b16ef`, optionally transcodes the source bytes through `locale_transcode_multibyte_string_between_codepages_via_utf16_bridge_when_needed` `0x005b1738`, and finally calls `GetStringTypeA`. Current grounded callers are the older codepage bootstrap `0x005adfbe`, the later codepage-table rebuild owner `0x005b0db0`, and startup-side CRT initialization strips around `0x005a3980` and `0x005abca3`.","llvm-objdump + import correlation + local disassembly + caller correlation + locale-correlation + character-type correlation"
0x005ac3b0,248,string_append_nul_terminated_return_dest,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Shared unbounded append helper over two NUL-terminated strings. The routine first finds the end of the caller destination string, then copies the caller source string including its terminating NUL, using aligned dword fast paths when possible, and finally returns the original destination pointer. Current grounded caller is the locale-aware lowercase normalizer `0x005a2abe`, which uses this helper to copy a converted temporary string back over the caller buffer. This is the support-family `strcat` analogue.","llvm-objdump + local disassembly + caller correlation + string-append correlation"
0x005ac579,956,locale_map_multibyte_string_via_lcmapstringw_or_lcmapstringa_fallback,support,cdecl,inferred,llvm-objdump + import correlation + caller correlation + local disassembly,3,"Broader locale string-mapping owner beneath the lowercase normalizer and adjacent CRT text paths. On first entry the helper probes whether the wide-character path is usable by calling `KERNEL32!LCMapStringW` with a tiny test buffer and caches mode `1` or fallback mode `2` in global `0x00dba1d4`, using `KERNEL32!GetLastError == 0x78` as the explicit unsupported-API cutoff. In mode `1`, it defaults missing locale or codepage arguments from `0x00dba33c`, converts the caller multibyte input to UTF-16 through `KERNEL32!MultiByteToWideChar`, queries or materializes the mapped UTF-16 output through `KERNEL32!LCMapStringW`, and either writes directly into the caller buffer on the in-place fixed-size path or converts the mapped UTF-16 result back through `KERNEL32!WideCharToMultiByte`. In mode `2` or `0`, it falls back to the ANSI-side helpers `0x005b16ef` and `0x005b1738`, then maps the caller buffer through `KERNEL32!LCMapStringA`. Current grounded caller is `string_lowercase_in_place_locale_aware` `0x005a2abe`, which uses this owner to materialize locale-aware lowercase text.","llvm-objdump + import correlation + caller correlation + local disassembly + locale-mapping correlation"
0x005acaa1,67,crt_walk_fixed_callback_table_0x5eab28,startup,cdecl,inferred,llvm-objdump + caller correlation + local disassembly,3,"Walks the fixed callback table `0x005eab28..` in 4-byte steps and calls each non-null entry in order. Current grounded registration path is `crt_init_exit_handlers` `0x005a2d64`, which appends this walker into the dynamic on-exit table so the fixed callback band runs during later CRT cleanup.","llvm-objdump + caller correlation + local disassembly + startup-callback-table correlation"
0x005acaf0,24,math_exp_f64_sse2_wrapper_from_x87_st0,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Tiny x87-to-SSE bridge for the optimized exponential fast path. The helper realigns the stack, stores the caller double from `st(0)`, loads it into `xmm0`, and forwards into `math_exp_f64_sse2_core` `0x005acb08`. Current grounded caller is the clean-state fastpath branch in `math_exp_x87_with_fastpath_probe` `0x005a2ee0`.","llvm-objdump + local disassembly + caller correlation + sse2-exp correlation"
0x005acb08,630,math_exp_f64_sse2_core,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Optimized SSE2 double-precision exponential core beneath `math_exp_x87_with_fastpath_probe` `0x005a2ee0`. The body expands the scalar into packed form, performs range reduction and table lookup, evaluates the polynomial over the reduced argument, rebuilds the exponent field, and returns the final double through `st(0)`, while diverting exceptional ranges into the slower x87-side tail at `0x005acd7e`.","llvm-objdump + local disassembly + caller correlation + sse2-exp correlation"
0x005acd13,107,math_exp_f64_sse2_exception_tail_handle_large_finite_and_nonfinite_input,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Larger exception-side tail beneath `math_exp_f64_sse2_core` `0x005acb08`. The helper handles the ranges that fall past the moderate-input roundtrip path `0x005acd7e`: large finite magnitudes return fixed overflow or underflow-style constants from `0x005e6b90/0x005e6b98`, exact positive or negative infinity returns the expected pass-through constants from `0x005e6b80/0x005e6b88`, and NaN-style cases fall through to the shared report path with code `0x03ea`. This is the safest current read for the large-input and non-finite exception ladder under the SSE2 `exp` core.","llvm-objdump + local disassembly + caller correlation + sse2-exp correlation + math-error-report correlation"
0x005acd7e,50,math_exp_f64_sse2_exception_tail_roundtrip_moderate_input_through_x87,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,1,"Small exception-side tail beneath `math_exp_f64_sse2_core` `0x005acb08`. The helper checks whether the absolute input magnitude stays below the moderate threshold `0x40900000`, and when it does, adds one fixed bias constant from `0x005e6b60`, spills that adjusted value to the stack, and reloads it through x87 before returning. Otherwise it falls through to the slower neighboring exceptional path. This is the safest current read for the moderate-input roundtrip tail under the SSE2 `exp` core rather than a standalone math helper.","llvm-objdump + local disassembly + caller correlation + sse2-exp correlation"
0x005acdb0,375,crt_emit_runtime_error_or_math_error_message_by_code_and_mode,startup,cdecl,inferred,llvm-objdump + local disassembly + runtime-string-table inspection + import correlation,3,"Broader CRT report owner over one caller error code in `ECX`. The function scans the fixed code-to-string table at `0x0062aac0`, resolves the matching runtime or math text such as `R6002`, `R6024`, `DOMAIN error`, `SING error`, or `TLOSS error`, and then emits the selected message through either the GUI report path rooted at `0x005b1907` or the console path using `GetStdHandle(-12)` plus `WriteFile`. It also prepends the module-name banner through `GetModuleFileNameA` and the shared append helpers at `0x005ac3b0/0x005ac3c0`, so this is the safest current read for the common CRT runtime-error or math-error message emitter by code rather than a pure GUI box helper.","llvm-objdump + local disassembly + runtime-string-table inspection + import correlation + report-path correlation"
0x005acf27,57,crt_emit_runtime_error_banner_pair_and_optional_hook,startup,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Small CRT wrapper over `crt_emit_runtime_error_or_math_error_message_by_code_and_mode` `0x005acdb0`. When the current reporting mode permits it, the helper emits the shared prefix or banner code `0xfc`, invokes the optional report hook at `0x00dba1e0` when present, and then emits the trailing `runtime error ` code `0xff`. This is the safest current read for the paired runtime-error banner wrapper rather than a standalone message formatter.","llvm-objdump + local disassembly + caller correlation + runtime-string-table correlation"
0x005acf60,356,crt_dispatch_floating_point_exception_record_to_registered_math_handler,startup,thiscall,inferred,llvm-objdump + local disassembly + exception-code inspection + import correlation,3,"Broader CRT exception-dispatch owner over one exception-state object. The helper scans the registered math-handler table rooted at `[state+0x54]`, temporarily swaps the active entry pointer at `[state+0x58]`, translates floating-point exception records such as `0xc000008d`, `0xc000008e`, `0xc000008f`, `0xc0000090`, `0xc0000091`, `0xc0000092`, and `0xc0000093` into the local runtime math codes `0x81..0x86` and `0x8a`, and then invokes the selected callback. When no registered handler accepts the exception it falls back to `UnhandledExceptionFilter`. This is the safest current read for the registered floating-point exception dispatcher beneath the older x87 report path.","llvm-objdump + local disassembly + exception-code inspection + import correlation + handler-table correlation"
0x005ac935,136,buffered_stream_prepare_temp_buffering_state_for_locked_formatting,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Prepares one FILE-like stream for the locked formatting path. The helper checks whether the stream handle is eligible for a temporary formatting buffer, distinguishes the canonical stream roots `0x0062a778` and `0x0062a798`, allocates or reuses one `0x1000`-byte temporary buffer from globals `0x00dba1d8..`, stores that buffer into `[stream+0x00/+0x08]`, seeds lengths `[stream+0x04/+0x18]`, sets stream flags `0x1102`, and returns a small snapshot code that tells the caller whether a temporary buffer was installed. Current grounded caller is `buffered_stream_vformat_with_lock_scope` `0x005a2bd2`.","llvm-objdump + local disassembly + caller correlation + stream-buffering correlation"
0x005ac9bd,42,buffered_stream_restore_after_locked_formatting_if_temp_buffering_was_installed,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Restore-side companion to `buffered_stream_prepare_temp_buffering_state_for_locked_formatting` `0x005ac935`. When the caller snapshot code is nonzero and the temporary-buffer flag is still live in `[stream+0x0d]`, the helper flushes or finalizes that temporary formatting state through `0x005a27e5`, clears the temp-buffer flag bits, and zeroes the stream root or length fields at `[stream+0x00/+0x08/+0x18]`. Current grounded caller is `buffered_stream_vformat_with_lock_scope` `0x005a2bd2`.","llvm-objdump + local disassembly + caller correlation + stream-buffering correlation"
0x005ac9e7,118,heap_query_allocation_size_for_pointer_with_local_heap_fastpath,startup,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"Queries the current allocation size for one caller pointer. When CRT heap mode global `0x00dbb8c4` equals `3`, the helper acquires local lock slot `4`, asks `heap_region_query_descriptor_for_pointer` `0x005a6649` whether the pointer belongs to the local CRT small-block region set, and if so derives the user-visible size from the local header word at `[ptr-0x4] - 9`; otherwise it falls back to `KERNEL32!HeapSize(0x00dbb8c0, 0, ptr)`. Current grounded caller is `crt_append_onexit_callback_to_global_table_unlocked` `0x005a2c30`, which uses this helper to query current capacity before growing the dynamic on-exit callback table.","llvm-objdump + import correlation + local disassembly + caller correlation + onexit-table correlation + heap-size correlation"
0x00556620,305,sprite_billboard_manager_reset,bootstrap,thiscall,inferred,ghidra-headless,3,Releases the shared sprite-billboard manager state including emitter slots at [this+0x10] queued templates at [this+0x18] and owned resource handles or containers before zeroing the manager pointers again.,ghidra + rizin + llvm-objdump
0x00556770,420,sprite_billboard_manager_init_pools,bootstrap,thiscall,inferred,ghidra-headless,4,Initializes the shared sprite-billboard manager when the shell first needs emitter templates. It allocates the long-lived emitter arrays and container objects at [this+0x10] [this+0x18] [this+0x8] [this+0x4] and [this+0x0] with a default capacity of 0xc350 slots unless the caller overrides it.,ghidra + rizin + llvm-objdump
0x00556920,814,sprite_billboard_init_emitter_template,bootstrap,thiscall,inferred,ghidra-headless,4,Initializes one sprite-billboard emitter template from optional source geometry color flags and atlas bounds. It copies source points or seeds a fallback anchor path stores owner position seeds default fade and timing fields across [this+0x94..0xd8] computes atlas uv steps from [this+0xe0..0xec] into [this+0x110..0x124] and optionally prewarms the spawn list through 0x00554ce0 when the caller flags request it.,ghidra + rizin + llvm-objdump
0x00556c50,143,sprite_billboard_manager_create_template_node,bootstrap,thiscall,inferred,ghidra-headless,4,Allocates or reuses one manager node then creates a fresh sprite-billboard template through 0x00556920 with flag 0x400 forced on. The helper stores the new template at [node+0x4] and queues the node into the manager container at [this+0x8].,ghidra + rizin + llvm-objdump
0x00556ce0,160,sprite_billboard_manager_clone_template_node,bootstrap,thiscall,inferred,ghidra-headless,4,Looks up one existing manager node and either returns its current template or clones a new sprite-billboard template from it through 0x00556920. On the first clone path it prewarms the source template through 0x00554ce0 and then queues the new node into the manager container at [this+0x4].,ghidra + rizin + llvm-objdump
0x00556e10,54,intrusive_queue_push_back,support,cdecl,inferred,ghidra-headless,4,Allocates one intrusive-queue node then appends the caller payload pointer to the tail of the container. The helper writes the payload at [node+0x00] links the previous tail through [node+0x04] and [tail+0x08] updates the head and tail slots when needed and increments the queued-node count at [this+0x0c].,ghidra + rizin + llvm-objdump
0x00556ef0,6,intrusive_queue_rewind_iterator,support,cdecl,inferred,ghidra-headless,4,Resets one intrusive-queue iterator by copying the container head pointer at [this+0x00] into the current-iterator slot at [this+0x04]. The helper is reused broadly across shell presentation and gameplay container walkers before repeated next-node calls.,ghidra + rizin + llvm-objdump
0x00556f00,19,intrusive_queue_next_iterator_node,support,cdecl,inferred,ghidra-headless,4,Returns the current intrusive-queue iterator node from [this+0x04] then advances the iterator to the linked next pointer at [node+0x08]. When the iterator is exhausted it returns null without mutating any payload state.,ghidra + rizin + llvm-objdump
0x00556f90,13,intrusive_queue_peek_tail_payload,support,cdecl,inferred,ghidra-headless,4,Returns the payload pointer stored in the current tail node at [this+0x08]. When the container is empty it returns null without mutating the queue state.,ghidra + rizin + llvm-objdump
0x00557c90,32,owner_handle_query_status_code_equals_4,map,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,1,"Small owner-handle status query helper. The routine reads optional handle `[this+0x00]`, dispatches it through import thunk `0x005c83c0` when nonnull, and returns `1` only when the resulting status code equals `4`; otherwise it returns `0`. Current grounded callers are the mode-gated shell wrapper `0x00531520`, the scalar update owner `0x00557d90`, and the transition service strip `0x00531fd0`.","objdump + import-table + local disassembly + caller inspection + owner-handle correlation"
0x00557cb0,32,owner_handle_query_status_code_equals_8,map,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,1,"Small owner-handle status query helper. The routine reads optional handle `[this+0x00]`, dispatches it through import thunk `0x005c83c0` when nonnull, and returns `1` only when the resulting status code equals `8`; otherwise it returns `0`. Current grounded callers are the mode-gated shell wrapper `0x00531520`, the scalar update owner `0x00557d90`, and the transition service strip `0x00531fd0`.","objdump + import-table + local disassembly + caller inspection + owner-handle correlation"
0x00557cd0,112,owner_handle_clear_unregister_from_global_slots_and_optionally_notify,map,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,2,"Primary clear-side owner for the same handle object. When optional handle `[this+0x00]` is live, the routine first dispatches import thunk `0x005c83c4(handle,0)` and then `0x005c8464(handle,1)`, releases the handle through `0x005c83bc`, scans the ten-entry global slot table `0x00d973b8` to clear any matching handle pointer, zeroes `[this+0x00]`, and finally calls optional callback `0x00d973e0` when the caller notify flag is nonzero. Current grounded callers are the mode-gated shell wrapper `0x00531520`, the open-or-rebind owner `0x00557e50`, and the broader global-owner shutdown strip `0x00531a10`.","objdump + import-table + local disassembly + caller inspection + global-slot correlation + callback correlation"
0x00557d40,80,owner_handle_unregister_from_global_slots_and_notify_with_scoped_reentrancy,map,cdecl,inferred,objdump + import-table + local disassembly + caller inspection,2,"Scoped callback-side cleanup helper for the same owner-handle family. The routine increments global reentrancy counter `0x00ccb9f0`, scans the ten-entry global slot table `0x00d973b8` to clear one matching caller-supplied handle pointer, calls optional callback `0x00d973e0` when present, then decrements the same reentrancy counter before returning. Current grounded caller is the open-or-rebind owner `0x00557e50`, which registers this helper as the callback body when the caller supplies an external notify callback.","objdump + import-table + local disassembly + caller inspection + reentrancy-counter correlation + global-slot correlation"
0x00557d90,192,owner_handle_set_primary_scalar_toggle_state_codes_4_or_8_and_apply_scaled_pair,map,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,2,"Primary scalar-update owner for the same handle object. When optional handle `[this+0x00]` is live, the routine branches on the sign of caller scalar arg0, uses status queries `0x005c83c0 == 4/8` to decide whether to toggle import thunk `0x005c8464(handle,1)` or `0x005c8464(handle,0)`, scales the same scalar by constant `0x005ddcc8`, forwards the duplicated scaled pair into import thunk `0x005c83fc(handle,scaled,scaled)`, and caches the original scalar in `[this+0x104]`. When no handle is live, it still stores arg0 into `[this+0x104]` and returns. Current grounded callers are the shell wrapper `0x00531560`, the global-owner shutdown and rebuild strip `0x00531a10/0x00531c00`, the transition service `0x00531fd0`, the controller rebind strip `0x00532260`, and the open-or-rebind owner `0x00557e50`.","objdump + import-table + local disassembly + caller inspection + scalar-update correlation + owner-handle correlation"
0x00557e50,256,owner_handle_open_named_resource_register_global_slot_and_optional_callback,map,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,2,"Primary open-or-rebind owner for the same handle object. The routine first checks global gate `0x00531500`, requires cached primary scalar `[this+0x104]` to stay positive, optionally copies caller string arg1 into local name buffer `[this+0x04]`, clears the current handle through `0x00557cd0(this,0)`, opens a new named handle through import thunk `0x005c83d0(arg0,[this+0x04],0x80000)`, reapplies cached scalar `[this+0x104]` through `0x00557d90`, publishes the resulting handle into the first empty slot of global table `0x00d973b8`, starts the handle through `0x005c83cc`, and finally registers either callback body `0x00557d40` or a null callback through import thunk `0x005c83c4` depending on whether caller callback arg2 is present. The routine also caches the caller callback in global `0x00d973e0` when nonnull. Current grounded callers are the refresh wrapper `0x00531d30` and the timed transition service `0x00531fd0`.","objdump + import-table + local disassembly + caller inspection + global-slot correlation + callback correlation"
0x00558000,128,shell_child_control_release_localized_text_handles_payloads_and_parent_active_links,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Base release body for the shared shell child-control family under vtable `0x005ddcd0`. The routine clears the parent-window active child links `[parent+0xc6d/+0xc71]` when they still point at this control, releases localized or text handles rooted at `[this+0x43]` and `[this+0x47]` through `0x0051d800`, releases optional payload handles `[this+0x63]` and `[this+0x92]` through `0x0053c000` on controller-owned root `0x006d4020`, and clears those local owner slots back to `0`. Current grounded callers include child-control-family destructors such as `0x0047b110`, `0x0055f9b0`, `0x005631e0`, and `0x00563d20`.","objdump + local disassembly + caller inspection + child-control correlation + release-path correlation"
0x00558080,176,shell_child_control_reset_default_geometry_flags_and_selector_state,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Base reset helper for the same shell child-control family. The routine zeroes the local geometry, callback, selector, and payload bands, seeds state dword `[this+0x38] = -1`, resets words `[this+0x68/+0x6a] = 3`, seeds sentinel words `[this+0x7e/+0x80] = -1`, and clears optional parent, template, and localized-text owner slots through `[this+0x9e]`. Current grounded callers are the base constructor `0x00558580` and several family-specific constructor strips that re-enter the base before copying payload bands.","objdump + local disassembly + caller inspection + child-control correlation + reset-state correlation"
0x00558180,96,shell_child_control_set_caption_selector_resolve_text_and_optionally_mirror_active_selector,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Caption-selector refresh helper for the shared shell child-control family. The routine releases any current resolved text handle at `[this+0x63]`, stores caller selector byte arg0 into `[this+0x37]`, resolves the new localized text handle through `0x0053ca20 -> 0x0053c6f0 -> 0x0053ca90` on controller-owned root `0x006d4020`, stores that handle in `[this+0x63]`, and optionally mirrors selector byte `[this+0x37]` into active selector byte `[this+0x67]` when caller arg1 is zero. Current grounded callers include the local child-control family setup and refresh strips beneath the shared shell-window registration helper.","objdump + local disassembly + caller inspection + child-control correlation + localized-text correlation"
0x005581e0,272,shell_child_control_hit_test_local_point_against_primary_rect_or_extent_modes,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Local hit-test helper for the shared shell child-control family. The routine first admits controls whose state flags `[this+0x33]` already carry bit `0x0002`; otherwise it chooses between two local shape modes using float span bands `[this+0x1b..+0x27]` and selector word `[this+0x06]`, comparing the caller XY pair against either the expanded float extent or the simpler integer-style span rooted at `[this+0x0b..+0x17]` around parent anchor `[this+0x86]`. On success it returns `1`; otherwise `0`. Current grounded caller is the broader point-hit owner `0x005582f0`, which uses this helper for the admitted selector-word cases.","objdump + local disassembly + caller inspection + child-control correlation + hit-test correlation"
0x005582f0,272,shell_child_control_hit_test_point_with_optional_virtual_gate_and_local_shape_filter,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Broader point-hit owner for the same shell child-control family. The routine first runs one optional virtual precheck through vtable slot `+0x2c` or `+0x30` depending on caller selector arg2, rejects points outside the coarse parent-anchored span rooted at `[this+0x0b..+0x17]` around parent anchor `[this+0x86]`, and then either delegates to local shape helper `0x005581e0` for selector words `1` and `4` or applies one extra mode-`8` gate involving callback slot `[this+0x172]`, flag `[this+0x126]`, and scalar threshold `[this+0xce]`. Current grounded callers are the higher shell-window pointer and event walks that need a fully validated child hit-test rather than the local shape-only helper.","objdump + local disassembly + caller inspection + child-control correlation + hit-test correlation + virtual-gate correlation"
0x00558470,48,shell_child_control_set_flag_bits_in_word_0x68_and_refresh_if_changed,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small flag-set helper over state word `[this+0x68]` in the shared shell child-control family. When the caller-supplied bitmask is not already fully present, the routine ORs it into `[this+0x68]` and then re-enters vtable slot `+0x1c` to refresh derived control state. Current grounded callers are child-control-family setup and ready-state strips that need to arm one presentation or interaction flag and then republish state.","objdump + local disassembly + caller inspection + child-control correlation + flag-refresh correlation"
0x005584a0,48,shell_child_control_clear_flag_bits_in_word_0x68_and_refresh_if_changed,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small flag-clear helper over state word `[this+0x68]` in the shared shell child-control family. When the caller-supplied bitmask intersects the current word, the routine clears those bits from `[this+0x68]` and re-enters vtable slot `+0x1c` to refresh derived control state. Current grounded callers are the same child-control-family setup and ready-state strips that need to withdraw one presentation or interaction flag and then republish state.","objdump + local disassembly + caller inspection + child-control correlation + flag-refresh correlation"
0x005584d0,96,shell_child_control_query_clamped_local_scalar_from_parent_anchor_and_span,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small scalar query helper for the shared shell child-control family. When parent anchor `[this+0x86]` is live, the routine derives one normalized scalar from parent-anchor lane `[parent+0x05]` plus local offset `[this+0x0b]` and span `[this+0x13]`, then clamps the result into the closed range `[0.0f, 1.0f]` before returning it on the x87 stack; when no parent anchor is available it returns the fallback constant at `0x005c8d48`. Current grounded caller is the local callback emitter strip `0x00558760`, which forwards this scalar into callback `0x0045ea20` when cue byte `[this+0x2f]` is armed.","objdump + local disassembly + caller inspection + child-control correlation + scalar-query correlation"
0x00558530,80,shell_child_control_forward_five_dword_tuple_to_virtual_slot_0x04,shell,thiscall,inferred,objdump + local disassembly + caller inspection,1,"Small tuple-forwarding wrapper for the shared shell child-control family. The routine packs five caller dwords into one stack-local block and forwards that block into vtable slot `+0x04` on the current control object. Current grounded callers are nearby control-family setup and update strips, so the safest current read is a compact virtual tuple-dispatch helper rather than a subsystem-specific owner.","objdump + local disassembly + caller inspection + child-control correlation + virtual-dispatch correlation"
0x00558580,240,shell_child_control_construct_base_from_optional_template_and_resolve_localized_text_handles,shell,stdcall,inferred,objdump + local disassembly + caller inspection,2,"Base constructor for the shared shell child-control family under vtable `0x005ddcd0`. The helper installs that vtable, resets the local state through `0x00558080`, optionally copies one caller template block into `[this+0x04..+0x63]`, rebuilds optional localized text handle `[this+0x92]` from template string root `[this+0x47]` through `0x0053ca20 -> 0x0053d110 -> 0x0053ca90`, normalizes selector byte `[this+0x37]` to default `3`, mirrors it into `[this+0x67]`, resolves current text handle `[this+0x63]` from that selector through `0x0053c6f0`, and snapshots the primary span or extent fields into `[this+0x6c..+0x7c]`. Current grounded callers include the generic child-copy constructors `0x0047b070/0x0047b0d0` and several later family-specific constructors such as `0x0055ecb0`, `0x0055fcc0`, `0x00563120`, and `0x00563c00`.","objdump + local disassembly + caller inspection + child-control correlation + constructor correlation"
0x00558670,80,shell_child_control_query_ready_for_primary_presentation_pass,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Primary readiness gate for the shared shell child-control family. The helper requires bit `0x01` in both words `[this+0x6a]` and `[this+0x68]`, a live owner window pointer at `[this+0x86]`, a live owner-side latch at `[owner+0x5c]`, and, when nested child pointer `[this+0x4b]` is nonnull, recursive readiness through the same helper on that child. It then rejects the pass when shell controller byte `[0x006d4024+0x57]` is nonzero. Current grounded callers include the presentation-side child service owner `0x005595d0` and several higher family-specific render strips.","objdump + local disassembly + caller inspection + child-control correlation + readiness-gate correlation"
0x005586c0,80,shell_child_control_query_ready_for_secondary_presentation_pass,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Secondary readiness gate for the same shell child-control family. The helper mirrors `0x00558670` but checks bit `0x02` in words `[this+0x6a]` and `[this+0x68]` and the sibling owner-side latch at `[owner+0x60]`, again honoring optional nested child `[this+0x4b]` and the shell controller byte gate `[0x006d4024+0x57]`. Current grounded callers are the same presentation and render strips that need the secondary pass predicate rather than the primary one.","objdump + local disassembly + caller inspection + child-control correlation + readiness-gate correlation"
0x00558710,32,shell_child_control_query_ready_for_primary_pass_when_flag33_bit0x10_clear,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small wrapper over primary secondary-pass gate `0x005586c0`. The helper returns `1` only when state dword `[this+0x33]` does not carry bit `0x10` and the secondary readiness gate succeeds; otherwise it returns `0`. Current grounded callers are the presentation-side child-control service strips that use bit `0x10` as an explicit suppressor for this pass.","objdump + local disassembly + caller inspection + child-control correlation + readiness-gate correlation"
0x00558730,32,shell_child_control_query_ready_for_secondary_pass_when_flag33_bit0x20_clear,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small wrapper over secondary readiness gate `0x005586c0`. The helper returns `1` only when state dword `[this+0x33]` does not carry bit `0x20` and the same secondary gate succeeds; otherwise it returns `0`. Current grounded callers are the presentation-side child-control service strips that use bit `0x20` as the companion suppressor for this pass.","objdump + local disassembly + caller inspection + child-control correlation + readiness-gate correlation"
0x00558760,224,shell_child_control_service_cue_callbacks_optional_pointer_callbacks_and_publish_active_caption,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Base-side active service helper for the shared shell child-control family. When cue byte `[this+0x2f]` is nonzero the routine queries one clamped local scalar through `0x005584d0` and forwards it plus the cue selector into `0x0045ea20`. It then optionally dispatches callback slots `[this+0x9e]` and `[this+0x96]` with owner-relative local coordinates derived from parent anchor `[this+0x86]`, control id word `[this+0x04]`, and current parent active-child relation `[parent+0xc6d]`. Finally, when this control is not already the parent's active child at `[parent+0xc6d]`, it stores itself there and publishes the current caption handle `[this+0x43]` through `0x00538c70`. Current grounded callers include `shell_overlay_state_update_hover_target_or_class_cell_and_forward_cursor_state` `0x0047b5e0` and several child-control-family update strips.","objdump + local disassembly + caller inspection + child-control correlation + callback-dispatch correlation + caption-publish correlation"
0x00558840,112,shell_child_control_clear_active_caption_dispatch_zero_callbacks_and_drop_parent_active_link,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Companion clear-side service helper for the same child-control family. When cue byte `[this+0x30]` is nonzero the routine forwards one clamped local scalar through `0x005584d0` into `0x0045ea20`; when callback slot `[this+0x96]` is live it invokes that callback with zeroed coordinate and state arguments; when the parent-window active-child slot `[parent+0xc6d]` still points at this control it clears that slot; and it finally publishes fixed caption token `0x005c87a8` through `0x00538c70` to clear the active caption strip. Current grounded callers are the child-control-family deactivation and focus-clear paths beneath the broader message owners.","objdump + local disassembly + caller inspection + child-control correlation + callback-dispatch correlation + caption-clear correlation"
0x005588b0,128,shell_child_control_clear_flag_bits_in_word_0x6a_and_reset_active_slots_if_needed,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Flag-clear helper over state word `[this+0x6a]` in the shared shell child-control family. When the caller mask intersects the current word, the routine clears those bits, conditionally runs secondary readiness gate `0x005586c0` and vtable slot `+0x10` when bit `0x04` is being withdrawn, clears parent active-child slot `[parent+0xc71]` when bit `0x10` is being removed, stores the new word back to `[this+0x6a]`, and refreshes derived state through vtable slot `+0x1c`. Current grounded callers are the release strip `0x00558930`, the set-side companion `0x00558980`, and several higher child-control message handlers.","objdump + local disassembly + caller inspection + child-control correlation + flag-refresh correlation + active-slot correlation"
0x00558930,80,shell_child_control_release_text_handles_after_clearing_flag4_in_word_0x6a,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small release-side helper in the same child-control family. When state word `[this+0x6a]` still carries bit `0x04`, the routine first clears that bit through `0x005588b0(4)`, then releases localized or text handles `[this+0x63]` and `[this+0x92]` through `0x0053c000` on controller-owned root `0x006d4020`, and clears those two owner slots back to `0`. Current grounded callers are higher child-control teardown and retarget paths that need to withdraw the bit-`0x04` active state before dropping text resources.","objdump + local disassembly + caller inspection + child-control correlation + release-path correlation"
0x00558980,144,shell_child_control_set_flag_bits_in_word_0x6a_and_dispatch_activation_if_needed,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Flag-set and activation helper over state word `[this+0x6a]` in the shared shell child-control family. When the caller mask is not already fully present, the routine ORs it into `[this+0x6a]`; if bit `0x04` becomes newly active it clears the previous parent active-child slot `[parent+0xc6d]` through `0x005588b0(4)` and dispatches one activation callback through vtable slot `+0x0c` with the caller XY pair plus two literal `1` flags; if bit `0x10` becomes newly active it clears the previous parent active-child slot `[parent+0xc71]` through `0x005588b0(0x10)` and stores this control there. All live paths finish by refreshing derived state through vtable slot `+0x1c`. Current grounded callers are the higher child-control pointer and activation paths beneath the family message dispatcher.","objdump + local disassembly + caller inspection + child-control correlation + activation correlation + active-slot correlation"
0x00558a10,1971,shell_child_control_handle_registered_message,shell,thiscall,inferred,objdump + local disassembly + caller inspection + message-switch correlation,2,"Primary registered-message dispatcher for the shared shell child-control family. The helper switches over one sparse message band normalized around `msg_id-2`, validates the target control id against word `[this+0x04]` for the matched cases, and then routes through a broad mix of local update paths including direct dword stores such as `[this+0x82]`, localized-text refresh under `[this+0x47]`, state-word mutators `0x005588b0/0x00558980`, and several vtable callbacks. Current grounded callers include `shell_overlay_state_handle_message` `0x0047b720`, `layout_state_subobject_vtable_0x5de2a8_handle_registered_message_strip` `0x0055f3f0`, `layout_state_subobject_vtable_0x5de360_handle_registered_message_strip` `0x00562ed0`, and `layout_state_subobject_vtable_0x5de3b0_handle_registered_message_strip` `0x00563950`, so the safest current read is the common child-control registered-message owner rather than one subsystem-specific wndproc.","objdump + local disassembly + caller inspection + child-control correlation + message-switch correlation"
0x00559340,160,shell_child_control_init_preview_surface_fields_and_default_aspect_scalars,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Initializer for the preview-surface child-control subfamily. The routine seeds selector word `[this+0x06] = 4`, clears preview-handle, size, and callback bands rooted at `[this+0xa2]`, `[this+0xae]`, `[this+0xb0]`, `[this+0xb4]`, `[this+0xb8]`, `[this+0xec..+0xfc]`, and `[this+0x10d]`, seeds aspect or scale scalars `[this+0x100]`, `[this+0x104]`, and `[this+0x108]` to `1.0f`, and initializes byte `[this+0x10c]` to `0xff`. Current grounded callers are the preview-surface child constructors above `0x00559520/0x005595d0`.","objdump + local disassembly + caller inspection + child-control correlation + preview-surface correlation"
0x005593e0,224,shell_child_control_refresh_preview_surface_span_and_aspect_scalars_from_bound_handle,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Preview-surface span refresh helper for the same child-control subfamily. When preview-refresh latch `[this+0xf4]` is live, selector word `[this+0xae]` is nonnegative, and preview handle `[this+0x92]` is bound, the routine refreshes local origin `[this+0x0b]` from staged value `[this+0xf8]`, resolves one or two preview-surface extents through `0x0053de00 -> 0x00552160/0x005521a0`, stores those extents into `[this+0x13/+0x17]`, and when flag bit `0x800000` is live derives aspect scalars `[this+0x100/+0x104]` by dividing the current local spans through the resolved preview extents. Current grounded callers are the same preview-surface render and update strips that rely on `[this+0x13/+0x17]` as the current local size band.","objdump + local disassembly + caller inspection + child-control correlation + preview-surface correlation + aspect-scale correlation"
0x005594c0,96,shell_child_control_stage_current_preview_origin_and_request_deferred_span_refresh,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Deferred preview-refresh helper in the same subfamily. When current local spans `[this+0x13/+0x17]` are positive or flag bit `0x800000` is live and preview handle `[this+0x92]` is bound, the routine snapshots the current local origin `[this+0x0b/+0x0f]` into staging dwords `[this+0xf8/+0xfc]`, arms refresh latch `[this+0xf4] = 1`, and then re-enters the child vtable through slot `+0x34`. Current grounded callers are the preview-side update paths beneath the base child-control message owner that need one deferred span or aspect refresh rather than an immediate recompute.","objdump + local disassembly + caller inspection + child-control correlation + preview-surface correlation + deferred-refresh correlation"
0x00557010,159,intrusive_queue_clear_owned_nodes,support,cdecl,inferred,ghidra-headless,3,Specialized intrusive-queue clear path for containers with an auxiliary owner or context pointer at [this+0x14]. It iterates the owned node chain through the queue iterator helpers releases nested payload state unlinks each node and decrements the queue count before returning to the outer container clear helper.,ghidra + rizin + llvm-objdump
0x005570b0,80,intrusive_queue_clear_and_release,support,cdecl,inferred,ghidra-headless,4,Clears and releases every node in one intrusive queue container. When [this+0x14] is present it routes through intrusive_queue_clear_owned_nodes; otherwise it walks the linked nodes directly releases them zeroes the head iterator and tail slots and resets the queued-node count at [this+0x0c].,ghidra + rizin + llvm-objdump
0x00559520,166,surface_init_rgba_pixel_buffer,support,thiscall,inferred,ghidra-headless,3,Initializes or refreshes a small 0xec-byte RGBA pixel-buffer object from caller-supplied image data and dimensions. On first use it allocates the backing object through 0x0053b070 stores width and height at [this+0xa2] and [this+0xa6] seeds the inner surface through 0x00543980 and 0x00541970 then copies width*height*4 bytes from the source buffer before finalizing through 0x005438d0. Current callers use it from the PaintTerrain preview path and the Multiplayer.win map-preview branch.,ghidra + rizin + llvm-objdump + strings
0x005595d0,1632,shell_child_control_render_style_selected_overlay_and_preview_surface_pass,shell,thiscall,inferred,objdump + runtime probe correlation + local disassembly,4,"Style-driven render owner for the preview-surface child-control subfamily beneath `shell_service_one_object_child_queue_and_deferred_state` `0x0053fda0`. The helper is first gated by `shell_child_control_query_ready_for_primary_presentation_pass` `0x00558670`, which checks child flags `[this+0x68/+0x6a]`, parent pointer `[this+0x86]`, and shell controller byte `[0x006d4024+0x57]`. Once admitted, it switches on style field `[this+0xb0]`: the simple color-strip styles `1/4/5/2/9/10` emit overlay quads through `0x54f710`; style `8` binds preview surface `[this+0xaa]` through `0x54f640` and then draws it through `0x51f460`; styles `3/6` build framed gauge or border geometry through repeated `0x54f710/0x54fdd0` calls using local scalar band `[this+0xc4]` and color field `[this+0xb8]`; and the generic preview-handle lane resolves tagged preview handle `[this+0x92]` through `0x53de00` and draws it through `0x552560` using local rect `[this+0xd8..+0xf0]`, aspect scalars `[this+0x100/+0x104/+0x108]`, alpha byte `[this+0x10c]`, and selector word `[this+0xae]`. After the main style pass it conditionally emits selection or emphasis outlines through `0x54f9f0` based on owner mask `[0x006d401c+0xc79]`, the secondary local rect `[this+0x1b..+0x27]`, and flag bit `0x40000`. Current live hook probes on the frozen mode-4 auto-load path show the early `LoadScreen.win` children all point back to the same parent through `[child+0x86]`, typically carry `flag_68 = 0x03` and `flag_6a = 0x03`, and return `4`, while later siblings with `flag_68 = 0x00` return `0`; in all traced cases `0x006cec78` stays `0`, so this now reads as the style-selected overlay and preview-surface render owner rather than the missing startup-runtime promotion lane.","objdump + runtime probe correlation + local disassembly + child-service gating correlation + preview-surface correlation + style-switch correlation"
0x00559c40,586,shell_child_control_handle_preview_surface_registered_message_and_selector_updates,shell,thiscall,inferred,objdump + local disassembly + message-switch correlation,3,"Registered-message dispatcher for the same preview-surface child-control subfamily. The helper normalizes `msg_id-2` through a local jump table, requires the vtable `+0x30` readiness gate for most cases, and then fans out across several preview-specific update lanes: one branch filters selector ids against word fields `[this+0xbc/+0xbe/+0xc0/+0xc2]`, optionally forwards cue byte `[this+0x2d]` through `0x45ea20`, and rewrites the outgoing message to `0xca` plus current control id; another branch requires `shell_child_control_query_ready_for_secondary_presentation_pass` `0x005586c0`, runs vtable slot `+0x20` against message coordinates `[msg+0x24/+0x28]`, then invokes optional callback `[this+0x9a]`; later branches update preview selector word `[this+0xae]`, color dword `[this+0xb8]`, aspect scalar `[this+0x108]`, alpha byte `[this+0x10c]`, and callback slot `[this+0x10d]` from the message payload before tailing into `shell_child_control_handle_registered_message` `0x00558a10`. Current evidence grounds this as the preview-surface-specific registered-message and selector-update owner rather than a generic child-control wndproc.","objdump + local disassembly + message-switch correlation + child-control correlation + preview-surface correlation"
0x00559f50,52,shell_child_control_store_preview_surface_local_rect_and_raise_outline_flag_0x40000,shell,thiscall,inferred,objdump + local disassembly,2,"Small setter in the preview-surface child-control subfamily. The helper ORs flag bit `0x40000` into `[this+0x33]` and stores the caller-supplied four-dword local rect band into `[this+0xd8/+0xdc/+0xe0/+0xe4]`. Current grounded caller correlation is the preview-surface render owner `0x005595d0`, which later consumes that rect as the emphasized outline or clipped draw band.","objdump + local disassembly + preview-surface correlation + local-rect correlation"
0x00559f90,169,shell_child_control_construct_preview_surface_from_heap_template_0x89,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,3,"Constructor-side helper for the preview-surface child-control subfamily. The routine runs base construction through `0x00558580(0)`, installs vtable `0x005ddd18`, initializes preview-surface fields through `0x00559340`, allocates one `0x89`-byte heap template block through `0x005a125d`, seeds that block through `0x0053b7c0`, copies the child-control template payload into the new object through `0x00557f80`, and then imports the preview-specific band rooted at template offsets `+0x5f..+0x75` into `[this+0xae..+0xc4]`. Current grounded callers include `start_new_company_dialog_construct` `0x0047c590`, so this is the heap-template constructor variant rather than the later inline-template copy sibling.","objdump + local disassembly + constructor correlation + preview-surface correlation + template-copy correlation"
0x0055a040,58,shell_child_control_construct_preview_surface_from_inline_template_band,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,2,"Inline-template constructor sibling for the same preview-surface child-control subfamily. The routine runs base construction through `0x00558580`, installs vtable `0x005ddd18`, initializes preview-surface fields through `0x00559340`, and then copies the preview-specific template band beginning at caller offset `+0x5f` directly into `[this+0xae..+0xc4]` before restoring selector word `[this+0x06] = 4`. Current grounded callers are the constructor strips that already own their template storage in place and do not need the separate `0x89`-byte heap block used by `0x00559f90`.","objdump + local disassembly + constructor correlation + preview-surface correlation + template-copy correlation"
0x0055a090,74,shell_child_control_destroy_preview_surface_release_pixel_buffer_and_tail_base_cleanup,shell,thiscall,inferred,objdump + local disassembly,2,"Destructor-side helper for the same preview-surface child-control subfamily. The routine restores vtable `0x005ddd18`, releases bound pixel-buffer object `[this+0xaa]` through `0x00542c90` and `0x0053b080` when present, clears that field, and then tails into the shared child-control base release `0x00558000`; when caller flag bit `0x01` is set it also frees the child object itself through `0x0053b080`.","objdump + local disassembly + preview-surface correlation + release correlation"
0x0055a0e0,131,shell_child_control_destroy_paired_token_children_and_tail_base_cleanup,shell,thiscall,inferred,objdump + local disassembly,2,"Destructor-side helper for the adjacent child-control family rooted at vtable `0x005ddd58`. The routine restores that vtable, releases optional token handles `[this+0x1ad]` and `[this+0x1b1]` through `shell_control_status_owner_release_active_token_handle` `0x00538880`, unregisters the paired child objects from the owning shell window through `0x0053f860([this+0x86], child)`, clears those two child pointers, releases inline text handle `[this+0x47]` through `0x0051d800`, and then tails into the shared child-control base release `0x00558000`.","objdump + local disassembly + child-control correlation + token-handle correlation + paired-child correlation"
0x0055a170,1005,shell_child_control_rebuild_paired_token_children_from_preview_handle_selectors_and_offsets,shell,thiscall,inferred,objdump + local disassembly + child-control correlation,3,"Broader rebuild owner for the same `0x005ddd58` child-control family. The helper resolves preview-handle metrics through `0x0053de00 -> 0x00552160/0x005521a0` using selector dwords `[this+0x129/+0x131/+0x139/+0x13d]`, derives current local span band `[this+0x13/+0x17]` from those extents plus orientation flag `[this+0x109]` and offset scalars `[this+0x169/+0x16d]`, refreshes delta scalar `[this+0x199]`, then allocates two shell token handles through `0x00538890`, builds two `0xe9`-byte child objects through `0x0053b070 -> 0x00540430`, registers them on owner `[this+0x86]` through `0x0053f9c0`, and seeds their payload descriptors from local field bands `[this+0x109..+0x16d]`, control ids, and optional text handle `[this+0x43]`. When cue selector dword `[this+0x11d]` is still zero, the routine defaults it to `0x1f` before returning. Current evidence keeps the widget subtype open, but the ownership of the paired token-child rebuild is now grounded.","objdump + local disassembly + child-control correlation + preview-handle correlation + paired-child correlation"
0x0055a560,213,shell_child_control_init_paired_token_child_fields_and_default_selectors,shell,thiscall,inferred,objdump + local disassembly,2,"Initializer for the same `0x005ddd58` child-control family. The routine seeds selector word `[this+0x06] = 0x40`, clears the full local metric, offset, selector, and child-pointer band rooted at `[this+0x101..+0x1b5]`, and leaves the family in its zero-child default state before any later rebuild through `0x0055a170`.","objdump + local disassembly + child-control correlation + field-reset correlation"
0x0055a640,18,shell_child_control_store_item_count_field_0x101,shell,thiscall,inferred,objdump + local disassembly,1,"Tiny setter in the same `0x005ddd58` child-control family. The helper stores caller dword into `[this+0x101]` only when the value changes.","objdump + local disassembly + child-control correlation + field-store correlation"
0x0055a660,186,shell_child_control_clamp_current_index_refresh_nested_peer_and_fire_cue_selector,shell,thiscall,inferred,objdump + local disassembly + child-control correlation,2,"Selection-change helper for the same `0x005ddd58` child-control family. The routine clamps the caller index against item-count field `[this+0x101]`, stores the resulting current index into `[this+0x185]`, optionally mirrors that index into nested child `[this+0x4b]` when that child is family type `0x08` and shares the same control id, invokes optional callback slot `[this+0x1b5]`, and when the caller requested cue dispatch it forwards one clamped local scalar through `0x005584d0` into `0x0045ea20` using cue selector dword `[this+0x11d]`.","objdump + local disassembly + child-control correlation + selection-change correlation + cue-dispatch correlation"
0x0055a720,613,shell_child_control_render_paired_preview_selector_pass_and_optional_outline,shell,thiscall,inferred,objdump + local disassembly + child-control correlation,3,"Render owner for the same `0x005ddd58` child-control family. The helper is first gated by `shell_child_control_query_ready_for_primary_presentation_pass` `0x00558670`, computes owner-relative origin from `[this+0x86]` plus local offsets `[this+0x0b/+0x0f]`, and then renders one or two tagged preview lanes through `0x0053de00 -> 0x00552560` using selector dwords `[this+0x13d]` and `[this+0x139]`. The second lane's placement is derived from orientation flag `[this+0x109]`, item count `[this+0x101]`, current index `[this+0x185]`, spacing scalar `[this+0x199]`, and offset bands `[this+0x141..+0x15d]`. After the main preview draws it conditionally emits one or two emphasis outlines through `0x0054f9f0` based on owner mask `[0x006d401c+0xc79]` and the primary or secondary local rect bands. Current evidence carries the row conservatively as the paired preview-selector render pass and outline logic.","objdump + local disassembly + child-control correlation + preview-handle correlation + outline-render correlation"
0x0055a990,411,shell_child_control_construct_paired_preview_selector_from_resource_0xe3,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,3,"Constructor-side helper for the same `0x005ddd58` child-control family. The routine runs base construction through `0x00558580(0)`, installs vtable `0x005ddd58`, initializes family fields through `0x0055a560`, loads resource `0xe3` through `0x005a125d -> 0x0053b7c0 -> 0x00557f80`, reinitializes the family fields, and then copies the resource payload bands rooted at `+0x5f` into local fields `[this+0x101..+0x16d]`, `[this+0x11d/+0x121/+0x125]`, and selector dwords `[this+0x129/+0x12d/+0x131/+0x135/+0x139/+0x13d]` before releasing the temporary resource handle. Current evidence grounds this as the resource-backed constructor variant for the paired preview-selector family rather than a generic child-control allocator.","objdump + local disassembly + constructor correlation + resource-correlation + child-control correlation"
0x0055ab30,28,shell_child_control_destruct_paired_preview_selector_wrapper,shell,thiscall,inferred,objdump + local disassembly,2,"Thin destructor wrapper for the same `0x005ddd58` family. The helper re-enters `shell_child_control_destroy_paired_token_children_and_tail_base_cleanup` `0x0055a0e0` and, when caller flag bit `0x01` is set, frees the object itself through `0x0053b080`.","objdump + local disassembly + child-control correlation + destructor-wrapper correlation"
0x0055ab50,56,shell_child_control_construct_paired_preview_selector_from_inline_payload_band,shell,thiscall,inferred,objdump + local disassembly + constructor correlation,2,"Inline-payload constructor sibling for the same `0x005ddd58` family. The routine runs base construction through `0x00558580`, installs vtable `0x005ddd58`, initializes family fields through `0x0055a560`, and then copies the caller payload band beginning at offset `+0x5f` directly into `[this+0x101..+0x1b5]` before restoring selector word `[this+0x06] = 0x40`. Current grounded callers include `start_new_company_dialog_construct` `0x0047c590`, so this is the inline-payload constructor variant rather than the resource-backed path at `0x0055a990`.","objdump + local disassembly + constructor correlation + payload-record correlation + child-control correlation"
0x0055aba0,1061,shell_child_control_handle_paired_preview_selector_registered_message_and_gesture_index_changes,shell,thiscall,inferred,objdump + local disassembly + message-switch correlation,3,"Registered-message owner for the same `0x005ddd58` family. The helper computes owner-relative local coordinates from the incoming message, branches on normalized message ids, and then fans out across several selection-side behaviors: one branch clears transient state dwords `[this+0x19d/+0x1a1/+0x1a5]`; several pointer or wheel branches compare the local coordinate against the current span and step bands, derive a new index from spacing scalar `[this+0x199]`, orientation flags `[this+0x109/+0x10d]`, item count `[this+0x101]`, and current index `[this+0x185]`, and then route the result through `shell_child_control_clamp_current_index_refresh_nested_peer_and_fire_cue_selector` `0x0055a660`; later branches react to direct child events from token ids `[this+0x1a9/+0x1ab]` and child pointers `[this+0x1ad/+0x1b1]` before forwarding into the shared child-control dispatcher `0x00558a10`. Current evidence grounds this as the paired preview-selector message and gesture-driven selection owner rather than a generic wndproc.","objdump + local disassembly + message-switch correlation + child-control correlation + selection-change correlation"
0x00565110,600,shell_rebuild_layout_state_and_service_mode_selected_record_sources,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Broader shell-side owner above `0x00564c70` and `0x00564ee0`. The function first branches on current layout mode from `0x00545e00`: one mode drains shared bank services around `0x0053b920/0x0053b8d0`, tears down and recreates subordinate layout state through `0x0055dd80` and `0x0055e2b0`, optionally emits the texture-budget report through `0x00527650`, and commits one refresh step through `0x00545d60(1)`; another mode waits for the current layout mode to clear by repeatedly draining pending messages through `0x0054e5d0`. On the active rebuild path it snapshots current live-world view pair scalars through `0x00548180`, clears and rebuilds bound slot properties through `0x00544df0`, `0x005488a0`, `0x00544f30`, `0x00546890`, `0x00548940`, `0x005467a0`, `0x00545020`, and `0x00547fe0`, temporarily zeros owner-side selector dword `[[this+0x29]+0x29]`, and then services one mode-selected record source through either `0x00564c70` or repeated calls into `0x00564ee0`. After the service pass it restores the saved owner selector dword and optionally finalizes through `0x00545db0(0)`. Current grounded callers are `0x00520679` and `0x0052cc0b`, so this is the safest current read for rebuilding the subordinate layout state and servicing the mode-selected record sources rather than a narrow texture-report owner.","objdump + caller inspection + local disassembly + layout-state correlation + service-owner correlation"
0x00565370,192,grid_trace_helper_init_power_of_two_square_mask_and_pair_buffers,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Constructor or reset owner for one small square-mask trace helper. The function derives the smallest power-of-two exponent that covers caller span `N`, stores that exponent in `[this+0x1f418]`, stores side length `1 << exponent` in `[this+0x3e833]`, allocates one square visited-mask table of size `(side + 1)^2` into `[this+0x1f414]`, allocates one `0x510`-byte pair buffer into `[this+0x1f40c]`, clears both buffers, seeds generation dword `[this+0x1f408] = 1`, clears pair count `[this+0x1f41c]`, marks the structure live through byte `[this+0x3e832]`, and exposes the pair buffer through `[this+0x00]`. Current grounded caller is `0x00527d43`, so this is the safest current read for initializing the power-of-two square-mask and pair-buffer helper rather than a generic allocator.","objdump + caller inspection + local disassembly + helper-family correlation + square-mask correlation"
0x00565440,42,grid_trace_helper_destruct_release_square_mask_and_pair_buffers,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side release helper for the same square-mask trace family. When live byte `[this+0x3e832]` is set, the function frees pair buffer `[this+0x1f414]` and square-mask table `[this+0x1f40c]` through `0x005a1145`.","objdump + local disassembly + helper-family correlation + release correlation"
0x00565470,111,grid_trace_helper_mark_pair_once_and_append_to_pair_buffer,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small insert helper in the same square-mask trace family. The function maps caller coordinate pair `(x, y)` into one `0x11 x 0x11`-indexed cell in the square-mask table `[this+0x1f40c]`; when that cell has not yet been marked for current generation `[this+0x1f408]`, it stores the generation stamp, appends the two `u16` coordinates into the output pair buffer rooted at `[this+0x3e820]`, advances that cursor by two words, and increments pair count `[this+0x1f41c]`. Current grounded caller is the broader trace owner `0x00565510`, so this is the safest current read for marking one pair once and appending it to the live pair buffer rather than a generic coordinate writer.","objdump + caller inspection + local disassembly + helper-family correlation + pair-buffer correlation"
0x005654f0,7,grid_trace_helper_query_power_of_two_exponent,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny getter in the same square-mask trace family. The function returns exponent field `[this+0x1f418]`.","objdump + local disassembly + helper-family correlation"
0x00565500,7,grid_trace_helper_query_square_mask_table,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny getter in the same square-mask trace family. The function returns square-mask table pointer `[this+0x1f414]`.","objdump + local disassembly + helper-family correlation"
0x00565510,2278,grid_trace_helper_walk_square_mask_collect_boundary_runs_and_emit_pair_strip,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Broader trace owner above `0x00565470` in the same square-mask helper family. The function selects one shifted offset from the caller origin and the stored power-of-two exponent, advances generation stamp `[this+0x1f408]` with wraparound reset of the square-mask table, seeds pair-buffer cursors `[this+0x3e820/+0x3e824]`, clears pair count `[this+0x1f41c]`, and first re-enters `0x00565470(0, 0)` to seed the initial pair. It then walks the generated coordinate frontier in `[this+0x1f420..]`, consults the square-mask table `[this+0x1f414]`, and uses temporary global index vectors `0x00d97a30` and `0x00d979b0` to collect two complementary boundary-run lists before appending repeated `u16` pair strips into the live pair buffer rooted at `[this+0x3e824]`. Current grounded caller is `0x00525cba`, so this is the safest current read for walking the square mask, collecting boundary runs, and emitting the final pair strip rather than a generic geometry loop.","objdump + caller inspection + local disassembly + helper-family correlation + boundary-run correlation + pair-buffer correlation"
0x00565c20,20,support_copy_three_dword_block_to_outparam,support,stdcall,inferred,objdump + local disassembly,1,"Tiny copy helper. The function copies three consecutive dwords from the caller object base into the caller outparam buffer and returns.","objdump + local disassembly + fixed-block correlation"
0x00565c40,24,shell_marker_config_store_pair_and_selector_byte,shell,stdcall,inferred,objdump + local disassembly,2,"Small config-set helper for the same marker-emitter family as `0x00565c90`. The function stores the caller dword pair into `[this+0x10/+0x14]` and selector byte into `[this+0xd8]`.","objdump + local disassembly + marker-family correlation"
0x00565c60,33,shell_marker_config_query_pair_and_selector_byte,shell,stdcall,inferred,objdump + local disassembly,2,"Small config-get helper paired with `0x00565c40` in the same marker-emitter family. The function optionally copies dwords `[this+0x10/+0x14]` to caller outparams and returns selector byte `[this+0xd8]`.","objdump + local disassembly + marker-family correlation"
0x00565d60,63,shell_marker_replace_shared_type6_image_handle_by_key,shell,stdcall,inferred,objdump + local disassembly,2,"Shared image-handle setter for the same world-anchor marker strip. When caller key is nonnull, the function first releases prior shared type-`6` handle `0x00d97ab0` through `0x0053c000`, then loads the new handle from the banked resource system through `0x0053c1c0(0, 0, 0x7f, key)` and stores it back into `0x00d97ab0`.","objdump + local disassembly + marker-family correlation + banked-resource correlation"
0x00565da0,31,shell_marker_release_shared_type6_image_handle,shell,cdecl,inferred,objdump + local disassembly,2,"Release-side sibling to `0x00565d60` in the same marker-emitter family. When global shared type-`6` handle `0x00d97ab0` is live, the function releases it through `0x0053c000` and clears the global back to null.","objdump + local disassembly + marker-family correlation + banked-resource correlation"
0x00565dc0,86,shell_marker_load_named_payload_triplet_and_seed_default_transform_band,shell,stdcall,inferred,objdump + local disassembly,2,"Small named-payload loader in the same marker-emitter family. The function resolves one named type-`1` staging row through `0x0053d0f0`, copies its first live triplet into caller fields `[out+0x00/+0x04/+0x08]` when present, seeds default transform band `[out+0x18..+0xd8]` from constant block `0x00625ae8`, then releases the staging row through `0x0053c000` and returns the caller output pointer.","objdump + local disassembly + marker-family correlation + banked-resource correlation"
0x00565e20,1,support_noop_return,support,cdecl,inferred,objdump + local disassembly,1,"Tiny support stub that immediately returns without side effects.","objdump + local disassembly"
0x00565e30,78,sprite_billboard_instance_init_defaults,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Constructor-style initializer for the sprite-billboard instance family used beneath `0x00555780` and `0x005662a0`. The helper zeroes the local position, basis, timing, and packed-color bands through `[this+0x00..+0x58]`, seeds dword `[this+0x4c] = 1`, and clears the remaining control lanes `[this+0x70/+0x74]`.","objdump + local disassembly + sprite-billboard correlation"
0x00565e80,180,sprite_billboard_instance_seed_basis_timing_flags_and_scale,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small seed helper for the same sprite-billboard instance family. The function stores caller lifetime into `[this+0x48/+0x4c]`, stores a timing-scale product into `[this+0x68]`, derives one reciprocal-like scalar into `[this+0x50]`, copies caller basis triplet into `[this+0x00..+0x14]` and `[this+0x0c..+0x14]`, conditionally seeds default orientation vectors into `[this+0x18..+0x24]` from constants `0x00625bac..0x00625bcc`, stores caller flag word into `[this+0x5c]`, and writes one secondary time or scale lane into `[this+0x64]`. This is the safest current read for seeding the live sprite-billboard basis, timing, flags, and scale rather than a generic float setter.","objdump + local disassembly + sprite-billboard correlation + basis-seed correlation"
0x00565f40,613,sprite_billboard_instance_step_position_basis_alpha_and_scale,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Per-step service helper for the same sprite-billboard instance family. The function advances remaining lifetime `[this+0x48]` by the caller delta, updates basis or position lanes `[this+0x00..+0x24]` according to flag word `[this+0x5c]`, conditionally accumulates auxiliary scalar `[this+0x40]`, recomputes dynamic basis scratch in globals `0x00d97b38..0x00d97b64`, optionally reprojects that basis through `0x005661b0`, adjusts lane `[this+0x10]` when flag bit `0x08` is live, and advances fade scalar `[this+0x44]` with clamp to `0.01`. The helper returns zero when lifetime is exhausted and one otherwise. This is the safest current read for stepping sprite-billboard instance position, basis, alpha, and scale rather than a generic particle tick.","objdump + local disassembly + sprite-billboard correlation + step-update correlation"
0x005661b0,237,shell_reproject_four_sprite_billboard_basis_points_through_helper_matrix,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small basis-reprojection helper used by the sprite-billboard instance strip. The function seeds one temporary identity-style matrix block on the stack, builds one helper matrix through `0x0056df7d`, and then reprojects four consecutive vec3 basis points from global scratch `0x00d97b98` by repeatedly calling `0x0056cd3c` and writing the transformed results back in place. Current grounded caller is `0x00565f40`, so this is the safest current read for reprojecting the four sprite-billboard basis points through one helper matrix rather than a broader owner body.","objdump + local disassembly + sprite-billboard correlation + basis-reprojection correlation"
0x005669d0,163,layout_state_route_scaled_integer_quad_band_to_optional_sink,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Small routed-payload helper used by the layout-state record-service owners `0x00564c70` and `0x00564ee0`. The function scales four caller float lanes by current layout integer spans `[this+0x25c7/+0x25cb]`, rounds them through `0x005a10d0`, stores the resulting integer quad in local scratch, and when the caller sink object is nonnull, first queries it through vtable slot `+0x14`, derives one selector in the `0x40810/0x40811` band from the returned flags plus the caller mode bits, publishes the scaled quad through sink slot `+0x18`, and finally releases that sink through slot `+0x20`. This is the safest current read for routing one scaled integer quad band into an optional sink object rather than a generic formatter.","objdump + caller inspection + local disassembly + layout-state correlation + routed-payload correlation"
0x00566a80,249,shell_load_streamed_0x24_byte_record_and_pack_rgba_scale_band,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Per-entry stream loader in the shell support family. The function reads one `0x24`-byte record through shared banked-stream helper `0x0053b7c0`, stores the four scalar lanes into caller fields `[out+0x10..+0x20]`, converts the leading four floats into one packed RGBA dword in `[out+0x08]` through repeated `0x005a10d0`, allocates one caller-sized trailing array at `[out+0x00]`, reads that array through `0x0053b7c0`, and then swaps the second and third float lanes inside each `0x0c`-byte element. Current grounded caller is `0x00567278`, so this is the safest current read for loading the streamed `0x24`-byte record and its trailing array rather than a named asset decoder.","objdump + caller inspection + local disassembly + streamed-record correlation + banked-stream correlation"
0x00566b80,1134,shell_load_streamed_0x45_byte_record_expand_bounds_and_build_0x4c_entry_table,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Broader sibling loader to `0x00566a80` in the same shell support branch. The function lazily allocates one shared helper root at `0x00d97bb8`, reads one streamed `0x0c`-byte header through `0x0053b7c0`, allocates the caller vertex array at `[out+0x00]`, normalizes each loaded triple by subtracting global anchor `0x00d97ba8..0x00d97bb4`, derives min/max bounds and maximum radius into `[out+0x14/+0x18]`, and, when entry count is positive, allocates and fills one `0x4c`-stride table at `[out+0x04]` whose records carry three source pointers plus copied float bands and normalized direction vectors. Current grounded caller is `0x005672bd`, so this is the safest current read for the streamed `0x45`-byte record loader and `0x4c`-entry expansion path rather than a narrower asset-specific decoder.","objdump + caller inspection + local disassembly + streamed-record correlation + banked-stream correlation + bounds-correlation"
0x00567190,328,shell_load_streamed_3dpf_child_record_seed_global_anchor_triplet_and_choose_patch_entry_format,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Per-child loader beneath the `3DPF` collection family. The helper reads one leading `0x08`-byte header through `0x0053b7c0`, optionally reads one inline `0x0c` triplet when global selector `0x00d97bb0 > 2`, copies that triplet into caller fields `[out+0x00..+0x08]` or clears them otherwise, mirrors the chosen anchor into globals `0x00d97ba8..0x00d97bb4`, stores the entry-count field at `[out+0x14]`, and then peeks one trailing format byte under the current-selection push-pop frame strip `0x0053ca20/0x0053ca90`. When that byte is `L` it allocates one `count * 0x24` inline-entry band at `[out+0x10]` and loads each child entry through `0x00566a80`; when it is `I` it allocates one `count * 0x45` expanded-entry band at `[out+0x0c]` and loads each child entry through `0x00566b80`. Current grounded caller is `0x00567400`, so this is the safest current read for the `3DPF` child-record loader and format selector rather than an anonymous banked-stream leaf.","objdump + caller inspection + local disassembly + streamed-record correlation + format-byte correlation + 3DPF-family correlation"
0x005672e0,275,shell_release_streamed_3dpf_child_record_inline_or_expanded_patch_entries,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Release-side sibling to `0x00567190`. The helper walks the current child entry count at `[entry+0x14]`, branches on whether the live payload uses the expanded `0x45`-format band at `[entry+0x0c]` or the inline `0x24`-format band at `[entry+0x10]`, frees any nested payloads such as `[row+0x04]`, optional `[row+0x35]`, and the shared helper object rooted at `0x00d97bb8`, then frees the top-level payload band itself. Current grounded callers are the collection destructor `0x005674c0` and the type-`1` staging-row release path through `0x0053bf60`, so this is the safest current read for the per-child streamed patch-record release helper rather than a generic heap clear.","objdump + caller inspection + local disassembly + streamed-record correlation + nested-payload correlation + 3DPF-family correlation"
0x00567400,176,shell_load_3dpf_collection_and_build_0x18_child_entry_array,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Collection loader for the shell-side `3DPF` stream family. The helper opens the keyed current-or-selected stream through `0x0053bd40`, validates the leading four-byte magic `33 44 50 46` (`3DPF`), stores the two trailing `u16` header fields into `[this+0x04]` and global selector `0x00d97bb0`, allocates one `count * 0x18` child-entry array at `[this+0x00]`, and then fills each child entry through `0x00567190`. Current grounded caller is the wrapper `0x00567500`, and the same family is used as the type-`1` payload root created through staging-row helper `0x0053c070`.","objdump + caller inspection + local disassembly + magic-correlation + staged-payload correlation + 3DPF-family correlation"
0x005674c0,55,shell_release_3dpf_collection_and_child_entries,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Destructor-side release helper for the `3DPF` collection root. The helper walks the child-entry count at `[this+0x04]`, releases each `0x18` child record through `0x005672e0`, and then frees the top-level child-entry array at `[this+0x00]`. Current grounded callers are the wrapper `0x00567520` and the type-`1` staging-row release strip through `0x0053bf60`.","objdump + caller inspection + local disassembly + 3DPF-family correlation + staged-payload correlation"
0x00567500,17,shell_construct_3dpf_collection_from_stream_key,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,1,"Thin wrapper around `shell_load_3dpf_collection_and_build_0x18_child_entry_array` `0x00567400`. The helper forwards one caller stream key into the collection loader and then returns the same collection pointer unchanged. Current grounded caller is the type-`1` staging-row acquire path `0x0053c070`.","objdump + caller inspection + local disassembly + staged-payload correlation"
0x00567520,5,shell_release_3dpf_collection,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tail-jump wrapper into `shell_release_3dpf_collection_and_child_entries` `0x005674c0`. Current grounded callers are the type-`1` staging-row release path `0x0053bf60` and the `3DPF` collection owner family itself.","objdump + caller inspection + local disassembly + 3DPF-family correlation"
0x00567530,130,support_select_nearest_wrapped_phase_from_table_0x625be0,support,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Small wrapped-phase selector over the four-float table rooted at `0x00625be0`. The helper compares the direct phase delta against the phase plus one full-turn offset `0x005c8768`, folds both through absolute-value comparisons against the half-turn scalar at `0x005c8760`, and returns whichever candidate is closer to the caller phase. Current grounded caller is the broader patch-emission owner `0x005686a5`, so this is the safest current read for the nearest wrapped phase helper rather than a generic trigonometric primitive.","objdump + caller inspection + local disassembly + wrapped-phase correlation"
0x005675c0,350,streamed_patch_compare_four_corner_pair_update_best_distance_and_corner_blend_bytes,bootstrap,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Pairwise comparison helper beneath the streamed patch-grid emitter. The helper compares two four-corner patch records, derives corner-to-corner distance scores from the corner triplets rooted at `+0x00/+0x08`, rejects corners already marked with state byte `+0x31 == 2`, updates the caller best-distance scalar when a closer match survives, and averages the paired corner blend bytes at `+0x39` back into output bytes `+0x35` on both records. When the distance instead falls under the secondary threshold at `0x005c85b8` it marks both corner state bytes `+0x31` as `1`. Current grounded caller is the neighborhood scan owner `0x00567730`, so this is the safest current read for the four-corner patch-pair compare and blend helper rather than a generic geometry distance leaf.","objdump + caller inspection + local disassembly + patch-grid correlation + corner-state correlation"
0x00567730,629,streamed_patch_grid_scan_neighborhood_choose_best_pairs_and_emit_midpoint_triplets,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,3,"Broader neighborhood-scan owner above `0x005675c0`. The helper clamps one caller rectangle against grid dimensions `[this+0x15d5/+0x15d9]`, walks the patch-cell pointer table at `[this+0x1669]`, and for each live cell searches the surrounding neighborhood for other live cells while skipping the center cell. It uses `streamed_patch_compare_four_corner_pair_update_best_distance_and_corner_blend_bytes` `0x005675c0` to pick the best surviving neighbor pair, then averages the winning patch positions into two midpoint triplets, resolves one world-height scalar through `0x00534490`, and decrements the caller output budget before continuing the scan. Current grounded caller is `0x005692cd`, which passes one local rectangle expanded by `-2/+0x12` around the current streamed record bounds. This is the safest current read for the patch-grid neighborhood scan and midpoint-emission owner rather than an isolated distance helper.","objdump + caller inspection + local disassembly + patch-grid correlation + midpoint-emission correlation"
0x0058bc3c,6,multiplayer_gamespy_ws2_inet_ntoa_thunk,shell,cdecl,inferred,objdump + caller inspection,3,"Direct ordinal-backed WS2_32 thunk. Current call shape is the strongest match for `inet_ntoa`: callers pass one raw IPv4 dword and receive a dotted-quad string pointer, which the GameSpy route and transport families append into builders as `localip%d` fields or other endpoint text. Grounded callers include the route-control builder `0x0058cd70`, the descriptor or route text helpers `0x0058d1e0` and `0x0058e150`, and the later transport-side status formatting around `0x005939f0`.","objdump + caller inspection + inet_ntoa-correlation"
0x0058bc42,6,multiplayer_gamespy_ws2_gethostbyname_thunk,shell,cdecl,inferred,objdump + caller inspection,3,"Direct ordinal-backed WS2_32 thunk. Current call shape is the strongest match for `gethostbyname`: callers pass one NUL-terminated host string and receive one hostent pointer used for local-hostname resolution or fallback remote endpoint lookup. Grounded callers include `multiplayer_gamespy_query_local_hostent_from_current_hostname` `0x0058f540` and `multiplayer_gamespy_build_sockaddr_in_from_host_string_and_port_with_resolve_fallback` `0x0058bd90`.","objdump + caller inspection + gethostbyname-correlation"
0x0058bc48,6,multiplayer_gamespy_ws2_gethostname_thunk,shell,cdecl,inferred,objdump + caller inspection,3,"Direct ordinal-backed WS2_32 thunk. Current call shape is the strongest match for `gethostname`: callers pass one stack-local text buffer plus size and receive the current machine hostname for later hostent resolution. Current grounded caller is `multiplayer_gamespy_query_local_hostent_from_current_hostname` `0x0058f540`.","objdump + caller inspection + gethostname-correlation"
0x0058bc4e,6,multiplayer_gamespy_ws2_closesocket_thunk,shell,cdecl,inferred,objdump + caller inspection,3,"Direct ordinal-backed WS2_32 thunk. Current call shape is the strongest match for `closesocket`: callers pass one live socket handle and use it in route, worker, and decoder teardown paths. Grounded callers include `multiplayer_gamespy_route_release_and_free` `0x0058cfd0`, the decoder-side sockets at `0x0058fc40` and `0x00590e50`, and the later transport-worker teardown family.","objdump + caller inspection + closesocket-correlation"
0x0058bc54,6,multiplayer_gamespy_ws2_sendto_thunk,shell,cdecl,inferred,objdump + caller inspection,3,"Direct ordinal-backed WS2_32 thunk. Current call shape is the strongest match for `sendto`: callers pass one socket handle, payload pointer, payload length, flags `0`, remote sockaddr pointer, and size `0x10`. Grounded callers include the route reply helper around `0x0058c720`, the ping sender `0x0058c950`, the broader route-control builder `0x0058cd70`, and later transport-side datagram publishers.","objdump + caller inspection + sendto-correlation"
0x0058bc5a,6,multiplayer_gamespy_ws2_htons_thunk,shell,cdecl,inferred,objdump + caller inspection,3,"Direct ordinal-backed WS2_32 thunk. Current call shape is the strongest match for `htons`: callers pass a host-order 16-bit port or word in `EAX` and consume the returned network-order word in `AX`. Grounded callers include `multiplayer_gamespy_build_sockaddr_in_from_host_string_and_port_with_resolve_fallback` `0x0058bd90` and several compact endpoint helpers such as `0x0058fbc0`, `0x00591060`, and `0x00591350`.","objdump + caller inspection + htons-correlation"
0x0058bc60,6,multiplayer_gamespy_ws2_htonl_thunk,shell,cdecl,inferred,objdump + caller inspection,3,"Direct ordinal-backed WS2_32 thunk. Current call shape is the strongest match for `htonl`: callers pass a host-order IPv4 dword and use the returned network-order value for direct sockaddr comparisons or endpoint materialization. Grounded callers include the local-bind loop `0x0058cb50` and compact endpoint helpers `0x0059100d`.","objdump + caller inspection + htonl-correlation"
0x0058bc66,6,multiplayer_gamespy_ws2_setsockopt_thunk,shell,cdecl,inferred,objdump + caller inspection,3,"Direct ordinal-backed WS2_32 thunk. Current call shape is the strongest match for `setsockopt`: callers pass a socket handle, level `0xffff`, one small option selector, an option-value pointer, and byte size `4`. Current grounded caller is the worker-side UDP socket bring-up strip around `0x0059c74c`, which applies one single-dword option immediately after socket creation.","objdump + caller inspection + setsockopt-correlation"
0x0058bc6c,6,multiplayer_gamespy_ws2_socket_thunk,shell,cdecl,inferred,objdump + caller inspection,3,"Direct ordinal-backed WS2_32 thunk. Current call shape is the strongest match for `socket`: callers pass `AF_INET`, `SOCK_DGRAM`, and protocol `0x11` for UDP datagram sockets, or the analogous stream-side arguments in later transport-worker code. Grounded callers include the GameSpy route bind helper `0x0058cb50` and the later worker-side socket bring-up families around `0x0059c720`, `0x0059fe90`, and `0x005a0920`.","objdump + caller inspection + socket-correlation"
0x0058bc72,6,multiplayer_gamespy_ws2_cleanup_thunk,shell,cdecl,inferred,objdump + caller inspection,3,"Direct ordinal-backed WS2_32 thunk. Current call shape is the strongest match for `WSACleanup`. The helper is normally reached through wrapper `multiplayer_gamespy_leave_winsock_guard` `0x0058f490`.","objdump + caller inspection + WSACleanup-correlation"
0x0058bc78,6,multiplayer_gamespy_ws2_startup_thunk,shell,cdecl,inferred,objdump + caller inspection,3,"Direct ordinal-backed WS2_32 thunk. Current call shape is the strongest match for `WSAStartup`: callers pass version `0x0101` plus a `WSADATA`-sized output buffer. The helper is normally reached through wrapper `multiplayer_gamespy_enter_winsock_1_1_guard` `0x0058f470`.","objdump + caller inspection + WSAStartup-correlation"
0x0058bc7e,6,multiplayer_gamespy_ws2_recvfrom_thunk,shell,cdecl,inferred,objdump + caller inspection,3,"Direct ordinal-backed WS2_32 thunk. Current call shape is the strongest match for `recvfrom`: callers pass one socket handle, payload buffer, byte budget, flags `0`, a sockaddr buffer, and a `0x10`-sized length slot, then interpret the return as the received byte count or `-1`. Grounded callers include `multiplayer_gamespy_route_drain_inbound_packets` `0x0058ccd0` and later compact-descriptor or transport-side datagram reads.","objdump + caller inspection + recvfrom-correlation"
0x0058bc84,6,multiplayer_gamespy_ws2_get_last_error_thunk,shell,cdecl,inferred,objdump + caller inspection,3,"Direct ordinal-backed WS2_32 thunk. Current call shape is the strongest match for `WSAGetLastError`: callers invoke it with no arguments immediately after socket, bind, or recv-side failures and branch on the returned error code. Grounded callers include the worker-side error path around `0x0059cabd`, the transport-side bind failure branch near `0x0059fed6`, and the later recv-side error handling around `0x005a04ea`.","objdump + caller inspection + WSAGetLastError-correlation"
0x0058bc8a,6,multiplayer_gamespy_ws2_bind_thunk,shell,cdecl,inferred,objdump + caller inspection,3,"Direct ordinal-backed WS2_32 thunk. Current call shape is the strongest match for `bind`: callers pass a socket handle, one `sockaddr_in` pointer, and length `0x10`, then branch on the usual zero-vs-error return. Grounded callers include `multiplayer_gamespy_try_open_udp_socket_and_bind_local_port_range` `0x0058cb50` and the later worker-side bind helper around `0x0059fecc`.","objdump + caller inspection + bind-correlation"
0x0058bc90,23,multiplayer_gamespy_route_set_extended_payload_callback,shell,thiscall,inferred,objdump,3,"Tiny callback-slot helper for one GameSpy-style route object. It stores the caller callback pointer in `[route+0xa0]`, or in the default route singleton at `0x00629948` when `ecx` is null. The current grounded transport-side caller is multiplayer_transport_try_connect_status_route, which patches the status route's validated extended-payload callback slot to `0x597330` after route construction.",objdump
0x0058bcb0,36,multiplayer_gamespy_append_small_control_id_to_byte_list_builder,shell,thiscall,inferred,objdump + caller inspection,3,"Tiny byte-list helper used by the multiplayer session-event callback strip. When the current count at `[builder+0x100]` is still below `0xfe` and the caller id in `edx` is within `1..0xfe`, the helper appends that single byte at `[builder+count]` and increments the count. Current grounded caller is `multiplayer_session_event_seed_control_id_list` `0x004690f0`.","objdump + caller inspection + builder correlation"
0x0058bce0,101,multiplayer_gamespy_append_c_string_to_text_builder_with_0x800_cap,shell,thiscall,inferred,objdump + caller inspection,3,"Small text-builder helper used by the multiplayer session-event and GameSpy route families. The routine measures one caller NUL-terminated string, clamps the copied span against the remaining `0x800`-byte capacity tracked at `[builder+0x800]`, appends the bytes into the builder body rooted at `[builder]`, updates the stored length, and rewrites the trailing NUL terminator. Current grounded callers include `multiplayer_session_event_publish_fixed_status_text` `0x004690d0` and the GameSpy-side field emitters beneath `0x0058c5c0`.","objdump + caller inspection + builder correlation + string correlation"
0x0058bd50,48,multiplayer_gamespy_refresh_local_host_address_dword_table_from_resolved_hostname,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Refreshes the small global local-address table used by the GameSpy transport path. The helper first resolves the current machine hostname through `multiplayer_gamespy_query_local_hostent_from_current_hostname` `0x0058f540`; when that hostent is present it clears the live count at `0x00db8b40`, walks the returned address-list vector at `[hostent+0x0c]`, copies the first dword from each non-null entry into the global table rooted at `0x00db8a28`, and stops after at most five entries before publishing the final count back to `0x00db8b40`. Current grounded callers are the status-route connect path around `0x0058cade` and the later local-address iteration helper at `0x0058d750`.","objdump + caller inspection + local disassembly + hostent-layout correlation + Gamespy-route correlation"
0x0058bd90,115,multiplayer_gamespy_build_sockaddr_in_from_host_string_and_port_with_resolve_fallback,shell,stdcall,inferred,objdump + caller inspection + strings,4,"Builds one IPv4 `sockaddr_in` for the GameSpy route family. The helper writes `AF_INET` at `[out+0x00]`, byte-swaps the caller port word through the `htons`-style thunk at `0x0058bc5a` into `[out+0x02]`, and then resolves the caller host string into `[out+0x04]`: null falls back to `0`, dotted-quad text is parsed first through `0x005b31f2`, and when that parse returns `0xffffffff` the helper falls back to the host-name resolver thunk at `0x0058bc42` unless the string matches the literal `127.0.0.1`. When the optional third argument is non-null it also publishes the resolved IPv4 dword there. The helper returns `0` only when host-name resolution fails and otherwise returns `1`. Current grounded callers are the status-route connect branch around `0x0058cb1b`, which formats `%s.master.gamespy.com` and uses port `0x6cfc` (`27900`), and the later UDP bind loop around `0x0058cb9c`, which walks candidate local address strings before calling `bind`.","objdump + caller inspection + strings + sockaddr-correlation + Gamespy-route correlation"
0x0058be10,11,multiplayer_gamespy_swap_two_bytes,shell,cdecl,inferred,objdump + caller inspection,3,"Tiny byte-swap helper. The function exchanges the caller bytes at `ecx` and `eax` and returns. Current grounded callers are the adjacent GameSpy stream-cipher helper `0x0058bee0`.","objdump + caller inspection"
0x0058be20,40,multiplayer_gamespy_map_six_bit_value_to_gamespy_base64_char,shell,cdecl,inferred,objdump + caller inspection,3,"Small alphabet-mapping helper for the adjacent GameSpy text codec family. The function maps six-bit values `0..63` onto the GameSpy-style Base64 alphabet `A..Z`, `a..z`, `0..9`, `+`, and `/`, and returns `0` for out-of-range inputs. Current grounded caller is `0x0058be50`.","objdump + caller inspection + alphabet correlation"
0x0058be50,142,multiplayer_gamespy_append_base64_text_from_byte_stream,shell,cdecl,inferred,objdump + caller inspection,3,"Text-encoding helper in the GameSpy route family. The routine reads the caller byte stream in `3`-byte groups, packs each group into four six-bit lanes, maps those lanes through `0x0058be20`, appends the resulting Base64 text into the caller output, and writes one trailing NUL terminator. Current grounded caller is the shared packet-field builder `0x0058c0c0`.","objdump + caller inspection + base64 correlation + string-builder correlation"
0x0058bee0,294,multiplayer_gamespy_apply_rc4_style_stream_cipher_in_place,shell,cdecl,inferred,objdump + caller inspection,3,"Stream-cipher helper used by the adjacent GameSpy packet-builder family. The function seeds a `256`-byte permutation box, runs the usual RC4-style key-scheduling loop over the caller key bytes, and then XORs the caller payload in place through the corresponding keystream. Current grounded caller is the shared packet-field builder `0x0058c0c0`.","objdump + caller inspection + RC4-correlation"
0x0058c010,18,multiplayer_gamespy_init_packet_field_builder_header_and_length,shell,cdecl,inferred,objdump + caller inspection,3,"Tiny packet-field builder initializer. The helper stores the caller field class byte at `[out+0x00]`, copies one caller length dword from `[edx]` into `[out+0x01]`, seeds builder length `[out+0x800] = 5`, and returns. Current grounded caller is the shared packet-field builder `0x0058c0c0`.","objdump + caller inspection + packet-builder correlation"
0x0058c030,136,multiplayer_gamespy_append_encoded_field_payload_to_packet_builder,shell,cdecl,inferred,objdump + caller inspection,3,"Payload-side helper beneath the shared GameSpy packet-field builder. For valid caller lengths in `1..0x41`, the routine copies the source bytes into one stack-local buffer, runs the adjacent RC4-style transform `0x0058bee0` with the caller key string, Base64-encodes the transformed bytes through `0x0058be50`, appends that text to the builder body, and advances the stored builder length. Current grounded caller is `0x0058c0c0`.","objdump + caller inspection + RC4-correlation + base64 correlation + packet-builder correlation"
0x0058c0c0,649,multiplayer_gamespy_build_length_coded_control_field_payload,shell,cdecl,inferred,objdump + caller inspection,3,"Shared packet-field builder in the GameSpy control-payload family. The routine initializes one field header through `0x0058c010`, encodes the caller payload according to field class `0`, `1`, or `2`, uses the adjacent RC4-style transform `0x0058bee0` and Base64 appender `0x0058be50` for the encoded payload lanes, and emits the final length-coded field text into the caller builder while maintaining builder size at `[builder+0x800]`. Current grounded caller is `multiplayer_gamespy_decode_triplet_control_payload` `0x0058c340`, which packages three decoded slices through field classes `0`, `1`, and `2`.","objdump + caller inspection + packet-builder correlation + control-payload correlation"
0x0058c300,54,multiplayer_gamespy_emit_three_predecoded_control_slices_as_field_classes_0_1_2,shell,cdecl,inferred,objdump + caller inspection,3,"Thin wrapper above the shared GameSpy control-field builder `0x0058c0c0`. The helper forwards three caller payload slices in order and packages them as field classes `0`, `1`, and `2` into the same destination builder. This is the safest current read for the immediate three-slice emitter wrapper rather than conflating it with the later parser that extracts those slices from raw packet text.","objdump + caller inspection + control-payload correlation + wrapper correlation"
0x0058c9b0,404,multiplayer_gamespy_route_construct_and_seed_callback_vector,shell,thiscall,inferred,objdump,3,"Constructs or replaces one 0x108-byte GameSpy-style route object and seeds its callback vector. The helper allocates the route object when the caller owner slot is non-null, copies two caller strings into the local route buffers at `+0x04` and `+0x44`, stores the supplied callback table across `[route+0x88]` through `[route+0x9c]`, records the owner context at `[route+0x104]`, initializes the route cookie state and recent-cookie ring, and explicitly zeroes the secondary callback slots `[route+0xa0]`, `[route+0xa4]`, and `[route+0xd4]` before any later patch-up. Current grounded callers are multiplayer_transport_try_connect_status_route and multiplayer_transport_try_connect_live_route through the wrapper at `0x58cc40` or the constructor directly.","objdump"
0x0058c950,84,multiplayer_gamespy_send_ping_control_packet_and_refresh_last_ping_tick,shell,cdecl,inferred,objdump + caller inspection + strings,4,"Small outbound `PING` packet sender for one live GameSpy route. The helper builds a field-class `8` control packet into one stack-local `0x804`-byte builder through `0x58c010` using route cookie dword `[route+0x84]`, sends that packet to remote sockaddr `[route+0xc4]` through thunk `0x0058bc54`, and then refreshes `[route+0xac]` from the shared tick source `0x0058f450`. Current grounded caller is the retry or keepalive owner `multiplayer_gamespy_route_service_retry_and_keepalive_timers` `0x0058cee0`, which emits it after roughly `0x4e20` ms without a recent ping refresh.","objdump + caller inspection + strings + ping-correlation + Gamespy-route correlation"
0x0058cb50,223,multiplayer_gamespy_try_open_udp_socket_and_bind_local_port_range,shell,cdecl,inferred,objdump + caller inspection + strings,4,"Opens one UDP socket for the GameSpy route family and binds it to a caller-selected local endpoint. The helper first enters the surrounding Winsock guard through `0x0058f470`, opens a datagram socket through thunk `0x0058bc6c`, and then tries to bind one `sockaddr_in` built through `multiplayer_gamespy_build_sockaddr_in_from_host_string_and_port_with_resolve_fallback` `0x0058bd90`. When the requested starting port loaded from `[*port_inout]` is nonzero it walks a `0x64`-wide port range, incrementing the local port candidate after each failed `bind`; when the resolved local address equals `127.0.0.1` it clears the IPv4 dword before `bind`, effectively retrying as `INADDR_ANY`. When the requested starting port is zero and the first bind succeeds it queries the chosen ephemeral port through `getsockname`-style helper `0x005b3204` and byte-swaps it back through `0x005b31fe`. On success it stores the live socket handle into the caller socket out slot and the chosen local port back through the caller port pointer, returning `0`; it returns `1` for immediate socket-open failure and `2` for bind or post-bind endpoint-query failure.","objdump + caller inspection + strings + socket-bind correlation + Gamespy-route correlation"
0x0058cc40,136,multiplayer_gamespy_try_open_udp_socket_bind_local_endpoint_and_construct_route,shell,thiscall,inferred,objdump + caller inspection + transport-caller correlation,4,"Connect-side wrapper above the GameSpy route constructor. The helper first opens and binds one UDP socket plus local port through `multiplayer_gamespy_try_open_udp_socket_and_bind_local_port_range` `0x0058cb50`; when that stage fails it exits the surrounding Winsock guard through `0x0058f490` and returns the same nonzero failure code. On success it forwards the caller route strings, callback table, owner pointer, socket handle, and chosen local port into `multiplayer_gamespy_route_construct_and_seed_callback_vector` `0x0058c9b0`, then marks the resulting route live by setting `[route+0xbc] = 1` on either the newly created object or the default singleton. Current grounded callers are `multiplayer_transport_try_connect_status_route` `0x005973d0` and `multiplayer_transport_try_connect_live_route` `0x00597480`.","objdump + caller inspection + transport-caller correlation + Gamespy-route correlation"
0x0058cd40,41,multiplayer_gamespy_append_formatted_decimal_scalar_to_text_builder,shell,cdecl,inferred,objdump + caller inspection + strings,3,"Small decimal-text helper reused by the GameSpy route packet builders and several shell-side multiplayer status publishers. The helper formats one caller scalar through the fixed `%d` template at `0x005c9cd0` into a stack-local buffer and then appends that buffer into the destination text builder through `multiplayer_gamespy_append_c_string_to_text_builder_with_0x800_cap` `0x0058bce0`. Current grounded callers include the outbound route-control builder `0x0058cd70`, the status-route owner callback strip `0x005970e0`, and the session-event status-value publisher `0x00469070`.","objdump + caller inspection + strings + builder correlation"
0x0058cd70,368,multiplayer_gamespy_build_and_send_mode_selected_route_control_packet,shell,cdecl,inferred,objdump + caller inspection + strings,4,"Broader outbound control-packet builder for one live GameSpy route. The helper starts one field-class `3` packet through `0x58c010` using route cookie dword `[route+0x84]`, appends every local IPv4 entry currently cached in globals `0x00db8a28..0x00db8b40` as `localip%d` key-value pairs after converting each dword through `0x58bc3c`, appends `localport` from `[route+0xb8]`, appends the boolean-like route state under key `statechanged` when the caller mode in `EBX` is nonzero, and appends the route-name text at `[route+0x04]`. Modes `0`, `1`, and `3` then emit the three-slice encoded payload suffix through `multiplayer_gamespy_emit_three_predecoded_control_slices_as_field_classes_0_1_2` `0x0058c300`, while mode `2` instead just terminates the text builder. The final packet is sent to remote sockaddr `[route+0xc4]` through thunk `0x0058bc54`, after which the helper refreshes both `[route+0xa8]` and `[route+0xac]` from `0x0058f450`. Current grounded callers are the retry and keepalive owner `0x0058cee0`, the periodic mode-`1` wrapper at `0x0058cf90`, and the release path at `0x0058cfd0`.","objdump + caller inspection + strings + control-packet correlation + Gamespy-route correlation"
0x0058cf90,55,multiplayer_gamespy_route_send_mode1_control_if_live_and_retry_elapsed,shell,thiscall,inferred,objdump + caller inspection,3,"Small periodic wrapper above the broader outbound route-control builder `0x0058cd70`. It resolves the caller route object or the default singleton at `0x00629948`, requires live flag `[route+0xb4]`, and then compares the current tick from `0x0058f450` against `[route+0xa8]`. When at least `0x2710` ms have elapsed it dispatches `multiplayer_gamespy_build_and_send_mode_selected_route_control_packet` with mode `1`. Current grounded caller is the lower route-service family, which uses it as the `10`-second mode-`1` resend side above the heavier retry owner `0x0058cee0`.","objdump + caller inspection + Gamespy-route correlation"
0x0058d0a0,40,multiplayer_gamespy_release_global_special_numeric_key_dictionary_if_probe_allows,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Small destroy-side helper for the shared special numeric-key dictionary rooted at `0x00db8b48`. When that global table is present, the helper probes it through `0x0058f8f0`; if that probe returns zero it frees the table through `0x0058f8b0` and clears the global root. Current grounded caller is `multiplayer_transport_route_callback_table_release_decoded_schema_dictionary` `0x005907a0`, which uses this helper during the broader route-callback decode-runtime teardown.","objdump + local disassembly + caller inspection + dictionary-release correlation"
0x0058d0d0,22,multiplayer_gamespy_server_descriptor_release_property_store_and_free_record,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Destructor for one compact GameSpy-style server descriptor. The helper releases the owned keyed property-store root at `[entry+0x18]` through `0x0058f8b0`, clears that slot, and then frees the descriptor body itself through `0x0058f3c0`. Current grounded callers are the primary-endpoint list teardown around `0x5904ae` and the staged route-callback payload clear path `0x5962d3`.","objdump + local disassembly + caller inspection + descriptor-release correlation"
0x0058d0f0,49,multiplayer_gamespy_server_descriptor_upsert_owned_string_property_pair,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared keyed-property upsert helper for one compact GameSpy-style server descriptor. It acquires shared owned copies of the caller key and value strings through `multiplayer_route_callback_runtime_acquire_shared_string_copy` `0x00590540`, then inserts or replaces that owned `(key, value)` pair in the descriptor property store rooted at `[this+0x18]` through `0x0058f920`. Current grounded callers include the decimal wrapper `0x0058d130`, the backslash text parser `0x0058d350`, the fixed response decoder `0x0058d3a0`, the compact descriptor decode owner `0x0058ff60`, and the queue mode-`1` reply handler `0x005a0a00`.","objdump + local disassembly + caller inspection + property-store correlation"
0x0058d070,21,multiplayer_gamespy_compare_dereferenced_key_strings_casefolded_current_locale,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Small callback-style comparator over two dereferenced string pointers. The helper first loads the pointed-to key strings from the two caller record slots, then tail-jumps into the shared locale-aware casefolded compare `0x005a57cf`. Current grounded caller is the special numeric-key dictionary bootstrap `0x0058d6a0`, which installs this helper as the key-compare callback for the shared table rooted at `0x00db8b48`.","objdump + local disassembly + caller inspection + dictionary-bootstrap correlation"
0x0058d090,7,multiplayer_gamespy_release_dereferenced_key_string,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny callback-style release helper that loads one owned string pointer from `[entry]` and forwards it into tracked-heap free `0x0058f3c0`. Current grounded caller is the shared special numeric-key dictionary bootstrap `0x0058d6a0`, which installs this helper as the per-entry release callback for the table rooted at `0x00db8b48`.","objdump + local disassembly + caller inspection + dictionary-bootstrap correlation"
0x0058d130,52,multiplayer_gamespy_server_descriptor_format_decimal_and_upsert_string_property,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Numeric-text wrapper above `multiplayer_gamespy_server_descriptor_upsert_owned_string_property_pair` `0x0058d0f0`. The helper formats the caller integer through the fixed `%d` template at `0x005c9cd0` into stack scratch and then inserts that decimal text under the caller key string into the descriptor property store. Current grounded callers are the primary-endpoint table sort or export paths around `0x59003a`, `0x590050`, and `0x595fee`, where it publishes numeric descriptor fields such as `gsi_am_rating`.","objdump + local disassembly + caller inspection + decimal-format correlation + property-store correlation"
0x0058d170,40,multiplayer_gamespy_server_descriptor_query_string_property_or_fallback,shell,cdecl,inferred,objdump,3,"Looks up one string property on a compact GameSpy-style server or route descriptor and falls back to the caller default string when the property is missing. It probes the descriptor-owned key store at `[this+0x18]` through `0x58f9c0`; on success it returns the matched value pointer at `[entry+0x04]`, and on failure it returns the fallback string from the stack. Current grounded callers use keys such as `hostname` and `gamever` when formatting route and selector status text.","objdump + caller inspection + strings"
0x0058d1a0,28,multiplayer_gamespy_server_descriptor_query_float_property_or_fallback_double,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Numeric query sibling above `multiplayer_gamespy_server_descriptor_query_string_property_or_fallback` `0x0058d170`. The helper requests the caller property string with a null fallback; when the string is absent it returns the caller fallback `double` unchanged, and otherwise parses the property text through the locale-aware floating parser `0x005a2076`. Current grounded callers are the descriptor sort and scoring paths around `0x5901af` and `0x5901ca`.","objdump + local disassembly + caller inspection + floating-parse correlation + property-store correlation"
0x0058d1f0,3,multiplayer_gamespy_server_descriptor_query_primary_ipv4_raw,shell,cdecl,inferred,objdump,3,"Returns the descriptor's primary endpoint IPv4 dword from `[this+0x00]` without byte-order conversion. Current grounded consumers pair it with the raw primary port getter `0x58d210` as the compact identity key in `0x5903a0`, and pair it with the host-order port getter `0x58d200` when building route-binding payloads and compatibility checks.","objdump + caller inspection + WSOCK32 byte-order correlation"
0x0058d200,13,multiplayer_gamespy_server_descriptor_query_primary_port_host_order,shell,cdecl,inferred,objdump,3,"Returns the descriptor's primary endpoint port from `[this+0x04]` after converting the stored raw word through the imported `ntohs` shim at `0x5b31fe`. Current grounded callers use this host-order port in route-binding payload formatting and compatibility checks when no secondary endpoint flag is present.","objdump + caller inspection + WSOCK32 ntohs correlation"
0x0058d210,5,multiplayer_gamespy_server_descriptor_query_primary_port_raw,shell,cdecl,inferred,objdump,3,"Returns the descriptor's primary endpoint port word from `[this+0x04]` without byte-order conversion. Current grounded consumer `0x5903a0` pairs it with raw primary IPv4 `0x58d1f0` as the compact lookup key in the descriptor collection.","objdump + caller inspection + raw-key correlation"
0x0058d1c0,9,multiplayer_gamespy_server_descriptor_query_state_flag_bit0,shell,cdecl,inferred,objdump,3,"Returns state bit `0x1` from descriptor byte `[this+0x14]`. Current evidence now bounds this bit against two owners rather than one: queue service can promote pending field-cache state `0x4` into ready bit `0x1`, and the compact descriptor decode helper `0x58ff60` also ORs in bit `0x1` after the inline keyed-property vector path gated by source header bit `0x40` completes. Current grounded caller `0x595a6d` uses it to skip reinsertion into the field-cache family.","objdump + caller inspection + queue-state correlation + compact-decode correlation"
0x0058d1d0,9,multiplayer_gamespy_server_descriptor_query_state_flag_bit1,shell,cdecl,inferred,objdump,3,"Returns state bit `0x2` from descriptor byte `[this+0x14]`. Current evidence now bounds this bit against two owners too: queue service can promote pending `gsi_am_rating` descriptor state `0x8` into ready bit `0x2`, and the compact descriptor decode helper `0x58ff60` also ORs in bit `0x2` after the signed trailing string-pair tail runs to completion. Current grounded callers in the `gsi_am_rating` route branch use bit `0x2` as the split between immediate transition handling and reinsertion into the queued-descriptor family.","objdump + caller inspection + am-rating-branch correlation + queue-state correlation + compact-decode correlation"
0x0058d220,9,multiplayer_gamespy_server_descriptor_has_secondary_endpoint_flag,shell,cdecl,inferred,objdump,3,"Returns bit `0x2` from descriptor flag byte `[this+0x15]`. Current grounded callers use it to decide whether the descriptor exposes a secondary endpoint tuple at `[this+0x08]/[this+0x0c]` and therefore whether route-binding payload and compatibility checks should use the secondary port getter `0x58d250` instead of the primary port getter `0x58d200`.","objdump + caller inspection + secondary-endpoint correlation"
0x0058d230,9,multiplayer_gamespy_server_descriptor_query_flag_byte15_bit0,shell,cdecl,inferred,objdump,3,"Returns source-side header bit `0x1` from descriptor flag byte `[this+0x15]`. Current evidence now bounds this bit more tightly than before: it is not generated by queue service, is explicitly set during the raw primary-endpoint seed refresh around `0x590dc0` together with bit `0x10` before insertion into `[transport+0x18bc]`, and is also preserved by the compact descriptor decode path at `0x58ff60`. The strongest current read is therefore one primary-endpoint-seed or endpoint-only source marker: grounded transport callers still only use it in the `gsi_am_rating` branch, where clear routes a richer descriptor through direct primary-endpoint handling at `[transport+0x18bc]` via `0x00591330`, while set routes the descriptor through the queued-descriptor family at `[transport+0x1e7c]` via `0x005a09a0` and later suppresses the direct `0x595dc0` transition even after ready bit `0x2` is present. Current evidence is strong enough to reject a queue-generated meaning and to treat this as the source-side marker for descriptors that still need later queue-backed enrichment before direct transition.","objdump + caller inspection + am-rating-branch correlation + endpoint-table correlation + queue-state correlation + compact-decode correlation + transition-suppression correlation + raw-endpoint-seed correlation"
0x0058d240,4,multiplayer_gamespy_server_descriptor_query_secondary_ipv4_raw,shell,cdecl,inferred,objdump,3,"Returns the descriptor's secondary endpoint IPv4 dword from `[this+0x08]` without byte-order conversion. Current grounded callers only use it when `multiplayer_gamespy_server_descriptor_has_secondary_endpoint_flag` reports bit `0x2` set in `[this+0x15]`, which makes this the current strongest match for an optional secondary address tuple rather than another scalar field.","objdump + caller inspection + secondary-endpoint correlation"
0x0058d250,13,multiplayer_gamespy_server_descriptor_query_secondary_port_host_order,shell,cdecl,inferred,objdump,3,"Returns the descriptor's secondary endpoint port from `[this+0x0c]` after converting the stored raw word through the imported `ntohs` shim at `0x5b31fe`. Current grounded callers only use it when flag bit `0x2` in descriptor byte `[this+0x15]` is set, and then compare it against bound-route word `[binding->route+0x30]` in the route-binding compatibility gate.","objdump + caller inspection + WSOCK32 ntohs correlation + secondary-endpoint correlation"
0x0058d260,3,multiplayer_gamespy_server_descriptor_store_intrusive_next_link,shell,cdecl,inferred,objdump,2,"Stores one intrusive next-descriptor link into field `[this+0x20]`. Current grounded caller `0x590410` uses it to prepend one descriptor onto the transport-owned primary-endpoint list headed at `[table+0x5bc]`.","objdump + caller inspection + descriptor-list correlation"
0x0058d270,3,multiplayer_gamespy_server_descriptor_query_intrusive_next_link,shell,cdecl,inferred,objdump,2,"Returns intrusive next-descriptor link field `[this+0x20]`. Current grounded caller `0x590490` uses it to walk and release the transport-owned primary-endpoint list headed at `[table+0x5bc]`.","objdump + caller inspection + descriptor-list correlation"
0x0058d550,19,multiplayer_gamespy_server_descriptor_release_property_entry_shared_string_pair,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Release callback for one compact descriptor property-store entry. It releases the owned shared key string at `[entry+0x00]` and the owned shared value string at `[entry+0x04]` through `multiplayer_route_callback_runtime_release_shared_string_copy` `0x005905a0`. Current grounded caller is the property-store constructor inside `multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record` `0x0058d5b0`, which installs this helper as the per-entry destroy callback for the keyed store rooted at `[entry+0x18]`.","objdump + local disassembly + caller inspection + property-store correlation + shared-string-pool correlation"
0x0058d570,9,multiplayer_gamespy_server_descriptor_hash_property_entry_key_mod_caller_divisor,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Hash callback for one compact descriptor property-store entry. The helper loads the dereferenced key string at `[entry+0x00]` and forwards it into `multiplayer_gamespy_hash_c_string_casefolded_current_locale_mod_caller_divisor` `0x0058d510`. Current grounded caller is the property-store constructor inside `multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record` `0x0058d5b0`, which installs this helper as the key-hash callback for the keyed store rooted at `[entry+0x18]`.","objdump + local disassembly + caller inspection + property-store correlation + hashing correlation"
0x0058d580,21,multiplayer_gamespy_server_descriptor_compare_property_entry_keys_casefolded_current_locale,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Compare callback for one compact descriptor property-store entry. It dereferences the two entry key pointers at `[lhs+0x00]` and `[rhs+0x00]` and then tail-jumps into the shared locale-aware casefolded compare `0x005a57cf`. Current grounded caller is the property-store constructor inside `multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record` `0x0058d5b0`, which installs this helper as the key-compare callback for the keyed store rooted at `[entry+0x18]`.","objdump + local disassembly + caller inspection + property-store correlation"
0x0058d5a0,3,multiplayer_gamespy_server_descriptor_query_special_numeric_scalar_dword1c,shell,cdecl,inferred,objdump,2,"Returns special numeric scalar field `[this+0x1c]` unchanged. Current grounded callers are the special-key fallback path inside `multiplayer_gamespy_server_descriptor_query_numeric_property_or_special_ping_yid_fallback` `0x58d6d0`, where both `queryid` and `ping` currently collapse onto this field, and the multiplayer session-event capacity-entry updater around `0x469251`, which copies the same scalar into entry field `[entry+0x118]` alongside `numplayers`, `maxplayers`, and the primary-endpoint text.","objdump + caller inspection + strings"
0x0058d5b0,112,multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record,shell,cdecl,inferred,objdump,3,"Allocates one 0x24-byte compact server-descriptor record and seeds its primary endpoint fields from the caller tuple. It allocates the descriptor body through `tracked_heap_alloc_with_header`, allocates the owned property-store block at `[entry+0x18]` through `0x58f840`, writes the primary IPv4 dword to `[entry+0x00]`, writes the raw primary port word to `[entry+0x04]`, and zero-initializes state byte `[entry+0x14]`, flag byte `[entry+0x15]`, both endpoint-extension fields, and the age or timestamp lanes at `[entry+0x1c]` and `[entry+0x20]`. Current grounded caller is the primary-endpoint table seed path around `0x590dc0`.","objdump + caller inspection + descriptor-allocation correlation"
0x0058d630,3,multiplayer_gamespy_server_descriptor_store_flag_byte15,shell,cdecl,inferred,objdump,2,"Stores one source-side compact header flag byte into descriptor field `[this+0x15]`. Current grounded callers are the compact descriptor decode helper `0x58ff60`, which copies the source header byte verbatim through this setter, and the raw primary-endpoint seed path `0x590dc0`, which stamps literal `0x11` into the same field for seeded descriptors.","objdump + caller inspection + compact-header correlation"
0x0058d640,13,multiplayer_gamespy_server_descriptor_store_secondary_endpoint_tuple,shell,cdecl,inferred,objdump,3,"Stores one secondary endpoint tuple into descriptor fields `[this+0x08]/[this+0x0c]`. The caller supplies the secondary IPv4 dword in `edx` and the secondary port word on the stack. Current grounded caller is the compact descriptor decode helper `0x58ff60`, which reaches this setter after header bit `0x02` selects an inline secondary IPv4 dword and header bit `0x20` either supplies the paired secondary port word or falls back to the owner default port at `[caller+0x498]`.","objdump + caller inspection + compact-header correlation"
0x0058d650,4,multiplayer_gamespy_server_descriptor_store_auxiliary_inline_dword10,shell,cdecl,inferred,objdump,2,"Stores one inline auxiliary dword into descriptor field `[this+0x10]`. Current grounded caller is the compact descriptor decode helper `0x58ff60`, which reaches this setter only when source header bit `0x08` is present. A local xref scan across the multiplayer descriptor family now makes the negative result tighter too: no dedicated semantic reader has been recovered yet. Current evidence only shows the field being preserved by later descriptor-record copy or callback marshaling helpers around `0x591410`, `0x591480`, and `0x591510`, not branched on or formatted through a dedicated accessor. So the field ownership and header-bit gate are explicit, while the higher-level meaning remains open.","objdump + caller inspection + compact-header correlation + local-xref scan + descriptor-copy correlation"
0x0058d660,3,multiplayer_gamespy_server_descriptor_store_state_byte14,shell,cdecl,inferred,objdump,2,"Stores one state byte into descriptor field `[this+0x14]`. Current grounded callers include queue-service paths that promote pending descriptor tags into ready bits and the compact decode helper `0x58ff60`, which ORs in bit `0x1` after the inline keyed-property vector path and bit `0x2` after the signed trailing string-pair tail.","objdump + caller inspection + queue-state correlation + compact-decode correlation"
0x0058d670,3,multiplayer_gamespy_server_descriptor_query_state_byte14,shell,cdecl,inferred,objdump,2,"Returns descriptor state byte `[this+0x14]` unchanged. Current grounded caller is the compact decode helper `0x58ff60`, which reads the existing state before OR-ing in bits `0x1` or `0x2` and writing the result back through `0x58d660`.","objdump + caller inspection + compact-decode correlation"
0x0058d690,9,multiplayer_gamespy_hash_dereferenced_key_string_mod_caller_divisor,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny callback-style hash helper that loads one dereferenced key string from `[entry]` and forwards it into the shared modulo hash routine `0x0058d510` using the caller divisor in `edx`. Current grounded caller is the special numeric-key dictionary bootstrap `0x0058d6a0`, which installs this helper as the key-hash callback for the shared table rooted at `0x00db8b48`.","objdump + local disassembly + caller inspection + dictionary-bootstrap correlation"
0x0058d6a0,47,multiplayer_gamespy_ensure_special_numeric_key_dictionary_queryid_ping,shell,cdecl,inferred,objdump + local disassembly + caller inspection + strings,3,"Lazy bootstrap for the small shared special-key dictionary rooted at `0x00db8b48`. When that global table is null, the helper constructs it through `0x0058f840` with the local dereferenced-string hash, compare, and release callbacks at `0x0058d690`, `0x0058d070`, and `0x0058d090`, using the fixed key strings `queryid` and `ping` as the current grounded owner family. Current grounded caller is the descriptor-side special numeric fallback path around `0x0058d0a0`, which uses this table before routing both keys to `[descriptor+0x1c]`.","objdump + local disassembly + caller inspection + strings + dictionary-bootstrap correlation"
0x0058d6d0,66,multiplayer_gamespy_server_descriptor_query_numeric_property_or_special_ping_yid_fallback,shell,cdecl,inferred,objdump,3,"Looks up one numeric property on a compact GameSpy-style server or route descriptor and falls back to the caller default integer when the property is missing. For ordinary keys it probes the descriptor string-key store through `multiplayer_gamespy_server_descriptor_query_string_property_or_fallback` and parses the resulting decimal text through `0x5a1ea5`. It also has two fixed-key special cases for `queryid` and `ping`, both currently routed through `multiplayer_gamespy_server_descriptor_query_special_numeric_scalar_dword1c` `0x58d5a0` instead of the generic property store. Current grounded callers use it for fields such as `numplayers`, `maxplayers`, `maxwaiting`, `numservers`, `numwaiting`, and `gsi_am_rating`.","objdump + caller inspection + strings + rdata-key correlation"
0x0058d350,80,multiplayer_gamespy_server_descriptor_parse_backslash_key_value_text_into_property_store,shell,cdecl,inferred,objdump + local disassembly + caller inspection + strings,3,"Parses one backslash-delimited key-value text blob into the descriptor property store. The helper repeatedly extracts the next key and value spans around delimiter byte `0x5c` through `0x0058d300`, falls back to fixed token `0x005c87a8` when a value is missing, and then inserts each recovered pair through `multiplayer_gamespy_server_descriptor_upsert_owned_string_property_pair` `0x0058d0f0` until the source text is exhausted. Current grounded caller is the non-mode-`1` queue reply handler `0x005a0ad0`, which uses this path for plain backslash text replies.","objdump + local disassembly + caller inspection + backslash-text correlation + property-store correlation"
0x0058d3a0,365,multiplayer_gamespy_server_descriptor_parse_fixed_two_section_reply_blob_into_property_store,shell,thiscall,inferred,objdump + local disassembly + caller inspection,4,"Broader fixed-reply parser for one compact GameSpy-style server descriptor. It first consumes an initial backslash-delimited key/value prefix and inserts each recovered pair through `multiplayer_gamespy_server_descriptor_upsert_owned_string_property_pair` `0x0058d0f0`. It then advances past the empty separator and walks exactly two counted reply sections, each headed by one network-order word. For each section it first counts the NUL-terminated local key stems in that section dictionary, then walks the caller value strings in lockstep and reinserts each value under one synthetic decimal-suffixed key built from the current stem plus one running section-local index. Current grounded caller is the mode-`1` queue reply owner `multiplayer_gamespy_server_descriptor_queue_handle_mode1_reply_and_publish_owner_callback` `0x005a0a00`, which selects this helper when descriptor flag bit `0x4` is clear and treats it as the fixed-reply alternative to the variable inline keyed-property payload path.","objdump + local disassembly + caller inspection + fixed-reply correlation + property-store correlation"
0x0058d750,72,multiplayer_gamespy_query_first_private_local_ipv4_dword_from_current_hostname,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Resolves the current machine hostname through `multiplayer_gamespy_query_local_hostent_from_current_hostname` `0x0058f540`, walks the returned hostent address-list vector at `[hostent+0x0c]`, and returns the first IPv4 dword whose bytes fall inside the private or loopback ranges accepted by `multiplayer_gamespy_ipv4_dword_is_private_rfc1918_or_loopback` `0x0058f580`. When no such entry is found it returns `0`. Current grounded caller is the transport-side branch around `0x0058dc84`, which uses the result as the local-address side of the multiplayer bring-up path.","objdump + caller inspection + local disassembly + hostent-correlation + RFC1918-correlation"
0x0058d7a0,55,multiplayer_transport_set_local_name,shell,thiscall,inferred,ghidra-headless,3,Updates the local identity string stored in the session-event transport object. When the transport is already configured through [this+0x44] and the incoming name pointer is non-null and non-empty it copies up to 0x40 bytes into [this+0x04] clears byte [this+0x43] and then forwards the same name into the lower transport update path through 0x0058f330.,ghidra + rizin + llvm-objdump
0x0058d7e0,41,multiplayer_transport_reset_selector_registration_tables_and_rebuild_selector_view_runtime,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Reset-side helper in the outer session-event transport family. It first clears the three selector registration tables and their companion runtime through `multiplayer_transport_reset_selector_tables` `0x005950d0`; when that succeeds it ensures the keyed selector-view store through `0x005949a0`; and on success it rebuilds the surrounding selector-view side effects through `0x00593fe0`. Current grounded caller is `multiplayer_transport_publish_callback_table_binding_result_and_release_work_record` `0x00593570`, which uses this helper to validate and finalize callback-table attach success before publishing the result. The helper returns boolean success rather than performing any deferred-reset teardown on its own.","objdump + local disassembly + caller inspection + selector-view-store correlation + callback-binding correlation"
0x0058d810,30,multiplayer_transport_reset_selector_slots_route_callback_runtime_and_selector_view_sidecars,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Common runtime-reset strip for the outer session-event transport object. It clears all selector slots and slot-local sample text through `0x005955a0`, releases the keyed selector-view store through `0x005949f0`, clears the auxiliary selector-view sidecar rooted at `[this+0xac8]` through `0x00594080`, and then forwards into `0x00595820` for the remaining route-mode-sensitive selector cleanup. Current grounded callers are `multiplayer_transport_disconnect` `0x0058d830` and the broader worker-release and deferred-reset paths `0x0058d860` and `0x0058de50`.","objdump + local disassembly + caller inspection + selector-view-store correlation + reset-strip correlation"
0x0058d830,40,multiplayer_transport_disconnect,shell,thiscall,inferred,ghidra-headless,3,Disconnects the session-event transport object from its current live route. The helper flips the internal active state through 0x005965d0 and 0x005961b0 calls the shared teardown block at 0x0058d810 and finally clears byte [this+0x60] and the copied local name at [this+0xaf4].,ghidra + rizin + llvm-objdump
0x0058d860,59,multiplayer_transport_release_worker_and_reset_runtime_state,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Common worker-release and runtime-reset strip for the outer session-event transport object. When the owned worker pointer at `[this]` is present it first tears that worker down through `multiplayer_transport_worker_shutdown_gracefully` `0x58e480`, then clears the worker root, local-name-copy byte `[this+0x04]`, and the two configured or active transport-state latches `[this+0x44]` and `[this+0x48]`. It next releases the transient work-record side through `0x593370`, runs the shared selector and callback-runtime reset block `0x58d810`, and finally clears live-route or keepalive state `[this+0x180c]`, byte `[this+0x1810]`, and deferred-reset latch `[this+0x1edc]`. Current grounded callers are the deferred-reset owner `0x58de50`, the callback-table attach failure path `0x58e200`, and the broader shutdown owner `0x58de90`.","objdump + local disassembly + caller inspection + worker-release correlation + reset-strip correlation"
0x0058d8a0,33,multiplayer_transport_destroy_queued_work_active_opcode_route_tables_and_owned_runtime_then_free,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Final destroy-side owner for the outer session-event transport object. It destroys the transient work-record collection at `[this+0x1780]` through `0x00593380`, releases the active opcode-record collection at `[this+0x17fc]` through `0x005927a0`, leaves the surrounding Winsock guard through `0x0058f490`, releases the remaining route-table or selector-text-owned runtime strings around `[this+0x18a8..]` through `0x005967f0`, and finally frees the transport object through `0x0058f3c0`. Current grounded caller is `multiplayer_transport_shutdown` `0x0058de90` after the deferred-close and common reset paths have already quiesced the live worker and route state.","objdump + local disassembly + caller inspection + final-destroy correlation"
0x0058d8d0,143,multiplayer_transport_service_frame,shell,cdecl,inferred,objdump + caller xrefs,3,"Recurring service pump for the outer session-event transport object. When the transport is configured through `[this+0x44]` or `[this+0x48]` it first services one worker step through multiplayer_transport_service_worker_once on the owned worker at `[this]`; if deferred reset is armed at `[this+0x1edc]` and the outstanding-work count has reached zero it falls straight into the common reset path at `0x0058de50`. Otherwise it conditionally emits the keepalive text at `0x005e1c24` after roughly `0x493e0` ms of inactivity, services the deeper selector or route helpers through `0x00596210` and `0x00597380`, finalizes deferred reset when the work count at `[this+0x1808]` reaches zero, and finishes by forwarding the caller selector through `0x00592800`. Current grounded callers reach it through multiplayer_transport_flush_and_maybe_shutdown and the immediate-drain submission paths, which places it at the center of the shell-owned multiplayer transport cadence.","objdump + caller xrefs + strings"
0x005a152e,176,math_abs_double_with_crt_special_case_handling,support,cdecl,inferred,objdump + arithmetic inspection + caller xrefs,4,"Returns the absolute value of one caller-supplied `double`. On ordinary finite inputs the helper simply clears the sign bit of the high dword before returning; on NaN or infinity it re-enters the surrounding CRT status machinery before returning either the preserved or sign-flipped value. Current grounded callers include the route-entry search family at `0x0049d380` and `0x0049c900`, where it is used as the absolute-value side of the span and angle quality gates.","objdump + arithmetic inspection + caller xrefs + CRT special-case correlation"
0x0058c340,144,multiplayer_gamespy_decode_triplet_control_payload,shell,cdecl,inferred,objdump,3,"Decodes one length-coded three-part GameSpy control payload and re-emits it through the shared packet-field builder at `0x58c0c0`. The helper reads up to three bounded variable-length slices from the caller payload, then packages them as field classes `0`, `1`, and `2`. The current grounded caller is subtype `0` of multiplayer_gamespy_route_dispatch_inbound_packet's `0xfe 0xfd` switch.",objdump
0x0058c3e0,480,multiplayer_gamespy_emit_query_field_group_via_route_callback_set,shell,cdecl,inferred,objdump + caller inspection + strings,3,"Callback-driven field-group emitter in the GameSpy route family. Given one destination text builder, one route object, and selector `0`, `1`, or `2`, the helper first asks the route callback set for the active key-id list through slots `[route+0x94]` or `[route+0x98]`, maps each returned id to a grounded key stem through table `0x00629958` with fallback `0x005e1b5c`, appends that key plus a separating backslash into the builder, and then dispatches the value side through callback slot `[route+0x88]`, `[route+0x8c]`, or `[route+0x90]` depending on the selector and optional index loop. When a value callback leaves the builder unchanged, the helper appends the fixed fallback token at `0x005c87a8`. Current grounded caller is `multiplayer_gamespy_build_backslash_query_response` `0x0058c5c0`, which invokes it for selectors `0`, `1`, and `2`.","objdump + caller inspection + strings + callback-vector correlation + query-response correlation"
0x0058c5c0,60,multiplayer_gamespy_build_backslash_query_response,shell,cdecl,inferred,objdump + strings,3,"Builds one backslash-delimited GameSpy query reply into the caller buffer. It seeds the leading `\\`, emits three callback-driven field groups through `0x58c3e0` for selectors `0`, `1`, and `2`, appends the fixed terminator token at `0x005e1b6c`, and leaves the result ready for immediate send. The current grounded caller is the backslash-packet branch inside multiplayer_gamespy_route_dispatch_inbound_packet.",objdump + strings
0x0058c600,142,multiplayer_gamespy_dispatch_natneg_or_raw_callback,shell,cdecl,inferred,objdump + strings,3,"Dispatches one validated extended GameSpy payload into route-owner callbacks. When the payload begins with the six-byte magic `fd fc 1e 66 6a b2` it treats bytes `[payload+6..+9]` as a little-endian value, materializes a small wrapper object through `0x5b31f8`, and forwards it through the route callback at `[route+0xa0]`; otherwise it falls back to the raw payload callback at `[route+0xa4]`. Both slots are optional: the helper tests them for null and returns without dispatch when the selected callback is absent. The current grounded caller is subtype `6` of multiplayer_gamespy_route_dispatch_inbound_packet.",objdump + strings
0x0058c690,58,multiplayer_gamespy_route_dedupe_recent_cookie,shell,cdecl,inferred,objdump,3,Maintains a small ring of the last ten 32-bit route cookies or packet ids under `[route+0xd8]` and `[route+0x100]`. It returns `1` when the caller id is already present and otherwise inserts it into the rotating slot table and returns `0`. The current grounded caller is subtype `6` of multiplayer_gamespy_route_dispatch_inbound_packet before dispatching the validated extended payload.,objdump
0x0058c6d0,606,multiplayer_gamespy_route_dispatch_inbound_packet,shell,cdecl,inferred,objdump + strings,3,"Main inbound packet parser for one GameSpy-style route object. It sends semicolon-prefixed lines through the route callback at `[route+0xd4]`, but only when that slot is non-null; otherwise the semicolon branch returns without additional work. It treats backslash-prefixed packets as query requests and answers them by building a reply through multiplayer_gamespy_build_backslash_query_response, and otherwise requires at least seven bytes plus the `0xfe 0xfd` header before entering a subtype switch on byte `2`. The grounded subtype branches are now tighter: subtype `0` decodes a three-slice control payload through multiplayer_gamespy_decode_triplet_control_payload; subtype `1` copies one bounded NUL-terminated string through `0x58c030`; subtype `2` copies up to `0x20` raw bytes into the local packet builder as field class `5`; subtype `4` validates the four-byte route cookie at `[route+0x84]`, clears `[route+0xb0]`, and dispatches the remaining payload through the validated route callback at `[route+0x9c]`, which the transport-owned status and live routes seed to `0x5972c0`; subtype `6` validates the same cookie, emits a field-class `7` record with the next dword, dedupes that dword through multiplayer_gamespy_route_dedupe_recent_cookie, and then dispatches the trailing payload through multiplayer_gamespy_dispatch_natneg_or_raw_callback. In the currently grounded transport-owned status and live routes, the extended callback layer is patched after construction so `[route+0xa0]` points at `0x597330`, while the optional raw fallback slot `[route+0xa4]` and semicolon-line slot `[route+0xd4]` remain null and therefore no-op. Subtypes `3` and `5` currently fall through without additional work. The current grounded caller is multiplayer_gamespy_route_drain_inbound_packets.","objdump + strings"
0x0058cfd0,107,multiplayer_gamespy_route_release_and_free,shell,thiscall,inferred,objdump,3,"Common teardown helper for one GameSpy-style route object. When the route still looks live through `[route+0xb4]` it first sends the mode-`2` control frame through `0x58cd70`, closes the current route handle at `[route]` when needed through `0x58bc4e`, resets the handle and last-send timestamp fields, and finally frees the route object through `0x58f3c0` when it is not the default singleton at `0x00629840`. Current grounded callers are multiplayer_transport_release_status_route, multiplayer_transport_release_live_route, and the status-route reconnect path.","objdump"
0x0058ccd0,107,multiplayer_gamespy_route_drain_inbound_packets,shell,cdecl,inferred,objdump + strings,3,"Inbound packet drain for one GameSpy-style route object. While the route receive queue remains non-empty it pulls one datagram through `0x58bc7e`, routes the payload into `multiplayer_gamespy_route_dispatch_inbound_packet`, and then repeats. The parser accepts semicolon-prefixed lines through the route callback at `[route+0xd4]`, backslash-delimited key bundles, and `0xfe 0xfd` GameSpy control packets. The current grounded caller is the lower route-service helper at `0x58d040`.","objdump + strings"
0x0058cee0,164,multiplayer_gamespy_route_service_retry_and_keepalive_timers,shell,cdecl,inferred,objdump + strings,3,"Timer and retry side of one GameSpy-style route object. It checks the active route handle and challenge or retry fields around `[route+0xa8]`, `[route+0xac]`, and `[route+0xb0]`, emits outbound control traffic through the local send helper when the `master.gamespy.com` challenge or state flow stalls, raises the `No challenge value was received from the master server.` callback through `[route+0x9c]` after repeated failures, and periodically refreshes the auxiliary timestamp through `0x58c950`. The current grounded caller is the lower route-service helper at `0x58d040`, which makes this the timer or retry half of the recurring GameSpy route cadence.","objdump + strings"
0x0058d040,37,multiplayer_gamespy_route_service_frame,shell,cdecl,inferred,objdump + strings,3,"Low-level recurring service step for one GameSpy-style route object. When the route handle state at `[route+0xb4]` is live it first services retry and keepalive timers through `multiplayer_gamespy_route_service_retry_and_keepalive_timers` and then drains inbound packets through `multiplayer_gamespy_route_drain_inbound_packets`. Current grounded callers are `multiplayer_transport_service_status_and_live_routes`, which uses the same helper for both the auxiliary status route at `[transport+0xaf0]` and the current live route at `[transport+0x1ecc]`.","objdump + strings"
0x0058d960,7,multiplayer_transport_select_status_route,shell,thiscall,inferred,ghidra-headless,3,Thin route-selector wrapper for the session-event transport. It forwards the requested small route id in EDX into multiplayer_transport_set_mode_q_flag which updates [this+0x560] formats the underlying `MODE %s -q` or `MODE %s +q` command text and reconfigures the transport-side callback plumbing.,ghidra + rizin + llvm-objdump
0x0058d970,89,multiplayer_transport_subscribe_field_callback_set,shell,thiscall,inferred,ghidra-headless,3,"Registers one field-subscription callback set on the session-event transport. When active byte `[this+0x60]` is set it stores the caller callback pair into `[this+0x176c]` and `[this+0x1770]`, then forwards the field-id list string plus callback and context into `multiplayer_transport_open_field_subscription_route_callback_table` `0x5962e0`; on failure it falls back through `multiplayer_transport_enqueue_field_snapshot_record` `0x592b50`. Current evidence now makes this the closest explicit lifecycle owner for the replay-band fields immediately below the still-unrecovered sidecar pointer at `[this+0x1778]`.","ghidra + rizin + llvm-objdump + local disassembly + field-subscription correlation"
0x0058d9e0,55,multiplayer_transport_send_selector_text,shell,thiscall,inferred,ghidra-headless,3,Sends one caller-supplied text pointer through a selector-specific transport slot. The helper looks up the selector entry from the handler table rooted at [this+0x390] and when both the text pointer and slot are valid forwards the string plus caller flag into the lower send helper at 0x0058e7e0 using the descriptor block at [this+0x80+selector*0x101].,ghidra + rizin + llvm-objdump
0x0058da60,75,multiplayer_transport_register_selector_callback,shell,thiscall,inferred,ghidra-headless,3,Registers or dispatches one selector callback against the transport slot table rooted at [this+0x390]. When the selected slot is absent it directly invokes the supplied callback with mode -1 and null payloads; otherwise it packages the caller context on the stack and walks the registered slot through 0x00594ac0 using helper 0x0058da20.,ghidra + rizin + llvm-objdump
0x0058db00,23,multiplayer_transport_request_status_pump,shell,thiscall,inferred,ghidra-headless,3,Marks the session-event transport status path dirty by setting [this+0xb44] to 1 and then calling multiplayer_transport_service_status_pump when the transport is active.,ghidra + rizin + llvm-objdump
0x0058db20,53,multiplayer_transport_clear_status_pump,shell,thiscall,inferred,ghidra-headless,3,Clears the session-event transport status-pump flag at [this+0xb44] then reruns multiplayer_transport_service_status_pump. When the transport still owns the auxiliary object at [this+0xaf0] it follows up with either 0x00597370 or 0x00597350 depending on whether selector slot [this+0x398] is present.,ghidra + rizin + llvm-objdump
0x0058db60,5,multiplayer_transport_force_status_flush,shell,thiscall,inferred,ghidra-headless,3,Tail-call wrapper into 0x00597370 for the active session-event transport object. The shell flush path uses it immediately before multiplayer_transport_flush_and_maybe_shutdown.,ghidra + rizin + llvm-objdump
0x0058db70,185,multiplayer_transport_send_mode_string_or_fallback_through_selector_text_slot,shell,thiscall,inferred,objdump + local disassembly + strings + caller inspection,3,"Small formatted-selector-text helper in the session-event transport family. When the transport is fully configured through `[this+0x48]` and the caller supplies both a nonempty mode string and a nonempty format string, it formats those two strings through the shared stack builder and then sends the result through `multiplayer_transport_send_selector_text` `0x0058e7e0` using selector id `3` or `4` depending on whether an optional companion pointer is present. Current grounded callers are the route-mode status publisher `0x0058dfb0` and the mode-command branch above the fixed `MODE %s`, `MODE %s -q`, and `MODE %s +q` literals.","objdump + local disassembly + strings + caller inspection + selector-text correlation"
0x0058dc30,22,multiplayer_transport_is_route_mode_active_nonterminal,shell,cdecl,inferred,ghidra-headless,3,Tiny predicate over the route-mode field at [this+0x18b8]. It returns false when the mode is zero or terminal mode `5` and true for the other active route modes. Current grounded callers use it to decide whether route callbacks can run inline or whether route work must be re-enqueued.,ghidra + rizin + llvm-objdump
0x0058dc50,576,multiplayer_transport_construct_and_zero_runtime_fields,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Constructor-side owner for the outer session-event transport object. It first enters the Winsock `1.1` guard through `0x58f470`, allocates one `0x1ee4`-byte transport body through `0x58f380`, and bulk-zeroes the full runtime field band with `rep stosd` count `0x7b9`. After zero-init it seeds local IPv4 `[this+0x58]` through `multiplayer_gamespy_query_first_private_local_ipv4_dword_from_current_hostname` `0x58d750`, clears the local-name latch byte `[this+0x60]`, clears neighboring replay-band field `[this+0x177c]`, constructs the transient work-record collection through `0x593330`, copies one caller-supplied `0x70`-byte callback-vector/state seed block into `[this+0x178c..+0x17f8]`, and then requires both `0x592750` and `0x5966f0` to succeed before the object is considered live. Later callback-slot wrappers over `[this+0x178c]`, `[this+0x17c0]`, `[this+0x17c4]`, and the sibling callback contexts near `[this+0x17f8]` now make that copied band read as the constructor-side callback vector and companion state block, not as a loose label blob. On any failure after allocation it falls back into final destroy owner `0x58d8a0`. Current evidence now makes this row important to the unresolved capacity-sidecar edge too: the constructor explicitly zero-initializes `[this+0x1778]`, later seeds neighbors such as `[this+0x177c]`, `[this+0x17fc]`, and the surrounding route-callback-table fields, and still never writes a nonzero value into `[this+0x1778]`. That proves the sidecar is not seeded by ordinary local construction inside `RT3.exe`.","objdump + local disassembly + caller inspection + constructor-layout correlation + callback-vector-band correlation + replay-band negative-writer correlation + Winsock-guard correlation"
0x0058dce0,357,multiplayer_transport_seed_local_name_status_bands_route_labels_and_rebuild_callback_tables,shell,cdecl,inferred,objdump + local disassembly,3,"Setup-side owner for the outer session-event transport object, adjacent to the callback-table attach path. When a local-name latch is already live at `[this+0x60]` it first disconnects through `0x58d830`, then copies the caller local name into `[this+0x60]`, seeds or refreshes the two status-text bands at `[this+0xad0]` and `[this+0xadc]` from caller-provided or default three-dword descriptors rooted at `0x00db8b50`, preserves those two descriptor triplets across setup only when selector-view result slot `[this+0xab0]` is already live, copies the two route-label buffers into `[this+0xb58]` and `[this+0xb78]`, clears route-label state bytes `[this+0xb77]` and `[this+0xb97]`, stores the caller callback-table metadata dwords at `[this+0xb98/+0xb9c]`, and rebuilds the route callback-table family through `multiplayer_transport_init_route_callback_tables` `0x596090`. When transport text or worker state at `[this+0x48]` is already live it also validates the callback-table attach through `multiplayer_transport_reset_selector_registration_tables_and_rebuild_selector_view_runtime` `0x58d7e0`, disconnecting on failure. On the success path it copies the caller status text into `[this+0xaf4]`, reruns status-route cleanup through `0x5965d0(1)`, clears the route-status latch band `[this+0xb40/+0xb44/+0xb54]` plus selector-view result slot `[this+0xab0]`, stores the caller scalar into `[this+0xb34]`, and returns success; on attach failure it returns `0` without reaching that refresh tail. This still leaves `[this+0x1778]` unresolved: current local evidence shows setup touching neighboring callback-table and replay-band state without writing a nonzero value there.","objdump + local disassembly + caller-state correlation + callback-table correlation + negative-writer correlation"
0x0058de50,49,multiplayer_transport_begin_deferred_reset_or_release_worker_and_pump_once,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Common reset owner for the outer session-event transport object. When outstanding-work count `[this+0x1808]` is still positive it simply arms deferred-reset latch `[this+0x1edc]` and returns. Otherwise it clears selector-view generation or result slot `[this+0xab0]`, releases the live worker and common runtime strip through `multiplayer_transport_release_worker_and_reset_runtime_state` `0x0058d860`, and then immediately pumps one service tick through `multiplayer_transport_service_frame` `0x0058d8d0` with selector `-1`. Current grounded callers are the direct reset wrapper `0x0058e2e0`, the broader shutdown owner `0x0058de90`, and the transport service cadence itself when deferred reset becomes eligible.","objdump + local disassembly + caller inspection + deferred-reset correlation + service-frame correlation"
0x0058de90,95,multiplayer_transport_shutdown,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shutdown owner for the outer session-event transport object. When the transport is still configured through `[this+0x44]` or `[this+0x48]`, it preserves the leading callback-vector dword at `[this+0x178c]` across the common reset owner `0x58de50`, then restores that field after the worker and selector-runtime teardown. It next disconnects the current live transport state through `multiplayer_transport_disconnect` `0x58d830`; when outstanding-work count `[this+0x1808]` remains positive it latches deferred-close flag `[this+0x1ee0]` and returns, otherwise it falls straight into the final destroy owner `0x58d8a0`. Current grounded callers are the direct shutdown wrapper `0x58e2e0`, the deferred-close follow-on `0x58def0`, and the outer bring-up or teardown error paths above the transport owner family.","objdump + local disassembly + caller inspection + callback-vector-band correlation + deferred-close correlation + final-destroy correlation"
0x0058def0,40,multiplayer_transport_flush_and_maybe_shutdown,shell,thiscall,inferred,ghidra-headless,3,Flushes the transport state through 0x0058d8d0 with selector -1 and when deferred-close flag [this+0x1ee0] is set and the outstanding-work count at [this+0x1808] has reached zero immediately falls into multiplayer_transport_shutdown.,ghidra + rizin + llvm-objdump
0x0058d720,35,multiplayer_transport_context_id_is_absent_from_queued_and_active_collections,shell,cdecl,inferred,objdump + caller inspection,2,"Small immediate-drain quiescence gate for one transport context id carried in `ESI`. It first checks the transient work-record collection at `[transport+0x1780]` through `multiplayer_transport_queued_work_collection_lacks_context_id` `0x593400`, then checks the active opcode-record collection at `[transport+0x17fc]` through `multiplayer_transport_active_opcode_record_collection_lacks_context_id` `0x592970`, and returns success only when both collections lack that same id. Current grounded callers are the immediate-drain tails in `multiplayer_transport_submit_text_record` `0x58df20`, the neighboring formatted selector-text publish root at `0x58dfb0`, and `multiplayer_transport_register_callback_table` `0x58e200`.","objdump + caller inspection + immediate-drain correlation + collection-quiescence correlation"
0x0058df20,131,multiplayer_transport_submit_text_record_with_context_id_and_callback_wrapper,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Primary text-record submit owner for the session-event transport. The helper first seeds one shared immediate-drain context id through `multiplayer_transport_next_work_sequence` `0x5934c0`, then tries the text fastpath through `multiplayer_transport_try_submit_text_record_fastpath` `0x593d60` using caller text pointer in `EDX`, one callback mode or selector in the first stack slot, one callback companion in the second stack slot, and the shared context id. When that fast path declines it falls back into `0x593170`, forwarding the same caller text pointer through `[transport+0x04]` together with callback mode or selector, callback companion, and the same context id. When immediate draining is requested in the third stack slot, it repeatedly services the transport through `0x58d8d0(-1)`, waits in `multiplayer_transport_context_id_is_absent_from_queued_and_active_collections` `0x58d720` until that same id has disappeared from both queued work field `+0x0c` and active opcode-record field `+0x14`, and then honors deferred-close state through `multiplayer_transport_shutdown` `0x58de90` when `[this+0x1ee0]` is armed and outstanding-work count `[this+0x1808]` has reached zero.","objdump + local disassembly + caller inspection + immediate-drain correlation + callback-wrapper correlation"
0x0058dfb0,328,multiplayer_transport_publish_route_mode_or_status_text_and_optionally_drain,shell,thiscall,inferred,objdump + local disassembly + caller inspection + strings,3,"Broader formatted selector-text publish owner for the session-event transport. It seeds one shared immediate-drain context id through `multiplayer_transport_next_work_sequence` `0x5934c0`, derives the active route-mode status code from transport latches such as `[this+0x60]`, `[this+0x48]`, `[this+0x384]`, `[this+0x390]`, `[this+0x9ac]`, and `multiplayer_transport_is_route_mode_active_nonterminal` `0x0058dc30`, and then either submits a richer selector-text route request through `multiplayer_transport_submit_selector_text_route_request` `0x00593c40` or falls back to `multiplayer_transport_probe_or_enqueue_route_record` `0x00592a70`. It also copies the current status text into `[this+0xaf4]`, refreshes the mode string band at `[this+0xad0/+0xadc]`, stores companion state at `[this+0xb34/+0xb40/+0xb44/+0xb54]`, may validate callback-table attach success through `0x58d7e0` with disconnect fallback `0x58d830`, and when the caller requests immediate draining it pumps `0x58d8d0` until `0x58d720` confirms that same context id has left both the queued-work and active-opcode families before honoring deferred-close state. Current grounded callers are the route-mode string setters above the fixed `MODE %s`, `MODE %s -q`, and `MODE %s +q` family and the neighboring status-publish wrappers.","objdump + local disassembly + caller inspection + strings + immediate-drain correlation + route-mode correlation"
0x0058e100,230,multiplayer_transport_publish_selector2_fixed_token_status_and_refresh_route_mode,shell,thiscall,inferred,objdump + local disassembly + caller inspection + strings,3,"Publishes one fixed-token status message through selector `2` on the session-event transport. The helper only runs when the transport is live and fully configured through `[this+0x60]`, `[this+0x48]`, `[this+0x398]`, and `[this+0xb40]`; when the caller token is null it falls back to the shared sample at `0x005c87a8`; then it formats one selector-`2` status line from the caller token plus internal text band `[this+0x282]` and the current route IPv4 at `[this+0x54]` using `inet_ntoa`, and sends that line through `multiplayer_transport_send_selector_text` `0x0058d9e0`. It sets `[this+0xb44] = 1`, reruns the status pump through `0x5951f0`, and then either nudges the route-mode helper `0x595650(5)` when `multiplayer_transport_is_route_mode_active_nonterminal` `0x0058dc30` is true or, when auxiliary object `[this+0xaf0]` is live, falls into `0x597350` or stores caller flags into `[this+0xb38]` before calling `0x597370`.","objdump + local disassembly + caller inspection + strings + selector-2 correlation + route-mode correlation"
0x0058e200,211,multiplayer_transport_attach_or_refresh_callback_table_and_optionally_immediate_drain,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Attaches or refreshes the session-event transport callback table and descriptor block. The helper first seeds one shared immediate-drain context id through `multiplayer_transport_next_work_sequence` `0x5934c0`. When the transport is not yet active through `[this+0x48]` or `[this+0x44]` but local-name latch `[this+0x60]` is already live, it copies the caller local name into `[this+0x04]`, clears `[this]`, `[this+0x48]`, and deferred-reset latch `[this+0x1edc]`, stores two caller follow-on callback fields at `[this+0x4c]` and `[this+0x5c]`, clears byte `[this+0x43]`, sets `[this+0x44] = 1`, and forwards the descriptor block plus caller metadata into `multiplayer_transport_attach_callback_table_descriptor` `0x593650` with that same context id. On attach failure it falls through the common worker and runtime release owner `0x58d860`. It then routes the resolved binding through `multiplayer_transport_dispatch_callback_table_binding` `0x592a40`, and when immediate draining is requested it pumps `0x58d8d0` until `0x58d720` confirms that same id has disappeared from both the queued work and active opcode collections before honoring deferred-close state.","objdump + local disassembly + caller inspection + callback-binding correlation + immediate-drain correlation"
0x0058e2e0,38,multiplayer_transport_reset_and_maybe_shutdown,shell,thiscall,inferred,ghidra-headless,3,Resets the common transport state through 0x0058de50 and when deferred-close flag [this+0x1ee0] is armed and the outstanding-work count at [this+0x1808] has reached zero immediately falls into multiplayer_transport_shutdown.,ghidra + rizin + llvm-objdump
0x0058e310,96,multiplayer_transport_try_dispatch_decoded_line_to_global_observer_table,shell,unknown,inferred,objdump + local disassembly + caller inspection,3,"Small decoded-line observer dispatcher in the transport worker family. It scans the global `(command-name, callback)` table rooted at `0x00629d58/0x00629d5c` using count `0x00629ee0`, compares the current decoded command token at `[EDI+0x14]` casefolded through `0x005a57cf`, and when one entry matches invokes the paired callback function with transport pointer from the caller stack in `ECX` and the decoded line band in `EDX`. It returns `1` on a handled match and `0` otherwise. Current grounded caller is the drain loop `multiplayer_transport_drain_request_text_queue` `0x0058e3f0`.","objdump + local disassembly + caller inspection + decoded-line correlation + observer-table correlation"
0x0058e370,33,multiplayer_transport_is_request_pending,shell,cdecl,inferred,ghidra-headless,3,Returns true while the caller transport request still appears in either the queued request collection at [this+0x550] or the secondary active-work collection checked through 0x0059c540. Immediate-drain callers use it as the loop predicate after pumping queued text and sleeping for 10 ms.,ghidra + rizin + llvm-objdump
0x0058e3f0,137,multiplayer_transport_drain_request_text_queue,shell,cdecl,inferred,ghidra-headless,3,Immediate-drain helper for one transport request. When request kind [req+0x20] is `1` it walks queued transport text lines under [this+0x1c] republishes them through 0x0059b790 and notifies the small observer table through 0x0058e310 until the queue is empty. When request kind `2` drains it also publishes `Disconnected`. Both paths refresh timeout state through 0x00598030 and finish by forwarding the request into 0x0059c470.,ghidra + rizin + llvm-objdump + strings
0x0058e480,105,multiplayer_transport_worker_shutdown_gracefully,shell,cdecl,inferred,rizin,3,"Graceful shutdown wrapper for one multiplayer transport worker. If the callback object at `[this+0x538]` and its owner slot `[this+0x544]` are present it first emits a final owner notification through the callback vtable using fallback text at `0x005c87a8`. When the owned text-stream socket at `[this+0x1c]` is still live it appends `QUIT :Later!` through multiplayer_transport_text_stream_append_crlf_line and services one I/O step through multiplayer_transport_text_stream_service_io before destroying the registered-name store at `[this+0x548]`, the pending-template dispatch store at `[this+0x54c]`, the text-stream object at `[this+0x1c]`, and finally the worker backing block itself.","rizin + llvm-objdump + strings"
0x0058e4f0,12,multiplayer_transport_service_worker_once,shell,cdecl,inferred,objdump,3,"Very small bridge from the outer session-event transport object into its owned worker. It forwards the worker pointer in `[this]` into multiplayer_transport_drain_request_text_queue with a null request pointer, making it the one-step worker service helper used by the recurring transport pump.",objdump
0x0058e510,277,multiplayer_transport_try_submit_text_record_fastpath_as_immediate_callback_or_formatted_local_name_request,shell,thiscall,inferred,objdump + local disassembly + caller inspection + strings,3,"Fastpath owner beneath `multiplayer_transport_try_submit_text_record_fastpath` `0x593d60`. When the transport worker root `[this]` is live and the caller text is either null, empty, too long for the local-name band, or casefold-equal to current local name `[this+0x36c]`, the helper allocates one local transient through `0x598060` and emits opcode `0x1b` through `0x59b790` using caller callback object `arg_4`, companion `arg_8`, and the staged transient pointer; when immediate draining is requested it then loops through `multiplayer_transport_drain_request_text_queue` `0x58e3f0`, `system_sleep_milliseconds` `0x58f460(10)`, and `multiplayer_transport_is_request_pending` `0x58e370`. Otherwise it formats one local-name command line through the owned text-stream builder `[this+0x1c]` using format string `0x005e1c64`, packages the resulting request through `0x598280`, and reuses the same immediate-drain loop. Current grounded caller is the type-`9` fastpath root `0x593d60`, which installs callback shim `0x593d00` above both branches.","objdump + local disassembly + caller inspection + strings + immediate-drain correlation + text-record-fastpath correlation"
0x0058e630,17,multiplayer_transport_query_current_local_name_or_fallback_sample,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Returns the active local-name buffer at `[this+0x36c]` when the transport worker root `[this]` is live; otherwise it falls back to the shared empty sample `0x005c87a8`. Current grounded caller is the status-route setup-side owner `0x58dce0`, which uses this helper while seeding the local-name and route-label family.","objdump + local disassembly + caller inspection + local-name correlation"
0x0058e650,80,multiplayer_transport_sanitize_identifier,shell,cdecl,inferred,ghidra-headless,4,Normalizes a caller-supplied identifier string into the destination buffer by replacing leading punctuation and any later disallowed characters with underscores while preserving acceptable bytes from the source. Current grounded callers use it for the randomized `RT3Player%d` retry name and for locally submitted session-event text records.,ghidra + rizin + llvm-objdump + strings
0x0058e6b0,98,multiplayer_transport_set_mode_q_flag,shell,thiscall,inferred,ghidra-headless,4,Updates the transport mode-q flag tracked at [this+0x560]. When the requested value changes it formats either `MODE %s -q` or `MODE %s +q` against the active name buffer at [this+0x36c] stores the new flag and for mode `0` refreshes the downstream callback plumbing through 0x0059e070 and 0x0059de00 using helper 0x0058e6a0.,ghidra + rizin + llvm-objdump + strings
0x0058e720,128,multiplayer_transport_submit_bound_route_or_selector_text_request_and_optionally_immediate_drain,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Common request-submit owner beneath the bound-route and selector-text route families. When the transport is active through `[this]`, it falls back to sample text `0x005c87a8` when the caller text pointer is null, formats one local route line through the text-stream builder at `[this+0x1c]`, packages the caller route payload and callback triplet into a type-`1` transient request through `0x5981b0`, refreshes the registered-name side through `0x59d5b0` using the same caller route string, and when immediate draining is requested loops through `multiplayer_transport_drain_request_text_queue` `0x0058e3f0`, `system_sleep_milliseconds` `0x0058f460(10)`, and `multiplayer_transport_is_request_pending` `0x0058e370` until that request completes. Current grounded callers are `multiplayer_transport_handle_bound_route_request` `0x00593bb0` and `multiplayer_transport_submit_selector_text_route_request` `0x00593c40`.","objdump + local disassembly + caller inspection + immediate-drain correlation + request-submit correlation"
0x0058e7a0,64,multiplayer_transport_publish_selector_slot_text_and_remove_registered_name_entry,shell,thiscall,inferred,objdump + local disassembly + caller inspection + strings,3,"Small selector-slot text publisher beneath selector reset. When the transport is active through `[this]`, it falls back to the shared sample `0x005c87a8` for a null caller string, formats one selector-slot line through the text-stream builder at `[this+0x1c]`, and then removes the corresponding registered-name entry through `multiplayer_transport_remove_registered_name_entry` `0x0059d760` using the caller slot buffer in `EDX`. Current grounded caller is `multiplayer_transport_reset_selector_slot` `0x005954b0`.","objdump + local disassembly + caller inspection + strings + selector-reset correlation"
0x0058e7e0,208,multiplayer_transport_publish_direct_selector_text_variant_and_notify_registered_name_slot,shell,thiscall,inferred,objdump + local disassembly + caller inspection + strings,3,"Direct selector-text publisher beneath `multiplayer_transport_send_selector_text` `0x58d9e0`. When the transport is active and both selector-slot buffer `EDX` and caller text are nonempty, the helper formats one line through the text-stream builder `[this+0x1c]` according to caller mode `arg_8`: mode `0` uses `PRIVMSG %s :%s`, mode `1` uses the action-prefixed `PRIVMSG %s :\\x01ACTION %s`, mode `2` uses `NOTICE %s :%s`, mode `3` uses `UTM %s :%s`, and mode `4` uses `ATM %s :%s`. It then probes the matching registered-name entry through `multiplayer_transport_find_registered_name_entry` `0x59d7d0`, and when one entry is present emits opcode `4` through `0x59b790` using entry fields `[entry]` and `[entry+0x2c]`, current local name `[this+0x36c]`, selector-slot buffer `EDX`, caller text, and the same caller mode. Current grounded callers are the generic selector-text bridge `0x58d9e0` and the fixed route-mode or status publisher family above it.","objdump + local disassembly + caller inspection + strings + registered-name correlation + selector-text correlation"
0x0058e8c0,37,multiplayer_transport_publish_topic_status_line,shell,thiscall,inferred,ghidra-headless,3,Formats and publishes one `TOPIC %s :%s` status line through the active transport text buffer at [this+0x1c]. When the caller text is null it falls back to the shared empty sample at 0x005c87a8. Current grounded caller is multiplayer_transport_handle_names_query_response.,ghidra + rizin + llvm-objdump + strings
0x0058e8f0,56,multiplayer_transport_publish_mode_key_status_line,shell,thiscall,inferred,ghidra-headless,3,Formats and publishes one mode-key status line through the active transport text buffer at [this+0x1c]. Depending on the caller flag it emits either `MODE %s +k %s` or `MODE %s -k %s`. Current grounded caller is multiplayer_transport_handle_bound_route_request.,ghidra + rizin + llvm-objdump + strings
0x0058e930,53,multiplayer_transport_publish_mode_level_status_line,shell,thiscall,inferred,ghidra-headless,3,Formats and publishes one mode-level status line through the active transport text buffer at [this+0x1c]. Depending on whether the caller level value is nonzero it emits either `MODE %s +l %d` or `MODE %s -l`. Current grounded caller is multiplayer_transport_handle_names_query_response.,ghidra + rizin + llvm-objdump + strings
0x0058e970,36,multiplayer_transport_invoke_registered_name_query_callback,shell,cdecl,inferred,ghidra-headless,3,Small callback shim used by the registered-name fast path. It loads the caller callback object from the dispatch frame and invokes its entry method with success flag `1`; the queried sample string; and the collected callback-entry arrays produced by multiplayer_transport_collect_registered_name_callback_entries.,ghidra + rizin + llvm-objdump
0x0058e9a0,177,multiplayer_transport_submit_names_query_with_callback,shell,thiscall,inferred,ghidra-headless,3,Builds and submits one `NAMES %s` query against the active transport text buffer at [this+0x1c]. When the caller sample is already present it bypasses transport submission through multiplayer_transport_dispatch_registered_name_query_fastpath. Otherwise it validates the sample through multiplayer_transport_has_registered_name packages the request through multiplayer_transport_enqueue_names_query_record and when immediate draining is requested loops through multiplayer_transport_drain_request_text_queue system_sleep_milliseconds and multiplayer_transport_is_request_pending. Current grounded callers are multiplayer_transport_handle_bound_route_request and multiplayer_transport_handle_selector_text_route_request.,ghidra + rizin + llvm-objdump + strings
0x0058ea60,171,multiplayer_transport_publish_direct_selector_text_variant_without_registered_name_notification,shell,thiscall,inferred,llvm-objdump + local disassembly + caller correlation,3,"Smaller sibling of `multiplayer_transport_publish_direct_selector_text_variant_and_notify_registered_name_slot` `0x0058e7e0`. When the transport worker is live and both selector-slot buffer `EDX` and caller text are nonempty, it formats one line through the owned text-stream builder `[this+0x1c]` according to caller mode `arg_8`: mode `0` uses `PRIVMSG %s :%s`, mode `1` uses the action-prefixed `PRIVMSG %s :\\x01ACTION %s`, mode `2` uses `NOTICE %s :%s`, mode `3` uses `UTM %s :%s`, and mode `4` uses `ATM %s :%s`. Unlike `0x58e7e0`, it stops after appending that line and does not probe the registered-name table or emit opcode `4`. Current grounded caller is `multiplayer_transport_send_selector_text` `0x0058d9e0`, which uses this helper on the plain publish branch opposite `0x58e7e0`.","llvm-objdump + local disassembly + caller correlation + selector-text correlation"
0x0058eb10,14,multiplayer_transport_has_registered_name_or_null_worker,shell,cdecl,inferred,llvm-objdump + caller correlation + local disassembly,3,"Tiny guard wrapper over `multiplayer_transport_find_registered_name_entry_and_optionally_return_bucket` `0x0059df60`. It returns `0` when the caller worker pointer is null or when the worker root `[this]` is null; otherwise it forwards the supplied name string and optional out-pointer pair into `0x59df60`. Current grounded caller is `multiplayer_transport_dispatch_registered_name_query_fastpath` `0x0059f8b0`, which uses this wrapper before collecting callback-entry arrays and emitting the local fastpath callback.","llvm-objdump + caller correlation + local disassembly + registered-name correlation"
0x0058eb70,212,multiplayer_transport_append_getkey_command,shell,cdecl,inferred,rizin,3,Formats one `GETKEY %s %s 0 :` command into a temporary 0x200-byte stack buffer and appends it to the owned transport text stream through multiplayer_transport_text_stream_append_crlf_line. After the fixed header it walks the caller string-vector argument and appends each additional item separated by backslashes. Current grounded caller is the synchronous submit wrapper at 0x0058ec50.,rizin + llvm-objdump + strings
0x0058ec50,140,multiplayer_transport_submit_getkey_command_and_wait,shell,cdecl,inferred,rizin,3,Synchronous `GETKEY` submit wrapper for the multiplayer transport worker. It resolves the query name from the caller string or falls back to [this+0x36c] primes one transient request through 0x0058eb30 emits the command text through multiplayer_transport_append_getkey_command and then loops through multiplayer_transport_drain_request_text_queue system_sleep_milliseconds and multiplayer_transport_is_request_pending until the request completes.,rizin + llvm-objdump + strings
0x0058ece0,197,multiplayer_transport_append_setchankey_or_setckey_command,shell,cdecl,inferred,rizin,3,Formats either `SETCHANKEY %s :` or `SETCKEY %s %s :` into a temporary 0x200-byte stack buffer and appends the resulting line to the owned transport text stream through multiplayer_transport_text_stream_append_crlf_line. The two-token `SETCKEY` form is selected when the optional caller key string at arg_210h is present and non-empty; otherwise the helper emits the simpler channel-key form.,rizin + llvm-objdump + strings
0x0058edb0,367,multiplayer_transport_append_setchankey_pair_list_command,shell,cdecl,inferred,rizin,2,Builds one larger backslash-delimited channel-key payload and appends it to the owned transport text stream through multiplayer_transport_text_stream_append_crlf_line. The helper formats normalized `\\%s\\%s` pair fragments in a 0x200-byte stack buffer converts backslashes to forward slashes in one staging path handles wildcard samples through the `*` token at 0x005e1e1c and is the main text builder beneath the synchronous submit wrapper at 0x0058ef20.,rizin + llvm-objdump + strings
0x0058ef20,199,multiplayer_transport_submit_setchankey_pair_list_command_and_wait,shell,cdecl,inferred,rizin,2,Synchronous channel-key submit wrapper for the multiplayer transport worker. It primes one transient request through 0x0058eb30 emits the larger backslash-delimited key payload through multiplayer_transport_append_setchankey_pair_list_command dispatches the caller result path through 0x005983b0 or 0x005984c0 depending on the staged optional arguments and then loops through multiplayer_transport_drain_request_text_queue system_sleep_milliseconds and multiplayer_transport_is_request_pending until the request completes.,rizin + llvm-objdump + strings
0x0058eff0,78,multiplayer_transport_is_valid_nick_string,shell,cdecl,inferred,rizin,4,Validates one transport nick string. It rejects null or empty strings rejects a leading digit or `-` through 0x005a53f2 and then scans every remaining byte against the allowed nick-character table at 0x005e1c70. It returns 1 when the full string is acceptable and 0 otherwise.,rizin + llvm-objdump + strings
0x0058f040,90,multiplayer_transport_dispatch_or_release_callback_binding,shell,cdecl,inferred,rizin,3,Generic dispatcher for one optional transport callback-binding structure. When binding field [this+0x0c] is present it packages the caller mode from EDX together with binding fields [this+0x18] and [this+0x36c] into opcode 0x1a through 0x0059b790. Otherwise it clears [this+0x04] and if callback pointer [this+0x14] is installed invokes it directly with the owner cookie at [this+0x18] and a zero status value.,rizin + llvm-objdump + strings
0x0058f380,64,tracked_heap_alloc_with_header,support,cdecl,inferred,ghidra-headless,4,Allocates one caller-sized heap block through the shared allocator at 0x005a125d stores the payload size in a 4-byte header immediately before the returned pointer and updates the global allocation counters at 0x00dba4c8 through 0x00dba4d0. Callers treat the returned value as a payload pointer just past the size header.,rizin + llvm-objdump
0x0058f3c0,43,tracked_heap_free_with_header,support,cdecl,inferred,ghidra-headless,4,Releases one heap block previously returned by tracked_heap_alloc_with_header. It reads the stored payload size from the 4-byte header decrements the shared allocation counters at 0x00dba4c8 and 0x00dba4cc and frees the underlying base pointer through 0x005a1145.,rizin + llvm-objdump
0x0058f3f0,94,tracked_heap_resize_with_header,support,cdecl,inferred,ghidra-headless,4,Resizes one header-tracked heap block to a new payload size. Null plus nonzero size falls through to tracked_heap_alloc_with_header; nonnull plus zero size frees through tracked_heap_free_with_header; and the main path reallocates through 0x005a5922 while preserving and re-accounting the payload size tracked in the 4-byte header.,rizin + llvm-objdump
0x0058f460,8,system_sleep_milliseconds,support,cdecl,inferred,ghidra-headless,4,Tiny wrapper over `Sleep` that forwards the caller millisecond delay in `ecx`. Current grounded callers use it as the 10 ms backoff inside immediate transport-drain loops.,rizin + llvm-objdump
0x0058f4a0,61,tracked_heap_clone_nul_terminated_string,support,thiscall,inferred,objdump + caller inspection,4,"Clones one caller-supplied NUL-terminated string into a freshly allocated tracked-heap buffer. Null falls through to null; otherwise the helper measures the byte span including the terminator, allocates that many bytes through `tracked_heap_alloc_with_header` `0x0058f380`, copies the full string including the trailing zero, and returns the cloned pointer. Grounded callers span the multiplayer transport, selector, and status families, where it acts as the shared tracked-heap strdup primitive.","objdump + caller inspection + tracked-heap correlation"
0x0058f470,32,multiplayer_gamespy_enter_winsock_1_1_guard,shell,cdecl,inferred,objdump + caller inspection,3,"Small Winsock bring-up wrapper for the GameSpy transport family. The helper allocates one stack-local `0x190`-byte `WSADATA`-sized buffer, then forwards version `0x0101` plus that buffer into thunk `0x0058bc78`, which is the current strongest read for the imported `WSAStartup` call. Current grounded callers include the local route bind helper `0x0058cb50`, the route-service and teardown family around `0x0058dc50/0x0058f119`, and several later connect or worker owners.","objdump + caller inspection + WSAStartup-correlation"
0x0058f490,5,multiplayer_gamespy_leave_winsock_guard,shell,cdecl,inferred,objdump + caller inspection,3,"Tail-jump wrapper into thunk `0x0058bc72`, which is the current strongest read for the imported `WSACleanup` call. Current grounded callers include the route-construction failure wrapper `0x0058cc40`, the lower route teardown path `0x0058d024`, the transport reset and shutdown family, and the later connect or worker owners.","objdump + caller inspection + WSACleanup-correlation"
0x0058f4e0,84,multiplayer_gamespy_socket_has_readable_datagram_pending,shell,thiscall,inferred,objdump + caller inspection,3,"Read-side socket readiness probe for the GameSpy route family. The helper seeds one stack-local zero-timeout `timeval` plus one single-entry `fd_set` containing the caller socket handle, forwards those into helper `0x005b320a`, and returns `1` only when that readiness call reports at least one readable socket without error. Current grounded caller is `multiplayer_gamespy_route_drain_inbound_packets` `0x0058ccd0`, which uses it as the loop predicate immediately before `recvfrom`.","objdump + caller inspection + socket-readiness correlation"
0x0058f540,64,multiplayer_gamespy_query_local_hostent_from_current_hostname,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Resolves the current machine hostname into one Winsock-style hostent pointer for the GameSpy transport path. The helper zeroes one `0x100`-byte stack buffer, queries the local hostname through thunk `0x0058bc48`, and then resolves that hostname through thunk `0x0058bc42`, returning the resulting hostent pointer or null. Current grounded callers are `multiplayer_gamespy_refresh_local_host_address_dword_table_from_resolved_hostname` `0x0058bd50` and the later local-address iteration helper at `0x0058d750`.","objdump + caller inspection + local disassembly + hostent-correlation"
0x0058f580,74,multiplayer_gamespy_ipv4_dword_is_private_rfc1918_or_loopback,shell,thiscall,inferred,objdump + caller inspection,3,"Classifies one raw IPv4 dword as belonging to the common private or loopback ranges. After byte-swapping the caller dword through helper `0x005b31f8`, the routine returns `1` for `10.0.0.0/8`, `172.16.0.0/12`, and `192.168.0.0/16`, and `0` otherwise. Current grounded caller is the local-address iteration helper around `0x0058d750`, which uses it to filter the hostent-derived local IPv4 list.","objdump + caller inspection + RFC1918-correlation"
0x0058fb10,24,memory_query_bounded_nul_terminated_byte_span_length,support,cdecl,inferred,objdump,3,"Scans one caller-supplied byte span for the first NUL terminator and returns the terminating length in bytes. The helper walks forward from the caller base pointer in `ecx` until it either finds a zero byte and returns the consumed count, or exhausts the caller byte budget in `edx` and returns `-1`. Current grounded callers use it as the bounded string-length primitive under compact descriptor tail validation and decode helpers such as `0x58fe50`, `0x58fe90`, and `0x58ff60`.","objdump + caller inspection + bounded-string correlation"
0x0058fe20,44,multiplayer_gamespy_server_descriptor_query_minimum_fixed_compact_header_byte_count,shell,cdecl,inferred,objdump,3,"Computes the minimum fixed byte count required by one compact descriptor header before any variable-length property or string tails are considered. The helper starts from `5` bytes for the source header byte plus the always-present primary IPv4 dword, then adds `4` when header bit `0x02` carries a secondary IPv4 dword, adds `4` when bit `0x08` carries the auxiliary inline dword stored at `[descriptor+0x10]`, adds `2` when bit `0x10` carries an inline primary port word, and adds `2` when bit `0x20` carries an inline secondary port word. Current grounded caller `0x5907d0` uses this as the first fixed-shape precheck above the heavier compact payload validators `0x58fe90` and `0x58fe50`.","objdump + caller inspection + compact-header correlation"
0x0058fe50,56,multiplayer_gamespy_server_descriptor_validate_signed_string_pair_tail_shape,shell,cdecl,inferred,objdump,3,"Validates the variable-length trailing tail used when the compact descriptor source header carries signed bit `0x80`. The helper repeatedly scans one bounded NUL-terminated string through `memory_query_bounded_nul_terminated_byte_span_length` `0x58fb10`, advances twice per loop to cover an alternating string pair, and only succeeds when the remaining byte budget ends on one final empty-string terminator. Current grounded caller `0x5907d0` uses this as the signed-tail shape precheck above the heavier decode path `0x58ff60`.","objdump + caller inspection + compact-header correlation + bounded-string correlation"
0x0058fe90,135,multiplayer_gamespy_server_descriptor_validate_inline_keyed_property_vector_shape,shell,cdecl,inferred,objdump,3,"Validates the variable-length inline keyed-property vector used when compact descriptor source header bit `0x40` is present. It walks the owner descriptor schema at `[owner+0x08]` through `0x59e110/0x59e120` and checks that the caller payload can supply each declared property item in sequence: one-byte entries for descriptor type `1`, two-byte entries for descriptor type `2`, and either one-byte dictionary selectors or bounded inline strings prefixed by `0xff` for descriptor type `0`, with the inline string lengths verified through `memory_query_bounded_nul_terminated_byte_span_length` `0x58fb10`. Current grounded caller `0x5907d0` uses this as the `0x40`-vector shape precheck before `0x58ff60` decodes the same property vector into the descriptor store.","objdump + caller inspection + compact-header correlation + bounded-string correlation"
0x0058ff20,52,multiplayer_gamespy_server_descriptor_preparse_compact_primary_endpoint_tuple,shell,cdecl,inferred,objdump,3,"Pre-parses the compact descriptor payload just far enough to recover the primary endpoint key used by the keyed-upsert decode lane. When the payload is at least `5` bytes long it reads the header byte at offset `0`, always copies the primary IPv4 dword from payload offset `+1` into one caller out slot, and then either copies the inline primary port word from payload offset `+5` when header bit `0x10` is present or falls back to the owner-side default port at `[caller+0x498]` when that bit is clear. Current grounded callers are the larger compact decode owners `0x5907d0` and `0x590d00`. This is the strongest current proof that compact descriptors always carry the primary IPv4 dword and that header bit `0x10` only gates the inline primary port word.","objdump + caller inspection + compact-header correlation"
0x00590140,78,multiplayer_gamespy_server_descriptor_compare_numeric_property_or_special_scalar,shell,cdecl,inferred,objdump,3,"Comparator helper for descriptor-collection property sorting. It resolves the caller-selected property key from global scratch slot `0x00db8c6c+0x488`, queries that key on both candidate descriptors through `multiplayer_gamespy_server_descriptor_query_numeric_property_or_special_ping_yid_fallback` `0x58d6d0` with zero fallback, subtracts the two integer-like results, and optionally negates the sign according to the reverse-sort latch at `0x00db8c6c+0x48c`. Current grounded caller is the collection sorter `0x590310` in comparator mode `0`.","objdump + caller inspection + descriptor-sort correlation"
0x00590190,138,multiplayer_gamespy_server_descriptor_compare_double_parsed_property,shell,cdecl,inferred,objdump,3,"Comparator helper for descriptor-collection property sorting on double-parsed property values. It resolves the caller-selected property key from global scratch slot `0x00db8c6c+0x488`, queries both candidate descriptors through `0x58d1a0` with `0.0` fallback, compares the resulting doubles against zero, and returns `-1/0/1` with optional sign inversion driven by the reverse-sort latch at `0x00db8c6c+0x48c`. Current grounded caller is the collection sorter `0x590310` in comparator mode `1`.","objdump + caller inspection + descriptor-sort correlation"
0x00590220,130,multiplayer_gamespy_server_descriptor_compare_string_property_lexicographically_inline,shell,cdecl,inferred,objdump,3,"Comparator helper for descriptor-collection property sorting on string properties. It resolves the caller-selected property key from global scratch slot `0x00db8c6c+0x488`, queries both candidate descriptors through `multiplayer_gamespy_server_descriptor_query_string_property_or_fallback` `0x58d170` with empty-string fallback, compares the two strings bytewise inlined, and optionally flips the result through the reverse-sort latch at `0x00db8c6c+0x48c`. Current grounded caller is the collection sorter `0x590310` in comparator mode `2`.","objdump + caller inspection + descriptor-sort correlation"
0x005902b0,88,multiplayer_gamespy_server_descriptor_compare_string_property_via_crt_compare,shell,cdecl,inferred,objdump,3,"Alternate string-property comparator for descriptor-collection sorting. It resolves the caller-selected property key from global scratch slot `0x00db8c6c+0x488`, queries both candidate descriptors through `multiplayer_gamespy_server_descriptor_query_string_property_or_fallback` `0x58d170` with empty-string fallback, compares them through the CRT string-compare helper at `0x5a57cf`, and optionally negates the sign according to the reverse-sort latch at `0x00db8c6c+0x48c`. Current grounded caller is the collection sorter `0x590310` in comparator modes above `2`.","objdump + caller inspection + descriptor-sort correlation"
0x00590310,76,multiplayer_gamespy_server_descriptor_collection_sort_by_property_mode,shell,cdecl,inferred,objdump,3,"Sorts one compact-descriptor collection by a caller-selected property comparator mode. The helper stores the chosen property-key pointer into global scratch slot `0x00db8c6c+0x488`, stores the reverse-sort latch into `0x00db8c6c+0x48c`, picks one comparator callback from `0x590140`, `0x590190`, `0x590220`, or `0x5902b0` according to the caller mode, and then sorts the backing vector at `[this+0x04]` through `generic_vector_sort` `0x59e170`. Current grounded caller `0x595f70` uses mode `1` with key `gsi_am_rating` before selecting the head descriptor from the primary-endpoint table.","objdump + caller inspection + descriptor-sort correlation + caller correlation"
0x00590370,45,multiplayer_gamespy_server_descriptor_collection_append_and_notify_owner,shell,cdecl,inferred,objdump,3,"Appends one descriptor pointer into the caller collection and immediately notifies the route-callback-table owner. It inserts the descriptor into the backing vector at `[this+0x04]` through `0x59e4d0`, then invokes the owner callback at `[this+0x480]` with mode `0`, passing the appended descriptor plus cookie `[this+0x484]`. Current grounded callers are the compact append paths `0x5907d0`, `0x590d00`, and the raw primary-endpoint seed path `0x590dc0`. This is now the clearest generic append-notify owner-callback lane for route-callback tables, and the capacity-descriptor owner `0x595bc0` uses that same mode-`0` branch for its populated live publish path.","objdump + caller inspection + descriptor-collection correlation + owner-callback correlation + capacity-owner-mode correlation"
0x005903a0,97,multiplayer_gamespy_server_descriptor_collection_find_by_primary_ipv4_and_port,shell,cdecl,inferred,objdump,3,"Searches one descriptor collection for an entry whose compact primary endpoint key matches the caller tuple. It walks the backing collection at `[this+0x04]`, compares each candidate descriptor's raw primary IPv4 dword through `0x58d1f0`, and then compares its raw primary port word through `0x58d210`. It returns the matching collection index or `-1` when no descriptor carries that same primary endpoint pair. This is the current strongest proof that descriptor fields `[0x00]` and `[0x04]` form the compact identity key for the server or route descriptor family.","objdump + caller inspection + descriptor-key correlation"
0x00590410,24,multiplayer_transport_route_callback_table_stage_descriptor_on_intrusive_list,shell,cdecl,inferred,objdump,2,"Prepends one descriptor pointer onto the route-callback table's staged intrusive list headed at `[this+0x5bc]`. It writes the prior head into descriptor field `+0x20` through `multiplayer_gamespy_server_descriptor_store_intrusive_next_link` `0x58d260`, then replaces `[this+0x5bc]` with the staged descriptor. Current grounded callers are the generic remove-notify lane `0x590430` and the active-collection release pass `0x5904d0`.","objdump + caller inspection + intrusive-list correlation"
0x00590430,57,multiplayer_gamespy_server_descriptor_collection_remove_index_notify_owner_and_stage_intrusive_link,shell,cdecl,inferred,objdump,3,"Removes one descriptor pointer from the caller collection by index, notifies the route-callback-table owner, and stages the removed descriptor onto the intrusive list head at `[this+0x5bc]`. It resolves the indexed descriptor through `0x59e120`, publishes owner callback mode `2` with that descriptor plus cookie `[this+0x484]`, erases the vector slot through `0x59e3d0`, and then prepends the removed descriptor onto the intrusive list through `0x590410`. Current grounded caller is the `gsi_am_rating` maintenance lane `0x595f70` when a descriptor fails the openstaging capacity gate. This is now the clearest generic remove-notify-and-stage owner-callback lane for route-callback tables, distinct from the append-notify mode-`0` path at `0x590370`.","objdump + caller inspection + descriptor-collection correlation + owner-callback correlation + generic-mode-split correlation"
0x00590470,8,multiplayer_gamespy_server_descriptor_collection_count,shell,cdecl,inferred,objdump,2,"Returns the live descriptor count in the caller collection by forwarding `[this+0x04]` into `generic_vector_count` `0x59e110`. Current grounded callers include the `gsi_am_rating` maintenance lane `0x595f70`.","objdump + caller inspection + descriptor-collection correlation"
0x00590480,11,multiplayer_gamespy_server_descriptor_collection_get_nth,shell,cdecl,inferred,objdump,2,"Returns the descriptor pointer stored at one zero-based collection index by forwarding the caller index into `generic_vector_get_nth` `0x59e120` on `[this+0x04]`. Current grounded callers include the keyed upsert path `0x590d00` and the `gsi_am_rating` maintenance lane `0x595f70`.","objdump + caller inspection + descriptor-collection correlation"
0x00590490,55,multiplayer_transport_route_callback_table_release_staged_intrusive_descriptor_list,shell,cdecl,inferred,objdump,3,"Releases the staged intrusive descriptor list headed at `[this+0x5bc]` for one route-callback table. It repeatedly reads the next-link through `multiplayer_gamespy_server_descriptor_query_intrusive_next_link` `0x58d270`, destroys the current staged descriptor through `0x58d0d0`, and advances the head until the intrusive list is empty. Current grounded callers are the broader active-collection teardown `0x5904d0` and the recurring table service helper `0x591290`, which now uses this to clear staged removals before the next state-driven service pass.","objdump + caller inspection + intrusive-list correlation + descriptor-destroy correlation"
0x005904d0,59,multiplayer_transport_route_callback_table_release_active_descriptor_collection,shell,cdecl,inferred,objdump,3,"Releases the active descriptor vector rooted at `[this+0x04]` for one route-callback table. It walks every live descriptor, stages each one onto the intrusive head at `[this+0x5bc]` through `0x590410`, clears the backing vector through `0x59e4b0`, and then destroys the staged intrusive list through `multiplayer_transport_route_callback_table_release_staged_intrusive_descriptor_list` `0x590490`. Current grounded callers are the broader runtime destroy helper `0x5907a0` and `multiplayer_transport_open_field_subscription_route_callback_table` `0x5962e0`, which uses it to drop prior active descriptors before rebuilding the field-subscription table.","objdump + caller inspection + descriptor-collection correlation + intrusive-list correlation + field-subscription correlation"
0x0058d680,14,multiplayer_gamespy_server_descriptor_matches_special_global_record,shell,cdecl,inferred,objdump,2,Returns 1 only when the caller descriptor pointer is exactly the special global descriptor stored at `0x00db8b4c`. Current grounded compact-descriptor owners use this as a hard reject before insertion so the shared global record does not get appended into normal descriptor collections.,objdump + caller inspection
0x005907d0,222,multiplayer_gamespy_server_descriptor_collection_append_decoded_compact_payload_if_valid_and_fresh,shell,cdecl,inferred,objdump,4,"Owner-side compact descriptor append path for the route-callback receive machine. It first requires at least one source byte, validates the compact payload length against `multiplayer_gamespy_server_descriptor_query_minimum_fixed_compact_header_byte_count` `0x58fe20`, the optional inline keyed-property vector validator `0x58fe90`, and the optional signed string-pair tail validator `0x58fe50`, then pre-parses the primary endpoint tuple through `0x58ff20`. When those prechecks succeed it allocates one fresh descriptor through `multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record` `0x58d5b0`, rejects the special global record through `multiplayer_gamespy_server_descriptor_matches_special_global_record` `0x58d680`, decodes the compact header and property payload through `multiplayer_gamespy_server_descriptor_decode_compact_header_and_property_payload` `0x58ff60` with decode mode `1`, and appends the surviving record through `0x590370`. The return split is tighter now too: malformed or undersized payloads return `0`, the special global record returns `-1`, and successful decode returns the compact payload byte count consumed by `0x58ff60`. Unlike the keyed upsert lane at `0x590d00`, this path always allocates a fresh descriptor once the prechecks pass.","objdump + caller inspection + compact-descriptor correlation + return-code correlation + route-callback-receive correlation"
0x00590540,95,multiplayer_route_callback_runtime_acquire_shared_string_copy,shell,cdecl,inferred,objdump,3,"Acquires one refcounted shared string copy for the route-callback-table runtime. It lazily initializes the global shared-string pool through `0x58d6a0`, probes that pool by exact string through `0x58f9c0`, increments the stored refcount and returns the pooled string pointer on hit, and otherwise duplicates the caller string through `0x58f4a0` and inserts a new `{string, refcount=1}` pair through `0x58f920`. Current grounded callers are the route-callback receive/decode state machine `0x5908c0`, which uses this helper while materializing schema-owned dictionary strings.","objdump + caller inspection + shared-string-pool correlation"
0x005905a0,58,multiplayer_route_callback_runtime_release_shared_string_copy,shell,cdecl,inferred,objdump,3,"Releases one refcounted shared string copy from the route-callback-table runtime. It probes the global shared-string pool through `0x58d6a0/0x58f9c0`, decrements the stored refcount on hit, and removes the backing entry through `0x58f970` once the refcount reaches zero. Current grounded callers are the runtime teardown helpers `0x5906f0` and `0x5906c1` beneath the route-callback-table family.","objdump + caller inspection + shared-string-pool correlation"
0x005905e0,194,multiplayer_transport_route_callback_table_construct,shell,cdecl,inferred,objdump,3,"Constructs one transport-owned route callback table runtime. The helper seeds table state to `1`, clears the intrusive-head slot at `[this+0x5bc]`, copies three caller strings into local buffers `[this+0x0c]`, `[this+0x2c]`, and `[this+0x4c]`, stores the owner callback and cookie at `[this+0x480]/[this+0x484]`, seeds default strings at `[this+0x488]` and `[this+0x49c]`, zeroes staged companion fields `[this+0x490]/[this+0x494]`, resets live socket and receive-buffer state at `[this+0x4a0]`, `[this+0x74]`, and `[this+0x78]`, stores the caller schema or descriptor owner pointer at `[this+0x4a8]`, and initializes the decoded schema dictionary lanes rooted at `[this+0x08]` and `[this+0x478/0x47c]`. The owner callback lane is now tighter too: current grounded later users invoke `[this+0x480]` with mode `0` from append-notify `0x590370`, mode `1` from compact upsert `0x590d00`, mode `2` from remove-notify `0x590430`, and modes `6/5/3` from the live receive/decode state machine `0x5908c0`. Current grounded callers are the callback-table initialization paths under `0x590ed0` and the larger transport table bring-up family.","objdump + caller inspection + route-callback-table correlation + owner-mode correlation"
0x005906b0,53,multiplayer_transport_route_callback_table_release_schema_shared_string_slots,shell,cdecl,inferred,objdump,3,"Releases the table-local shared schema-string slot array rooted at `[this+0x7c]` with live count `[this+0x478]`. It walks each stored shared-string pointer through `multiplayer_route_callback_runtime_release_shared_string_copy` `0x5905a0` and then clears the live count back to zero. Current grounded callers are the broader live-route reset helper `0x590740` and the decode-side teardown paths that abandon schema materialization midstream.","objdump + local disassembly + caller inspection + shared-string-slot correlation"
0x005906f0,68,multiplayer_transport_route_callback_table_release_decoded_schema_dictionary,shell,cdecl,inferred,objdump,3,"Releases the decoded schema-dictionary runtime rooted at `[this+0x08]` for one route callback table. It walks every stored shared-string pointer through the collection at `[this+0x08]`, releases each one through `multiplayer_route_callback_runtime_release_shared_string_copy` `0x5905a0`, destroys the backing collection through `0x59e330`, and clears the owner slot afterward. Current grounded callers are the larger route-callback receive/decode and teardown paths.","objdump + caller inspection + route-callback-table correlation"
0x00590740,84,multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime,shell,cdecl,inferred,objdump,3,"Resets the live route and decode-side runtime for one route-callback table without destroying the outer table object. It frees the staged receive buffer at `[this+0x74]`, closes the live route handle at `[this+0x4a0]` when present, restores table state to sentinel `1`, releases the decoded schema dictionary through `multiplayer_transport_route_callback_table_release_decoded_schema_dictionary` `0x5906f0`, resets schema companion field `[this+0x47c]` to `-1`, and releases the table-local shared schema-string slots through `multiplayer_transport_route_callback_table_release_schema_shared_string_slots` `0x5906b0`. Current grounded callers are the disconnect-publication helper `0x590ea0`, the one-shot resend wrapper `0x5912c0`, and the broader destroy path `0x5907a0`.","objdump + local disassembly + caller inspection + route-callback-table correlation"
0x005907a0,43,multiplayer_transport_route_callback_table_destroy_runtime_and_release_descriptor_collection,shell,cdecl,inferred,objdump,3,"Destroys the full route-callback-table runtime. It first resets the live route and decode-side state through `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740`, then releases the active descriptor collection through `0x5904d0`, performs one remaining shared multiplayer cleanup call through `0x58d0a0`, destroys the backing descriptor vector at `[this+0x04]` through `0x59e330` when present, and clears that owner slot afterward. Current grounded callers are the larger transport teardown lanes and the auxiliary capacity-descriptor cache cleanup family.","objdump + local disassembly + caller inspection + route-callback-table correlation + descriptor-collection correlation"
0x005908c0,804,multiplayer_transport_route_callback_table_service_receive_decode_state_machine,shell,cdecl,inferred,objdump,3,"Services the live receive/decode state machine for one transport-owned route callback table using staged buffer `[this+0x74]/[this+0x78]` and state dword `[this+0x5b8]`. The current bounded model is: state `0` validates the leading route companion header, stores the first dword into `[this+0x490]`, stores the first word or sentinel into `[this+0x498]`, publishes owner callback mode `6` with the special global descriptor `0x00db8b4c` plus cookie `[this+0x484]`, and when the trailing token path succeeds also publishes owner callback mode `5` with that same special global descriptor before either entering a terminal route-mode branch or continuing into schema decode; states `1..3` build the table-owned descriptor schema and shared-string dictionaries under `[this+0x08]` and `[this+0x7c..]` through `0x59e0b0`, `0x590540`, and `0x59e4d0`; and state `4` repeatedly hands the remaining compact payload stream to `multiplayer_gamespy_server_descriptor_collection_append_decoded_compact_payload_if_new` `0x5907d0` until the staged receive buffer is exhausted. Decode failures return `5`, while the explicit compact-payload failure tail publishes owner callback mode `3` with that same special global descriptor before advancing the staged-buffer pointers and leaving the remaining byte count back in `[this+0x78]`. Current grounded caller is `multiplayer_transport_service_route_callback_table_once` `0x591290` in table states `2/3`.","objdump + caller inspection + route-callback-table correlation + compact-descriptor correlation + owner-mode correlation"
0x00590c00,192,multiplayer_transport_route_callback_table_rebuild_decoded_schema_dictionary_from_counted_string_payload,shell,cdecl,inferred,objdump,4,"Rebuilds the decoded schema dictionary rooted at `[this+0x08]` from one counted string payload. The helper reads the leading entry count byte, releases any existing dictionary through `multiplayer_transport_route_callback_table_release_decoded_schema_dictionary` `0x5906f0`, allocates a fresh `0x08`-stride collection through `0x59e0b0`, and then walks that many payload entries as `{ selector byte, NUL string }` pairs. Each string is validated through `memory_query_bounded_nul_terminated_byte_span_length` `0x58fb10`, interned through `multiplayer_route_callback_runtime_acquire_shared_string_copy` `0x590540`, and inserted into the new dictionary through `0x59e4d0` together with the preceding selector byte. Success returns `0`, malformed payload returns `4`, and collection allocation failure returns `5`. Current grounded caller is the live route decode service `0x5911e0` on its subtype-`1` frame branch.","objdump + local disassembly + caller inspection + schema-dictionary correlation + return-code correlation"
0x00590cd0,42,multiplayer_transport_route_callback_table_remove_descriptor_by_primary_endpoint_payload,shell,cdecl,inferred,objdump,3,"Removes one active descriptor from the route-callback table by primary endpoint tuple carried in a fixed six-byte payload. When the payload is at least `{ ipv4 dword, port word }`, the helper looks up the matching descriptor through `multiplayer_gamespy_server_descriptor_collection_find_by_primary_ipv4_and_port` `0x5903a0` and, on hit, removes it through `multiplayer_gamespy_server_descriptor_collection_remove_index_notify_owner_and_stage_intrusive_link` `0x590430`. Short payloads return `4`; otherwise the helper returns `0` whether or not a match was found. Current grounded caller is the live route decode service `0x5911e0` on its subtype-`4` frame branch.","objdump + local disassembly + caller inspection + descriptor-remove correlation + return-code correlation"
0x00590ea0,34,multiplayer_transport_route_callback_table_publish_disconnect_and_reset,shell,cdecl,inferred,objdump,3,"Publishes one route-callback-table disconnect event and then tears the live route side down. It invokes the owner callback at `[this+0x480]` in mode `4`, passing the special global descriptor at `0x00db8b4c` plus cookie `[this+0x484]`, and then tails into the broader table reset helper `0x590740`. Current grounded callers are the state-`2/3` receive-service helper `0x5911e0`, the connect-or-send wrapper `0x5912c0`, and failure paths beneath the route-table open helper `0x590ed0`.","objdump + caller inspection + route-callback-table correlation + owner-callback correlation"
0x00590ed0,531,multiplayer_transport_route_callback_table_open_live_route_stage_initial_request_and_seed_receive_state,shell,cdecl,inferred,objdump,4,"Opens or reopens the live route side for one transport-owned callback table. The helper first bounds both caller-supplied route-name strings to `0x100` bytes, defaulting null inputs to the shared empty string `0x005c87a8`; overlong names return `6`. It then stores the caller route-mode or flag dword into `[this+0x5b4]`, resets the local request builder, seeds the staged request with fixed selector bytes `2`, `1`, and `3`, appends the schema or descriptor owner pointer at `[this+0x4a8]`, the table-local route labels at `[this+0x0c]` and `[this+0x2c]`, the local send-buffer label band rooted at `[this+0x6c]`, the caller route strings, the host-order route scalar converted through `htons`, and two optional branches gated by `[this+0x5b4]` bit `0x08` and the sign bit. It then sends that staged request through the live route handle at `[this+0x4a0]` via `0x5b3216`; send failure tears the live route side back down through `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740` and returns `3`. On success it sets table state to `3`, clears decode-substate `[this+0x5b8]`, ensures the staged receive buffer at `[this+0x74]` is allocated at `0x1000` bytes, and zeroes the staged receive count `[this+0x78]`; receive-buffer allocation failure returns `5`. Current grounded callers are the reconnect wrapper `0x5912c0`, the direct `gsi_am_rating` upsert path `0x591330`, and the larger transport-owned route bring-up paths around `0x5964e1` and `0x59655f`.","objdump + caller inspection + route-callback-table correlation + live-route-handle correlation + caller correlation + request-builder correlation + return-code correlation"
0x005911e0,332,multiplayer_transport_route_callback_table_service_live_socket_and_dispatch_framed_subtypes,shell,cdecl,inferred,objdump,4,"Services one open route-callback-table socket in states `2/3`. It polls the live route handle at `[this+0x4a0]`, reads newly available bytes into the staged receive buffer `[this+0x74]/[this+0x78]` through `0x5b321c`, grows that backing buffer through `0x59e750` when needed, and once at least one full framed record is buffered it dispatches on subtype byte `[frame+0x02]`: subtype `1` rebuilds the decoded schema dictionary through `0x590c00`, subtype `2` upserts one compact descriptor through `0x590d00`, subtype `3` forwards the raw frame payload back through the live route handle with `0x5b3216`, and subtype `4` removes one descriptor by primary endpoint through `0x590cd0`. After each completed frame it compacts any unconsumed tail back to the start of the staging buffer. Closure, malformed framing, or decode failure tears the route side down through `multiplayer_transport_route_callback_table_publish_disconnect_and_reset` `0x590ea0`. Current grounded caller is `multiplayer_transport_service_route_callback_table_once` `0x591290` for table states `2/3`.","objdump + caller inspection + route-callback-table correlation + staged-buffer correlation + subtype-switch correlation"
0x00590dc0,155,multiplayer_transport_primary_endpoint_table_seed_from_raw_endpoint_list,shell,cdecl,inferred,objdump,3,"Rebuilds the transport-owned primary-endpoint table from the raw endpoint list exposed by the live route handle at `[this+0x4a0]`. It first probes list availability through `0x58f4e0`, then repeatedly reads one endpoint tuple through `0x58bc7e` record type `0x1f3`, skips tuples already present in the table through `multiplayer_gamespy_server_descriptor_collection_find_by_primary_ipv4_and_port` `0x5903a0`, allocates fresh descriptor records through `multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record` `0x58d5b0`, rejects one special global descriptor through `0x58d680`, then stamps descriptor flag byte `[entry+0x15]` with `0x11` and inserts the surviving record into the table through `0x590370`. That makes this the strongest current source-side writer for header bit `0x1`, and it also ties bit `0x10` to the same source-header family later decoded as the inline primary-port-present branch in `0x58ff20/0x58ff60`. Current grounded caller is the recurring table service helper `0x591290` when the table sits in state `0`.","objdump + local disassembly + caller inspection + endpoint-table correlation + header-flag correlation + compact-header correlation"
0x0058ff60,432,multiplayer_gamespy_server_descriptor_decode_compact_header_and_property_payload,shell,cdecl,inferred,objdump,3,"Decodes one compact server-descriptor header and trailing property payload into the caller descriptor record. The helper copies the source header byte into descriptor flag byte `[entry+0x15]` through `0x58d630`, then conditionally consumes endpoint and scalar fields according to header bits `0x02`, `0x08`, `0x10`, `0x20`, `0x40`, and signed bit `0x80`. Current grounded split is tighter now: the primary IPv4 dword is always present immediately after the header byte; bit `0x10` only marks the inline primary port word branch, otherwise the helper falls back to the owner default port at `[caller+0x498]`; bit `0x02` supplies the secondary IPv4 dword; bit `0x20` supplies the paired secondary port word, otherwise the helper again falls back to the owner default port; bit `0x08` supplies one still-unresolved auxiliary dword through `[entry+0x10]`; bit `0x40` enables one inline keyed-property vector decoded through `0x59e110/0x59e120` plus the property-store writers rooted at `0x58d0f0` and `0x58d130`, after which the helper ORs descriptor state byte `[entry+0x14]` with bit `0x1`; and signed bit `0x80` enables one trailing NUL-terminated string-pair tail decoded through repeated `0x58d0f0` stores, after which the helper ORs state byte `[entry+0x14]` with bit `0x2`. Current grounded callers are the larger compact decode paths at `0x5907d0` and `0x590d00`. This remains the strongest proof that byte-`0x15` bit `0x1` is a source-side descriptor header bit rather than a queue-generated flag.","objdump + caller inspection + compact-decode correlation + header-flag correlation + secondary-endpoint correlation + state-byte correlation"
0x00590d00,184,multiplayer_transport_upsert_compact_descriptor_by_primary_endpoint_and_notify_owner_mode1,shell,cdecl,inferred,objdump,4,"Owner-side keyed compact descriptor update path above the primary-endpoint table. It first pre-parses the compact primary endpoint tuple through `0x58ff20`, looks for an existing descriptor by primary IPv4 and port through `multiplayer_gamespy_server_descriptor_collection_find_by_primary_ipv4_and_port` `0x5903a0`, and then either reuses that record through `0x590480` or allocates one fresh record through `multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record` `0x58d5b0`. Fresh allocation still rejects the special global record through `multiplayer_gamespy_server_descriptor_matches_special_global_record` `0x58d680` before decode. The surviving descriptor is then updated in place through `multiplayer_gamespy_server_descriptor_decode_compact_header_and_property_payload` `0x58ff60` with decode mode `0`; new records are appended through `0x590370`, while reused records stay in place and skip the append lane. The helper always publishes owner callback mode `1` at `[this+0x480]` with the updated descriptor plus cookie `[this+0x484]`. The current capacity-descriptor owner `0x595bc0` sharpens that split further: mode `1` is a no-op there, so this path refreshes the live descriptor family without emitting one opcode-`2` capacity record. Current return behavior is also tighter now: decode failure returns `4`, special-global fresh allocation returns `5`, and success returns `0`.","objdump + caller inspection + compact-descriptor correlation + owner-callback correlation + capacity-owner-mode correlation + return-code correlation"
0x00591290,43,multiplayer_transport_service_route_callback_table_once,shell,cdecl,inferred,objdump,3,"Shared recurring service helper for one transport-owned route callback or descriptor table. It first clears the staged intrusive descriptor list at `[this+0x5bc]` through `multiplayer_transport_route_callback_table_release_staged_intrusive_descriptor_list` `0x590490`, then switches on table state dword `[this+0x00]`: state `0` seeds the primary-endpoint side through `multiplayer_transport_primary_endpoint_table_seed_from_raw_endpoint_list` `0x590dc0`; states `2` and `3` service the live receive path rooted at socket `[this+0x4a0]` by appending new bytes into the staging buffer at `[this+0x74]/[this+0x78]`, growing the backing buffer through `0x59e750` when needed, and invoking the heavier decode state machine `0x5908c0` once buffered data is available in state `3`; other states return immediately. Receive failure or closure tears the live route side down through `0x590ea0` and returns status `3`. Current grounded caller is `multiplayer_transport_service_route_callback_tables` `0x596210`, which uses this helper on the route tables at `[transport+0xba4]`, `[transport+0x1164]`, and `[transport+0x18bc]`.","objdump + caller inspection + route-table-service correlation + intrusive-list correlation"
0x005912c0,108,multiplayer_transport_route_callback_table_send_payload_with_one_reopen_retry,shell,cdecl,inferred,objdump,3,"Attempts one outbound send on the live route handle at `[this+0x4a0]` and performs at most one full reopen retry on failure. It forwards the caller payload pointer and byte count into `0x5b3216`; if that first send fails it resets the live route side through `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740`, reopens the route through `multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state` `0x590ed0` in mode `2`, retries the same send once, and on persistent failure publishes disconnect plus reset through `multiplayer_transport_route_callback_table_publish_disconnect_and_reset` `0x590ea0`. Current grounded callers are the keyed primary-endpoint upsert lane `0x591330` and the direct route-send family under the callback-table transport block.","objdump + local disassembly + caller inspection + route-send correlation"
0x00591330,96,multiplayer_transport_primary_endpoint_table_upsert_descriptor_by_primary_ipv4_and_port,shell,cdecl,inferred,objdump,3,"Upserts one compact descriptor record into the `gsi_am_rating` primary-endpoint table rooted at `[transport+0x18bc]`. When the table is still in sentinel state `1` it first reinitializes it through `0x590ed0` mode `2`; afterward it converts the caller host-order port through `0x58bc5a`, builds a 9-byte stack record with tag byte `1`, primary IPv4 dword, and primary port word, and forwards that record into `0x5912c0` for keyed insertion or replacement. Current grounded caller is `multiplayer_transport_dispatch_am_rating_route_event_mode` when descriptor flag byte `0x15` bit `0x1` is clear.","objdump + caller inspection + endpoint-table correlation"
0x005913f0,25,generic_callback_invoke_record2_and_trailing_context,support,cdecl,inferred,objdump,2,"Small callback-marshaling helper over one outer wrapper whose field `[record+0x10]` points at a two-dword inner payload and whose field `[record+0x0c]` carries one trailing context scalar. It pushes `(inner[0], inner[1], outer[0x0c])` into the callback at `[record+0x08]` with callback context `[record+0x04]`. Current evidence only bounds the record shape, not a more specific subsystem owner.","objdump + local disassembly"
0x00591410,85,generic_record_0x1c_deep_copy_with_owned_string_at_0x08,support,cdecl,inferred,objdump,2,"Deep-copies one `0x1c`-byte record whose fields are `u32` at `+0x00/+0x04/+0x0c/+0x10/+0x14/+0x18` plus one owned string pointer at `+0x08`. It copies the scalar fields verbatim, duplicates the optional string through `0x58f4a0`, and returns failure only when the source string is nonnull and duplication fails. Current evidence now makes this one of the generic preservation helpers that can carry descriptor-adjacent payload fields such as a copied `+0x10` scalar without interpreting them.","objdump + local disassembly + preservation-path correlation"
0x00591480,45,generic_callback_invoke_record7_and_trailing_context,support,cdecl,inferred,objdump,2,"Small callback-marshaling helper over one outer wrapper whose field `[record+0x10]` points at a seven-dword inner payload and whose field `[record+0x0c]` carries one trailing context scalar. It pushes `(inner[0..6], outer[0x0c])` into the callback at `[record+0x08]` with callback context `[record+0x04]`. Current evidence only bounds the record shape, not a more specific subsystem owner.","objdump + local disassembly"
0x005914b0,69,generic_record_0x14_deep_copy_with_owned_string_at_0x00,support,cdecl,inferred,objdump,2,"Deep-copies one `0x14`-byte record whose leading field `+0x00` is an owned string pointer and whose remaining fields at `+0x04/+0x08/+0x0c/+0x10` are copied verbatim. It duplicates the optional leading string through `0x58f4a0` and fails only when that duplication is required but returns null.","objdump + local disassembly"
0x00591510,37,generic_callback_invoke_record5_and_trailing_context,support,cdecl,inferred,objdump,2,"Small callback-marshaling helper over one outer wrapper whose field `[record+0x10]` points at a five-dword inner payload and whose field `[record+0x0c]` carries one trailing context scalar. It pushes `(inner[0..4], outer[0x0c])` into the callback at `[record+0x08]` with callback context `[record+0x04]`. Current evidence only bounds the record shape, not a more specific subsystem owner.","objdump + local disassembly"
0x00592710,31,multiplayer_transport_invoke_bound_route_callback_if_present,shell,thiscall,inferred,objdump + local disassembly + caller xrefs,3,"Small bound-route callback bridge over current route binding `[this+0x1ec8]`. When the bound route exists and its callback vtable slot pointer at `[binding+0x14]` is nonnull, the helper loads companion argument `[binding+0x18]`, calls that callback with the same binding object plus the companion argument, and returns the callback result in `EAX`; otherwise it returns `0`. Current grounded caller is `multiplayer_transport_check_capacity_and_optionally_invoke_bound_route_callback` `0x595d60`, where success on the descriptor-capacity path immediately falls into this bound-route callback handoff.","objdump + local disassembly + caller xrefs + route-binding-callback correlation"
0x00592730,26,multiplayer_transport_release_active_opcode_record_payload_and_stage_object,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Release callback for one active opcode record in the collection rooted at `[this+0x17fc]`. It dispatches the record type dword `[entry+0x00]` through the opcode-specific cleanup table at `0x005e2008`, passing payload pointer `[entry+0x10]`, and then releases that same staged object through `0x58f3c0`. Current grounded caller is the generic collection constructor `0x592750`, which installs this helper as the element destroy callback for the active opcode-record family.","objdump + local disassembly + caller inspection + active-opcode-collection correlation + opcode-table correlation"
0x00592750,67,multiplayer_transport_construct_active_opcode_record_collection_and_reset_counters,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Constructor-side helper for the active opcode-record family rooted at `[this+0x17fc]`. It zeroes the three surrounding counters at `[this+0x1800]`, `[this+0x1804]`, and `[this+0x1808]`, then allocates one `0x1c`-stride generic collection through `0x59e0b0` using release callback `0x592730`, stores the resulting root at `[this+0x17fc]`, and returns boolean success. Current grounded caller is the outer transport constructor `multiplayer_transport_construct_and_zero_runtime_fields` `0x58dc50`, while the paired destroy path is `0x5927a0` from the final transport teardown owner.","objdump + local disassembly + caller inspection + active-opcode-collection correlation + constructor-layout correlation"
0x005927a0,15,multiplayer_transport_destroy_active_opcode_record_collection,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Destroy-side helper for the active opcode-record collection rooted at `[this+0x17fc]`. When that root is nonnull it forwards the collection into `0x59e330`; otherwise it returns immediately. Current grounded caller is the final outer transport destroy owner `0x58d8a0`.","objdump + local disassembly + caller inspection + active-opcode-collection correlation + final-destroy correlation"
0x005927b0,77,multiplayer_transport_service_and_retire_nth_active_opcode_record,shell,cdecl,inferred,objdump,3,"Services one active opcode record by ordinal from the collection rooted at `[this+0x17fc]`. It marks the selected record busy at `+0x18`, increments in-flight counter `[this+0x1808]`, dispatches through the opcode-specific service callback table rooted at `0x005e200c`, then clears the busy flag, decrements `[this+0x1808]`, increments completed count `[this+0x1804]`, and removes the serviced record from the active collection through `0x59e3d0`.","objdump + local disassembly + opcode-table correlation + active-collection correlation"
0x00592800,147,multiplayer_transport_remove_active_opcode_records_by_context_or_idle,shell,cdecl,inferred,objdump,3,"Removes records from the active opcode-record collection rooted at `[this+0x17fc]`. With `EDX != -1` it scans for records whose dword field `+0x14` matches the requested context id or whose opcode type dword at `+0x00` is `0x17`, then retires them through `multiplayer_transport_service_and_retire_nth_active_opcode_record` `0x5927b0`. With `EDX == -1` it instead retires every non-busy record whose in-flight flag at `+0x18` is clear.","objdump + local disassembly + active-collection correlation + immediate-drain correlation"
0x005928a0,189,multiplayer_transport_enqueue_opcode_record,shell,cdecl,inferred,ghidra-headless,3,Common allocator and queue-submit helper for session-event transport opcode records. It allocates a zeroed caller-sized record through tracked_heap_alloc_with_header invokes the opcode-specific initializer from the handler table at 0x005e2004 plus opcode times 0x10 packages the resulting payload together with caller metadata into 0x0059e4d0 and increments [this+0x1800] on success. Allocation or initializer failure releases the temporary record through tracked_heap_free_with_header and returns -1.,ghidra + rizin + llvm-objdump
0x005929a0,69,multiplayer_transport_remove_active_opcode_records_by_type,shell,cdecl,inferred,objdump,3,"Removes active opcode records of one requested type from the collection rooted at `[this+0x17fc]`. It walks the live records in reverse ordinal order, compares opcode dword `+0x00` against the requested type in `EBX`, and removes each match through `0x59e3d0`. Current grounded caller `multiplayer_transport_clear_progress_field_cache` `0x595b80` uses it with opcode type `3`, which corrects that helper as an active field-snapshot cleanup rather than a queued-work sweep.","objdump + local disassembly + caller inspection + active-collection correlation"
0x005929f0,78,multiplayer_transport_remove_active_field_snapshot_records_by_callback_pair,shell,cdecl,inferred,objdump,3,"Removes active field-snapshot opcode records keyed by one subscribed callback pair. It walks the active opcode-record collection at `[this+0x17fc]` in reverse ordinal order, filters for opcode type `3`, resolves the opcode payload pointer at record `+0x10`, and removes records whose payload dword `+0x04` matches the requested callback or context dword in `EBX`. Current grounded caller `multiplayer_transport_enqueue_field_snapshot_record` `0x592b50` uses it before building a fresh opcode-`3` snapshot entry.","objdump + local disassembly + caller inspection + opcode-3 correlation + active-collection correlation"
0x00592970,41,multiplayer_transport_active_opcode_record_collection_lacks_context_id,shell,thiscall,inferred,objdump + caller inspection,2,"Predicate over the active opcode-record collection rooted at `[this+0x17fc]`. It performs a comparator-driven collection search through `0x59e420` using comparator `0x592960`, which orders records by dword field `+0x14`, and returns `1` only when no active opcode record carries the requested context id. Current grounded caller is the immediate-drain completion gate `0x58d720`, so current evidence now bounds active field `+0x14` specifically as the active-side mirror of the shared drain context id seeded by `0x5934c0`.","objdump + caller inspection + collection-search correlation + immediate-drain correlation"
0x00592a40,40,multiplayer_transport_dispatch_callback_table_binding,shell,cdecl,inferred,objdump + local disassembly,2,"Small deferred callback-trigger wrapper over `multiplayer_transport_enqueue_opcode_record` using explicit opcode `1` (table slot `0`) and payload size `0x04`. The opcode-`1` constructor at `0x5913a0` is a no-op, so this wrapper is not the real 0x08-byte binding-record builder; it instead stages one tiny callback trigger record whose active-side service lands in `0x5913c0`. Current grounded callback-table callers still show the replay-side triplet feeding this lane as `(first staged metadata dword duplicated in work `+0x0c/+0x10`, second staged metadata dword in `+0x18`)`, with the incoming `EDX` mode or status carried separately into the queued record.","objdump + local disassembly + opcode-table correction + callback-triplet correlation"
0x00592a70,109,multiplayer_transport_probe_or_enqueue_route_record,shell,cdecl,inferred,ghidra-headless,2,"Small route-probe or deferred route-record wrapper over `multiplayer_transport_enqueue_opcode_record`. It first calls `multiplayer_transport_is_route_mode_active_nonterminal` and when that succeeds with caller mode `2` directly invokes the supplied callback; otherwise it falls back to an 0x08-byte opcode-`1` record built from the caller callback and payload fields. Current grounded callers now show the staged work-record triplet more concretely as `(callback fn @ +0x10, callback companion @ +0x18, drain context id @ +0x0c)` with extra route-mode control bytes layered on top, and the final dword again aligned to the shared `0x5934c0`-seeded drain context used by the deferred path.","ghidra + rizin + llvm-objdump + local disassembly + callback-triplet correlation"
0x00592ae0,111,multiplayer_transport_enqueue_descriptor_block_record,shell,cdecl,inferred,objdump + local disassembly,3,"Copies one caller-supplied seven-dword descriptor-block payload into a local `0x1c` buffer and enqueues it through `multiplayer_transport_enqueue_opcode_record` `0x5928a0` as opcode `2`. The deeper opcode-`2` initializer family rooted at `0x591410/0x591470/0x591480` now bounds that payload more tightly: it stores dwords `+0x00/+0x04/+0x0c/+0x10/+0x14/+0x18` verbatim and duplicates the optional string pointer at `+0x08` into owned heap storage. Current grounded callers are now broader than the earlier callback-registration-only note: the helper is also the enqueue tail beneath `multiplayer_transport_enqueue_capacity_descriptor_record` `0x595bc0`, where live mode supplies a populated descriptor payload but replay modes `3/5` intentionally pass an all-zero seven-dword payload while reusing separate sidecar metadata slots from the cached work record.","objdump + local disassembly + opcode-record table correlation + descriptor-block initializer correlation + capacity-descriptor correlation"
0x00592b50,226,multiplayer_transport_enqueue_field_snapshot_record,shell,cdecl,inferred,ghidra-headless,3,"Builds and enqueues one field-snapshot transport record through `multiplayer_transport_enqueue_opcode_record` using opcode `3` and a `0x14`-byte payload. Depending on the caller mode it can first remove prior matching entries through `0x5929f0`, then normalizes the `hostname` field against `(No Name)`, samples the `gamemode` field and compares it against `openstaging`, computes one 0-to-100 progress percentage from cached progress slot `[this+0x1774]` plus counters `[this+0x1734]` and `[this+0x1740]` and the current active descriptor count under `[this+0xba4]`, and packages the subscribed callback pointers from `[this+0x176c]` and `[this+0x1770]`. Current grounded caller `0x596500` seeds `[this+0x1774]` to `1` immediately before the first mode-`3` snapshot under `multiplayer_transport_open_field_subscription_route_callback_table` `0x5962e0`.","ghidra + rizin + llvm-objdump + strings + local disassembly + caller inspection"
0x00593330,57,multiplayer_transport_construct_transient_work_record_collection,shell,thiscall,inferred,objdump + local disassembly,3,"Constructs the transient transport work-record collection at `[this+0x1780]`. It clears the queued and completed counters `[this+0x1784]` and `[this+0x1788]`, allocates one vector-like owner through `0x59e0b0` using cleanup shim `0x5932f0`, stores the resulting collection root at `[this+0x1780]`, and returns success when that root is nonnull.","objdump + local disassembly + work-queue correlation"
0x00593370,16,multiplayer_transport_clear_transient_work_record_collection,shell,thiscall,inferred,objdump + local disassembly,2,"Thin clearer for the transient transport work-record collection rooted at `[this+0x1780]`. When that collection exists it tailcalls the generic clear helper `0x59e4b0`; otherwise it returns immediately.","objdump + local disassembly + work-queue correlation"
0x00593380,30,multiplayer_transport_destroy_transient_work_record_collection,shell,thiscall,inferred,objdump + local disassembly,2,"Destructor-side helper for the transient transport work-record collection rooted at `[this+0x1780]`. When the collection exists it destroys that vector owner through `0x59e330`, then clears `[this+0x1780]` to null.","objdump + local disassembly + work-queue correlation"
0x005933a0,83,multiplayer_transport_remove_queued_work_record_by_pointer,shell,thiscall,inferred,objdump + local disassembly,3,"Scans the transient transport work-record collection at `[this+0x1780]` for one exact record-pointer match and removes that vector slot through `generic_vector_remove_index` `0x59e3d0`. Successful removal also increments the released-or-completed work counter at `[this+0x1788]`. Current grounded callers include the callback-table binding result helper `0x593570`, route-binding release `0x595620`, and the names or bound-route or selector-text completion lanes when they drop stale or finished work records.","objdump + local disassembly + caller inspection + work-queue correlation"
0x00593400,90,multiplayer_transport_queued_work_collection_lacks_context_id,shell,thiscall,inferred,objdump + local disassembly,2,"Predicate over the same transient work-record collection at `[this+0x1780]`. It returns `1` when no queued work record carries the requested dword context id in field `+0x0c`, and returns `0` on the first match. Current grounded caller is the small transport gate at `0x58d720`, which uses this uniqueness test immediately before `0x592970`; that now bounds queued field `+0x0c` specifically as the queued-side mirror of the shared drain context id seeded by `0x5934c0`.","objdump + local disassembly + caller inspection + work-queue correlation + immediate-drain correlation"
0x00592c40,54,multiplayer_transport_enqueue_callback_binding_record,shell,cdecl,inferred,objdump + local disassembly,2,"Builds and enqueues one `0x08`-byte explicit opcode-`5` callback-binding record through `multiplayer_transport_enqueue_opcode_record` `0x5928a0`. The helper stages a local two-dword payload from `(incoming EDX, first stack dword)`, uses that local payload as the deep-copy source for the opcode-`5` family `0x591540/0x591570/0x591580`, and carries the transport follow-on callback field `[this+0x4c]` plus the remaining caller metadata in the queued outer record. It is the real lower binding leaf beneath the worker callback shim at `0x593610`, not the earlier direct role previously attributed to `0x592a40`.","objdump + local disassembly + opcode-table correction + callback-binding correlation"
0x00592c80,80,multiplayer_transport_enqueue_callback_slot9_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x10-byte opcode `9` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x1790] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592cd0,85,multiplayer_transport_enqueue_callback_slot10_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x14-byte opcode `10` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x1794] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592d30,62,multiplayer_transport_enqueue_callback_slot11_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x04-byte opcode `11` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x1798] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592d70,77,multiplayer_transport_enqueue_callback_slot12_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that copies a caller-supplied seven-dword block and enqueues it as a 0x20-byte opcode `12` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x179c] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592dc0,72,multiplayer_transport_enqueue_callback_slot13_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `13` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a0] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592e10,72,multiplayer_transport_enqueue_callback_slot14_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x10-byte opcode `14` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a4] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592ee0,62,multiplayer_transport_enqueue_callback_slot17_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x08-byte opcode `17` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is the current-selector profile-key callback root at `0x59f8b0`, which submits one profile-key bundle and then forwards the same selector context through this owner-callback lane.","objdump + caller xrefs"
0x00592f20,69,multiplayer_transport_enqueue_callback_slot18_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `18` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b4]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`.","objdump"
0x00592f70,72,multiplayer_transport_enqueue_callback_slot19_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `19` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b8]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f850`, which resets selector-side state and then forwards the same selector-name pair through this owner-callback lane.","objdump + caller xrefs"
0x00592fc0,50,multiplayer_transport_enqueue_callback_slot20_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x04-byte opcode `20` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17bc]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`.","objdump"
0x00593000,69,multiplayer_transport_enqueue_callback_slot21_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `21` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17c0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`.","objdump"
0x00593050,77,multiplayer_transport_enqueue_callback_slot22_record,shell,cdecl,inferred,objdump,3,"Gated callback-slot wrapper that enqueues one 0x10-byte opcode `22` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17c4]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded callers are the per-key profile callback helper at `0x596970`, which forwards one selector name plus the parsed `X...X|%d` probe tuple `(request id, displayed version/build integer)` or a zeroed `(END)` sentinel payload, and the same helper's sibling path at `0x596a45`, which republishes the currently armed selector-view probe tuple.","objdump + caller xrefs"
0x005930a0,50,multiplayer_transport_enqueue_callback_slot23_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x04-byte opcode `23` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x178c]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is the callback root at `0x59f5c0`, which first arms deferred-close state at `[this+0x1edc]`.","objdump + caller xrefs"
0x005930e0,62,multiplayer_transport_enqueue_callback_slot24_record,shell,cdecl,inferred,objdump,3,"Gated callback-slot wrapper that enqueues one 0x08-byte opcode `24` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17cc]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is multiplayer_transport_commit_selector_view_refresh_probe_success, which forwards the selector-view entry pointer together with the current averaged probe sample through this owner-callback lane.","objdump + caller xrefs"
0x00593120,72,multiplayer_transport_enqueue_callback_slot25_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `25` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f560`, which first updates selector-view runtime state through `0x5948f0` and then forwards the same selector-name pair through this owner-callback lane.","objdump + caller xrefs"
0x005931b0,67,multiplayer_transport_enqueue_callback_slot27_record,shell,cdecl,inferred,objdump + local disassembly,2,"Gated callback-slot wrapper that enqueues one `0x10`-byte opcode `27` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d4]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded caller is the built-in profile-key sweep `0x596b10`, which forwards the selector-name pair that produced the first successful per-key result across the shared and slot-local callback-name stores.","objdump + local disassembly + caller inspection"
0x00593200,78,multiplayer_transport_enqueue_callback_slot28_record,shell,cdecl,inferred,objdump + local disassembly,2,"Gated callback-slot wrapper that enqueues one `0x10`-byte opcode `28` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d8]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded callers are `multiplayer_transport_callback_query_slot_built_in_profile_key_and_publish_slot28` `0x59fbd0` and its helper `0x596b90`.","objdump + local disassembly + caller inspection"
0x00592e60,64,multiplayer_transport_enqueue_callback_slot15_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x08-byte opcode `15` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a8] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592ea0,64,multiplayer_transport_enqueue_callback_slot16_record,shell,cdecl,inferred,ghidra-headless,2,"Gated callback-slot wrapper that enqueues one `0x08`-byte opcode `16` record through `multiplayer_transport_enqueue_opcode_record` when byte `[this+0x17ac]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded caller `0x59f440` forwards the staged route-callback payload handle from `[this+0xb50]` together with fixed text at `0x00db9dd8` through this lane just before `multiplayer_transport_set_route_mode` forces mode `5`, so slot `16` is no longer just an abstract callback-slot wrapper.","ghidra + rizin + llvm-objdump + caller inspection"
0x00593280,30,multiplayer_transport_enqueue_fixed_selector_0x1f_opcode16_record,shell,cdecl,inferred,objdump + local disassembly + enqueue-caller correlation,2,"Tiny queue-submit shim over `multiplayer_transport_enqueue_opcode_record` `0x5928a0`. It forwards caller payload in `EAX`, owner context `[this+0x17f8]`, fixed selector `0x1f`, queue class `1`, and opcode `0x10`, then returns the common enqueue result. Current local shape bounds this as the fixed-selector opcode-`0x10` submit lane rather than a generic route helper.","objdump + local disassembly + enqueue-caller correlation"
0x005932a0,64,multiplayer_transport_enqueue_bound_route_mode_snapshot_opcode4_if_live,shell,cdecl,inferred,objdump + local disassembly + route-mode correlation,3,"Route-mode change notification shim for the bound-route branch rooted at `[this+0x1ec8]`. When one bound route still exists and carries both callback payload pointer `[route+0x10]` and companion owner dword `[route+0x18]`, the helper snapshots the current route mode from `[this+0x18b8]` into one local dword and forwards it through `multiplayer_transport_enqueue_opcode_record` `0x5928a0` with opcode `4`, queue class `1`, fixed selector `0x21`, owner context `[this+0x17f8]`, callback payload pointer `[route+0x10]`, callback companion dword `[route+0x18]`, and route-local discriminator dword `[route+0x0c]`. If the bound route or its callback payload pointer is absent it returns without enqueuing anything. Current grounded caller is `multiplayer_transport_set_route_mode` `0x595650`, which uses this only when the stored route mode actually changes.","objdump + local disassembly + route-mode correlation + enqueue-caller correlation"
0x005932f0,56,multiplayer_transport_release_work_record_callback_payloads_and_optional_socket_handle,shell,cdecl,inferred,objdump + local disassembly + work-record lifecycle correlation,2,"Destructor-style release callback for the transport work-record family. It releases three owned callback payload pointers from fields `+0x20`, `+0x24`, and `+0x08` through `0x58f3c0`, then when presence flag `[record+0x34]` is nonzero it closes the optional socket handle in `[record+0x2c]` through `closesocket` and `0x58f490`, and finally tail-calls `0x58f3c0` on the work record object itself. Current grounded caller is the work-record collection constructor `0x593330`, which installs this as the collection release callback for records stored in `[transport+0x1780]`.","objdump + local disassembly + work-record lifecycle correlation"
0x0059f2e0,64,multiplayer_transport_is_selector_control_line,shell,cdecl,inferred,objdump,2,"Small selector-text classifier used in the second callback descriptor lane. It returns true only when the caller string is at least four bytes long and begins with `@@@` but not `@@@ `, which makes it the current gate between control-line handling and the ordinary selector-name callback lanes.","objdump + caller xrefs + strings"
0x0059f320,131,multiplayer_transport_split_selector_payload_token_and_tail,shell,cdecl,inferred,objdump,2,"Splits one selector payload string at the first space into the two shared scratch buffers `0x00db9dd0` and `0x00db9dd8`. Current grounded callers are the mode-`3/4` selector callback helpers at `0x59f650` and `0x59f720`, which use that token-plus-tail pair as the payload for callback slots `14` and `10`.","objdump + caller xrefs + strings"
0x0059f5e0,111,multiplayer_transport_sync_selector_view_nfo_r_flag,shell,cdecl,inferred,objdump,3,"Local `@@@NFO` helper shared by the selector callback lanes at `0x59f650` and `0x59f720`. It only accepts control lines ending in the literal tail `X\\`, searches the same line for the field marker `\\$flags$\\`, and then sets or clears bit `0x2` in the selector-view entry flag word at `[entry+0x64]` depending on whether the following flag segment contains the letter `r` before the next backslash. The current grounded entry gate is `[entry+0x48]`, so this path is specific to selector entries that participate in the third selector slot.","objdump + caller xrefs + strings"
0x00593460,87,multiplayer_transport_mark_selector_slot_records_stale,shell,cdecl,inferred,ghidra-headless,3,Scans the queued transport request collection at [this+0x1780] for records of type `1` or `2` whose selector-slot field at +0x1c matches the requested slot id. Matching records are marked stale by setting byte or dword field +0x38 to one. Current grounded caller is multiplayer_transport_reset_selector_slot.,ghidra + rizin + llvm-objdump
0x005934e0,130,multiplayer_transport_allocate_and_enqueue_work_record,shell,cdecl,inferred,objdump + local disassembly,3,"Allocates one zeroed `0x3c` transient transport work record and appends it into the work collection at `[this+0x1780]` when that collection exists. The helper stores the owner transport pointer at `+0x00`, caller-supplied type and metadata dwords at `+0x04`, `+0x08`, `+0x0c`, `+0x10`, and `+0x18`, clears bookkeeping field `+0x20` and stale latch `+0x38`, inserts the finished pointer through `generic_vector_push_back` `0x59e4d0`, and increments the queued-work counter `[this+0x1784]` on success. Current grounded callers include callback-table descriptor attach, bound-route request submission, selector-text route request submission, and the type-`9` text fastpath. The wider caller set now proves one stronger boundary on the metadata triplet itself: these three dwords are shared transport wrapper metadata reused across type `0/1/2/9` work records, not one capacity-only or route-only cache tuple. Current direct consumers now bound that triplet more concretely as `drain context id @ +0x0c`, deferred callback function pointer @ `+0x10`, and callback companion or context @ `+0x18`; the callback-table lane still gives the cleanest concrete subcase because it intentionally duplicates the same caller metadata dword into both `+0x0c` and `+0x18` while preserving the callback pointer in `+0x10`.","objdump + local disassembly + caller inspection + work-queue correlation + metadata-triplet correlation + cross-type work-record correlation + callback-dispatch correlation"
0x00593570,160,multiplayer_transport_publish_callback_table_binding_result_and_release_work_record,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Consumes one transient callback-table attach work record. It resolves the owner transport from work field `+0x00`, conditionally downgrades a nominal success when the current live transport probe through `0x58d7e0/0x58d810` fails, clears in-flight latch `[transport+0x44]`, and stores the final boolean result into `[transport+0x48]`. When validation fails it also clears `[transport+0x48]`, arms deferred reset latch `[transport+0x1edc]`, and still falls through into the same replay path. On the success branch it stamps the current route scalar from `0x58f450` into `[transport+0x50]`, refreshes the local transport name buffer at `[transport+0x04]` from `multiplayer_transport_query_current_local_name_or_fallback_sample` `0x58e630`, and then republishes the staged metadata triplet through `multiplayer_transport_dispatch_callback_table_binding` `0x592a40` using work fields `(callback fn +0x10, callback companion +0x18, drain context id +0x0c)` together with the final boolean result in `EDX`. The helper always finishes by unlinking the consumed work record through `multiplayer_transport_remove_queued_work_record_by_pointer` `0x5933a0`, which increments completed-work counter `[transport+0x1788]` on successful removal.","objdump + local disassembly + caller inspection + callback-binding correlation + work-queue correlation + callback-triplet correlation + opcode-table correlation"
0x00593610,25,multiplayer_transport_worker_callback_enqueue_opcode5_binding_record_from_work_triplet,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Small worker-side callback shim used by the callback-table attach owner `0x593650`. It loads the staged work-record metadata dwords at `+0x0c` and `+0x18` from the caller work record, pushes those together with the incoming callback result token, resolves the owner transport from work field `+0x00`, and then forwards the assembled triplet into `multiplayer_transport_enqueue_callback_binding_record` `0x592c40`. This is the clean enqueue-side worker callback in the attach pair chosen from transport field `[this+0x4c]`.","objdump + local disassembly + caller inspection + callback-binding correlation + work-record-triplet correlation"
0x00593630,23,multiplayer_transport_worker_callback_store_route_scalar_and_forward_into_0x597780,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Second worker-side callback shim used by the callback-table attach owner `0x593650`. It resolves the owner transport from work field `+0x00`, stores incoming scalar `EDX` into transport field `[transport+0x54]`, pushes companion dword `[transport+0x5c]`, and then forwards the caller text/buffer pointer together with that companion into `0x597780`. Current evidence grounds this as the route-scalar store plus format-or-forward sibling of `0x593610`, while the exact higher semantic role of `0x597780` remains open.","objdump + local disassembly + caller inspection + callback-binding correlation + route-scalar correlation"
0x00593790,351,multiplayer_transport_handle_names_query_response,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_names_query_with_callback. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can update route-binding state through multiplayer_transport_is_route_mode_active_nonterminal and multiplayer_transport_try_connect_status_route_once seeds selector slot `2` through multiplayer_transport_init_selector_slot upserts returned name records through multiplayer_transport_upsert_selector_name_entry publishes `TOPIC` and `MODE` lines through multiplayer_transport_publish_topic_status_line and multiplayer_transport_publish_mode_level_status_line and may promote one deferred route binding into [this+0x1ec8]. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump + strings
0x005938f0,145,multiplayer_transport_handle_bound_route_request,shell,cdecl,inferred,ghidra-headless,3,"Completion callback for `multiplayer_transport_submit_bound_route_request`. If the request is already stale at `+0x38` it just unlinks through `0x5933a0`. On nonzero result it can publish `[req+0x24]` through `multiplayer_transport_publish_mode_key_status_line` and then schedules `multiplayer_transport_handle_names_query_response` through `multiplayer_transport_submit_names_query_with_callback`. On zero result it resets selector slot `2` and falls back to `multiplayer_transport_probe_or_enqueue_route_record` using the staged work fields `(callback fn +0x10, callback companion +0x18, drain context id +0x0c)` plus the request-specific route-mode pair before unlinking the request.","ghidra + rizin + llvm-objdump + local disassembly + callback-triplet correlation"
0x00593fe0,149,multiplayer_transport_ensure_aux_selector_view_sidecar_worker_and_seed_runtime,shell,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Ensure-side owner for the auxiliary selector-view sidecar rooted at `[this+0xac8]`. The helper first compares the current status-text descriptor triplet `[this+0xad0..+0xad8]` against the fixed default three-dword block at `0x00db8ca4`; when they already match it returns success immediately without rebuilding anything. Otherwise it allocates one `0x84`-byte sidecar store through `0x58faf0` using the local callback trio `0x593db0/0x593e40/0x593ef0`, stores that root at `[this+0xae8]`, starts the companion global worker path through `0x5a0000` with selector `0x3353` and local callback `0x593fb0`, clears the sidecar-owned pointer pair `[this+0xacc]` and `[this+0xaec]`, seeds the sidecar runtime from the current tick through `0x58f450 -> 0x5a299e`, and finally sets the presence latch `[this+0xac8] = 1`. Current grounded caller is the selector-view rebuild side of `0x58d7e0`, which uses this helper after `multiplayer_transport_reset_selector_tables` and keyed-store ensure. This is therefore the current safest read for the auxiliary selector-view sidecar ensure or worker-arm owner rather than another keyed-store allocator.","llvm-objdump + local disassembly + caller correlation + selector-view-sidecar correlation"
0x00593fb0,48,multiplayer_transport_aux_selector_view_worker_probe_callback_lookup_and_commit_success,shell,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Worker callback installed by `multiplayer_transport_ensure_aux_selector_view_sidecar_worker_and_seed_runtime` `0x593fe0` into the companion global worker path `0x5a0000`. It resolves one selector-view entry through `0x594b40` using the worker-provided key data, and when a matching entry exists it forwards the returned probe sample and the resolved entry pointer into `multiplayer_transport_commit_selector_view_refresh_probe_success` `0x593f00`. Current evidence therefore bounds this as the sidecar worker's probe-result lookup-and-commit callback rather than a generic keyed-store notification shim.","objdump + local disassembly + caller correlation + selector-view-sidecar correlation"
0x00594080,71,multiplayer_transport_release_aux_selector_view_sidecar_when_unbound,shell,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Release helper for the auxiliary selector-view sidecar rooted at `[this+0xac8]`. When the sidecar-present latch `[this+0xac8]` is nonzero while the keyed selector-view store gate `[this+0xab0]` is clear, the helper clears the sidecar-owned pointer pair `[this+0xacc]` and `[this+0xaec]`, releases the owned sidecar object at `[this+0xae8]` through `0x58f8b0`, re-enters the global UDP callback-worker shutdown helper `0x5a0120`, and then clears the presence latch `[this+0xac8]`. Current grounded caller is the common runtime-reset strip `0x58d810`, where it runs between selector-view-store release and the remaining route-mode-sensitive cleanup.","llvm-objdump + local disassembly + caller correlation + selector-view-sidecar correlation"
0x00594620,106,multiplayer_transport_reset_selector_view_entry_runtime_state,shell,cdecl,inferred,objdump,2,"Clears the extended runtime fields of one selector-view entry. When the transport-side selector-view layer is present through `[this+0xac8]` it zeroes the entry block from `+0x68` through `+0xa8`, including the dirty or refresh flags at `+0xa0`, `+0xa4`, and `+0xa8`, then returns success. Current grounded caller is the selector-view snapshot export path at `0x594ee0`.","objdump"
0x00594690,76,multiplayer_transport_mark_selector_slot_views_dirty,shell,cdecl,inferred,ghidra-headless,2,"Marks one selector slot dirty in the transport-side selector-view layer rooted at `[this+0xab4]` with backing arrays around `[this+0xad0]..[this+0xae4]`. It sets slot-specific dirty bits at `+0xa0` and `+0xa4` when the matching backing arrays are populated and also sets `+0xa8` for selector slot `2`. Current grounded callers are multiplayer_transport_set_selector_slot_flags and multiplayer_transport_upsert_selector_name_entry.","ghidra + rizin + llvm-objdump"
0x005949a0,80,multiplayer_transport_ensure_selector_view_store,shell,thiscall,inferred,objdump,3,"Ensures the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it allocates a `0xac`-byte keyed container through `0x58faf0`, stores the resulting root at `[this+0xab4]`, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport setup and reset path around `0x58d7ee`.","objdump + caller xrefs"
0x005949f0,56,multiplayer_transport_release_selector_view_store,shell,thiscall,inferred,objdump,3,"Releases the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it frees the root at `[this+0xab4]` through `0x58f8b0`, clears that root, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport teardown path around `0x58d81a`.","objdump + caller xrefs"
0x00594a30,11,multiplayer_transport_remove_selector_view_entry_from_store,shell,cdecl,inferred,objdump + local disassembly,3,"Tiny selector-view store remover. It tailcalls the keyed-container erase helper `0x58f970` against the selector-view store rooted at `[this+0xab4]` using the caller entry pointer in `edx`. Current grounded callers are `multiplayer_transport_clear_selector_view_entry_slot_and_remove_if_empty` `0x594fb0` and `multiplayer_transport_rekey_selector_view_entry_preserving_slot_runtime` `0x595010`.","objdump + local disassembly + caller inspection"
0x00594a40,80,multiplayer_transport_find_selector_view_entry_by_name,shell,cdecl,inferred,objdump,3,"Looks up one selector-view entry by its bounded name string. It copies up to `0x40` bytes of the caller key into a local buffer, then probes the keyed selector-view store rooted at `[this+0xab4]` through `0x58f9c0` and returns the matching entry pointer or null. Current grounded callers include multiplayer_transport_set_selector_slot_flags, multiplayer_transport_merge_selector_mode_mask, multiplayer_transport_upsert_selector_name_entry, and several later selector-view formatting helpers.","objdump + caller xrefs"
0x00594d50,28,multiplayer_transport_selector_view_entry_slot_has_presence_mask,shell,cdecl,inferred,objdump,3,"Small selector-view predicate over one slot-local flag dword. When the requested slot has a live pointer at `[entry+0x40+slot*4]`, it returns whether the paired slot flag word at `[entry+0x5c+slot*4]` carries either presence bit `0x20` or `0x40`. Current grounded caller is multiplayer_transport_filter_insert_refreshable_selector_view_entry, which uses slot `2` to bias entry ordering and dedupe inside the periodic refreshable-entry collector.","objdump + caller xrefs"
0x00594d70,21,multiplayer_transport_selector_view_entry_has_gml_disconnect_gate,shell,cdecl,inferred,objdump,3,"Tiny selector-view predicate used only in the current grounded `GML` control path. It returns nonzero only when the selector-view entry participates in the third selector slot through `[entry+0x48]` and bit `0x20` is set in the entry flag word at `[entry+0x64]`. The current grounded caller is multiplayer_transport_handle_gml_or_png_selector_control, where it gates the `GML Disconnected` branch before the transport forces one status-pump pass, emits callback slot `16`, and re-enters route mode `5`.","objdump + caller xrefs + strings"
0x00594e30,52,multiplayer_transport_count_selector_view_entries_with_slot_flag20_and_optional_name_match,shell,cdecl,inferred,objdump + local disassembly,3,"Counts selector-view entries in the keyed store rooted at `[this+0xab4]` whose per-slot flag dword at `[entry+0x5c+slot*4]` carries bit `0x20`. When the optional caller string is nonnull it first requires that string to match the entry's leading name field through `0x5a57cf`; otherwise it counts every entry that passes the same flag test. Current grounded callers are the staged route-callback submit-result handler `0x595860` and the later selector-view decision helper at `0x59f9c0`, where both use slot `2` and the current transport name buffer at `[this+0x04]`.","objdump + local disassembly + caller inspection + selector-view-store correlation"
0x0059f5c0,20,multiplayer_transport_callback_arm_deferred_close_and_enqueue_slot23,shell,cdecl,inferred,objdump,2,"Small callback-root helper installed through the transport-side callback descriptor table at `0x59f5c0`. It takes the owner transport pointer from the first stack argument, sets deferred-close latch `[this+0x1edc]` to one, and then forwards into multiplayer_transport_enqueue_callback_slot23.","objdump + caller xrefs"
0x00594150,65,multiplayer_transport_schedule_selector_view_entry_refresh_probe,shell,cdecl,inferred,objdump,3,"Arms one deferred refresh probe for a selector-view entry when no probe is already pending at `[entry+0x74]`. It schedules callback `0x594110` after `0x1388` ms, latches the pending flag at `[entry+0x74]`, stores the current tick count at `[entry+0x68]`, and clears the entry-local transient field at `[entry+0xa8]`. The current grounded caller is the periodic selector-view service path at `0x594540`.","objdump + caller xrefs"
0x005941a0,376,multiplayer_transport_filter_insert_refreshable_selector_view_entry,shell,cdecl,inferred,objdump,3,"Store-walk callback used by the periodic selector-view service path. It filters one selector-view entry before insertion into a temporary refresh list: the entry must have local backing at `[entry+0xa0]`, live state at `[entry+0x58]`, no pending probe at `[entry+0x74]`, and no blocker at `[entry+0x4c]`; if slot pointers `[entry+0x40]`, `[entry+0x44]`, or `[entry+0x48]` are present, the corresponding slot flag words `[entry+0x5c]`, `[entry+0x60]`, and `[entry+0x64]` must not carry mask `0x0c`, which matches the `g`/`a` bits produced by multiplayer_transport_parse_selector_mode_letters. Eligible entries then pass slot-aware retry timing based on `[entry+0x68]`, `[entry+0x6c]`, `[entry+0x78]`, and `[entry+0x7c]`, after which the helper inserts the entry into the caller list while biasing third-slot entries through multiplayer_transport_selector_view_entry_slot_has_presence_mask and name comparisons.","objdump + caller xrefs + existing slot-flag map"
0x00594320,115,multiplayer_transport_collect_refreshable_selector_view_entries,shell,cdecl,inferred,objdump,3,"Collects a bounded list of refreshable selector-view entries from the keyed selector-view store rooted at `[this+0xab4]`. It clears the caller count to at most `0x0c` entries, walks the store through callback `0x5941a0`, and returns the finished temporary entry pointer list. The current grounded caller is the periodic selector-view service path at `0x594540`, which then schedules deferred refresh probes for the collected entries.","objdump + caller xrefs"
0x005940d0,61,multiplayer_transport_finish_selector_view_refresh_probe_if_matching,shell,cdecl,inferred,objdump,3,"Probe-completion callback used by the deferred selector-view refresh path. When the entry still has a pending probe at `[entry+0x74]`, live selector-view state at `[entry+0x58]`, and the callback request id matches `[entry+0x50]`, it clears the pending latch. Result `-1` increments the consecutive-failure counter at `[entry+0x7c]`; any other result forwards the returned payload pointer into multiplayer_transport_commit_selector_view_refresh_probe_success.","objdump + caller xrefs"
0x00594110,48,multiplayer_transport_dispatch_selector_view_refresh_probe_result,shell,cdecl,inferred,objdump,3,"Deferred callback shim for selector-view refresh probes. It walks the keyed selector-view store at `[transport+0xab4]` and runs multiplayer_transport_finish_selector_view_refresh_probe_if_matching against each entry using the completed request descriptor on the stack. Current grounded caller is multiplayer_transport_schedule_selector_view_entry_refresh_probe.","objdump + caller xrefs"
0x00593f00,171,multiplayer_transport_commit_selector_view_refresh_probe_success,shell,cdecl,inferred,objdump,3,"Success path for one selector-view refresh probe. It increments the probe-success generation at `[entry+0x78]`, clears the consecutive-failure counter at `[entry+0x7c]`, stamps the last-success tick at `[entry+0x6c]`, writes the returned probe sample into the rolling history at `[entry+0x84..]`, grows the bounded sample-count at `[entry+0x94]` up to four, computes the current averaged millisecond sample into `[entry+0x80]`, increments total-success count `[entry+0x98]`, and publishes that averaged `ms` value through multiplayer_transport_enqueue_callback_slot24_record.","objdump + caller xrefs"
0x00594b60,104,multiplayer_transport_arm_selector_view_probe_tracking,shell,cdecl,inferred,objdump,3,"Resolves one selector-view entry by name and arms its fast probe-tracking fields. It stores the parsed probe request id at `[entry+0x50]`, stores the parsed displayed version/build companion integer at `[entry+0x54]`, sets the live probe gate at `[entry+0x58]`, and refreshes the per-slot dirty gates at `+0xa0/+0xa4/+0xa8` for any active selector slots through multiplayer_transport_mark_selector_slot_views_dirty. Current grounded callers are the profile-key callback-table lanes around `0x596a18` and `0x59f929`, both after parsing one `X...X|%d` marker through `0x5977b0`.","objdump + caller xrefs"
0x005943a0,231,multiplayer_transport_stage_selector_view_progress_snapshot,shell,cdecl,inferred,objdump,3,"Slow selector-view sidecar helper reached from multiplayer_transport_service_selector_view_refresh_cycle after multiplayer_transport_select_stale_selector_view_progress_entry picks one candidate. It requires the entry-local progress gate at `[entry+0xa4]`, rebuilds the local core `X%sX` probe marker from request id `[entry+0x50]` through multiplayer_transport_format_selector_view_probe_marker_core, formats one `PNG %s %d` line around that marker and the averaged millisecond sample at `[entry+0x80]`, appends up to three selector-slot-specific `PNG` fragments when the corresponding slot pointers and generation counters are live, then marks the entry progress snapshot in-flight at `[entry+0x9c]` and stamps both `[entry+0x70]` and the transport-wide throttle tick `[transport+0xaec]`. Current evidence still does not show the wider `|%d` companion suffix being emitted on this path.","objdump + caller xrefs + strings + marker-format correlation"
0x00594490,83,multiplayer_transport_pick_stale_selector_view_progress_entry,shell,cdecl,inferred,objdump,3,"Store-walk callback used by multiplayer_transport_select_stale_selector_view_progress_entry. It only considers selector-view entries whose slow progress gate `[entry+0xa4]` is set, blocker `[entry+0x4c]` is clear, total-success count `[entry+0x98]` is nonzero, and in-flight progress latch `[entry+0x9c]` is clear; among those, it requires at least `0x1388` ms since the last progress tick `[entry+0x70]` and keeps the stalest candidate in the caller scratch slot.","objdump + caller xrefs"
0x005944f0,69,multiplayer_transport_select_stale_selector_view_progress_entry,shell,cdecl,inferred,objdump,3,"Walks the keyed selector-view store at `[transport+0xab4]` through callback `0x594490` and returns the stalest eligible selector-view entry for the slow progress-snapshot lane, or null when none qualify. Current grounded caller is multiplayer_transport_service_selector_view_refresh_cycle.","objdump + caller xrefs"
0x00594540,214,multiplayer_transport_service_selector_view_refresh_cycle,shell,thiscall,inferred,objdump,3,"Recurring selector-view maintenance pass beneath the multiplayer transport frame owner. When the selector-view layer is enabled and not blocked by the `g`/`a` route gates at `[this+0xb44]` and `[this+0x180c]`, it first rate-limits and runs the fast probe lane by collecting refreshable entries through multiplayer_transport_collect_refreshable_selector_view_entries and scheduling deferred probes through multiplayer_transport_schedule_selector_view_entry_refresh_probe. It then runs a slower sidecar lane every `0x7d0` ms by selecting one stale progress entry through multiplayer_transport_select_stale_selector_view_progress_entry and staging a progress snapshot through multiplayer_transport_stage_selector_view_progress_snapshot before falling into the shared timer service at `0x5a05d0`.","objdump + caller xrefs"
0x0059f3c0,498,multiplayer_transport_handle_gml_or_png_selector_control,shell,cdecl,inferred,objdump,3,"Small control-token handler reached from the slot-`25` selector-view callback lane after multiplayer_transport_split_selector_payload_token_and_tail. When the token is `GML` and the tail is `Disconnected`, it requires the current selector-view entry to pass multiplayer_transport_selector_view_entry_has_gml_disconnect_gate, then forces one status-pump pass, emits callback slot `16` with the tail text, and re-enters route mode `5`. Its sibling `PNG` branch resolves a named selector-view entry from the tail text and, when that entry overlaps the active selector-slot ownership, refreshes selector-view runtime state through `0x5948f0` and republishes callback slot `25`.","objdump + caller xrefs + strings"
0x0059f650,193,multiplayer_transport_callback_dispatch_selector_name_payload_lane,shell,cdecl,inferred,objdump,3,"Main selector-name branch in the second transport-side callback descriptor lane. It first classifies the incoming payload through multiplayer_transport_is_selector_control_line. `@@@NFO` control lines resolve one selector-view entry through multiplayer_transport_find_selector_view_entry_by_name and forward into multiplayer_transport_sync_selector_view_nfo_r_flag; non-control mode-`3/4` payloads split through multiplayer_transport_split_selector_payload_token_and_tail and publish callback slot `14`; and the remaining non-control payloads publish callback slot `13`.","objdump + caller xrefs + strings"
0x0059f720,289,multiplayer_transport_callback_dispatch_current_selector_payload_lane,shell,cdecl,inferred,objdump,3,"Sibling callback root that first resolves the current selector through `0x5951a0` and then dispatches one payload against that active selector context. It reuses multiplayer_transport_is_selector_control_line, the `@@@GML` and `@@@NFO` control tokens, and the shared token-tail splitter at `0x59f320`: `@@@NFO` lines flow into multiplayer_transport_sync_selector_view_nfo_r_flag, `@@@GML` lines plus mode-`3/4` payloads feed callback slot `10`, and the remaining non-control payloads feed callback slot `9`.","objdump + caller xrefs + strings"
0x0059f850,87,multiplayer_transport_callback_reset_selector_and_enqueue_slot19,shell,cdecl,inferred,objdump,2,"Callback-root helper from the second transport-side descriptor lane. It resolves the current selector slot through `0x5951a0`, resets that selector text path through `0x5954b0`, forwards the supplied selector-name pair through multiplayer_transport_enqueue_callback_slot19, and when the resolved selector is `2` plus route mode is still active it re-enters multiplayer_transport_set_route_mode with mode `1`.","objdump + caller xrefs"
0x00594bd0,97,multiplayer_transport_set_selector_slot_flags,shell,cdecl,inferred,ghidra-headless,3,Updates one selector-slot flag dword at [entry+0x5c] after resolving the current selector entry through 0x00594a40. When selector index `2` flips bit `1` it forwards the new bit value through multiplayer_transport_enqueue_callback_slot15_record and then notifies the shared selector-change callback path through 0x00593250 with selector id old flags and new flags.,ghidra + rizin + llvm-objdump
0x00594c40,103,multiplayer_transport_parse_selector_mode_letters,shell,cdecl,inferred,ghidra-headless,3,Parses one selector-mode letter string into a small bitmask by probing for the letters `s` `r` `g` `a` and `h`. Current grounded callers merge this mask into the selector-slot flags that live at [entry+0x5c].,ghidra + rizin + llvm-objdump + strings
0x00594cb0,65,multiplayer_transport_merge_selector_mode_mask,shell,cdecl,inferred,ghidra-headless,3,Resolves one selector entry through 0x00594a40 parses the caller mode-letter string through multiplayer_transport_parse_selector_mode_letters preserves the current presence bits 0x20 and 0x40 from [entry+0x5c] and commits the merged result through multiplayer_transport_set_selector_slot_flags.,ghidra + rizin + llvm-objdump + strings
0x00594d00,72,multiplayer_transport_set_selector_presence_mask,shell,cdecl,inferred,ghidra-headless,3,Overwrites the selector presence bits 0x20 and 0x40 in [entry+0x5c] from one caller byte mask while preserving the rest of the selector-slot flags. The helper then commits the new value through multiplayer_transport_set_selector_slot_flags.,ghidra + rizin + llvm-objdump
0x00594f20,142,multiplayer_transport_upsert_selector_name_entry,shell,cdecl,inferred,ghidra-headless,3,Looks up or creates one selector-name entry for the requested selector slot. It resolves the current slot entry through 0x594a40 allocates a new entry through 0x594e70 when no match exists marks the selector index active at [entry+0x40+slot*4] increments the per-slot generation counter at [this+0xab8+slot*4] applies the caller flag bits 0x20 and 0x40 into [entry+0x5c+slot*4] and then marks the slot views dirty through multiplayer_transport_mark_selector_slot_views_dirty. Current grounded callers come from multiplayer_transport_handle_names_query_response and multiplayer_transport_handle_selector_update_response.,ghidra + rizin + llvm-objdump
0x00594fb0,93,multiplayer_transport_clear_selector_view_entry_slot_and_remove_if_empty,shell,cdecl,inferred,objdump + local disassembly,3,"Resolves one selector-view entry by name, clears the requested selector-slot ownership pointer at `[entry+0x40+slot*4]`, decrements the paired generation counter at `[this+0xab8+slot*4]`, clears the corresponding slot-flag dword at `[entry+0x5c+slot*4]`, and refreshes selector-view side effects through `0x594790`. When all three slot ownership pointers at `[entry+0x40]`, `[entry+0x44]`, and `[entry+0x48]` are then null it removes the whole keyed entry through `multiplayer_transport_remove_selector_view_entry_from_store` `0x594a30` before notifying `0x596900`. Current grounded callers are the later selector-view callback root at `0x59f9c0` and the keyed store-walk helper at `0x5950a0`.","objdump + local disassembly + caller inspection"
0x00595010,102,multiplayer_transport_rekey_selector_view_entry_preserving_slot_runtime,shell,cdecl,inferred,objdump + local disassembly,3,"Rekeys one selector-view entry under a new bounded name while preserving its slot-local runtime block. It resolves the old entry by name, copies the `0x1b`-dword runtime band rooted at `[entry+0x40]` into stack scratch, removes the old keyed entry through `multiplayer_transport_remove_selector_view_entry_from_store` `0x594a30`, allocates or resolves the replacement entry through `0x594e70`, restores the copied runtime band into `[new_entry+0x40]`, and then refreshes the surrounding selector-name side through `0x596c10`. Current grounded caller is the adjacent selector callback root at `0x59fab0`.","objdump + local disassembly + caller inspection"
0x005950a0,36,multiplayer_transport_clear_selector_view_slot_from_all_entries,shell,cdecl,inferred,objdump + local disassembly,3,"Walks the keyed selector-view store at `[this+0xab4]` and clears one selector slot from every entry that still owns it. The local store-walk callback `0x595080` checks `[entry+0x40+slot*4]` and, when present, forwards into `multiplayer_transport_clear_selector_view_entry_slot_and_remove_if_empty` `0x594fb0`. Current grounded callers are `multiplayer_transport_reset_selector_slot` `0x5954b0` and the later callback root `0x59fb60`.","objdump + local disassembly + caller inspection"
0x005950d0,101,multiplayer_transport_reset_selector_tables,shell,cdecl,inferred,ghidra-headless,4,Resets the three selector registration tables rooted at [this+0x80] [this+0x390] and [this+0x39c] together with state at [this+0x9a8] and [this+0x9ac]. When [this+0xab0] is set it preserves selector slot `0`; otherwise it clears all three selector slots.,ghidra + rizin + llvm-objdump
0x00595140,89,multiplayer_transport_set_selector_name,shell,cdecl,inferred,ghidra-headless,4,Copies one selector name into the fixed 0x101-byte selector-name slot at [this+0x80+index*0x101] when the caller string fits. It then marks the selector present at [this+0x384+index*4] and clears the paired transient pointer at [this+0x99c+index*4].,ghidra + rizin + llvm-objdump
0x005951a0,67,multiplayer_transport_find_selector_name,shell,cdecl,inferred,ghidra-headless,4,Scans the three selector-name slots rooted at [this+0x80] for an exact string match and returns the matching selector index through the caller pointer. The callback-slot wrapper family uses this helper before enqueueing several selector-bound opcode records.,ghidra + rizin + llvm-objdump
0x005951f0,579,multiplayer_transport_service_status_pump_and_emit_hashed_selector_mode_strings,shell,cdecl,inferred,objdump + local disassembly,3,"Central selector-status pump for the session-event transport. When the transport is live at `[this+0x48]`, it builds up to three transient selector-mode strings from selector-presence lanes `[this+0x384/+0x388/+0x38c/+0x390/+0x394/+0x398]` plus status latches `[this+0xb40/+0xb44/+0xb54/+0x180c]`, appending the letters `s`, `r`, `h`, `g`, and `a` into the temporary bands rooted at `[esp+0x14]`, `[esp+0x94]`, and `[esp+0x114]`. It hashes each completed string through `multiplayer_transport_parse_selector_mode_letters` `0x594c40`, compares the resulting masks against `[this+0x99c/+0x9a0/+0x9a4]`, and only emits the corresponding `SETCHANKEY` or `SETCKEY` line through `multiplayer_transport_append_setchankey_or_setckey_command` `0x58ece0` when that hashed mode state changed. Current grounded callers are selector-slot init or reset, the fixed flush helper `0x58db20`, and the status cleanup sibling `0x5965d0`.","objdump + local disassembly + caller inspection + selector-status-latch correlation"
0x00595440,98,multiplayer_transport_init_selector_slot,shell,cdecl,inferred,ghidra-headless,3,Initializes one selector slot under [this+0x384] and [this+0x390]. It copies caller text or the default sample at 0x005c87a8 into the fixed selector buffer at [slot+0x39c] clears byte [slot+0x59b] reruns multiplayer_transport_service_status_pump and then notifies multiplayer_transport_submit_profile_key_query_bundle_default for the refreshed selector slot.,ghidra + rizin + llvm-objdump + strings
0x005954b0,238,multiplayer_transport_reset_selector_slot,shell,cdecl,inferred,ghidra-headless,3,Resets one selector slot under [this+0x384] and [this+0x390]. When the slot is active it tears the current selector object down through 0x593460 optionally republishes caller text through 0x58e7a0 refreshes selector bookkeeping through 0x5950a0 and clears the active and present flags before returning.,ghidra + rizin + llvm-objdump
0x005955a0,125,multiplayer_transport_reset_all_selector_slots_and_clear_probe_marker_bands,shell,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Bulk selector-reset owner for the outer session-event transport. The helper walks all three selector slots, and for each slot either tears the current selector object down through `multiplayer_transport_reset_selector_slot` `0x5954b0` or directly clears the slot-active or generation dwords, slot-local sample buffer, and fixed selector-text buffer rooted at `[this+0x80]`, `[this+0x384]`, `[this+0x390]`, and `[this+0x39c]`. Slot `2` also forces the route-side cleanup tail through `0x5965d0(0)`, `multiplayer_transport_release_status_route` `0x597350` when the status-route latch is already clear, `multiplayer_transport_clear_staged_route_callback_payload` `0x5962c0`, the route-status pump `0x5951f0`, and the selector callback-name service owner `0x596900`, while slot `1` additionally clears `[this+0x9a8]`. After the full sweep the helper clears the shared probe-marker byte at `[this+0x9ac]`. Current grounded caller is the common runtime-reset strip `0x58d810`.","llvm-objdump + local disassembly + caller correlation + selector-slot correlation + route-side cleanup correlation"
0x00595620,35,multiplayer_transport_release_current_route_binding_detach_descriptor_callback_and_clear_slot,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Small route-binding teardown helper beneath route-mode branches `3` and `5`. The helper first detaches the current binding callback or descriptor lane from the route-label object rooted at `[this+0x1ed0]` through `0x58f3c0`, then releases the staged bound-route callback payload stored at `[this+0x1ec8]` through `0x5933a0`, and finally clears `[this+0x1ec8]` back to zero. Current grounded caller is `multiplayer_transport_set_route_mode` `0x595650`, where it runs only after the am-rating family and live route have already been torn down.","objdump + local disassembly + caller inspection + route-mode correlation + bound-route teardown correlation"
0x00595650,688,multiplayer_transport_set_route_mode,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Main route-mode state machine for the session-event transport. When one bound route still exists at `[this+0x1ec8]`, the helper first takes a pre-dispatch gate: requested mode `2` with no selector-`2` owner at `[this+0x398]` submits one bound-route status request through `0x5959e0`, and on failure immediately rewrites the target mode to `0` or `1` according to deferred am-rating latch `[this+0x1ed4]`. After that gate it stores the requested mode in `[this+0x18b8]`, notifies `0x5932a0` on change, and then runs one of six concrete branches. Mode `0` releases the current live route through `0x5973b0`, resets selector slot `2`, and when the am-rating route is not already live at `[this+0x1ec4]` tries to reopen it through `0x596530`; a failed reopen then falls back to mode `0` or `2` according to deferred route-status flag `[this+0x1ed8]`. Mode `1` reopens that am-rating route only when both `[this+0x1ec4]` and `[this+0x1ed4]` are clear and then, when no live route exists at `[this+0x1ecc]`, tries to connect the live route through `0x597480`; a failed live-route connect falls back to mode `0` or `1` according to `[this+0x1ed4]`. Mode `2` first releases any stale live route when status latch `[this+0xb40]` is clear, resets the am-rating route family through `0x596060`, and when `[this+0xb40]` remains live with no live route present tries `0x597480`, promoting success into mode `1`. Mode `3` resets the am-rating family, releases the live route, resets selector slot `2`, and releases the current route binding through `0x595620`. Mode `4` is the narrow recovery branch that only retries `0x597480` when status latch `[this+0xb40]` is live and no live route exists. Mode `5` resets the am-rating family, releases the live route, and releases the current route binding without the selector-slot reset. The stable transitions therefore converge through am-rating reopen, live-route release or reconnect, selector-slot-`2` reset, and route-binding release rather than through in-place mutation of the live route object's callback slots.","objdump + local disassembly + caller inspection + route-mode correlation + status-route correlation + am-rating-owner correlation + live-route correlation"
0x00595860,125,multiplayer_transport_handle_staged_route_callback_submit_result,shell,cdecl,inferred,objdump + local disassembly,3,"Completion callback used by `multiplayer_transport_try_stage_route_callback_payload` `0x5958e0`. On a nonzero submit result it first checks whether the third selector-generation counter at `[this+0xac0]` exceeds `1`; when it does, the helper counts matching selector-view entries for slot `2` through `0x594e30` using the current transport name buffer at `[this+0x04]`. A positive count advances the route-mode state machine through mode `3`, and when the transport remains in route mode `3` and the same third selector-generation counter has reached the target at `[this+0xb48]` it advances once more through mode `4`. Otherwise, and on the zero-result path too, it resets selector slot `2` to the default sample through `multiplayer_transport_reset_selector_slot` `0x5954b0`; when the current route mode is still `2` it then re-enters `multiplayer_transport_set_route_mode` `0x595650` with mode `2`. This now bounds the callback as a real staged-route-capacity submit result handler rather than a generic route-mode nudge.","objdump + local disassembly + caller correlation + selector-generation correlation"
0x005958e0,156,multiplayer_transport_try_stage_route_callback_payload,shell,cdecl,inferred,ghidra-headless,3,"Builds one staged route-callback payload from the caller route object and transport-local text buffer at `[this+0x60]`. It extracts a small compact descriptor tuple from the caller route object through `0x58d1f0`, `0x58d220`, `0x58d240`, and `0x58d250` or `0x58d200`, packs that tuple through multiplayer_transport_format_route_binding_gsp_payload, submits the staged text through `multiplayer_transport_submit_selector_text_route_request` `0x593c40` using callback `multiplayer_transport_handle_staged_route_callback_submit_result` `0x595860`, and on success stores the cloned callback payload returned by multiplayer_transport_clone_staged_callback_payload at `[this+0xb50]`. The same descriptor family later reappears in the route-binding compatibility gate at `0x595d00`, so this payload lane is now bounded as a real route-binding descriptor publisher rather than a pure presentation helper. The route-binding descriptor tuple is therefore kept separate from the selector-view probe-marker companion integer at `[entry+0x54]`.","ghidra + rizin + llvm-objdump + strings + later compatibility correlation + descriptor-layout correlation + callback correlation"
0x00595820,58,multiplayer_transport_reset_live_route_mode_to_zero_while_preserving_selector2_owner,shell,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Small route-mode-sensitive cleanup helper beneath the broader runtime-reset strip `0x58d810`. When `multiplayer_transport_is_route_mode_active_nonterminal` `0x58dc30` succeeds, the helper temporarily clears the live route object's dword `[route+0x10]`, saves selector-slot-`2` owner `[this+0x398]`, re-enters `multiplayer_transport_set_route_mode` `0x595650` with mode `0`, and then restores `[this+0x398]` before returning. Current grounded callers are the common reset strip `0x58d810` and the surrounding disconnect path `0x58d830`, so the safest current read is a forced route-mode-zero cleanup that preserves the selector-`2` owner across the reset.","llvm-objdump + local disassembly + caller correlation + route-mode correlation"
0x00595980,84,multiplayer_transport_handle_route_status_result,shell,cdecl,inferred,objdump + local disassembly + selector-generation correlation,3,"Completion callback used by `multiplayer_transport_submit_route_status_request` `0x5959e0`. On a nonzero callback result it reads the third selector-generation counter `[this+0xac0]`; values `<= 1` force route mode `2`, while larger values compare against target `[this+0xb48]` and then advance through route mode `3` or `4` via `multiplayer_transport_set_route_mode` `0x595650`. On a zero callback result it arms deferred route-status flag `[this+0x1ed8] = 1`, derives one fallback target from deferred am-rating route-state latch `[this+0x1ed4]`, and then re-enters `0x595650` with mode `0` when that latch is zero or mode `1` otherwise. This now grounds the callback as the real route-status result owner beneath `0x5959e0`, including its explicit fallback split instead of only a generic generation-gated mode nudge.","objdump + local disassembly + selector-generation correlation + route-mode fallback correlation"
0x005959e0,81,multiplayer_transport_submit_route_status_request,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Submits one bound-route status request for the current binding at `[this+0x1ec8]`. The helper first derives one request token from the current binding through `0x5934c0`, then forwards binding dword `[route+0x2c]`, binding word `[route+0x30]`, the current local status counter `[this+0xb48]`, and default sample text `0x005c87a8` into `multiplayer_transport_submit_bound_route_request` `0x593980` using completion callback `multiplayer_transport_handle_route_status_result` `0x595980`. On failure it immediately sets deferred route-status flag `[this+0x1ed8]`, so the surrounding route-mode owner can fall back without waiting for a callback. Current grounded caller is `multiplayer_transport_set_route_mode` `0x595650`, where the helper forms the pre-dispatch gate for requested mode `2` when selector slot `2` is not already active.","objdump + local disassembly + caller inspection + route-status correlation"
0x00596260,16,multiplayer_transport_upsert_cloned_staged_callback_payload_pair_into_owned_property_store,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Tiny clone-side shim used by `multiplayer_transport_clone_staged_callback_payload` `0x596270`. It treats the caller object in `edx` as the target staged callback payload, reads one owned `(key, value)` string pair from the source record pointer in `ecx`, and reinserts that pair into the target payload's property store through `multiplayer_gamespy_server_descriptor_upsert_owned_string_property_pair` `0x58d0f0`. Current grounded caller is the element walk registered inside `0x596270`, where it repopulates the cloned payload's owned keyed-property store from the source payload list.","objdump + local disassembly + caller inspection + property-store correlation + staged-callback-clone correlation"
0x00596270,70,multiplayer_transport_clone_staged_callback_payload,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Clones one staged route-callback payload block by allocating a same-sized object through `0x58d5b0`, copying the first nine dwords, preserving the source property-store head at `[clone+0x18]`, clearing intrusive next-link `[clone+0x20]`, and then replaying the source payload's owned keyed-property list through `generic_callback_list_for_each` `0x58fa00` with shim `multiplayer_transport_upsert_cloned_staged_callback_payload_pair_into_owned_property_store` `0x596260`. Current grounded caller is `multiplayer_transport_try_stage_route_callback_payload` `0x5958e0`, where the returned clone is stored at `[this+0xb50]` for later callback publication.","objdump + local disassembly + caller inspection + staged-callback-clone correlation + property-store correlation"
0x00597710,16,multiplayer_transport_format_selector_view_probe_marker_fallback_with_fixed_template_0x5e2350,shell,cdecl,inferred,llvm-objdump + caller inspection,2,"Tiny fixed-template formatter in the selector-view probe family. It forwards destination buffer `ECX` together with one caller-supplied dword in `EDX` into `0x5a19c4` using the fixed template at `0x005e2350`. Current grounded caller is the selector-text route request owner `0x58e060`, which falls back to this helper when the entry-local marker text at `[entry+0x9ac]` is empty before submitting the request through `multiplayer_transport_submit_selector_text_route_request` `0x593c40`. Current evidence is sufficient to bound the helper as a local fallback marker formatter, but not to overname the exact rendered token family beyond that fixed template.","llvm-objdump + caller inspection + selector-view-marker fallback correlation"
0x00597720,96,multiplayer_transport_format_route_binding_gsp_payload,shell,cdecl,inferred,ghidra-headless,3,"Formats one route-binding or callback payload with the `#GSP!%s!%c%s%c` template at `0x005e2358`. It takes the caller text payload in `esi`, then wraps one encoded descriptor fragment with either `X...X` or `M...M` depending on whether the global formatter state at `0x00dba4c4` is present. On the simpler branch it encodes the primary descriptor dword through `0x597590` and chooses wrapper char `0x58` (`X`); on the mixed branch it folds two dwords plus one normalized word through `0x5976c0` and chooses wrapper char `0x4d` (`M`). It then emits the final `#GSP!` line through `0x5a19c4`. Current grounded callers are multiplayer_transport_submit_bound_route_request and multiplayer_transport_try_stage_route_callback_payload.","ghidra + rizin + llvm-objdump + strings + route-binding-payload correlation"
0x00597780,38,multiplayer_transport_format_encoded_route_scalar_with_fixed_template_0x5e2368,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Small transport formatter beneath the callback-table attach worker seam. It encodes incoming scalar `EDX` through `0x597590`, then formats that encoded token together with one caller-supplied companion dword using the fixed template at `0x005e2368` into the destination buffer in `ECX` through `0x5a19c4`. Current grounded caller is `multiplayer_transport_worker_callback_store_route_scalar_and_forward_into_0x597780` `0x593630`.","objdump + local disassembly + caller inspection + format-string correlation"
0x005977b0,127,multiplayer_transport_parse_selector_view_probe_marker,shell,cdecl,inferred,objdump,3,"Parses one selector-view probe marker in the local `X%sX|%d` family. It requires a length of at least `0x0c`, accepts the marker only when byte `0` or byte `9` is `X`, decodes the wrapped request-id fragment through `0x597630`, parses the decimal tail after the `|` through `0x5a1ea5`, and returns those two values through caller output pointers as `(probe request id, displayed version/build integer)`. Current grounded callers are the profile-key callback lanes at `0x596a01` and `0x59f912`, which forward that tuple into multiplayer_transport_arm_selector_view_probe_tracking.","objdump + caller xrefs + format string"
0x00597840,30,multiplayer_transport_format_selector_view_probe_marker_core,shell,cdecl,inferred,objdump,3,"Formats the core `X%sX` wrapper used inside the selector-view probe marker family. It encodes the caller request id through `0x597590`, wraps the result with sentinel `X` bytes, and terminates the destination buffer at byte `0x0a`. Current grounded caller is multiplayer_transport_stage_selector_view_progress_snapshot, which uses `[entry+0x50]` as the marker id when building `PNG %s %d` progress lines. The trailing `|%d` companion integer from the wider `X%sX|%d` family is parsed by `0x5977b0`, but current evidence does not show it being emitted here.","objdump + caller xrefs + format string + staged-progress correlation"
0x00597860,20,multiplayer_transport_try_parse_selector_view_probe_marker_core,shell,cdecl,inferred,llvm-objdump + caller inspection,3,"Core parser for the shorter selector-view probe marker family. It accepts a caller string only when byte `0` or byte `9` is `X`, advances past the leading sentinel, and then decodes the wrapped request-id fragment through `0x597630`. Unlike `multiplayer_transport_parse_selector_view_probe_marker` `0x5977b0`, this helper does not parse any trailing `|%d` companion integer. Current grounded caller is the selector-view dispatch branch at `0x59f4b4`, which resolves the request id from global marker text `0x00db9dd8` before pairing it with a separately parsed decimal tail from `0x00db9de3`.","llvm-objdump + caller inspection + selector-view-marker correlation"
0x00593980,382,multiplayer_transport_submit_bound_route_request,shell,cdecl,inferred,ghidra-headless,3,"Builds and submits one bound-route request using the current transport text buffers and a caller-supplied binding id or fallback route id. It formats the request payload through multiplayer_transport_format_route_binding_gsp_payload allocates a type `1` transient request record through 0x5934e0 and stages the same three transport wrapper metadata dwords later consumed from work fields `+0x0c/+0x10/+0x18` on the completion side publishes selector `2` text through multiplayer_transport_set_selector_name and finally submits the request through 0x58e720 using multiplayer_transport_handle_bound_route_request. A nonempty caller text sample sets [this+0xb4c].","ghidra + rizin + llvm-objdump + strings + work-record-triplet correlation"
0x00593b00,161,multiplayer_transport_handle_selector_update_response,shell,cdecl,inferred,ghidra-headless,3,"Follow-up callback used by `multiplayer_transport_handle_selector_text_route_request`. When the callback succeeds it initializes or repopulates selector slot `[req+0x1c]` through `multiplayer_transport_init_selector_slot` and `multiplayer_transport_upsert_selector_name_entry`. When it fails it resets that selector slot. Both paths finish by enqueueing a route record through `multiplayer_transport_probe_or_enqueue_route_record` using the staged work fields `(callback fn +0x10, callback companion +0x18, drain context id +0x0c)` plus the request-local selector slot id at `+0x1c`, then unlinking the request through `0x5933a0`.","ghidra + rizin + llvm-objdump + local disassembly + callback-triplet correlation"
0x00593bb0,144,multiplayer_transport_handle_selector_text_route_request,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_selector_text_route_request. If the request is already stale at +0x38 it clears the transient state through 0x5962c0 and unlinks the request. On nonzero result it schedules multiplayer_transport_handle_selector_update_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot [req+0x1c] and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump
0x00593c40,177,multiplayer_transport_submit_selector_text_route_request,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Builds and submits one selector-text route request. The helper rejects null or empty caller text, falls back to fixed sample text `0x005c87a8` when the caller sample pointer is null, and rejects texts whose byte length reaches `0x101`. It then allocates a type-`2` transient request record through `multiplayer_transport_allocate_and_enqueue_work_record` `0x5934e0`, stores the selector id from `EDX` into work field `+0x1c`, stages the same shared transport wrapper metadata triplet later consumed from work fields `+0x0c/+0x10/+0x18`, refreshes selector-side naming through `0x59fc80` and `multiplayer_transport_set_selector_name` `0x595140`, and finally submits the request through `multiplayer_transport_submit_bound_route_or_selector_text_request_and_optionally_immediate_drain` `0x58e720` using completion callback `multiplayer_transport_handle_selector_text_route_request` `0x593bb0`. Current grounded callers include the formatted status publisher `0x58dfb0` and the staged route-callback descriptor path `0x5958e0`.","objdump + local disassembly + caller inspection + strings + work-record-triplet correlation + selector-id staging correlation"
0x00595a40,245,multiplayer_transport_dispatch_field_snapshot_mode,shell,cdecl,inferred,ghidra-headless,3,"Dispatches several session-field snapshot update modes into multiplayer_transport_enqueue_field_snapshot_record. Current grounded cases are tighter now: mode `0` enqueues one descriptor-backed snapshot and, when descriptor ready bit `0x1` is still clear, also inserts that descriptor into the local field-cache family `[this+0x1724]` with pending tag `0x4`; mode `1` enqueues the same snapshot without cache insertion; mode `2` removes descriptors carrying pending state bits `0x04/0x08` from that local field-cache family before enqueueing; mode `3` clears progress scalar `[this+0x1774]` and resets the callback payload to zero; mode `4` enqueues one empty selector snapshot through mode `0`; and mode `5` copies the transport-staged route companion dword from `[this+0x490]` into `[this+0x54]` while mirroring that same value into the field-cache subslot `[this+0x1724+0x24]` through `multiplayer_gamespy_server_descriptor_queue_set_companion_dword_filter` `0x005a0940`, not into `[this+0x1778]`. Queue service later promotes pending tag `0x4` into ready bit `0x1`.","ghidra + rizin + llvm-objdump + strings + queue-state correlation + caller inspection + local disassembly + companion-dword-slot correlation"
0x00595b60,25,multiplayer_transport_enqueue_field_snapshot_mode1_if_enabled,shell,cdecl,inferred,ghidra-headless,2,Tiny field-snapshot wrapper that enqueues one mode-1 field snapshot only when the caller enable flag is zero. The helper is a thin front end over multiplayer_transport_enqueue_field_snapshot_record.,ghidra + rizin + llvm-objdump
0x00595b80,50,multiplayer_transport_clear_field_subscription_table_runtime_and_active_opcode3_records,shell,cdecl,inferred,objdump + local disassembly,3,"Clears the live field-subscription route callback table rooted at `[this+0xba4]` through `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740`, clears the companion local field-cache family `[this+0x1724]` through `0x5a0950`, and then removes matching opcode-`3` field-snapshot records from the active opcode collection `[this+0x17fc]` through `0x5929a0`. The helper only runs when callback-table plumbing latch `[this+0xba0]` is set. Current grounded callers are the broader route-callback teardown and reopen owners `0x5961b0` and `0x5962e0`.","objdump + local disassembly + caller inspection + route-callback-table correlation + active-opcode correlation"
0x00595bc0,272,multiplayer_transport_enqueue_capacity_descriptor_record,shell,cdecl,inferred,objdump + local disassembly,3,"Owner callback for the capacity-descriptor route callback table rooted at `[transport+0x1164]`, building and enqueueing one opcode-`2` descriptor-block record tied to the borrowed sidecar pointer at `[transport+0x1778]`. The route-callback-table constructor `0x5905e0` installs this helper with owner cookie `transport`; later append-notify `0x590370` and decode-service `0x5908c0/0x5911e0` invoke it with `ecx = table object`, the route descriptor or special decode frame on the stack, and the transport cookie on the stack. Inside that callback it always reads the sidecar pointer first; modes `3` and `5` use it immediately, while mode `0` branches through a live descriptor-property build path and then still consumes the same sidecar metadata triplet `[sidecar+0x0c/+0x10/+0x18]` just before publishing the record. Mode `0` is therefore the populated live-capacity branch rather than a sidecar-free fallback: it resolves the current descriptor's primary IPv4 through `0x58d1f0`, formats one local stem through `0x58d170(0x005e1fd8, 0x005e2230)`, queries the four keyed integer properties `numwaiting`, `maxwaiting`, `numservers`, and `numplayers` through `0x58d6d0(0x005e2280/0x005e2274/0x005e2268/0x005ce1a0)`, and then forwards those five live payload lanes plus the borrowed callback-wrapper triplet into `multiplayer_transport_enqueue_descriptor_block_record` `0x592ae0` with `EDX=1`. Modes `3` and `5` are the live receive-state callbacks sourced by `multiplayer_transport_route_callback_table_service_live_socket_and_feed_decode_machine` `0x5911e0` and its inner decode state machine `0x5908c0`: they enqueue the same outer callback-wrapper triplet but deliberately zero all seven descriptor-payload lanes, using `EDX=1` for mode `3` and `EDX=0` for mode `5`, before unlinking the borrowed sidecar through `0x5933a0`. Modes `1`, `2`, and `6` are now explicitly bounded as no-op fallthroughs in this owner callback: compact-descriptor upsert notifies mode `1` through `0x590d00`, generic removal notifies mode `2` through `0x590430`, and the receive-header gate notifies mode `6` through `0x5908c0`, but this leaf stages no descriptor block for those modes. The negative result is stronger now too: direct local field-xref scans hit neighboring lifecycle fields `[transport+0x176c]`, `[transport+0x1770]`, `[transport+0x1774]`, `[transport+0x177c]`, `[transport+0x1780]`, and `[transport+0x1784]`, while the owned transient-work lifecycle at `0x593330/0x593370/0x593380/0x5934e0/0x5933a0`, the constructor or teardown owners `0x58dc50/0x596090/0x5961b0`, the reset or service strip `0x596060/0x596210/0x596530`, and the neighboring active-opcode reset path `0x5929a0` still never seed `[transport+0x1778]`. Broader local text scans also fail to show any `lea`-based replay-band writer or block-copy owner spanning the full `0x176c..0x1784` band, and a full-binary literal-offset sweep still finds only this read at `0x595bce`. The callback-binding family now sharpens that boundary too: `0x5934e0` stages the shared work-record metadata triplet, `0x593650` binds it into the callback-table worker path, and `0x593570` later consumes and republishes it, while `[transport+0x1778]` still appears only as the borrowed sidecar read in this callback owner. So the producer remains upstream of the mapped binary and is best treated as an external callback or worker handoff rather than one missing ordinary direct, derived-address, literal-offset, constructor-side, or higher callback-owner lifecycle store. Current evidence therefore bounds this as a real capacity or occupancy descriptor publisher over one cached borrowed work record, not a vague route-progress helper or a custom replay-scalar blob.","objdump + local disassembly + strings + capacity-cache correlation + route-callback-table ownership correlation + work-record correlation + descriptor-block correlation + mode split correlation + opcode2-payload correlation + generic-owner-mode correlation + ne
0x00595ce0,22,multiplayer_transport_clear_capacity_descriptor_route_callback_table_live_runtime_only,shell,cdecl,inferred,objdump + local disassembly,3,"Clears only the live runtime for the auxiliary capacity-descriptor route callback table at `[this+0x1164]` through `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740` when callback-table plumbing latch `[this+0xba0]` is present. Unlike the broader field-subscription reset `0x595b80`, this helper does not touch `[this+0xba4]`, `[this+0x1724]`, the queued descriptor families, or the active opcode collection. Current grounded callers use it before disconnect and broader route-state cleanup.","objdump + local disassembly + caller inspection + route-callback-table correlation + negative-owner-scope correlation"
0x00595d00,83,multiplayer_transport_route_binding_matches_route_callback_descriptor_tuple,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Small compatibility gate over one staged route-callback payload versus the current bound route object. It compares the caller descriptor's primary IPv4 dword through `0x58d1f0` against bound-route field `[binding+0x54]`. When payload byte-flag getter `0x58d220` carries bit `0x2`, it also requires the descriptor's secondary IPv4 dword from `0x58d240` to match `[binding+0x58]` and the descriptor's host-order port word from `0x58d250` to match `[binding->route+0x30]`; otherwise it falls back to the single-port getter `0x58d200` against that same route word. The helper returns `1` only when the full required tuple matches and `0` otherwise. Current grounded caller is `multiplayer_transport_check_openstaging_capacity_gate` `0x595d60`, where this tuple check short-circuits the broader capacity path. This row is intentionally scoped to the route-binding descriptor family, not the selector-view `X...X|%d` marker tuple.","objdump + local disassembly + caller inspection + descriptor-getter correlation + route-binding-layout correlation + tuple-match correlation"
0x00595d60,84,multiplayer_transport_check_capacity_and_optionally_invoke_bound_route_callback,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Capacity-side gate beneath the `gsi_am_rating` route transition family. When a bound route already exists at `[this+0x1ecc]`, the helper first reuses `multiplayer_transport_route_binding_matches_route_callback_descriptor_tuple` `0x595d00`; a successful tuple match returns immediately through `multiplayer_transport_invoke_bound_route_callback_if_present` `0x592710`, which is the already-bound fast path rather than a fresh live-route transition. Otherwise it samples the caller descriptor's `maxplayers` and `numplayers` fields through `0x58d6d0` using the fixed keys at `0x005ce194` and `0x005ce1a0`, and only when the current player count is still below the max-player cap does it again fall into that same `0x592710` bound-route callback lane. Failure on both branches returns `0`. Current grounded caller is `multiplayer_transport_try_transition_after_capacity_gate` `0x595dc0`, where this helper forms the immediate already-bound-or-capacity gate before the staged route-callback payload path.","objdump + local disassembly + caller inspection + descriptor-capacity correlation + route-binding-callback correlation + bound-fastpath correlation"
0x00595dc0,79,multiplayer_transport_try_transition_after_capacity_gate,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Transition gate beneath the `gsi_am_rating` callback family. It first rejects immediately when either staged-route busy latch `[this+0x1e8c]` or selector slot object `[this+0x38c]` is non-null. Otherwise it reuses `multiplayer_transport_check_capacity_and_optionally_invoke_bound_route_callback` `0x595d60`; only when that capacity gate returns positive does it continue. The success path then refreshes route-side selector state through `0x5973b0`, resets selector slot `2` through `multiplayer_transport_reset_selector_slot` `0x5954b0` with fixed text `0x005c87a8`, forwards the caller descriptor into `multiplayer_transport_try_stage_route_callback_payload` `0x5958e0`, and only when that staging call reports success falls into `multiplayer_transport_set_route_mode` `0x595650` mode `0`. Any busy-latch, capacity, or staging failure returns without changing route mode. Current grounded callers are the ready-descriptor branch in `0x595e10` mode `1` and the mode-`0` fast path in `0x595f70`.","objdump + local disassembly + caller inspection + route-mode correlation + staged-callback correlation"
0x00595e10,321,multiplayer_transport_dispatch_am_rating_route_event_mode,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Dispatches route-event modes for the `gsi_am_rating` callback branch rooted at the primary-endpoint table `[this+0x18bc]` and queued descriptor family `[this+0x1e7c]`. Mode `0` first checks descriptor flag-byte `0x15` bit `0x1`: clear-bit descriptors are upserted directly into the primary-endpoint table through `multiplayer_transport_primary_endpoint_table_upsert_descriptor_by_primary_ipv4_and_port` `0x00591330`, while set-bit descriptors are reinserted into the queued family through `multiplayer_gamespy_server_descriptor_queue_insert_with_pending_state_tag` `0x005a09a0` with pending tag `1/0`. Mode `1` first requires descriptor state-byte ready bit `0x2`; clear-ready descriptors go straight back into that same queue family, while ready descriptors next test flag-byte `0x15` bit `0x1`, suppressing the direct transition path for endpoint-only records and otherwise falling into `multiplayer_transport_try_transition_after_capacity_gate` `0x595dc0`. Mode `2` removes descriptors still carrying queued pending-state bits `0x04/0x08` through `0x005a0cd0`. Mode `3` checks endpoint-table emptiness through `0x590470` and forces route mode `2` only when no primary endpoint remains. Mode `4` stamps `[this+0x1ed4] = 1` and then switches route mode based on callback-table sentinel `[this+0x18b8]` plus deferred descriptor pointer `[this+0x1ed8]`, producing mode `1` when no deferred descriptor is staged and mode `3` when one is present. Mode `5` copies the transport-staged route companion dword from `[this+0x490]` into `[this+0x54]` while mirroring that same value into the field-cache subslot `[this+0x1724+0x24]` through `multiplayer_gamespy_server_descriptor_queue_set_companion_dword_filter` `0x005a0940`, not into `[this+0x1778]`. The strongest current read remains that flag byte `0x15` bit `0x1` marks primary-endpoint-seed or endpoint-only descriptors: they can be staged and enriched through the queue family, but they do not take the richer direct transition path used by clear-bit descriptors.","objdump + local disassembly + caller inspection + endpoint-table correlation + queued-descriptor correlation + transition-suppression correlation + companion-dword-slot correlation"
0x00595f70,237,multiplayer_transport_dispatch_am_rating_route_callback,shell,cdecl,inferred,objdump + local disassembly + strings + endpoint-table correlation,3,"Callback handler for the `gsi_am_rating` route branch rooted at the primary-endpoint table `[this+0x18bc]`. Mode `0` forwards directly into `multiplayer_transport_try_transition_after_capacity_gate` `0x595dc0`. Mode `2` is now grounded as the real owner above the staged route-callback path, not just a vague table walk: it requires current route mode `1`, no live selector object at `[this+0x398]`, and no busy slot object at `[this+0x38c]`; then it walks the primary-endpoint table through `0x590470/0x590480`, prunes stale entries against `multiplayer_transport_check_openstaging_capacity_gate` `0x595d60`, and refreshes every surviving entry's `gsi_am_rating` property through `0x58d130` using fixed key `0x005e228c`. After that sweep it branches on table emptiness. When the table is empty it forces route mode `2` through `multiplayer_transport_set_route_mode` `0x595650`. Otherwise it stages the same fixed `gsi_am_rating` key into the endpoint table through `0x590310`, selects the current head entry through `0x590480` with index `0`, forwards that head descriptor into `multiplayer_transport_try_stage_route_callback_payload` `0x5958e0`, and on submit failure falls back to route mode `0`. Success leaves the staged callback path to drive the later route-mode ladder through `0x595860`. This now closes the owner split above `0x5958e0` without inventing a separate fake function boundary at internal label `0x596000`.","objdump + local disassembly + strings + endpoint-table correlation + route-mode correlation + staged-callback correlation"
0x00596060,48,multiplayer_transport_reset_am_rating_route_runtime_and_queued_descriptor_family,shell,cdecl,inferred,objdump + local disassembly,3,"Resets the `gsi_am_rating` route branch when callback-table plumbing latch `[this+0xba0]` is present: it zeroes am-rating state latch `[this+0x1ec4]`, clears the live runtime for the primary-endpoint callback table `[this+0x18bc]` through `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740`, and clears the companion queued descriptor family `[this+0x1e7c]` through `0x5a0950`. The helper does not touch the field-subscription table `[this+0xba4]` or the capacity-descriptor table `[this+0x1164]`. Current grounded callers are the route-mode owner `0x595650` and the reopen helper `0x596530`.","objdump + local disassembly + caller inspection + am-rating-owner correlation + negative-owner-scope correlation"
0x00596090,272,multiplayer_transport_construct_route_callback_tables_and_descriptor_caches,shell,cdecl,inferred,objdump + local disassembly,3,"Constructor-side owner for the transport callback-table branch. It constructs the field-subscription table `[this+0xba4]` through `multiplayer_transport_route_callback_table_construct` `0x5905e0` with owner callback `0x595a40`, owner cookie `this`, route-label bands `[this+0xb58]` and `[this+0xb78]`, descriptor/schema owner `[this+0xb98]`, and base runtime state `[this+0x60]`; seeds the companion field-cache family `[this+0x1724]` through `0x5a08f0` with helper `0x595b60` and fixed descriptor stem `0x00629d50`; constructs the capacity-descriptor route callback table `[this+0x1164]` through the same `0x5905e0` path but with owner callback `0x595bc0`; then builds one fixed `0x20`-byte `gsi_am_rating` route label on the stack from local transport name `[this+0x60]` plus suffix template `0x005dccfc`, constructs the primary-endpoint table `[this+0x18bc]` through `0x5905e0` with owner callback `0x595e10` and that stack-built label, and finally seeds the queued descriptor family `[this+0x1e7c]` through `0x5a08f0` with helper `0x595f70` plus fixed stem `0x00629d54`. On success it clears staged route-callback payload slot `[this+0xb50]`, sets callback-table plumbing latch `[this+0xba0] = 1`, and leaves the surrounding route-label and descriptor-cache band ready for the later open or reopen owners `0x5962e0` and `0x596530`. Current local disassembly now also makes one negative owner boundary explicit: this constructor seeds `[this+0xba4]`, `[this+0x1164]`, `[this+0x18bc]`, `[this+0x1e7c]`, `[this+0x1724]`, and `[this+0xb50]` but never seeds the borrowed sidecar slot `[this+0x1778]`, so that sidecar is not part of ordinary callback-table bring-up inside the mapped binary.","objdump + local disassembly + constructor-argument correlation + route-label correlation + latch-state correlation + higher-owner-lifecycle correlation + fixed-stem correlation + negative-sidecar-boundary correlation"
0x005961b0,92,multiplayer_transport_teardown_route_callback_tables_and_descriptor_caches,shell,cdecl,inferred,objdump + local disassembly,4,"Full teardown for the transport-owned route callback-table branch. It first clears the live field-subscription runtime, field-cache family, and active opcode-`3` records through `0x595b80`; then clears the live capacity-descriptor callback runtime through `0x595ce0`; and finally, when callback-table plumbing latch `[this+0xba0]` is set, destroys the callback tables at `[this+0xba4]`, `[this+0x1164]`, and `[this+0x18bc]` through `0x5907a0`, releases the companion caches `[this+0x1724]` and `[this+0x1e7c]` through `0x5a0970`, and resets am-rating state latch `[this+0x1ec4]` to `0`. Current grounded caller is `multiplayer_transport_disconnect` `0x58d830`.","objdump + local disassembly + caller inspection + route-callback-table correlation + active-opcode correlation"
0x00596210,71,multiplayer_transport_service_route_callback_tables_and_descriptor_queues,shell,cdecl,inferred,objdump + local disassembly,3,"Recurring service sweep for the transport-owned route callback tables and descriptor queues. When callback-table plumbing latch `[this+0xba0]` is enabled it services the field-subscription table `[this+0xba4]`, the capacity-descriptor table `[this+0x1164]`, and the `gsi_am_rating` primary-endpoint table `[this+0x18bc]` through `0x591290`, then services the companion descriptor queues `[this+0x1724]` and `[this+0x1e7c]` through `multiplayer_gamespy_server_descriptor_queue_service_and_publish_empty_transition` `0x5a0c80`. Current evidence now bounds those queue families more tightly too: the service pass promotes pending state tags `0x4/0x8` into ready bits `0x1/0x2` before the higher transport-owned route branches consume them. Current grounded caller is `multiplayer_transport_service_frame` `0x58d8d0`, which makes this the callback-table side of the recurring multiplayer transport cadence. The same recurring sweep also strengthens the negative replay-band result: it services all local owner tables surrounding `[this+0x1778]` without ever writing that sidecar slot.","objdump + local disassembly + queue-state correlation + higher-owner-lifecycle correlation + caller inspection"
0x005962c0,32,multiplayer_transport_clear_staged_route_callback_payload,shell,cdecl,inferred,objdump + local disassembly,3,"Clears the cloned staged route-callback payload handle at `[this+0xb50]`. When that slot is non-null the helper forwards the embedded owned object slot through `0x58d0d0`, then zeroes `[this+0xb50]`. Current grounded callers are the stale-request branch in `multiplayer_transport_handle_selector_text_route_request` `0x593bb0` and the selector-slot-`2` reset path around `0x595561`.","objdump + local disassembly + caller inspection + payload-slot correlation"
0x005962e0,583,multiplayer_transport_open_field_subscription_route_callback_table,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Builds and opens the field-subscription route callback table rooted at `[this+0xba4]`. It first clears prior field-subscription runtime through `0x595b80` and releases any live route descriptors at `[this+0xba4]` through `0x5904d0`. It then builds one route label from the optional suffix text: with a caller suffix it formats `0x005e22b4` plus that suffix into a local `0x100`-byte buffer and appends the fixed two-byte tail at `0x005d0b78`; without a suffix it copies the default stem block at `0x005e22c0..0x005e22cc` directly. After that it clears local progress-counter slot `[this+0x1760]`, materializes the fixed callback-key stem block at `0x005e22a0..0x005e22b2` into a local buffer, seeds the field-cache family `[this+0x1724]` through `0x5a0cc0` with fixed key ids `1` and `0x0b`, and then appends one selector-name key id per caller field byte through the string table at `0x00629958` as long as the assembled key buffer still fits in `0x100` bytes. Finally it opens the live route through `multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state` `0x590ed0` in mode `4` with that assembled label and callback-key buffer. On success it seeds cached progress percentage `[this+0x1774] = 1` and immediately enqueues the first field snapshot through `multiplayer_transport_enqueue_field_snapshot_record` `0x592b50`; on failure it falls back through the same `0x595b80` clear path. This remains the strongest current upstream owner above the `[transport+0xba4]` route-callback table.","objdump + local disassembly + caller inspection + field-cache correlation + route-callback-table correlation + route-label correlation"
0x00596530,101,multiplayer_transport_try_open_am_rating_route_callback_table_from_stored_route_label,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Tries to reopen the `gsi_am_rating` route callback table rooted at `[this+0x18bc]` from the stored route label at `[this+0x1ed0]`. When precondition `[this+0xba0]` is clear the helper does not attempt any reopen work at all: it simply stamps deferred am-rating latch `[this+0x1ed4] = 1` and returns failure. Otherwise it resets that am-rating route family through `multiplayer_transport_reset_am_rating_route_state` `0x596060`, clears the callback-table descriptor band at `[this+0x18bc]` through `0x5904d0`, and then opens one mode-`4` live route through `multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state` `0x590ed0` with stored route label `[this+0x1ed0]` and a null companion route string. A successful open clears `[this+0x1ed4]` and sets `[this+0x1ec4] = 1`; a failed open re-enters the same reset path and then stamps `[this+0x1ed4] = 1`. Current grounded caller is the larger route-mode setter around `0x595650`. This higher reopen path also tightens the negative result for `[this+0x1778]`: even the am-rating reset and reopen lifecycle clears and reseeds the surrounding live tables and queued descriptor family without ever staging that sidecar slot.","objdump + local disassembly + caller inspection + am-rating-owner correlation + route-callback-table correlation + higher-owner-lifecycle correlation"
0x005965a0,44,multiplayer_transport_try_connect_status_route_once,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Single-shot wrapper for the auxiliary status-route object at `[this+0xaf0]`. When the in-flight latch at `[this+0xb40]` is already set it returns false immediately. Otherwise it sets that latch to `1`, forwards the caller route id into `multiplayer_transport_try_connect_status_route` `0x5973d0`, and booleanizes the returned result without doing any local rollback itself. Current grounded callers are `multiplayer_transport_handle_names_query_response` and the larger route-mode family around `0x595650`; the matching latch cleanup lives in `multiplayer_transport_clear_status_route_latches_and_optionally_release_route_then_rerun_status_pump` `0x5965d0`.","objdump + local disassembly + caller inspection + status-route-latch correlation"
0x005965d0,61,multiplayer_transport_clear_status_route_latches_and_optionally_release_route_then_rerun_status_pump,shell,cdecl,inferred,objdump + local disassembly,3,"Status-route cleanup sibling used by the selector-status owner strip. When caller flag `EDX` is nonzero it first releases the auxiliary status-route object through `multiplayer_transport_release_status_route` `0x597350`; when transport latch `[this+0xb40]` is live it then clears `[this+0xb40]`, `[this+0xb44]`, and `[this+0xb54]` together and tail-calls `multiplayer_transport_service_status_pump_and_emit_hashed_selector_mode_strings` `0x5951f0`. Current grounded callers are `multiplayer_transport_disconnect` `0x58d830` and the selector-slot-`2` reset tail inside `multiplayer_transport_reset_selector_slot` `0x5954b0`.","objdump + local disassembly + caller inspection + latch correlation"
0x00596840,105,multiplayer_transport_prune_shared_selector_callback_name_when_no_live_slot_store_still_owns_it,shell,cdecl,inferred,objdump + local disassembly,3,"Callback used while servicing the shared selector callback-name store at `[this+0x18a8]`. For one stored name pair it resolves the current selector-view entry through `0x594a40`; when no live selector-view entry remains, or when none of the three slot ownership pointers at `[entry+0x40/+0x44/+0x48]` still resolves the same name in the slot-specific callback stores rooted at `[this+0x1890/+0x1894/+0x1898]` through `hashed_entry_table_lookup` `0x58f9c0`, it removes that shared name record from `[this+0x18a8]` through `hashed_entry_table_remove` `0x58f970`. Current grounded caller is `multiplayer_transport_service_selector_callback_name_tables` `0x596900`.","objdump + local disassembly + selector-view correlation + caller inspection"
0x005968b0,79,multiplayer_transport_prune_shared_selector_callback_name_from_one_slot_service_pass,shell,cdecl,inferred,objdump + local disassembly,3,"Slot-specific callback used during selector callback-name service. It resolves the current selector-view entry for one shared selector name, checks whether the current slot index still owns that entry at `[entry+0x40+slot*4]`, and then confirms the same name still exists in the slot-owned callback store rooted at `[this+0x189c+slot*4]` through `hashed_entry_table_lookup` `0x58f9c0`. When either condition fails, it removes the shared name record from `[this+0x18a8]` through `hashed_entry_table_remove` `0x58f970`. Current grounded caller is `multiplayer_transport_service_selector_callback_name_tables` `0x596900`.","objdump + local disassembly + selector-slot correlation + caller inspection"
0x00596610,47,multiplayer_transport_hash_selector_callback_name_primary_text_mod_caller_divisor,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Hash callback for the first `0x10`-stride selector callback-name lists rooted at `[this+0x1890..+0x1898]`. It walks the primary owned string pointer at `[entry+0x00]`, accumulates one locale-normalized integer per byte through `0x5a5900`, and returns the running sum modulo the caller divisor. Current grounded caller is the constructor `0x5966f0`, which installs this helper as the hash callback for the per-slot list family.","objdump + local disassembly + caller inspection + selector-callback-store correlation + hashing correlation"
0x00596640,21,multiplayer_transport_compare_selector_callback_name_primary_text_casefolded_current_locale,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Compare callback for the first `0x10`-stride selector callback-name lists rooted at `[this+0x1890..+0x1898]`. It rewrites the caller entry pointers to their primary string fields at `[entry+0x00]` and tail-jumps into the locale-aware casefolded string compare `0x5a57cf`. Current grounded caller is the constructor `0x5966f0`, which installs this helper as the compare callback for that per-slot list family.","objdump + local disassembly + caller inspection + selector-callback-store correlation + compare correlation"
0x00596660,7,multiplayer_transport_release_selector_callback_name_primary_text,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Release callback for the first `0x10`-stride selector callback-name lists rooted at `[this+0x1890..+0x1898]`. It releases the owned primary string pointer at `[entry+0x00]` through `0x58f3c0`. Current grounded caller is the constructor `0x5966f0`, which installs this helper as the element destroy callback for that per-slot list family.","objdump + local disassembly + caller inspection + selector-callback-store correlation + release correlation"
0x00596670,48,multiplayer_transport_hash_selector_callback_name_pair_secondary_text_mod_caller_divisor,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Hash callback for the shared keyed selector callback-name stores rooted at `[this+0x18a8]` and `[this+0x18ac..+0x18b4]`. It walks the secondary owned string pointer at `[entry+0x04]`, accumulates one locale-normalized integer per byte through `0x5a5900`, and returns the running sum modulo the caller divisor. Current grounded caller is the constructor `0x5966f0`, which installs this helper as the hash callback for the keyed callback-name store family.","objdump + local disassembly + caller inspection + selector-callback-store correlation + hashing correlation"
0x005966a0,47,multiplayer_transport_compare_selector_callback_name_pair_primary_then_secondary_text_casefolded_current_locale,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Compare callback for the shared keyed selector callback-name stores rooted at `[this+0x18a8]` and `[this+0x18ac..+0x18b4]`. It first compares the primary string fields at `[entry+0x00]` casefolded through `0x5a57cf`; on equality it compares the secondary string fields at `[entry+0x04]` through the same helper. Current grounded caller is the constructor `0x5966f0`, which installs this helper as the key-compare callback for the keyed callback-name store family.","objdump + local disassembly + caller inspection + selector-callback-store correlation + compare correlation"
0x005966d0,26,multiplayer_transport_release_selector_callback_name_pair_strings,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Release callback for the shared keyed selector callback-name stores rooted at `[this+0x18a8]` and `[this+0x18ac..+0x18b4]`. It releases the three owned string pointers at `[entry+0x00]`, `[entry+0x04]`, and `[entry+0x08]` through `0x58f3c0`. Current grounded caller is the constructor `0x5966f0`, which installs this helper as the element destroy callback for the keyed callback-name store family.","objdump + local disassembly + caller inspection + selector-callback-store correlation + release correlation"
0x005966f0,248,multiplayer_transport_construct_shared_and_slot_local_selector_callback_name_stores,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Constructor-side owner for the selector callback-name store family. It first zeroes the three slot-local collection bands at `[this+0x1890..+0x1898]`, `[this+0x189c..+0x18a4]`, and `[this+0x18ac..+0x18b4]`, then allocates the shared keyed callback-name store at `[this+0x18a8]` through `0x58faf0` with hash/compare/release callbacks `0x596670/0x5966a0/0x5966d0`. After that it loops three times, seeding for each selector slot one first `0x10`-stride callback-name list at `[this+0x1890+slot*4]`, one second `0x10`-stride callback-name list at `[this+0x189c+slot*4]`, and one keyed callback-name store at `[this+0x18ac+slot*4]`. The helper returns success only when the shared store plus all three per-slot triplets are nonnull. Current grounded caller is the outer transport constructor `multiplayer_transport_construct_and_zero_runtime_fields` `0x58dc50`, and the paired destroy-side helper is `0x5967f0`.","objdump + local disassembly + caller inspection + selector-callback-store correlation + constructor-layout correlation"
0x005967f0,76,multiplayer_transport_release_shared_and_slot_local_selector_callback_name_stores,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Destroy-side helper for the selector callback-name store family. It first releases the shared keyed store at `[this+0x18a8]` through `0x58f8b0`, then walks the three slot-local triplets rooted at `[this+0x1890..+0x1898]`, `[this+0x189c..+0x18a4]`, and `[this+0x18ac..+0x18b4]`, releasing each nonnull collection through the same `0x58f8b0` owner. Current grounded callers are the final outer transport destroy path `0x58d8a0` and the constructor-failure cleanup paths that fall into that same owner.","objdump + local disassembly + caller inspection + selector-callback-store correlation + final-destroy correlation"
0x00596900,101,multiplayer_transport_service_selector_callback_name_tables,shell,thiscall,inferred,objdump + local disassembly,3,"Recurring maintenance pass over the selector-side callback-name tables. It first walks the shared selector callback-name store at `[this+0x18a8]` through `generic_callback_list_for_each` `0x58fa40` using callback `0x596840`, then services the three slot-local callback collections rooted at `[this+0x18ac/+0x18b0/+0x18b4]`: when the corresponding selector slot is inactive under `[this+0x384/+0x390]` it clears that collection through `0x58fac0`, otherwise it walks the collection through `0x58fa40` with callback `0x5968b0` and the current slot index. Current grounded caller is the selector-slot-`2` reset tail in `multiplayer_transport_reset_selector_slot` `0x5954b0`.","objdump + local disassembly + selector-callback-store correlation + caller inspection"
0x00596970,404,multiplayer_transport_handle_profile_key_query_result,shell,cdecl,inferred,objdump,3,"Per-key callback helper for the profile-key query bundle family. It ignores empty selector names, treats a null fallback text as `0x005c87a8`, special-cases the `username` key by parsing one `X...X|%d` marker through multiplayer_transport_parse_selector_view_probe_marker, arming selector-view probe tracking through multiplayer_transport_arm_selector_view_probe_tracking, and optionally publishing callback slot `22` with the selector name plus the parsed probe tuple `(request id, displayed version/build integer)` or a zeroed `(END)` sentinel payload. It also special-cases `b_flags` by forwarding the returned mode-letter string into multiplayer_transport_merge_selector_mode_mask, then hashes the selector name, key name, and resolved value text through `0x58f4a0` and upserts that triplet into the caller table through hashed_entry_table_upsert.","objdump + strings + caller context"
0x00596b10,118,multiplayer_transport_query_shared_and_slot_local_profile_key_stores_until_first_success_then_publish_slot27,shell,cdecl,inferred,objdump + local disassembly,3,"Shared built-in profile-key sweep above the generic per-key result helper. It first tries `multiplayer_transport_handle_profile_key_query_result` `0x596970` against the shared callback-name store `[this+0x18a8]` plus the first slot-local store `[this+0x1890]`, then against the sibling slot-local stores `[this+0x1894]` and `[this+0x1898]` until one query succeeds. On the first success it publishes callback slot `27` through `multiplayer_transport_enqueue_callback_slot27_record` `0x5931b0` using the same selector-name pair. Current grounded caller is the higher per-key array sweep around `0x596cb6`.","objdump + local disassembly + caller inspection + profile-key-store correlation"
0x00596b90,72,multiplayer_transport_query_slot_built_in_profile_key_and_publish_slot28_on_success,shell,cdecl,inferred,objdump + local disassembly,3,"Small helper above the generic per-key profile query path. Using the caller selector slot in `edx`, it indexes one per-slot built-in string pair from `[this+0x189c+slot*4]` and `[this+0x18ac+slot*4]`, forwards that pair plus the caller selector name and fallback text into `multiplayer_transport_handle_profile_key_query_result` `0x596970` with its publication flag enabled, and, when that lower helper returns success, also publishes callback slot `28` through `multiplayer_transport_enqueue_callback_slot28_record` `0x593200`. Current grounded callers are the selector callback root `0x59fbd0` and the later multi-entry sweep around `0x596d33`.","objdump + local disassembly + caller inspection"
0x00596be0,44,multiplayer_transport_replace_selector_callback_name_primary_text_if_match,shell,cdecl,inferred,objdump + local disassembly,3,"Small rename helper used by the selector callback-name stores. It compares the primary text field at `[entry+0x00]` against the caller old-name text, and on match releases that stored primary string through `0x58f3c0` before replacing it with a heap copy of the caller new-name text through `0x58f4a0`. Current grounded caller is `multiplayer_transport_refresh_selector_callback_name_stores_after_selector_rename` `0x596c10`.","objdump + local disassembly + caller inspection"
0x00596c10,107,multiplayer_transport_refresh_selector_callback_name_stores_after_selector_rename,shell,cdecl,inferred,objdump + local disassembly,3,"Refreshes the shared and slot-local selector callback-name stores after one selector rename. It walks the shared store at `[this+0x18a8]` and the three slot-local stores at `[this+0x18ac/+0x18b0/+0x18b4]` through `generic_callback_list_for_each` `0x58fa00` using callback `0x596be0`, rewriting any callback-name entry whose primary text still matches the caller old selector name to the caller new selector name. Current grounded caller is `multiplayer_transport_rekey_selector_view_entry_preserving_slot_runtime` `0x595010`.","objdump + local disassembly + caller inspection + selector-callback-store correlation"
0x00596c80,15,generic_pointer_array_append_current_element,support,cdecl,inferred,objdump + local disassembly,4,"Tiny pointer-array append helper. It treats `edx` as one `(count, pointer-array)` pair, writes caller pointer `ecx` into `array[count]`, and then increments the count dword. Current grounded callers use it while collecting per-slot profile-key strings into temporary pointer arrays under `0x596da0`.","objdump + local disassembly + caller inspection"
0x00596c90,67,multiplayer_transport_query_shared_built_in_profile_keys_for_selector_name_array,shell,cdecl,inferred,objdump + local disassembly,3,"Small array-sweep helper above the shared built-in profile-key query path. It requires a nonnull selector-name array pointer and a positive element count, then walks one parallel selector-name pair array and forwards each pair into `multiplayer_transport_query_shared_and_slot_local_profile_key_stores_until_first_success_then_publish_slot27` `0x596b10` using the caller selector name plus fallback text. Current grounded caller is the channel-key pair callback owner `0x596ce0`.","objdump + local disassembly + caller inspection"
0x00596ce0,225,multiplayer_transport_handle_channel_key_pair_query_result,shell,cdecl,inferred,objdump + local disassembly,3,"Second-stage callback owner for the per-slot profile-key bundle submitted through `multiplayer_transport_submit_setchankey_pair_list_command_and_wait` `0x58ef20`. In the default-slot branch it resolves the selector slot from the returned selector name through `0x5951a0`, then walks one caller array of selector-name pairs and forwards each pair into `multiplayer_transport_query_slot_built_in_profile_key_and_publish_slot28_on_success` `0x596b90` using the shared fallback text at `0x00629d54` with publication disabled. In the selector-name-override branch it resolves the slot from that explicit override name and instead walks one parallel selector-name pair array, forwarding each pair into the same lower helper with the caller publication flag enabled. Current grounded caller is `multiplayer_transport_submit_profile_key_query_bundle_for_selector_slot` `0x596da0`.","objdump + local disassembly + caller inspection + selector-slot correlation"
0x00596da0,497,multiplayer_transport_submit_profile_key_query_bundle_for_selector_slot,shell,unknown,inferred,objdump + local disassembly,3,"Owner-side profile-key query bundle for one selector slot, using the slot index passed in `EAX` and one optional selector-name override from the stack. It first requires the slot to be active or present under `[this+0x390/+0x384]`, then builds the first key list from the slot-owned store at `[this+0x1890+slot*4]` and submits a synchronous `GETKEY` command through `multiplayer_transport_submit_getkey_command_and_wait` `0x58ec50`, using the caller override when present and otherwise the fixed selector name at `[this+0x80+slot*0x101]`. When no override is supplied it then builds the second key list from the slot-owned store at `[this+0x189c+slot*4]`, conditionally appending built-in `username` and `b_flags` requests, and submits the larger synchronous channel-key pair list through `multiplayer_transport_submit_setchankey_pair_list_command_and_wait` `0x58ef20` with callback `0x596ce0`. The helper uses `0x58f8f0` plus `0x58fa00` and `0x596c80` to count and collect the per-slot key vectors before both submissions. Current grounded wrappers are `multiplayer_transport_submit_profile_key_query_bundle_for_selector_slot_with_selector_name_override` `0x596fa0` and `multiplayer_transport_submit_profile_key_query_bundle_for_selector_slot_default_name` `0x596fc0`.","objdump + local disassembly + caller inspection + strings + per-slot-key-store correlation"
0x00596fa0,19,multiplayer_transport_submit_profile_key_query_bundle_for_selector_slot_with_selector_name_override,shell,cdecl,inferred,objdump + local disassembly,2,"Thin wrapper over `multiplayer_transport_submit_profile_key_query_bundle_for_selector_slot` `0x596da0`. It preserves the caller selector slot in `edx`, moves that slot index into the callee's `EAX` convention, and forwards the stack-supplied selector-name override as the extra bundle argument. Current grounded use is through the callback root `0x59f8b0`.","objdump + local disassembly + caller inspection"
0x00596fc0,14,multiplayer_transport_submit_profile_key_query_bundle_for_selector_slot_default_name,shell,cdecl,inferred,objdump + local disassembly,3,"Thin wrapper over `multiplayer_transport_submit_profile_key_query_bundle_for_selector_slot` `0x596da0`. It preserves the caller selector slot in `edx`, moves that slot index into `EAX`, and forces a null selector-name override so the bundle uses the slot's fixed name at `[this+0x80+slot*0x101]`. Current grounded callers are `multiplayer_transport_init_selector_slot` and the callback root `0x59fb60`.","objdump + local disassembly + caller inspection"
0x00596fd0,441,multiplayer_transport_dispatch_status_route_event,shell,cdecl,inferred,objdump + local disassembly + caller correlation + strings,3,"Main local callback dispatcher for the auxiliary status-route object. It requires selector presence at `[this+0x398]`; when route-status latch `[this+0xb44]` is live it only exposes the fixed built-in field table when bit `0x02` is also armed in `[this+0xb38]`. Those built-in field ids append either internal text `[this+0x79c]`, decimal state from `[this+0xac0]`, `[this+0xb48]`, and `[this+0xb3c]`, one static fallback token `0x005ce1c8`, or the boolean form of `[this+0xb4c]` through `0x58bce0` and `0x58cd40`. Outside that built-in strip it maps route event ids through the local table at `0x5970c4` into the status-route callback-vector lanes `0x5970e0`, `0x597180`, `0x5971b0`, and `0x597270`, or falls back to the owner callback at `[this+0x17dc]` with context `[this+0x17f8]`. Current grounded caller is the status-route callback table seeded by `multiplayer_transport_try_connect_status_route` `0x5973d0`.","objdump + local disassembly + caller correlation + strings + status-route-dispatch correlation"
0x0059f8b0,260,multiplayer_transport_callback_upsert_current_selector_and_request_profile_keys,shell,cdecl,inferred,objdump,3,"Callback-root helper adjacent to the second transport-side descriptor lane. It resolves the current selector through multiplayer_transport_find_selector_name, upserts that selector name into the selector-view store through multiplayer_transport_upsert_selector_name_entry, optionally reuses a cached `username` marker from `0x58eb10` to arm selector-view probe tracking through multiplayer_transport_parse_selector_view_probe_marker and multiplayer_transport_arm_selector_view_probe_tracking, then submits one profile-key query bundle through multiplayer_transport_submit_profile_key_query_bundle_with_context and publishes callback slot `17`. When selector `2` is active, the same helper can also force the route-mode transitions `2 -> 3 -> 4` through multiplayer_transport_set_route_mode after checking the status-route latch at `[this+0xb54]`, route activity, and the generation gate `[this+0xac0] >= [this+0xb48]`.","objdump + caller xrefs + strings"
0x0059f9c0,239,multiplayer_transport_callback_clear_named_selector_view_slot_publish_slot18_and_maybe_set_route_mode,shell,cdecl,inferred,objdump + local disassembly,3,"Callback-root helper installed in the second transport-side selector descriptor lane at `0x59fc80`. It resolves the current selector through `0x5951a0`; when selector `2` is active and the route is live, it derives one follow-on route-mode request from the current selector-view state by combining the route-status latch at `[this+0xb40]`, the slot-`2` flag-`0x20` count from `multiplayer_transport_count_selector_view_entries_with_slot_flag20_and_optional_name_match` `0x594e30`, and the third selector-generation gate `[this+0xac0]` versus target `[this+0xb48]`. It then clears the named selector-view slot membership through `multiplayer_transport_clear_selector_view_entry_slot_and_remove_if_empty` `0x594fb0`, publishes callback slot `18` through `0x592f20` using the selector name plus either the default sample `0x005c87a8`, the alternate token `0x005e24e0` for selectors `2/3`, or the caller text when present, and finally re-enters `multiplayer_transport_set_route_mode` `0x595650` when the earlier route-mode decision armed a transition. This now bounds the helper as the named selector-view slot-clear and callback-slot-`18` publication lane rather than an anonymous route-mode side effect.","objdump + local disassembly + callback-table install correlation + caller inspection"
0x0059fab0,58,multiplayer_transport_callback_rekey_named_selector_view_entry_and_publish_slot21,shell,cdecl,inferred,objdump + local disassembly,3,"Callback-root helper installed in the same selector descriptor lane at `0x59fc80`. It resolves the current selector through `0x5951a0`, rekeys the named selector-view entry through `multiplayer_transport_rekey_selector_view_entry_preserving_slot_runtime` `0x595010`, and then publishes callback slot `21` through `0x593000` using the old and new selector names plus the caller context in `edx`. Current grounded role is the rename or relabel sibling next to the slot-clear lane, not a generic selector-text setter.","objdump + local disassembly + callback-table install correlation"
0x0059faf0,98,multiplayer_transport_callback_set_selector_slot_sample_text_and_refresh_active_object,shell,cdecl,inferred,objdump + local disassembly,2,"Callback-root helper adjacent to `0x59fab0`. After resolving the caller selector name into one slot index through `0x5951a0`, it copies up to `0x200` bytes of caller text into the fixed selector sample buffer at `[this+0x39c+slot*0x200]`, clears the trailing byte at `[this+0x59b+slot*0x200]`, and, when an active selector object is still present at `[this+0x390+slot*4]`, refreshes that object through `0x592d30`. This currently bounds the helper as the selector-sample-text update lane rather than a broader selector-table mutator.","objdump + local disassembly + selector-buffer correlation"
0x0059fb60,104,multiplayer_transport_callback_replace_selector_slot_name_set_request_default_profile_keys_and_publish_slot20,shell,cdecl,inferred,objdump + local disassembly,3,"Callback-root helper installed at offset `0x24` in the selector descriptor lane seeded by `0x59fc80`. It resolves the caller selector name into one slot index through `0x5951a0`, clears that selector slot from every selector-view entry through `multiplayer_transport_clear_selector_view_slot_from_all_entries` `0x5950a0`, then iterates one caller-supplied name list and re-upserts each name into that slot through `multiplayer_transport_upsert_selector_name_entry` `0x594f20` using the paired caller-side flag words. After the replacement sweep it requests the default profile-key bundle for that selector slot through `0x596fc0` and publishes callback slot `20` through `0x592fc0`.","objdump + local disassembly + callback-table install correlation + caller inspection"
0x0059fbd0,69,multiplayer_transport_callback_query_slot_built_in_profile_key_and_publish_slot28,shell,cdecl,inferred,objdump + local disassembly,3,"Callback-root helper installed at offset `0x28` in the selector descriptor lane seeded by `0x59fc80`. It resolves the caller selector name into one slot index through `0x5951a0`, forwards the caller trio into `multiplayer_transport_query_slot_built_in_profile_key_and_publish_slot28_on_success` `0x596b90`, and then publishes the same trio through `multiplayer_transport_enqueue_callback_slot28_record` `0x593200`. This currently bounds the helper as the built-in per-slot profile-key query sibling next to the selector-set replacement lane, rather than another generic selector-text path.","objdump + local disassembly + callback-table install correlation + helper correlation"
0x0059fc20,44,multiplayer_transport_callback_set_named_selector_presence_mask_bits_0x20_0x40,shell,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Small callback-root helper in the selector descriptor lane installed by `0x59fc80`. It resolves the caller selector name into one slot index through `multiplayer_transport_find_selector_name` `0x5951a0`, then forwards the caller byte-mask payload into `multiplayer_transport_set_selector_presence_mask` `0x594d00` using that resolved slot index. Current evidence is strongest for the named selector-presence-mask setter over bits `0x20/0x40`, not for a broader selector-table mutation.","llvm-objdump + local disassembly + caller correlation + selector-presence correlation"
0x0059fc50,37,multiplayer_transport_callback_publish_slot12_for_named_selector,shell,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Small callback-root sibling in the same selector descriptor lane installed by `0x59fc80`. It resolves the caller selector name into one slot index through `multiplayer_transport_find_selector_name` `0x5951a0` and then forwards the caller seven-dword payload block into `multiplayer_transport_enqueue_callback_slot12_record` `0x592d70` using that resolved slot index. This is the current strongest safe read for the named-selector callback-slot-`12` publisher.","llvm-objdump + local disassembly + caller correlation + callback-slot12 correlation"
0x0059fc80,90,multiplayer_transport_init_second_selector_descriptor_lane_callback_table,shell,thiscall,inferred,llvm-objdump + caller correlation + local disassembly,3,"Initializes the second selector-descriptor callback lane used by the selector-text and selector-view request owners `0x593aa0` and `0x593c40`. The helper zeroes the caller-supplied `0x30`-byte descriptor table, stores the owner transport pointer at `[table+0x2c]`, and installs the full callback vector: `0x59f720`, `0x59f850`, `0x59f8b0`, `0x59f9c0`, `0x59fab0`, `0x59faf0`, `0x59fc50`, `0x59fc20`, `0x59fb60`, and `0x59fbd0`. With the surrounding callback roots already grounded, the strongest current read is the real descriptor-lane initializer rather than another anonymous stack-table fill.","llvm-objdump + caller correlation + local disassembly + callback-lane correlation"
0x005a07c0,300,multiplayer_gamespy_server_descriptor_queue_activate_entry_timestamp_and_emit_query_packet,shell,unknown,inferred,llvm-objdump + local disassembly + caller inspection,3,"Active-send owner in the compact server-descriptor queue family. The helper appends the caller descriptor into the active list rooted at `[queue+0x08]`, stamps the current tick into `[entry+0x1c]`, then builds and sends one outbound UDP query packet through queue socket `[queue+0x20]`. In queue mode `1` it emits the `0xfe 0xfd 0x00` GameSpy-style query header plus either the descriptor-owned keyed-property text at `[entry+0x28]` or the `0xff/0xff/0xff` fallback trio; in the other grounded mode it emits one of two short static payloads from `0x005e24e8` or `0x005e24f4` depending on descriptor flag bit `0x4`. The destination endpoint normally comes from descriptor tuple `[entry+0x00/+0x04]`, but when that tuple matches queue companion dword `[queue+0x24]` and descriptor state bit `0x2` is set it switches to the secondary tuple `[entry+0x08/+0x0c]`. Current grounded caller is `multiplayer_gamespy_server_descriptor_queue_insert_with_pending_state_tag` `0x005a09a0`.","llvm-objdump + local disassembly + caller inspection + queue-family correlation + active-list correlation + outbound-query correlation"
0x005a0940,4,multiplayer_gamespy_server_descriptor_queue_set_companion_dword_filter,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Tiny setter for one queue-family-side companion dword at `[this+0x24]`. Current grounded callers are the field-snapshot mode dispatcher `0x595a40` and the `gsi_am_rating` route-event dispatcher `0x595e10`, where mode `5` copies the transport-staged route companion dword from `[transport+0x490]` into transport field `[transport+0x54]` and then mirrors the same value into this queue-side slot. The heavier queue service path `0x5a0b40` later uses `[this+0x24]` as the alternate endpoint companion filter when matching descriptors that carry secondary-endpoint state bit `0x2`, so this is now the safest current read for the shared queue companion-dword setter rather than an opaque local store.","objdump + local disassembly + caller inspection + queue-service correlation + companion-dword-slot correlation"
0x005a0950,18,multiplayer_gamespy_server_descriptor_queue_clear_active_and_pending_lists,shell,cdecl,inferred,objdump,3,"Clears both linked lists in one compact server-descriptor queue family by forwarding the active list at `[this+0x08]` and pending list at `[this+0x14]` into the shared list-clear helper `0x5a07b0`. Current grounded caller is `multiplayer_transport_reset_am_rating_route_state`, which uses it to clear the queued-descriptor family at `[transport+0x1e7c]`.","objdump + caller inspection + queue-family correlation"
0x005a0970,48,multiplayer_gamespy_server_descriptor_queue_destroy_and_release_owned_buffer,shell,cdecl,inferred,objdump,2,"Destructor-side helper for one compact server-descriptor queue family. It releases the owned scratch buffer or stream handle at `[this+0x20]` through `0x58bc4e`, resets that slot to `-1`, and then clears the active and pending lists through the same lower list-clear helper used by `0x005a0950`. Current grounded caller is the queued-descriptor family teardown path beneath the multiplayer transport callback-table shutdown.","objdump + caller inspection + queue-family correlation"
0x005a09a0,84,multiplayer_gamespy_server_descriptor_queue_insert_with_pending_state_tag,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Inserts one compact server descriptor into a queue family while stamping a pending state tag into descriptor byte `[entry+0x14]`. The helper first clears transient state bits `0x4/0x8/0x10`; then its second stack argument chooses pending bit `0x4` or `0x8`, which later service code promotes into ready bits `0x1` or `0x2`. When local threshold dword `[queue+0x10]` is below dword `[queue+0x04]`, the helper immediately activates and emits the descriptor through `multiplayer_gamespy_server_descriptor_queue_activate_entry_timestamp_and_emit_query_packet` `0x005a07c0`; otherwise its first stack argument chooses whether insertion goes through the pending-list path at `[queue+0x14]` or the active-list path at `[queue+0x08]`. Current grounded callers use pending tag `0x4` for the local field-cache family at `[transport+0x1724]` and pending tag `0x8` for the `gsi_am_rating` queued-descriptor family at `[transport+0x1e7c]`.","objdump + local disassembly + caller inspection + queue-state correlation + active-send correlation"
0x005a0a00,195,multiplayer_gamespy_server_descriptor_queue_handle_mode1_reply_and_publish_owner_callback,shell,unknown,inferred,llvm-objdump + local disassembly + caller inspection,3,"Mode-`1` reply processor for one active compact descriptor entry. When the entry is still unprocessed at `[entry+0x00] == 0`, the helper either consumes the variable keyed-property payload through `0x0058fb10` plus repeated `0x0058d0f0` writes when descriptor flag bit `0x4` is set, or consumes the fixed response blob through `0x0058d3a0` otherwise. It then sets the corresponding ready bits in `[entry+0x14]`, clears the pending bits, rewrites `[entry+0x1c]` from creation tick to elapsed age, removes the entry from the active list rooted at `[queue+0x08]`, and publishes owner callback mode `0` through `[queue+0x40]` with cookie `[queue+0x44]`. Current grounded caller is the queue receive-service owner `0x005a0b40`.","llvm-objdump + local disassembly + caller inspection + queue-family correlation + reply-processing correlation"
0x005a0ad0,105,multiplayer_gamespy_server_descriptor_queue_handle_nonmode1_reply_and_publish_owner_callback,shell,unknown,inferred,llvm-objdump + local disassembly + caller inspection,3,"Non-mode-`1` reply processor for one active compact descriptor entry. The helper first matches the response body against fixed token `0x005e2504`, then routes the caller response through `0x0058d350`, updates descriptor state byte `[entry+0x14]` to the corresponding ready-bit form, rewrites `[entry+0x1c]` as elapsed age, removes the entry from the active list `[queue+0x08]`, and publishes owner callback mode `0` through `[queue+0x40]` with cookie `[queue+0x44]`. Current grounded caller is the queue receive-service owner `0x005a0b40` when queue mode dword `[queue+0x00]` is not `1`.","llvm-objdump + local disassembly + caller inspection + queue-family correlation + reply-processing correlation"
0x005a0b40,222,multiplayer_gamespy_server_descriptor_queue_service_socket_receive_and_match_active_entries,shell,unknown,inferred,llvm-objdump + local disassembly + caller inspection,3,"Main receive-side service pass for one compact server-descriptor queue family. While the queue-owned UDP socket `[queue+0x20]` remains readable, the helper drains one datagram through `recvfrom`, NUL-terminates the received body, walks the active intrusive list rooted at `[queue+0x08]`, matches either the primary endpoint tuple `[entry+0x00/+0x04]` or the secondary tuple `[entry+0x08/+0x0c]` when queue companion dword `[queue+0x24]` and descriptor state bit `0x2` permit it, and then dispatches the matched response into `0x005a0a00` for queue mode `1` or `0x005a0ad0` for the alternate grounded mode. Current grounded caller is the broader queue service owner `0x005a0c80`.","llvm-objdump + local disassembly + caller inspection + queue-family correlation + active-list correlation + receive-service correlation"
0x005a0c00,74,multiplayer_gamespy_server_descriptor_queue_expire_stale_active_entries_and_publish_timeout_mode1,shell,unknown,inferred,llvm-objdump + local disassembly + caller inspection,3,"Expiry sweep over the active descriptor list `[queue+0x08]`. The helper compares each head entry's timestamp `[entry+0x1c]` against the current tick plus fixed grace window `0x9c4`, marks expired entries with state bit `0x10` while clearing pending bits, publishes owner callback mode `1` through `[queue+0x40]` with cookie `[queue+0x44]`, and then pops them from the active list through `0x005a0740`. Current grounded caller is the broader queue service owner `0x005a0c80`.","llvm-objdump + local disassembly + caller inspection + queue-family correlation + expiry correlation"
0x005a0c50,47,multiplayer_gamespy_server_descriptor_queue_promote_pending_entries_into_active_send_window,shell,thiscall,inferred,llvm-objdump + local disassembly + caller inspection,3,"Promotion pass between the pending and active intrusive lists in the same queue family. While active-threshold dword `[queue+0x10]` stays below dword `[queue+0x04]` and pending-count dword `[queue+0x1c]` is still positive, the helper pops one descriptor from the pending list `[queue+0x14]` and immediately activates plus emits it through `multiplayer_gamespy_server_descriptor_queue_activate_entry_timestamp_and_emit_query_packet` `0x005a07c0`. Current grounded caller is the broader queue service owner `0x005a0c80`.","llvm-objdump + local disassembly + caller inspection + queue-family correlation + promotion correlation + active-send correlation"
0x005a0c80,79,multiplayer_gamespy_server_descriptor_queue_service_and_publish_empty_transition,shell,cdecl,inferred,objdump,3,"Recurring service helper for one compact server-descriptor queue family. When the family still owns descriptors it runs the heavier refresh pass at `0x5a0b40`, the age or expiry sweep at `0x5a0c00`, and the compaction pass at `0x5a0c50`; if the family becomes empty afterward it notifies the owner callback at `[this+0x40]` with mode `2` and null entry. Current grounded callers are `multiplayer_transport_service_route_callback_tables`, which services the transport-owned field-cache family at `[transport+0x1724]` and the companion `gsi_am_rating` queued-descriptor family at `[transport+0x1e7c]`.","objdump + caller inspection + queue-family correlation"
0x005a0cc0,16,multiplayer_gamespy_server_descriptor_append_bounded_token_byte,shell,thiscall,inferred,llvm-objdump + local disassembly,2,"Tiny helper in the compact server-descriptor family. When live count dword `[this+0x3c]` is still below `0x14`, the helper appends caller byte `DL` into the local token band rooted at `[this+0x28]` and then increments that count field. This is the safest current read for one bounded descriptor-token byte appender rather than a generic vector push helper.","llvm-objdump + local disassembly + queue-family correlation"
0x005a0cd0,35,multiplayer_gamespy_server_descriptor_queue_remove_matching_entry,shell,cdecl,inferred,objdump,3,"Removes one matching compact descriptor from a queue family by probing the active list at `[this+0x08]` first and falling back to the pending list at `[this+0x14]` when no active match is found. Current grounded caller is `multiplayer_transport_dispatch_am_rating_route_event_mode`, which removes descriptors carrying pending state bits `0x4/0x8` from the `gsi_am_rating` queued family at `[transport+0x1e7c]`.","objdump + caller inspection + queue-family correlation"
0x005970e0,156,multiplayer_transport_status_route_publish_selector_name_or_probe_average_or_forward_owner,shell,cdecl,inferred,objdump + caller correlation + strings,3,"Status-route callback helper from the six-entry route vector seeded by `multiplayer_transport_try_connect_status_route`. When the transport is active and the status-route gate around `[this+0x398]`, `[this+0xb44]`, and bit `0x4` in `[this+0xb38]` permits it, event id `0x15` resolves the active selector-view entry through `0x594dc0` mode `2` and appends the returned selector text through `0x58bce0`, while event id `0x18` resolves that same entry and publishes the averaged probe sample from `[entry+0x80]` through `0x58cd40`. When no active entry is available it falls back to the fixed text token at `0x005c87a8`. Outside those bounded cases it forwards the same `(event id, payload)` pair into the owner callback at `[this+0x17e0]` with context `[this+0x17f8]`. This is currently the strongest safe role for one status-route callback-vector lane, while the exact user-facing label of the averaged sample remains open.","objdump + caller correlation + strings + selector-view correlation"
0x00597180,40,multiplayer_transport_status_route_forward_owner_event_payload,shell,cdecl,inferred,objdump + caller correlation,3,"Thin owner-forwarding lane in the status-route callback vector. It forwards the caller event id in `ecx` and payload pointer in `edx` into the owner callback at `[this+0x17e4]` with context `[this+0x17f8]` when that callback is present, and otherwise returns immediately. Current grounded caller is the status-route callback table seeded by `multiplayer_transport_try_connect_status_route`.","objdump + caller correlation"
0x005971b0,192,multiplayer_transport_status_route_seed_control_id_list_and_notify_owner,shell,cdecl,inferred,objdump + caller correlation + strings,3,"Status-route callback-vector lane that seeds one control-id list into the caller byte builder through `0x58bcb0`. In its first grounded mode it appends the currently available local status-control ids, including the always-on `8` lane plus conditional ids `1`, `0x0b`, `0x13`, `0x14`, and `0x0a` according to the current status-route state at `[this+0x1ecc]`, `[this+0xb4c]`, `[this+0xb3c]`, and `[this+0xb48]`; in its second grounded mode it emits the smaller pair `0x15` and `0x18`. After seeding that local list it optionally forwards the same mode plus builder into the owner callback at `[this+0x17e8]` with context `[this+0x17f8]`. Current grounded caller is the status-route callback table seeded by `multiplayer_transport_try_connect_status_route`.","objdump + caller correlation + control-id-list correlation"
0x00597270,80,multiplayer_transport_status_route_query_third_selector_generation_or_forward_owner_scalar,shell,cdecl,inferred,objdump + caller correlation,2,"Small scalar-query lane in the status-route callback vector. When the caller event id is `1` and the transport-side status gate around `[this+0x398]`, `[this+0xb44]`, and bit `0x4` in `[this+0xb38]` permits it, the helper returns the third selector-slot generation counter at `[this+0xac0]`. Otherwise it forwards the same selector or scalar query into the owner callback at `[this+0x17ec]` with context `[this+0x17f8]`, returning zero when that callback is absent. Current grounded caller is the status-route callback table seeded by `multiplayer_transport_try_connect_status_route`.","objdump + caller correlation + selector-generation correlation"
0x005972c0,97,multiplayer_transport_handle_validated_route_cookie_event,shell,cdecl,inferred,objdump,3,"Validated subtype-`4` callback for the transport-owned GameSpy route family. The route constructor seeds this helper into `[route+0x9c]`; after multiplayer_gamespy_route_dispatch_inbound_packet validates the current route cookie it forwards the event id in `ecx`, the remaining payload pointer in `edx`, and the owner transport context from `[route+0x104]`. When multiplayer_transport_is_route_mode_active_nonterminal succeeds it marks `[this+0x1ed8]` and re-enters multiplayer_transport_set_route_mode with a mode-selection bit derived from `[this+0x1ed4]` and `[this+0x18b8]`; otherwise it falls back to the owner callback at `[this+0x17f0]` using context `[this+0x17f8]`.","objdump"
0x00597300,3,multiplayer_transport_noop_status_route_owner_callback,shell,cdecl,inferred,objdump + local disassembly,2,"Three-byte `ret 4` stub in the status-route helper strip. Current local layout shows it sitting immediately before the owner-callback dispatchers at `0x597303` and `0x597330`, so the safest current read is a no-op status-route owner callback placeholder rather than a hidden route-state mutator.","objdump + local disassembly + callback-strip correlation"
0x00597303,28,multiplayer_transport_forward_validated_route_cookie_event_to_owner_callback_0x17f0,shell,cdecl,inferred,objdump + local disassembly,3,"Owner-callback forwarding lane immediately beside `multiplayer_transport_handle_validated_route_cookie_event` `0x5972c0`. It checks owner callback slot `[this+0x17f0]`, and when present forwards the caller event id in `ebx`, payload wrapper in `edi`, and owner context `[this+0x17f8]`. Current grounded caller is the fallback branch inside `0x5972c0`, so this is the clearest explicit dispatcher for the validated cookie-event owner callback slot rather than another generic route callback shim.","objdump + local disassembly + caller correlation + callback-slot correlation"
0x00597330,28,multiplayer_transport_forward_validated_extended_route_payload,shell,cdecl,inferred,objdump,3,"Small forwarding callback used for the transport-owned status route's validated extended-payload slot. It treats `edx` as the owner transport object, checks the owner callback pointer at `[this+0x17f4]`, and when present forwards the validated payload wrapper in `ecx` together with owner context `[this+0x17f8]`. Current grounded caller is the status-route connect helper through multiplayer_gamespy_route_set_extended_payload_callback.","objdump"
0x00597350,30,multiplayer_transport_release_status_route,shell,cdecl,inferred,ghidra-headless,3,Releases the auxiliary status-route object stored at [this+0xaf0] through 0x58cfd0 and clears the owner slot afterward. Status-pump cleanup fixed-token publishing and the auxiliary route connect helper use this before rebuilding status-route state.,ghidra + rizin + llvm-objdump
0x00597370,16,multiplayer_transport_service_status_route_if_live,shell,cdecl,inferred,objdump + local disassembly,3,"Tiny status-route service helper for the session-event transport. When the auxiliary status route at `[this+0xaf0]` is live it forwards that route object into the shared low-level route tick helper `0x58cf90`; otherwise it returns immediately. Current grounded callers are `multiplayer_transport_publish_selector2_fixed_token_status_and_refresh_route_mode` `0x58e100` and the route-object sweep `0x597380`.","objdump + local disassembly + caller inspection"
0x00597380,34,multiplayer_transport_service_status_and_live_routes,shell,cdecl,inferred,objdump + local disassembly,3,"Recurring route-object sweep for the session-event transport. It first services the auxiliary status route at `[this+0xaf0]` through the broader route-object service helper `0x58d040` when present, then applies that same helper to the current live route at `[this+0x1ecc]`. The current grounded caller is the recurring multiplayer transport frame service, so this is now the explicit two-route owner sweep rather than a vague route-side tick wrapper.","objdump + local disassembly + caller inspection + route-object-service correlation"
0x005973b0,30,multiplayer_transport_release_live_route,shell,cdecl,inferred,ghidra-headless,4,Releases the current live route object stored at [this+0x1ecc] through 0x58cfd0 and clears the owner slot afterward. The route-mode setter and connect helper use it before rebuilding or switching live route state.,ghidra + rizin + llvm-objdump
0x005973d0,170,multiplayer_transport_try_connect_status_route,shell,cdecl,inferred,objdump + local disassembly + strings + caller correlation,3,"Attempts to connect or rebuild the auxiliary status-route object at `[this+0xaf0]`. It first releases any existing status route through `multiplayer_transport_release_status_route` `0x597350`, then seeds the full six-entry callback vector `0x596fd0/0x5970e0/0x597180/0x5971b0/0x597270/0x5972c0` together with owner scalar `[this+0xb34]`, owner context string `[this+0x60]`, and route-side callback storage `[this+0xaf4]`. When the caller route id is `-1` it opens the default route id `0x1964` through `multiplayer_gamespy_try_open_udp_socket_bind_local_endpoint_and_construct_route` `0x58cc40`; otherwise it uses the caller route id through `multiplayer_gamespy_route_construct_and_seed_callback_vector` `0x58c9b0` after zero-extending the supplied route word. On success it copies stored route label pointer `[this+0x9a8]` into `[this+0xb3c]`, patches the created route object's extended-payload callback slot `[route+0xa0]` through `multiplayer_gamespy_route_set_extended_payload_callback` `0x58bc90` using `multiplayer_transport_forward_validated_extended_route_payload` `0x597330`, clears status-route mode mask `[this+0xb38]`, and returns `1`; failure returns `0` without those patches. The optional route callbacks stay bounded too: current local evidence still shows no transport-owned post-construction writes to `[route+0xa4]` or `[route+0xd4]`, so the raw-fallback and semicolon-packet parser branches remain inactive for this status-route family. Current grounded callers are the one-shot wrapper `0x5965a0`, the selector-status refresh owner `0x595650`, and the names-query response path `0x58e100` that later services this route through `0x597370`.","objdump + local disassembly + strings + caller correlation + callback-vector correlation + status-route correlation + route-id-width correlation + inactive-optional-slot correlation"
0x00597480,281,multiplayer_transport_try_connect_live_route,shell,cdecl,inferred,objdump + local disassembly + strings + caller correlation,3,"Attempts to connect or rebuild the current live route object at `[this+0x1ecc]`. It first releases any existing live route through `multiplayer_transport_release_live_route` `0x5973b0`, then builds one `0x20`-byte local identifier from owner text `[this+0x60]` plus suffix template `0x005dccfc` through `0x5a18a0` and `0x5a1eb0`. The helper then seeds the full live-route callback vector rooted at `0x596fd0`, `0x5970e0`, `0x597180`, `0x5971b0`, `0x597270`, and `0x5972c0`, forwards owner scalar `[this+0xb34]`, and chooses between the default route id `0x1964` through `multiplayer_gamespy_try_open_udp_socket_bind_local_endpoint_and_construct_route` `0x58cc40` when binding dword `[binding+0x2c]` is `-1`, or the binding-specific id in word `[binding+0x30]` through `multiplayer_gamespy_route_construct_and_seed_callback_vector` `0x58c9b0` otherwise. On the binding-specific path it also clears any pending rebuild cookie at `[binding+0x34]` and marks the newly constructed route live by storing `1` into `[route+0xbc]`. On success it mirrors stored route label pointer `[this+0x9a8]` into `[this+0xb3c]`, patches the created route object's extended-payload callback slot `[route+0xa0]` through `multiplayer_gamespy_route_set_extended_payload_callback` `0x58bc90` using `multiplayer_transport_forward_validated_extended_route_payload` `0x597330`, clears live-route mode mask `[this+0xb38]`, and mirrors success into deferred route-status flag `[this+0x1ed8]`, which the later mode-`4` branch in `0x595e10` uses to choose route mode `1` versus `3`. Failure returns `0`. The optional route callbacks stay bounded too: current local evidence still does not show transport-owned post-construction writes to `[route+0xa4]` or `[route+0xd4]`, so the raw-fallback and semicolon-packet parser branches remain inactive for this live-route family.","objdump + local disassembly + strings + caller correlation + live-route-callback-vector correlation + deferred-route-flag correlation + extended-payload-callback correlation + inactive-optional-slot correlation"
0x00598230,67,multiplayer_transport_enqueue_names_query_record,shell,cdecl,inferred,ghidra-headless,3,Allocates one 0x10-byte transient names-query work item zeroes its four dword fields and submits it through 0x5980f0 as request kind `3` using the caller-provided sample or callback context pointer. The helper returns the allocated work item on success and null on allocation or submit failure. Current grounded caller is multiplayer_transport_submit_names_query_with_callback.,ghidra + rizin + llvm-objdump
0x0058f0a0,99,multiplayer_transport_append_user_and_optional_nick_commands,shell,cdecl,inferred,rizin,3,Builds the initial identity command bundle for one multiplayer transport worker. It appends `USER %s %s %s :%s` to the owned text stream using worker text fields at [this+0x3ac] [this+0x42c] and [this+0x4b0] together with the fallback host `127.0.0.1` then checks the current nick through multiplayer_transport_is_valid_nick_string and either falls through multiplayer_transport_dispatch_or_release_callback_binding with mode `1` or appends `NICK %s` directly through the same text-stream path.,rizin + llvm-objdump + strings
0x0058f920,72,hashed_entry_table_upsert,support,cdecl,inferred,rizin,4,Generic hashed-entry-table upsert over a bucket array of contiguous vectors. It computes the bucket index through the table hash callback at [this+0x0c] looks for an existing matching entry through hashed_entry_table_lookup and when found overwrites that slot through generic_vector_overwrite_with_callback; otherwise it appends the caller record into the selected bucket vector through 0x0059e4d0.,rizin + llvm-objdump
0x0058f970,69,hashed_entry_table_remove,support,cdecl,inferred,rizin,4,Generic hashed-entry-table remove over a bucket array of contiguous vectors. It hashes the caller key into one bucket and erases the matching slot through generic_vector_erase_with_callback when present; otherwise it returns false.,rizin + llvm-objdump
0x0058f9c0,63,hashed_entry_table_lookup,support,cdecl,inferred,rizin,4,Generic hashed-entry-table lookup over a bucket array of contiguous vectors. It hashes the caller key into one bucket resolves the matching index through generic_vector_find_index and returns the matched entry pointer or null.,rizin + llvm-objdump
0x0058f110,465,multiplayer_transport_worker_init,shell,cdecl,inferred,rizin,3,"Initializes one heap-backed multiplayer transport worker and its owned text-stream and store state. It zeroes the `0x5e4`-byte worker copies caller identifier strings into the fixed buffers at `[this+0x00]`, `[this+0x36c]`, `[this+0x3ac]`, `[this+0x42c]`, and `[this+0x4b0]`, copies one 5-dword descriptor block into `[this+0x534]`, seeds the state fields at `[this+0x04]` and `[this+0x558]`, initializes the registered-name store at `[this+0x548]`, the pending-template dispatch store at `[this+0x54c]`, and the owned text-stream object at `[this+0x1c]`, and tears partial state back down on failure.","rizin + llvm-objdump"
0x0058f2f0,60,multiplayer_transport_worker_create,shell,cdecl,inferred,rizin,3,"Thin allocation wrapper for multiplayer_transport_worker_init. It allocates one `0x5e4`-byte worker block through tracked_heap_alloc_with_header and then forwards the descriptor pointer already staged in `EDX` plus the caller argument bundle into multiplayer_transport_worker_init.","rizin + llvm-objdump"
0x0059d430,47,string_hash_sum_mod,support,cdecl,inferred,rizin,3,Small string-hash helper that accumulates one normalized integer value per input byte through 0x005a5900 and returns the running sum modulo the caller divisor. Current grounded callers use it as the bucket-selector callback for registered-name entry tables.,rizin + llvm-objdump
0x0059d470,57,multiplayer_transport_lookup_registered_name,shell,cdecl,inferred,ghidra-headless,3,Copies one caller string into a stack-local buffer and looks it up against the registered-name store rooted at [this+0x548] through hashed_entry_table_lookup. It returns the matched entry pointer or null. Current grounded callers are multiplayer_transport_has_registered_name and the deeper names-query payload helper family.,ghidra + rizin + llvm-objdump
0x0059d520,91,multiplayer_transport_init_registered_name_store,shell,thiscall,inferred,rizin,4,Initializes the transport-side registered-name store by allocating the hashed bucket table at [this+0x548] with 7 buckets and a 0x1e0-byte entry shape through 0x0058f840 and then allocating the companion flat entry vector at [this+0x54c] through 0x0059e0b0. On allocation failure it tears any partial state back down.,rizin + llvm-objdump
0x0059d580,35,multiplayer_transport_destroy_registered_name_store,shell,thiscall,inferred,rizin,4,Destroys the transport-side registered-name store by releasing the hashed bucket table at [this+0x548] through 0x0058f8b0 and the companion flat entry vector at [this+0x54c] through generic_vector_destroy when present.,rizin + llvm-objdump
0x0059d5b0,70,multiplayer_transport_append_flat_registered_name_stub,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Builds one zeroed `0x1e0`-byte registered-name stub on the stack from the caller string and appends that stub into the companion flat registered-name vector at `[this+0x54c]` through `generic_vector_push_back` `0x0059e4d0`. Current grounded caller is the bound-route or selector-text request submit owner `0x0058e720`, which uses it to refresh the flat registered-name side before later removal through `0x0059d760`.","objdump + local disassembly + caller inspection + flat-registered-name correlation"
0x0059d610,81,multiplayer_transport_contains_registered_name_entry,shell,cdecl,inferred,rizin,3,Linear membership check over the flat registered-name entry vector at [this+0x54c]. It compares each live entry against the caller key through 0x005a57cf and returns true on the first exact match.,rizin + llvm-objdump
0x0059d670,240,multiplayer_transport_upsert_registered_name_entry,shell,cdecl,inferred,rizin,3,Builds one temporary 0x1e0-byte registered-name entry on the stack from the caller descriptor and name string; allocates the entry-owned callback table through 0x0058f840; removes any older flat-vector entry with the same key from [this+0x54c]; and then inserts or replaces the canonical entry in the hashed registered-name store at [this+0x548] through hashed_entry_table_upsert.,rizin + llvm-objdump
0x0059d760,103,multiplayer_transport_remove_registered_name_entry,shell,cdecl,inferred,rizin,4,Copies the caller name into a stack-local temporary key; removes any matching entry from the flat registered-name vector at [this+0x54c]; and then removes the canonical hashed-store entry from [this+0x548] through hashed_entry_table_remove.,rizin + llvm-objdump
0x0059df60,130,multiplayer_transport_find_registered_name_entry_and_optionally_return_bucket,shell,cdecl,inferred,llvm-objdump + local disassembly + caller inspection,3,"Search helper over the worker-owned registered-name store at `[worker+0x548]`. The helper copies the caller name string into one stack-local buffer, walks the hashed entry table through `generic_callback_list_for_each` `0x58fa00` and local callback `0x59df00`, and returns success only when one registered-name entry exactly matches that copied string. When the optional out-pointer arguments are nonnull it also publishes the matched entry pointer and its owning bucket or vector pointer before returning `1`; otherwise it returns `0`. Current grounded callers are the tiny guard wrapper `0x58eb10` and the selector-text or registered-name fastpath family above `0x59f8b0`.","llvm-objdump + local disassembly + caller inspection + registered-name-store correlation"
0x0058fa00,49,generic_callback_list_for_each,support,cdecl,inferred,ghidra-headless,4,Generic callback-list walker over one `[items count]` style callback collection. It uses generic_vector_for_each to visit every entry pointer and forwards the caller context through the supplied callback shim unchanged. Transport registration and the registered-name fast path reuse it to fan out one callback over all registered entries.,rizin + llvm-objdump
0x0058fa40,47,hashed_entry_table_for_each_reverse,support,cdecl,inferred,objdump + local disassembly,4,"Walks one hashed-entry table bucket array in bucket order and runs `generic_vector_for_each_reverse` `0x59e1d0` on each live bucket vector. The helper forwards the caller callback shim in `edx` and the shared context pointer from the stack unchanged. Current grounded callers use it to service selector callback-name tables under `0x596900`.","objdump + local disassembly + caller inspection"
0x0058fa80,53,hashed_entry_table_find_first,support,cdecl,inferred,objdump + local disassembly,4,"Scans one hashed-entry table bucket array in bucket order and returns the first element whose caller predicate matches through `generic_vector_find_first` `0x59e200`. It forwards the caller predicate shim in `edx` and the shared context pointer from the stack unchanged, returning null when no element matches.","objdump + local disassembly + caller inspection"
0x0058fac0,37,hashed_entry_table_clear_with_callback,support,thiscall,inferred,objdump + local disassembly,4,"Clears every bucket vector in one hashed-entry table by walking the bucket array and forwarding each live vector into `generic_vector_clear_with_callback` `0x59e4b0`. Current grounded callers use it as the inactive-slot clear path under the selector callback-name service owner `0x596900`.","objdump + local disassembly + caller inspection"
0x0059e110,3,generic_vector_count,support,cdecl,inferred,rizin,4,Returns the current element count from dword [this+0x00] for one contiguous vector-style container.,rizin + llvm-objdump
0x0059e120,10,generic_vector_index_ptr,support,cdecl,inferred,rizin,4,Computes one element pointer as base [this+0x14] plus index times stride [this+0x08]. Most higher-level vector helpers funnel slot access through this helper.,rizin + llvm-objdump
0x0059e130,58,generic_vector_erase,support,cdecl,inferred,rizin,4,Removes one indexed element from a contiguous vector. When the erased slot is not already the tail it memmoves the trailing span down and then decrements the element count at [this+0x00].,rizin + llvm-objdump
0x0059e170,21,generic_vector_sort,support,cdecl,inferred,rizin,4,Sorts the backing element range at [this+0x14] through the shared qsort-style helper using the current count and stride from the vector header.,rizin + llvm-objdump
0x0059e190,49,generic_vector_for_each,support,cdecl,inferred,rizin,4,Forward iterator for one contiguous vector. It walks indices `0..count-1` resolves each slot through generic_vector_index_ptr and invokes the caller callback with the shared context argument.,rizin + llvm-objdump
0x0059e1d0,42,generic_vector_for_each_reverse,support,cdecl,inferred,rizin,4,Reverse iterator for one contiguous vector. It walks indices `count-1..0` and invokes the caller callback on each resolved slot pointer.,rizin + llvm-objdump
0x0059e200,61,generic_vector_find_first,support,cdecl,inferred,rizin,4,Scans the vector from the front and returns the first element pointer whose caller predicate returns zero. When no match is found it returns null.,rizin + llvm-objdump
0x0059e2f0,19,generic_vector_invoke_element_callback,support,cdecl,inferred,rizin,4,Invokes the optional per-element callback stored at [this+0x10] for one indexed slot when that callback pointer is nonnull. Erase overwrite and destroy helpers reuse it before mutating storage.,rizin + llvm-objdump
0x0059e310,31,generic_vector_store_at,support,cdecl,inferred,rizin,4,Copies one caller-supplied element record into the indexed slot resolved through generic_vector_index_ptr using the current element stride from the vector header.,rizin + llvm-objdump
0x0059e330,49,generic_vector_destroy,support,cdecl,inferred,rizin,4,Walks all live elements through generic_vector_invoke_element_callback then frees the backing storage at [this+0x14] and finally releases the vector object itself through tracked_heap_free_with_header.,rizin + llvm-objdump
0x0059e370,87,generic_vector_insert_copy_at,support,cdecl,inferred,rizin,4,Ensures capacity grows through 0x0059e090 when full increments the count shifts the tail upward when inserting before the end and copies the caller element record into the requested slot through generic_vector_store_at.,rizin + llvm-objdump
0x0059e3d0,22,generic_vector_erase_with_callback,support,cdecl,inferred,rizin,4,Calls generic_vector_invoke_element_callback for the indexed slot and then removes that slot through generic_vector_erase. Current grounded callers use it for registered-name and callback-entry teardown paths.,rizin + llvm-objdump
0x0059e3f0,33,generic_vector_overwrite_with_callback,support,cdecl,inferred,rizin,4,Invokes generic_vector_invoke_element_callback for one indexed slot and then copies the caller replacement record back into that same slot through generic_vector_store_at. Hashed entry-table upsert uses it when replacing an existing matching record.,rizin + llvm-objdump
0x0059e420,137,generic_vector_find_index,support,cdecl,inferred,rizin,4,Returns the index of one matching element within the contiguous vector or `-1` when none is found. Depending on the caller flag it uses either the linear comparator scan at 0x0059e240 or the ordered search helper at 0x0059e290 and derives the final index from the matched element pointer and stride.,rizin + llvm-objdump
0x0059e4b0,32,generic_vector_clear_with_callback,support,cdecl,inferred,objdump + local disassembly + caller inspection,4,"Clears a contiguous vector by iterating indices from `count-1` down to `0` and erasing each slot through `generic_vector_erase_with_callback` `0x0059e3d0`. Higher-level callers use it as the release-side clear path before destroying or reinitializing vector-backed stores.","objdump + local disassembly + caller inspection + vector-clear correlation"
0x0059e4d0,13,generic_vector_push_back,support,cdecl,inferred,objdump + local disassembly + caller inspection,4,"Appends one caller-supplied element record to the end of a contiguous vector. When the vector pointer is nonnull it forwards the current count as the target index into `generic_vector_insert_copy_at` `0x0059e370`; otherwise it becomes a no-op. Higher-level callers use it as the common push-back path for opcode records, registered-name stubs, hashed-bucket vectors, and queued UDP callback records.","objdump + local disassembly + caller inspection + vector-append correlation"
0x0059d7f0,86,multiplayer_transport_collect_registered_name_callback_entries,shell,cdecl,inferred,ghidra-headless,3,Callback collector used by the registered-name fast path. For each callback entry in the name entry's callback list it grows two parallel pointer arrays in the caller scratch frame through tracked_heap_resize_with_header and appends the callback entry pointer plus its `[entry+0xdc]` payload pointer. Current grounded caller is multiplayer_transport_dispatch_registered_name_query_fastpath through generic_callback_list_for_each.,ghidra + rizin + llvm-objdump
0x0059d850,114,multiplayer_transport_dispatch_registered_name_query_fastpath,shell,cdecl,inferred,ghidra-headless,3,Fast path for multiplayer_transport_submit_names_query_with_callback when the queried sample already exists in the registered-name table. It resolves the name entry through multiplayer_transport_lookup_registered_name collects entry-owned callback state through multiplayer_transport_collect_registered_name_callback_entries and invokes the caller callback through multiplayer_transport_invoke_registered_name_query_callback without enqueueing a transport names-query record. Temporary callback arrays are released through tracked_heap_free_with_header on exit.,ghidra + rizin + llvm-objdump
0x0059d8d0,15,multiplayer_transport_has_registered_name,shell,cdecl,inferred,ghidra-headless,3,Boolean wrapper over multiplayer_transport_lookup_registered_name. It returns true when the caller string resolves to one registered-name entry in the transport-side table and false otherwise. Current grounded caller is multiplayer_transport_submit_names_query_with_callback.,ghidra + rizin + llvm-objdump
0x0059d8e0,64,multiplayer_transport_try_read_registered_name_header_block,shell,cdecl,inferred,rizin,4,Looks up one registered-name entry and when the header-valid flag at `[entry+0x154]` is set copies the 7-dword header block at `[entry+0x138]` into the caller buffer and returns true. Otherwise it returns false without mutating the destination.,rizin + llvm-objdump
0x0059d920,48,multiplayer_transport_set_registered_name_header_block,shell,cdecl,inferred,rizin,4,Looks up one registered-name entry copies 7 caller-supplied dwords into the header block at `[entry+0x138]` and sets the paired valid flag at `[entry+0x154]` to one.,rizin + llvm-objdump
0x0059d950,112,multiplayer_transport_set_registered_name_status_text,shell,cdecl,inferred,rizin,3,Looks up one registered-name entry frees the prior heap string at `[entry+0x158]` and replaces it with a heap copy of the caller text or the shared empty string when the caller passes null. This is the main per-name status or topic text setter for the registered-name store.,rizin + llvm-objdump
0x0059d9c0,32,multiplayer_transport_mark_registered_name_dirty,shell,cdecl,inferred,rizin,3,Looks up one registered-name entry and sets the dword dirty or active flag at `[entry+0x15c]` to one.,rizin + llvm-objdump
0x0059d9e0,32,multiplayer_transport_get_registered_name_dirty,shell,cdecl,inferred,rizin,3,Looks up one registered-name entry and returns the current dword dirty or active flag stored at `[entry+0x15c]` or zero when the entry is absent.,rizin + llvm-objdump
0x0059da00,64,multiplayer_transport_set_registered_name_display_text,shell,cdecl,inferred,rizin,3,Looks up one registered-name entry copies up to 0x80 bytes of caller text into the embedded buffer at `[entry+0x160]` through string_copy_bounded_zerofill and clears the trailing byte flag at `[entry+0x1df]`. This is a second inline text field distinct from the heap string at `[entry+0x158]`.,rizin + llvm-objdump
0x0059da40,208,multiplayer_transport_upsert_registered_name_callback_entry,shell,cdecl,inferred,rizin,4,Looks up one registered-name entry zeroes a temporary 0xe0-byte nested callback-entry record copies the secondary key string into the local record and when both payload blocks are provided copies 0x18 bytes into `[record+0x80]` and 0x40 bytes into `[record+0x98]` sets the local active flag at `[record+0xd8]` and stores one caller dword at `[record+0xdc]` before upserting the record into the entry-owned callback table at `[entry+0x134]` through hashed_entry_table_upsert.,rizin + llvm-objdump
0x0059db10,80,multiplayer_transport_remove_registered_name_callback_entry,shell,cdecl,inferred,rizin,4,Looks up one registered-name entry copies the caller secondary key into a stack-local temporary and removes the matching nested callback-entry record from the entry-owned callback table at `[entry+0x134]` through hashed_entry_table_remove.,rizin + llvm-objdump
0x0059db90,96,multiplayer_transport_dispatch_registered_name_callback_entry,shell,cdecl,inferred,rizin,3,Fans one callback descriptor over the transport-side registered-name store. It copies the primary name into a stack-local key builds a small dispatch frame and visits all registered-name entries through generic_callback_list_for_each where helper 0x0059db60 resolves the matching nested callback-entry record and invokes the descriptor function pointer at `[desc+0x08]` with the descriptor owner context plus the secondary key plus the payload cookie plus the owning registered-name entry.,rizin + llvm-objdump
0x0059dcb0,48,multiplayer_transport_update_registered_name_callback_key,shell,cdecl,inferred,rizin,3,Visits every registered-name entry through generic_callback_list_for_each and runs helper 0x0059dbf0 to rewrite one nested callback-entry key. The helper removes the existing nested record from `[entry+0x134]` copies the replacement key into the local record reinserts it through hashed_entry_table_upsert and conditionally emits transport opcode 8 through 0x0059b790 when the name entry is marked dirty and has owner callbacks installed.,rizin + llvm-objdump
0x0059dce0,256,multiplayer_transport_update_registered_name_callback_flags,shell,cdecl,inferred,rizin,4,Looks up one registered-name entry then resolves one nested callback-entry record by secondary key from the entry-owned callback table at `[entry+0x134]`. Depending on the caller mode flag it ORs or clears the caller bitmask against `[subentry+0xdc]` and when the parent entry has transport callbacks installed publishes an opcode-11 update through 0x0059b790 carrying the primary name plus the secondary key plus the new flag mask.,rizin + llvm-objdump
0x0059de00,64,multiplayer_transport_dispatch_registered_name_callbacks,shell,cdecl,inferred,rizin,3,If the owning transport is active at `[*this]` it walks the full registered-name store through generic_callback_list_for_each and helper 0x0059dde0 increments a dispatch count and invokes the caller-provided callback function for each live registered-name entry.,rizin + llvm-objdump
0x0059de40,96,multiplayer_transport_stage_registered_name_callback_payload,shell,cdecl,inferred,rizin,3,Resolves one nested callback-entry record by secondary key from the caller registered-name entry then copies a 0x18-byte payload block into `[subentry+0x80]` and a 0x40-byte payload block into `[subentry+0x98]` null-terminates both copied regions and sets the active flag at `[subentry+0xd8]` to one.,rizin + llvm-objdump
0x0059dea0,96,multiplayer_transport_stage_registered_name_callback_payload_for_name,shell,cdecl,inferred,rizin,3,Looks up one primary registered-name entry then fans helper multiplayer_transport_stage_registered_name_callback_payload across the registered-name store through generic_callback_list_for_each using the caller secondary key plus the two payload buffers. Current grounded role is a primary-name keyed payload staging wrapper for nested callback-entry records.,rizin + llvm-objdump
0x0059df00,96,multiplayer_transport_try_resolve_registered_name_callback_payload,shell,cdecl,inferred,rizin,4,Fast resolver for one nested callback-entry payload. When the descriptor either has no selector string or matches the shared two-byte default token at 0x005e1e1c it looks up the nested callback-entry record by key from `[entry+0x134]` and if the entry is active at `[subentry+0xd8]` marks the descriptor successful and returns pointers to the staged payload blocks at `[subentry+0x80]` and `[subentry+0x98]`.,rizin + llvm-objdump
0x005934c0,30,multiplayer_transport_next_work_sequence,shell,thiscall,inferred,ghidra-headless,3,"Returns the next monotonically increasing transport work-sequence value by incrementing dword `[this+0x177c]` and clamping negative wraparound back to zero. Current grounded callers now bound this more tightly than a generic work-sequence source: the returned dword is also the shared immediate-drain context id later copied into queued work field `+0x0c`, mirrored into active opcode-record field `+0x14`, and waited on through `0x58d720` by the text-submission and callback-table registration roots.","ghidra + rizin + llvm-objdump"
0x00593650,229,multiplayer_transport_attach_callback_table_descriptor,shell,cdecl,inferred,objdump + local disassembly,3,"Builds one transport-side callback-table descriptor from caller metadata and then links it through `multiplayer_transport_worker_create` `0x58f2f0`. The helper first allocates one transient work record through `multiplayer_transport_allocate_and_enqueue_work_record` `0x5934e0`; this lane is now tighter: it uses work-record type `0`, leaves field `+0x08` zero, duplicates the first caller metadata dword into both fields `+0x0c` and `+0x10`, and carries the second caller metadata dword in field `+0x18` for the later replay path through `multiplayer_transport_publish_callback_table_binding_result_and_release_work_record` `0x593570`. It then installs callback vectors from `0x59f5c0` and `0x59f650`, copies the caller transport pointer into the local descriptor frame, always installs `multiplayer_transport_worker_callback_store_route_scalar_and_forward_into_0x597780` `0x593630` as the second worker callback, and only installs `multiplayer_transport_worker_callback_enqueue_opcode5_binding_record_from_work_triplet` `0x593610` as the first worker callback when transport field `[this+0x4c]` is nonzero. Failure unlinks the staged work record through `multiplayer_transport_remove_queued_work_record_by_pointer` `0x5933a0`. The current grounded caller is `multiplayer_transport_register_callback_table`.","objdump + local disassembly + work-queue correlation + callback-binding-triplet correction + worker-callback correlation"
0x00593d00,85,multiplayer_transport_fastpath_submit_text_shim_copy_local_name_and_maybe_reemit_followon_callback,shell,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Callback shim installed by `multiplayer_transport_try_submit_text_record_fastpath` `0x593d60` above the fast local-name and immediate-callback owner `0x58e510`. When the incoming result flag in `EDX` is nonzero, it copies the returned text at the second stack argument into the owner transport's local-name buffer rooted at `[transport+0x04]`. It then checks the staged callback function pointer in work field `+0x10`; when that pointer is nonnull it forwards the copied text, staged callback function, callback companion, and drain context id through `multiplayer_transport_enqueue_callback_record` `0x593170`. The shim always finishes by unlinking the consumed work record through `multiplayer_transport_remove_queued_work_record_by_pointer` `0x5933a0`. Current grounded caller is the type-`9` text fastpath owner `0x593d60`, so this is the clean callback-and-copy shim above that fastpath rather than a generic string copy helper.","objdump + local disassembly + caller correlation + text-fastpath correlation + callback-wrapper correlation"
0x00593d60,66,multiplayer_transport_try_submit_text_record_fastpath,shell,cdecl,inferred,ghidra-headless,3,"Attempts the fast submission path for one prepared transport text record. It allocates a type-`9` transient record through `0x005934e0`, again staging the shared transport wrapper triplet as `(drain context id +0x0c, callback fn +0x10, callback companion +0x18)`, and when that succeeds forwards the caller callback and payload through `0x0058e510` with callback shim `0x00593d00`. That shim copies the returned text into `[transport+0x04]` and, when work field `+0x10` is nonnull, re-emits one follow-on callback record through `0x00593170` using the staged callback pointer and companion plus the same drain context id. The current grounded caller is `multiplayer_transport_submit_text_record`.","ghidra + rizin + llvm-objdump + work-record-triplet correlation + local disassembly"
0x00593db0,144,multiplayer_transport_hash_pair_of_ordered_status_strings_mod_divisor,shell,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Hash callback installed by `multiplayer_transport_ensure_aux_selector_view_sidecar_worker_and_seed_runtime` `0x593fe0` into the auxiliary selector-view sidecar allocator `0x58faf0`. The helper first orders the two fixed `0x40`-byte status strings rooted at `(entry, entry+0x40)` by lexical compare, then walks the chosen ordered pair bytewise, maps each signed character through `0x5a5900`, accumulates the resulting integer sum, and after each string reduces that rolling sum modulo the caller-supplied divisor from the first stack argument. The final remainder is returned in `EAX`. Current evidence therefore bounds this as the pair-hash callback for the sidecar keyed store rather than a generic string checksum.","objdump + local disassembly + caller correlation + selector-view-sidecar correlation"
0x00593e40,176,multiplayer_transport_compare_pair_of_ordered_status_strings_for_sidecar_key_equality,shell,cdecl,inferred,objdump + local disassembly + caller correlation,3,"Equality callback installed by `multiplayer_transport_ensure_aux_selector_view_sidecar_worker_and_seed_runtime` `0x593fe0` into the auxiliary selector-view sidecar allocator `0x58faf0`. It receives two records, treats each as the same fixed two-string key rooted at `(base, base+0x40)`, lexically orders the pair inside each record, and then compares the ordered string pairs through `0x5a57cf`. The helper returns nonzero only when both ordered string slots match. Current evidence therefore bounds this as the sidecar key-equality predicate paired with `0x593db0`, not a broader selector-name comparator.","objdump + local disassembly + caller correlation + selector-view-sidecar correlation"
0x00593ef0,1,multiplayer_transport_aux_selector_view_sidecar_noop_release_callback,shell,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Trivial `ret` callback installed as the third callback in the auxiliary selector-view sidecar allocator `0x58faf0` beneath `0x593fe0`. Current local evidence shows no cleanup work at all, so this is the current safest read for the sidecar's no-op release or dispose callback.","objdump + local disassembly + caller correlation"
0x00598d50,496,multiplayer_transport_handle_registered_name_callback_bind_record_mode1,shell,cdecl,inferred,rizin,3,Owner-side wrapper for record mode 1 in the registered-name branch. It parses the mode prefix from the secondary key string at record field `+0x08` checks whether the primary name matches the local transport name at `[this+0x36c]` and either seeds one local registered-name entry through multiplayer_transport_upsert_registered_name_entry plus multiplayer_transport_set_registered_name_status_text or upserts one nested callback-entry record through multiplayer_transport_upsert_registered_name_callback_entry and emits follow-up opcode 6 or opcode 12 notifications when the target name entry is already marked dirty.,rizin + llvm-objdump
0x00598f40,255,multiplayer_transport_handle_registered_name_callback_remove_record_mode1,shell,cdecl,inferred,rizin,3,Owner-side removal wrapper for registered-name record mode 1. It resolves the primary and secondary key strings from the caller record removes the matching nested callback-entry through multiplayer_transport_remove_registered_name_callback_entry and then emits opcode 7 or opcode 12 notifications from the current registered-name owner callbacks when the target entry is dirty.,rizin + llvm-objdump
0x00599040,308,multiplayer_transport_handle_registered_name_callback_remove_record_mode23,shell,cdecl,inferred,rizin,3,Owner-side removal wrapper for registered-name record modes 2 and 3. It removes one nested callback-entry record by secondary key and then branches on whether the primary name matches the local transport name. The local-owner branch can emit opcode 5 and remove the whole registered-name entry through multiplayer_transport_remove_registered_name_entry while the remote branch emits opcode 7 subtype notifications through the installed owner callbacks.,rizin + llvm-objdump
0x00599180,160,multiplayer_transport_publish_registered_name_callback_remove_mode1,shell,cdecl,inferred,rizin,3,Small publish helper for registered-name callback-removal mode 1. It removes the named nested callback-entry and then emits the same owner callback notifications as the wider mode-1 removal path through opcode 7 and opcode 12 when the target entry is dirty and callback-enabled.,rizin + llvm-objdump
0x00599230,25,multiplayer_transport_dispatch_registered_name_callback_remove_mode1,shell,cdecl,inferred,rizin,3,Dispatch shim for registered-name callback-removal mode 1. When the input record kind equals 1 it forwards the primary name and one mode-1 removal helper descriptor into multiplayer_transport_dispatch_registered_name_callback_entry so the removal helper runs against each matching registered-name entry.,rizin + llvm-objdump
0x00599250,160,multiplayer_transport_publish_registered_name_callback_remove_mode3,shell,cdecl,inferred,rizin,3,Small publish helper for registered-name callback-removal mode 3. It removes the named nested callback-entry and emits the mode-3 owner callback notifications through opcode 7 and opcode 12 when the target registered-name entry is dirty and callback-enabled.,rizin + llvm-objdump
0x00599300,25,multiplayer_transport_dispatch_registered_name_callback_remove_mode3,shell,cdecl,inferred,rizin,3,Dispatch shim for registered-name callback-removal mode 3. When the input record kind equals 2 it forwards the primary name and one mode-3 removal helper descriptor into multiplayer_transport_dispatch_registered_name_callback_entry.,rizin + llvm-objdump
0x00599320,93,multiplayer_transport_handle_registered_name_display_text_record_mode2,shell,cdecl,inferred,rizin,4,Owner-side wrapper for registered-name display-text record mode 2. It copies the record string into the inline display buffer through multiplayer_transport_set_registered_name_display_text and when the target registered-name entry has an installed owner callback emits opcode 9 carrying the primary name and copied display text.,rizin + llvm-objdump
0x00599380,253,multiplayer_transport_apply_registered_name_update_bundle,shell,cdecl,inferred,rizin,4,Applies one parsed update bundle to an existing registered-name entry. It walks the decoded element list from 0x00598630 and uses the element tags to route updates into multiplayer_transport_update_registered_name_callback_flags multiplayer_transport_set_registered_name_status_text and the header read or write pair multiplayer_transport_try_read_registered_name_header_block plus multiplayer_transport_set_registered_name_header_block before releasing the decoded bundle object.,rizin + llvm-objdump
0x005997f0,177,multiplayer_transport_handle_registered_name_display_text_record_mode3,shell,cdecl,inferred,rizin,3,Owner-side wrapper for registered-name display-text record mode 3. It stores the supplied display text into the inline registered-name buffer and either resolves one pending template node through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node or falls back to emitting opcode 9 through the installed owner callback for the target registered-name entry.,rizin + llvm-objdump
0x005998b0,171,multiplayer_transport_handle_registered_name_display_text_clear_record,shell,cdecl,inferred,rizin,3,Owner-side wrapper for clearing registered-name display text. It builds a small mode-2 template with the shared empty string and either satisfies that request through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node or emits opcode 9 with the empty display text through the installed owner callback for the target registered-name entry.,rizin + llvm-objdump
0x00599960,144,multiplayer_transport_handle_pending_template_pair_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Structural mode-3 wrapper over the pending-template path. It builds one single-entry pending-template query from the pair of caller strings then resolves a matching node through multiplayer_transport_find_pending_template_node and dispatches it through multiplayer_transport_dispatch_pending_template_node. When no pending node exists it falls back to the transport-side callback at `[this+0x04]` through multiplayer_transport_dispatch_or_release_callback_binding.,llvm-objdump
0x005999f0,412,multiplayer_transport_handle_registered_name_callback_payload_record_mode8,shell,cdecl,inferred,rizin,3,Owner-side wrapper for registered-name record mode 8. It stages the supplied nested callback-entry payload blocks through multiplayer_transport_stage_registered_name_callback_payload_for_name and then walks the returned template nodes to emit higher-level follow-up notifications including opcode 0x16 and opcode 0x17 based on the decoded template kinds and the marker characters found in the staged payload text through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node.,rizin + llvm-objdump
0x00599c40,96,multiplayer_transport_copy_backslash_segment,shell,cdecl,inferred,llvm-objdump,4,Copies one backslash-delimited segment from the caller text into a freshly allocated heap string and writes the consumed byte count back through the out-parameter. Higher-level pending-template handlers reuse it to split multi-segment payloads before dispatch or callback fallback.,llvm-objdump
0x00599ca0,320,multiplayer_transport_handle_segment_list_template_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Mode-4 pending-template wrapper for template kind 0x0c. It resolves one pending node through multiplayer_transport_find_pending_template_node splits the caller payload into a temporary heap string list with multiplayer_transport_copy_backslash_segment and then either dispatches that list through multiplayer_transport_dispatch_pending_template_node or falls back to emitting opcode 0x1e through the node-owned callback path before freeing the temporary segments.,llvm-objdump
0x00599de0,128,multiplayer_transport_handle_pair_template_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Compact mode-4 pending-template wrapper for template kind 0x0c. After multiplayer_transport_find_pending_template_node succeeds it forwards two dword values from the matched node-owned payload block into one simple dispatch descriptor and completes the request through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x00599e60,768,multiplayer_transport_handle_segment_broadcast_template_record_mode5,shell,cdecl,inferred,llvm-objdump,3,Structural mode-5 pending-template wrapper over split payload broadcasting. One branch matches a fixed token and walks the registered-name owner callback list to emit opcode 0x1d once per backslash-delimited segment. The other branch resolves one template-kind 0x0d pending node builds a temporary split-string array with multiplayer_transport_copy_backslash_segment optionally appends node-owned paired strings and then either dispatches the finished descriptor through multiplayer_transport_dispatch_pending_template_node or falls back to opcode 0x1f through the node callback path.,llvm-objdump
0x0059a160,128,multiplayer_transport_handle_triplet_template_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Compact mode-4 pending-template wrapper for template kind 0x0d. After multiplayer_transport_find_pending_template_node succeeds it forwards the caller primary string plus two dword fields from the matched node payload block through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059a1e0,1024,multiplayer_transport_handle_segment_pair_template_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Structural mode-4 sibling of the split-payload template path for template kind 0x0e. One branch matches the fixed auxiliary token and emits opcode 0x1d once per backslash-delimited segment through the installed registered-name owner callbacks. The other branch resolves one pending node builds a temporary split-string array with multiplayer_transport_copy_backslash_segment appends paired node-owned strings and completes the request through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059a650,64,multiplayer_transport_mark_pending_template_kind1_ready,shell,cdecl,inferred,llvm-objdump,3,Small pending-template helper that looks up one kind-1 node through multiplayer_transport_find_pending_template_node and sets the first dword in its payload block to one when present.,llvm-objdump
0x0059a690,448,multiplayer_transport_stage_pending_template_triplet_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Mode-4 helper for pending-template kind 1. It resolves one kind-1 node through multiplayer_transport_find_pending_template_node duplicates the caller strings plus one normalized helper string into heap storage emits opcode 0x0e through 0x0059b790 using the node-owned callback metadata and appends the three staged values into the node payload's parallel pointer arrays for later dispatch.,llvm-objdump
0x0059a850,112,multiplayer_transport_dispatch_pending_template_quintuple_helper,shell,cdecl,inferred,llvm-objdump,3,Small helper that resolves one kind-5 pending-template node through multiplayer_transport_find_pending_template_node and forwards the four dword payload fields stored at `[node+0x1c+0x04..0x10]` through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059a8c0,272,multiplayer_transport_handle_registered_name_update_bundle_record_mode3plus,shell,cdecl,inferred,llvm-objdump,3,Owner-side registered-name update handler for record kinds 3 and above. It decodes one update bundle through 0x00598630 and 0x00598860 tries the registered-name header read or write path through multiplayer_transport_try_read_registered_name_header_block plus multiplayer_transport_set_registered_name_header_block publishes opcode 0x0a when the target entry already has owner callbacks and then completes any waiting kind-5 pending-template node through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059a9d0,320,multiplayer_transport_handle_pending_template_triplet_record_mode6,shell,cdecl,inferred,llvm-objdump,3,Mode-6 pending-template wrapper that looks up either a kind-4 or kind-7 node through multiplayer_transport_find_pending_template_node. The kind-4 branch copies three caller strings into the node-owned payload slots while the kind-7 branch formats a derived string through 0x0059cbd0 and completes the request through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059ab10,256,multiplayer_transport_handle_token_list_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Mode-3 pending-template helper for kind 4. It parses the caller text into a token list with 0x005a3db9 trims leading `-` `@` and `+` markers duplicates each token into heap storage and appends the cleaned strings into the node-owned dynamic vector after multiplayer_transport_find_pending_template_node succeeds.,llvm-objdump
0x0059ac10,144,multiplayer_transport_dispatch_extended_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Mode-3 helper for kind-4 pending-template nodes. After multiplayer_transport_find_pending_template_node succeeds it builds one extended dispatch descriptor from the caller string a boolean derived from the first payload dword and the remaining four dwords stored in the node payload block then completes the request through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059aca0,176,multiplayer_transport_append_string_template_record_mode8,shell,cdecl,inferred,llvm-objdump,3,Helper for pending-template kind 8. It resolves one node through multiplayer_transport_find_pending_template_node grows the node-owned pointer vector through tracked_heap_resize_with_header duplicates the caller string and appends that heap string to the vector.,llvm-objdump
0x0059ad50,112,multiplayer_transport_dispatch_string_vector_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Mode-3 dispatch helper for pending-template kind 8. It resolves one node through multiplayer_transport_find_pending_template_node then forwards the caller key together with the node-owned string-count and string-vector pointers through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059adc0,96,multiplayer_transport_handle_local_name_record_mode2,shell,cdecl,inferred,llvm-objdump,4,Mode-2 transport-state setter for the local name buffer at `[this+0x36c]`. It copies the caller string into that fixed buffer clears state dword `[this+0x04]` sets active flag `[this+0x00]` and when the transport owner callback at `[this+0x14]` is installed invokes it with mode `1` and the owner cookie at `[this+0x18]`.,llvm-objdump
0x0059ae20,176,multiplayer_transport_handle_transport_text_pair_record_mode3,shell,cdecl,inferred,llvm-objdump + local disassembly + caller inspection,3,"Mode-`3` transport-state setter for the paired text-stream cipher setup path. The helper accepts two caller strings from payload slab `[msg+0x20]`, XORs each of them in place against the repeating key string rooted at `[this+0x564]` through `0x005a1050`, then seeds the two RC4-style `0x102`-byte cipher states at `[this+0x242]` and `[this+0x140]` through `0x005a0d00`. It finally marks `[this+0x13c]` active and refreshes the transport-side status line rooted at `[this+0x1c]` through `0x0059caf0`.","llvm-objdump + local disassembly + caller inspection + multiplayer-transport correlation + stream-cipher correlation"
0x0059aed0,112,multiplayer_transport_handle_normalized_pair_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Mode-3 wrapper that normalizes the secondary caller string through 0x005a1ea5 then resolves one kind-0x10 pending-template node through multiplayer_transport_find_pending_template_node and completes it through multiplayer_transport_dispatch_pending_template_node with the normalized value plus the original secondary string.,llvm-objdump
0x00597920,56,multiplayer_transport_find_pending_template_kind0c_by_key,shell,cdecl,inferred,llvm-objdump,4,Searches the linked pending-template list rooted at `[this+0x550]` for the first kind-0x0c node whose payload string at `[node+0x1c+0x08]` exactly matches the caller key. It returns the matched node or null.,llvm-objdump
0x0059af40,186,multiplayer_transport_dispatch_fallback_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Mode-3 fallback wrapper over the pending-template path. It first queries for either a kind-1 or kind-5 node keyed by the caller string through multiplayer_transport_find_pending_template_node and dispatches the matching node through multiplayer_transport_dispatch_pending_template_node with a minimal descriptor. When neither node exists it falls back to multiplayer_transport_find_pending_template_kind0c_by_key and completes that node with an empty descriptor instead.,llvm-objdump
0x0059b000,103,multiplayer_transport_dispatch_kind1_string_template_record_mode6,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `6` and the original string payload.,llvm-objdump
0x0059b070,103,multiplayer_transport_dispatch_kind1_string_template_record_mode2,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `2` and the original string payload.,llvm-objdump
0x0059b0e0,103,multiplayer_transport_dispatch_kind1_string_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `3` and the original string payload.,llvm-objdump
0x0059b150,103,multiplayer_transport_dispatch_kind1_string_template_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `4` and the original string payload.,llvm-objdump
0x0059b1c0,103,multiplayer_transport_dispatch_kind1_string_template_record_mode5,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `5` and the original string payload.,llvm-objdump
0x0059b230,103,multiplayer_transport_dispatch_kind1_string_template_record_mode8,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `8` and the original string payload.,llvm-objdump
0x0059b2a0,1,multiplayer_transport_noop_cleanup_callback,shell,cdecl,inferred,llvm-objdump,2,Trivial no-op cleanup callback that returns immediately. Current grounded role is as a placeholder callback target in the transport cleanup layer.,llvm-objdump
0x0059b2b0,17,multiplayer_transport_release_optional_callback_binding,shell,cdecl,inferred,llvm-objdump,2,Small cleanup helper that checks the optional callback binding stored at `[this+0x04]` and when present forwards it into multiplayer_transport_dispatch_or_release_callback_binding with mode `1`.,llvm-objdump
0x0059b2d0,8,multiplayer_transport_free_template_entry_owner_string,shell,cdecl,inferred,llvm-objdump,3,Small element cleanup helper that releases the owner string pointer stored at `[entry+0x14]` through tracked_heap_free_with_header. The companion pending-template container uses it as the per-element cleanup callback when destroying its flat vector.,llvm-objdump
0x0059b2e0,1239,multiplayer_transport_destroy_pending_template_dispatch_record,shell,cdecl,inferred,llvm-objdump,3,Type-switched destructor for one pending-template dispatch record. It reads the record kind at `[record+0x00]` and frees the owned payload graph under `[record+0x08]` through tracked_heap_free_with_header including nested string arrays and paired pointer vectors for the more complex template kinds before finally releasing the top-level payload block itself.,llvm-objdump
0x0059b710,40,multiplayer_transport_init_pending_template_dispatch_store,shell,thiscall,inferred,llvm-objdump,3,Initializes the companion flat pending-template dispatch store at `[this+0x55c]` by allocating a stride-0x18 contiguous vector through 0x0059e0b0 and installing multiplayer_transport_free_template_entry_owner_string as the per-element cleanup callback. Returns true on success.,llvm-objdump
0x0059b740,74,multiplayer_transport_destroy_pending_template_dispatch_store,shell,thiscall,inferred,llvm-objdump,3,Destroys the companion flat pending-template dispatch store at `[this+0x55c]`. It walks every live element through multiplayer_transport_destroy_pending_template_dispatch_record and then releases the backing vector through generic_vector_destroy.,llvm-objdump
0x0059c220,458,multiplayer_transport_dispatch_pending_template_dispatch_record,shell,unknown,inferred,rizin,3,Switch-driven dispatcher for one flat pending-template dispatch-store record after the store manager has removed it from the vector. It reads the record kind at `[record+0x00]` invokes the record-owned callback at `[record+0x04]` with a payload tuple rooted at `[record+0x08]` and the owner string or selector at `[record+0x0c]` and then destroys the record through multiplayer_transport_destroy_pending_template_dispatch_record. Case `16` also resolves the registered-name dirty flag through 0x0059d9c0 before invoking the callback.,rizin + llvm-objdump
0x0059c470,203,multiplayer_transport_service_pending_template_dispatch_store,shell,unknown,inferred,rizin,3,"Services the flat pending-template dispatch store at `[this+0x55c]`. It walks every live 0x18-byte entry; entries whose owner string at `[entry+0x14]` no longer resolves through multiplayer_transport_has_registered_name are destroyed and erased immediately, while surviving entries are dispatched only when their registered-name dirty flag is nonzero and the optional filter value in EDX is zero or matches `[entry+0x10]`. Dispatching copies the 0x18-byte record to stack storage, erases the vector slot, and forwards the copied record into multiplayer_transport_dispatch_pending_template_dispatch_record.",rizin + llvm-objdump
0x0059c540,70,multiplayer_transport_find_pending_template_dispatch_record_index,shell,unknown,inferred,rizin,4,Searches the flat pending-template dispatch store at `[this+0x55c]` for the first record whose selector or request field at `[entry+0x10]` matches the caller key. It returns the zero-based vector index on success or `-1` when no record matches.,rizin + llvm-objdump
0x0059c590,21,multiplayer_transport_has_pending_template_dispatch_record,shell,unknown,inferred,rizin,4,Boolean wrapper over multiplayer_transport_find_pending_template_dispatch_record_index. It returns true when the flat pending-template dispatch store currently contains one record for the caller key and false otherwise.,rizin + llvm-objdump
0x0059c5b0,40,growable_text_buffer_init,support,unknown,inferred,rizin,3,"Initializes one heap-backed growable text buffer structure. It clears the used-length field at `[buf+0x04]`, seeds the initial capacity at `[buf+0x08]` to `0x2000`, allocates a `0x2001`-byte NUL-terminated backing block through tracked_heap_alloc_with_header, stores that pointer at `[buf+0x00]`, and returns true on success.",rizin + llvm-objdump
0x0059c5e0,3,growable_text_buffer_free,support,unknown,inferred,rizin,4,Small wrapper that frees the heap-backed buffer pointer stored at `[buf+0x00]` through tracked_heap_free_with_header.,rizin + llvm-objdump
0x0059c5f0,65,growable_text_buffer_reserve_append,support,unknown,inferred,rizin,4,Ensures that one growable text buffer has room to append the requested byte count in ECX while preserving a trailing NUL terminator. When `[buf+0x04] + requested` would exceed capacity `[buf+0x08]` it rounds the new capacity up in 0x2000-byte chunks resizes the backing block through tracked_heap_resize_with_header stores the new pointer at `[buf+0x00]` and updates `[buf+0x08]` before returning success or failure.,rizin + llvm-objdump
0x0059c640,35,growable_text_buffer_consume_prefix_and_slide_tail_down,support,cdecl,inferred,llvm-objdump + local disassembly + caller inspection,3,"Consumes one prefix from a growable text buffer by sliding the remaining tail down to the start of the backing block. The helper subtracts caller byte count `ECX` from used length `[buf+0x04]`, memmoves the remaining bytes from `[buf+0x00] + consumed` back to `[buf+0x00]`, and then restores the trailing NUL terminator. Current grounded callers are the text-stream send pump `0x0059c990` and the CRLF-line receive peel owner `0x0059d210`.","llvm-objdump + local disassembly + caller inspection + text-buffer correlation"
0x0059c670,76,multiplayer_transport_text_stream_init,shell,thiscall,inferred,rizin,3,Initializes one multiplayer transport text-stream object. It zeroes the 0x350-byte state block seeds socket `[this+0x00]` to `-1` and allocates two growable text buffers at `[this+0x108]` and `[this+0x114]` through growable_text_buffer_init. Failure to allocate the second buffer frees the first and returns false.,rizin + llvm-objdump
0x0059c6c0,196,multiplayer_transport_text_stream_connect_to_remote_host_and_port_with_keepalive,shell,thiscall,inferred,llvm-objdump + caller inspection,4,"Connects one multiplayer transport text-stream to the caller host and port. The helper first copies the caller host string into `[this+0x08]`, resolves the IPv4 dword through `inet_addr` `0x005b31f2` with `gethostbyname` fallback via thunk `0x0058bc42`, builds one `AF_INET` `sockaddr_in` using caller port byte-swapped through `htons` thunk `0x0058bc5a`, opens a stream socket through thunk `0x0058bc6c`, enables keepalive through `setsockopt(SOL_SOCKET, 8, 1)` via thunk `0x0058bc66`, and then connects through helper `0x005b3210`. On success it stores the live socket handle at `[this+0x00]` and sets state `[this+0x04] = 1`; on failure it closes any opened socket and returns false. Current grounded caller is `multiplayer_transport_worker_init` `0x0058f110`.","llvm-objdump + caller inspection + text-stream correlation + connect correlation"
0x0059c720,97,multiplayer_transport_text_stream_try_open_socket_set_keepalive_and_connect_stack_sockaddr,shell,stdcall,inferred,llvm-objdump + local disassembly + caller correlation,3,"Low-level TCP connect helper beneath the multiplayer text-stream worker seam. The function opens one stream socket through thunk `0x0058bc6c`, enables keepalive through `setsockopt(SOL_SOCKET, 8, 1)` via `0x0058bc66`, attempts `connect` through helper `0x005b3210` using the caller stack `sockaddr_in`, and on success stores the live socket into `[this+0x00]` while setting state `[this+0x04] = 1`. On failure it closes any opened socket and returns false. Current grounded caller is `multiplayer_transport_text_stream_connect_to_remote_host_and_port_with_keepalive` `0x0059c6c0`.","llvm-objdump + local disassembly + caller correlation + text-stream correlation + connect correlation"
0x0059c790,194,multiplayer_transport_text_stream_destroy,shell,thiscall,inferred,rizin,4,"Destroys one multiplayer transport text-stream object. If socket `[this+0x00]` is live it shuts it down with `shutdown(..., 2)` and `closesocket`, marks state `[this+0x04]` as closed, frees the two growable text buffers at `[this+0x108]` and `[this+0x114]`, releases the fixed pointer fields at `[this+0x328]` through `[this+0x344]`, then walks and frees the pointer vector rooted at `[this+0x348]` before freeing that vector itself.",rizin + llvm-objdump
0x0059c860,300,multiplayer_transport_select_socket_ready_flags,shell,cdecl,inferred,rizin,4,"Small `select` wrapper for one transport socket. It takes the socket on the stack plus up to three optional out-pointers for read write and exception readiness, builds the requested `fd_set` structures on the stack, calls `select(0x40, ...)` with a null timeout, and stores `1` or `0` into each requested out-slot depending on whether `__WSAFDIsSet` reports that socket as ready.",rizin + llvm-objdump
0x0059c990,113,multiplayer_transport_text_stream_send_pump,shell,thiscall,inferred,rizin,4,"Attempts to flush queued bytes from the transport text-stream send buffer at `[this+0x114]`. While buffered length `[this+0x118]` remains nonzero it probes writability through multiplayer_transport_select_socket_ready_flags, sends up to `min(len, 0x400)` bytes with `send`, slides any remaining buffered bytes down through `0x0059c640`, and continues until the socket is no longer writable or the buffer is empty.",rizin + llvm-objdump
0x0059ca10,190,multiplayer_transport_text_stream_recv_pump,shell,thiscall,inferred,rizin,3,Receives available socket text into the transport text-stream receive buffer at `[this+0x108]`. It first probes readability through multiplayer_transport_select_socket_ready_flags then repeatedly reserves 0x1000 bytes through growable_text_buffer_reserve_append calls `recv` into the free tail of the buffer optionally applies the stream-cipher helper at 0x005a0f70 when `[this+0x120]` is armed advances the used-length field at `[this+0x10c]` NUL-terminates the buffer and loops while readability remains set. Socket errors store closed-state value `2` into `[this+0x04]`.,rizin + llvm-objdump
0x0059cad0,25,multiplayer_transport_text_stream_service_io,shell,thiscall,inferred,rizin,4,Services one multiplayer transport text-stream I/O step unless state `[this+0x04]` is already closed. It first flushes queued outbound bytes through multiplayer_transport_text_stream_send_pump and then pumps inbound socket text through multiplayer_transport_text_stream_recv_pump.,rizin + llvm-objdump
0x0059caf0,216,multiplayer_transport_text_stream_append_crlf_line,shell,thiscall,inferred,rizin,4,"Appends one caller text line plus `\\r\\n` to the transport text-stream send buffer at `[this+0x114]`. It ignores requests when state `[this+0x04]` is already closed, reserves `strlen(text) + 2` bytes through growable_text_buffer_reserve_append, copies the bytes into the current tail tracked by `[this+0x118]`, appends CRLF, and updates the used-length field. When the stream-cipher gate at `[this+0x120]` is armed it post-processes the newly appended span through 0x005a0f70 using the send-side cipher state rooted at `[this+0x226]`.",rizin + llvm-objdump
0x0059cbd0,86,multiplayer_transport_text_stream_format_and_append_crlf_line_via_static_builder,shell,cdecl,inferred,llvm-objdump + caller inspection,4,"Formats one caller vararg message into the shared static builder at `0x00db8dd0` and immediately forwards it into `multiplayer_transport_text_stream_append_crlf_line` `0x0059caf0`. If text-stream state `[this+0x04]` is already closed it returns success without emitting anything. Otherwise it forwards `(buffer, format, &va_list)` into formatter `0x005a5b82`, NUL-terminates the resulting text either at the returned length or at fallback byte `0x00db9dcf` when the formatter reports `-1`, and then tail-jumps into the ordinary CRLF append path. Current grounded callers include `multiplayer_transport_worker_init` `0x0058f110`, where it emits `CRYPT des 1 %s`, and `multiplayer_transport_handle_pending_template_triplet_record_mode6` `0x0059a9d0`, where it formats the derived kind-7 payload string before dispatch.","llvm-objdump + caller inspection + text-stream correlation + formatting correlation"
0x0059cc30,355,multiplayer_transport_text_stream_split_prefix_token_into_nick_user_and_host_copies,shell,cdecl,inferred,llvm-objdump + caller inspection,3,"Splits one text-stream prefix token into owned subfields under the transient decode band rooted at `[this+0x328]`. The helper scans the caller string for `!` and `@`, allocates an owned copy of the leading nick-like stem into `[this+0x330]`, an owned copy of the middle user-like slice into `[this+0x334]`, and an owned copy of the trailing host-like slice into `[this+0x338]`, leaving any missing component null. On allocation failure it tears down the partially built subfield copies and returns false. Current grounded caller is `multiplayer_transport_text_stream_decode_isolated_line_into_transient_field_band_0x328` `0x0059cec0`.","llvm-objdump + caller inspection + text-stream correlation + prefix-split correlation"
0x0059cd90,93,multiplayer_transport_text_stream_append_owned_string_copy_to_transient_vector_0x348,shell,cdecl,inferred,llvm-objdump + caller inspection,3,"Appends one owned string copy into the transient pointer vector rooted at `[this+0x348]` with live-count `[this+0x34c]`. The helper first grows the backing pointer array at `[this+0x348]` when needed, then allocates an owned copy of the caller string, stores it into the next vector slot, and increments the live count. It returns false on either array-growth or string-allocation failure. Current grounded caller is `multiplayer_transport_text_stream_tokenize_field_into_owned_string_vector_with_colon_tail_split` `0x0059cdf0`.","llvm-objdump + caller inspection + text-stream correlation + transient-vector correlation"
0x0059cdf0,208,multiplayer_transport_text_stream_tokenize_field_into_owned_string_vector_with_colon_tail_split,shell,cdecl,inferred,llvm-objdump + caller inspection,3,"Tokenizes one decoded text-stream field into the transient owned-string vector at `[this+0x348]`. The helper first copies the caller field into mutable temporary storage, then either strips one leading `:` or splits once on one special delimiter pair before repeatedly resolving the remaining tokens through the local table-driven scanner at `0x005a3db9` and appending each owned string through `0x0059cd90`. It frees the temporary storage and returns false if any append fails. Current grounded caller is `multiplayer_transport_text_stream_decode_isolated_line_into_transient_field_band_0x328` `0x0059cec0`, which re-enters this helper for the later decoded fields.","llvm-objdump + caller inspection + text-stream correlation + transient-vector correlation"
0x0059cec0,846,multiplayer_transport_text_stream_decode_isolated_line_into_transient_field_band_0x328,shell,thiscall,inferred,llvm-objdump + caller inspection,3,"Decodes one already-isolated text-stream line into the worker-owned transient field band rooted at `[this+0x328]`. The helper first allocates an owned copy of the full line into `[this+0x328]`, then parses an optional colon-prefixed prefix token plus up to three space-delimited fields, repeatedly allocating owned copies into the adjacent transient slots while reusing helper `0x0059cc30` for prefix-side validation or decomposition and helper `0x0059cdf0` for later token classification. On any parse or allocation failure it tears down the partially built transient field band and returns false; on success it leaves the decoded transient pointers live under `[this+0x328..+0x344]` and returns true.","llvm-objdump + caller inspection + text-stream correlation + transient-field correlation"
0x0059d210,496,multiplayer_transport_text_stream_pop_next_crlf_delimited_line_decode_transient_field_band_and_slide_receive_buffer,shell,cdecl,inferred,llvm-objdump + caller inspection,4,"Consumes the next complete CR or LF delimited line from the transport text-stream receive buffer at `[this+0x108]`. The helper skips leading CRLF bytes, finds one nonempty line, temporarily NUL-terminates it in place, clears the previous transient decode band rooted at `[this+0x328]`, decodes the isolated line through `multiplayer_transport_text_stream_decode_isolated_line_into_transient_field_band_0x328` `0x0059cec0`, restores the saved terminator byte, and then slides the consumed prefix out of the receive buffer through `0x0059c640`. It returns true only when a complete line was decoded successfully into the transient field band.","llvm-objdump + caller inspection + text-stream correlation + transient-field correlation"
0x0059d400,48,multiplayer_transport_text_stream_service_decoded_line_and_return_transient_field_band_if_ready,shell,thiscall,inferred,llvm-objdump + caller inspection,4,"Small receive-side wrapper above the transient decode band. Unless text-stream state `[this+0x04]` is already closed, the helper checks whether the receive buffer currently holds any bytes at `[this+0x10c]`, attempts to peel and decode one complete line through `multiplayer_transport_text_stream_pop_next_crlf_delimited_line_decode_transient_field_band_and_slide_receive_buffer` `0x0059d210`, and returns pointer `[this+0x328]` when that decode succeeded. Otherwise it returns null.","llvm-objdump + caller inspection + text-stream correlation + transient-field correlation"
0x0059fce0,29,multiplayer_gamespy_udp_next_global_cookie_word,shell,cdecl,inferred,llvm-objdump + local disassembly,2,"Tiny global cookie-word allocator in the UDP callback-worker family. The helper returns the current word at `0x00db9fe4`, wraps the sentinel `0xffff` back to `1`, and otherwise increments that word in place before returning. Current grounded caller is the kind-`1` packet handler `0x005a0200`, which uses the returned word as the staged reply or timeout-registration key.","llvm-objdump + local disassembly + UDP-callback-worker correlation + cookie-word correlation"
0x0059fd00,125,multiplayer_gamespy_udp_try_decode_control_packet_0x91_v1_with_optional_0x18_payload,shell,cdecl,inferred,llvm-objdump + caller inspection + local disassembly,3,"Decodes one fixed `0x20`-byte GameSpy-side UDP control packet into a compact stack header plus optional payload. The helper copies the leading bytes and words into output fields `(tag, version, kind, word4, word6)`, accepts only tag `0x91`, version `1`, and kind `1..3`, and on success copies the trailing `0x18`-byte payload band into the caller buffer before returning true. Current grounded caller is the global UDP receive owner `0x005a0490`, which feeds successful decodes into the kind dispatcher `0x005a0440`.","llvm-objdump + caller inspection + local disassembly + UDP-callback-worker correlation + control-packet correlation"
0x0059fdc0,110,multiplayer_gamespy_udp_send_control_packet_0x91_v1_with_optional_0x18_payload_to_sockaddr,shell,cdecl,inferred,llvm-objdump + caller inspection + local disassembly,3,"Builds and sends one fixed `0x20`-byte UDP control packet to the caller `sockaddr_in`. The helper seeds tag `0x91`, version `1`, and caller words `(kind, word4, word6)`, copies the optional `0x18`-byte payload band when supplied or zero-fills it otherwise, and then emits the finished buffer through `sendto` thunk `0x0058bc54` on the global socket `0x00629f28`. Current grounded callers are the kind-`1` and kind-`2` handlers `0x005a0200` and `0x005a02f0`.","llvm-objdump + caller inspection + local disassembly + UDP-callback-worker correlation + control-packet correlation"
0x0059fe30,94,multiplayer_gamespy_udp_resolve_optional_host_and_port_into_stack_sockaddr_then_open_bind_global_socket,shell,cdecl,inferred,llvm-objdump + caller inspection + local disassembly,3,"Resolves one optional host string plus caller port into a stack `sockaddr_in`, then forwards that prepared address into the lower global socket-open helper `0x0059fe8e`. The helper seeds `AF_INET`, byte-swaps the caller port through `htons` thunk `0x0058bc5a`, parses dotted-quad text through `inet_addr` `0x005b31f2`, falls back to `gethostbyname` thunk `0x0058bc42`, and writes the chosen IPv4 dword into the stack sockaddr before tailing into the bind-side owner. Current grounded caller is the global worker bootstrap `0x005a0000`, which uses it when the immediate-bind flag is armed.","llvm-objdump + caller inspection + local disassembly + UDP-callback-worker correlation + sockaddr correlation"
0x0059fe8e,93,multiplayer_gamespy_udp_try_open_global_socket_set_reuseaddr_and_bind_stack_sockaddr,shell,cdecl,inferred,llvm-objdump + caller inspection + local disassembly,3,"Lower global UDP socket-open owner beneath `0x0059fe30`. The helper opens one datagram socket with protocol `0x11` through thunk `0x0058bc6c`, stores it in global `0x00629f28`, enables `SO_REUSEADDR` through `setsockopt(SOL_SOCKET, 4, 1)` via thunk `0x0058bc66`, and then binds the caller stack `sockaddr_in` through thunk `0x0058bc8a`. On failure it calls `WSAGetLastError` through `0x0058bc84` and returns false; on success it returns true. Current grounded callers are the hostname-resolve wrapper `0x0059fe30` and the global worker bootstrap `0x005a0000`.","llvm-objdump + caller inspection + local disassembly + UDP-callback-worker correlation + socket-bind correlation"
0x0059fef0,114,multiplayer_gamespy_udp_enqueue_global_callback_record_with_optional_copied_payload,shell,unknown,inferred,llvm-objdump + caller inspection + local disassembly,3,"Stages one global UDP callback record into the queued-callback vector rooted at `0x00db9fec`. The helper builds one stack-local `0x1c`-byte record from register fields `(ECX, DX, EBX, EAX)` plus two caller dwords, optionally allocates and copies one caller payload block through tracked-heap helper `0x0058f380`, stores that owned payload pointer into the staged record, and then appends the finished record through `generic_vector_push_back` `0x0059e4d0`. Current grounded callers are the kind-`2` and timeout paths `0x005a02f0` and `0x005a0550`, which use it to defer callback delivery out of the receive sweep.","llvm-objdump + caller inspection + local disassembly + UDP-callback-worker correlation + queued-callback correlation"
0x0059ff70,134,multiplayer_gamespy_udp_dispatch_and_free_queued_global_callback_records,shell,cdecl,inferred,llvm-objdump + local disassembly + caller inspection,3,"Drains the queued global callback vector rooted at `0x00db9fec`. The helper repeatedly copies the head `0x1c`-byte record to stack storage, erases that vector slot through `generic_vector_erase_with_callback` `0x0059e3d0`, dispatches the staged callback function pointer with its four payload arguments, frees the optional copied payload through `0x0058f3c0`, and continues until the vector is empty. Current grounded caller is the global service tick `0x005a05d0`.","llvm-objdump + local disassembly + caller inspection + UDP-callback-worker correlation + queued-callback correlation"
0x005a0000,274,multiplayer_gamespy_udp_global_callback_worker_bootstrap,shell,unknown,inferred,llvm-objdump + caller inspection + local disassembly,3,"Bootstraps the global UDP callback-worker family around active flag `0x00dba000`. The helper seeds the callback-state globals `0x00db9fd8..0x00db9ffc` from the caller tuple, allocates the `0x20`-stride timeout-registration vector at `0x00db9ff0` and the `0x1c`-stride queued-callback vector at `0x00db9fec` through `0x0059e0b0`, optionally opens the global UDP socket immediately through `0x0059fe30` when the immediate-bind flag is set, and on success marks `0x00dba000 = 1`. Failure tears down the socket, releases both vectors, and returns false. Current grounded callers sit in the GameSpy transport bring-up layer above this worker seam.","llvm-objdump + caller inspection + local disassembly + UDP-callback-worker correlation + bootstrap correlation"
0x005a0120,82,multiplayer_gamespy_udp_global_callback_worker_shutdown,shell,cdecl,inferred,llvm-objdump + local disassembly + caller inspection,2,"Shutdown companion to `0x005a0000` for the global UDP callback-worker family. When the worker is active and not inside the reentrancy guard `0x00db9ffc`, the helper closes the global socket `0x00629f28`, calls the shared Winsock cleanup wrapper `0x0058f490`, destroys the timeout-registration vector `0x00db9ff0`, destroys the queued-callback vector `0x00db9fec`, and clears active flag `0x00dba000` back to `0`.","llvm-objdump + local disassembly + caller inspection + UDP-callback-worker correlation + shutdown correlation"
0x005a0180,19,multiplayer_gamespy_udp_compare_timeout_registration_port_word,shell,cdecl,inferred,llvm-objdump + local disassembly + caller inspection,2,"Tiny comparator over the timeout-registration records rooted at `0x00db9ff0`. The helper subtracts record word `[entry+0x04]` values and returns the signed difference. Current grounded caller is the keyed lookup helper `0x005a01a0`, which uses it to find one registration by its stored port or cookie word.","llvm-objdump + local disassembly + caller inspection + UDP-callback-worker correlation + timeout-registration correlation"
0x005a01a0,66,multiplayer_gamespy_udp_find_timeout_registration_by_port_word,shell,cdecl,inferred,llvm-objdump + caller inspection + local disassembly,3,"Finds one timeout-registration record inside the `0x20`-stride vector rooted at `0x00db9ff0` by matching the caller word against record field `[entry+0x04]`. The helper forwards the search key and comparator `0x005a0180` into `generic_vector_find_index` `0x0059e420`, optionally writes the matched index through the caller out-parameter, and returns the matching record pointer or null. Current grounded callers are the kind-`2` and kind-`3` control-packet handlers `0x005a02f0` and `0x005a03d0`.","llvm-objdump + caller inspection + local disassembly + UDP-callback-worker correlation + timeout-registration correlation"
0x005a0200,225,multiplayer_gamespy_udp_handle_control_packet_kind1_issue_kind2_reply_and_optionally_stage_timeout_registration,shell,unknown,inferred,llvm-objdump + caller inspection + local disassembly,3,"Kind-`1` control-packet handler in the global UDP callback-worker family. The helper validates that decoded packet word4 is nonzero and word6 is zero, optionally allocates a new cookie word through `0x0059fce0`, optionally invokes the immediate packet callback rooted at `0x00db9ff4` to populate one `0x18`-byte reply payload, emits the corresponding kind-`2` reply through `0x0059fdc0`, and when the callback-registration function at `0x00db9fd8` is live appends one `0x20`-byte timeout-registration record into vector `0x00db9ff0` with the current tick, an expiry tick `+0x2710`, the source endpoint, and the deferred callback metadata. Current grounded caller is the kind dispatcher `0x005a0440`.","llvm-objdump + caller inspection + local disassembly + UDP-callback-worker correlation + control-packet correlation + timeout-registration correlation"
0x005a02f0,212,multiplayer_gamespy_udp_handle_control_packet_kind2_dispatch_callback_and_optionally_issue_kind3_ack,shell,unknown,inferred,llvm-objdump + caller inspection + local disassembly,3,"Kind-`2` control-packet handler in the same UDP callback-worker family. The helper resolves the matching timeout-registration record from `0x00db9ff0` by decoded packet word4 through `0x005a01a0`, optionally invokes the immediate callback root at `0x00db9ff4`, optionally emits a kind-`3` acknowledgement through `0x0059fdc0` when decoded packet word6 is nonzero, packages the completed callback result through `0x0059fef0` using the registration metadata plus the elapsed tick delta, and finally erases the matched registration record through `0x0059e3d0`. Current grounded caller is the packet-kind dispatcher `0x005a0440`.","llvm-objdump + caller inspection + local disassembly + UDP-callback-worker correlation + control-packet correlation + timeout-registration correlation + queued-callback correlation"
0x005a03d0,96,multiplayer_gamespy_udp_handle_control_packet_kind3_dispatch_completion_callback,shell,unknown,inferred,llvm-objdump + caller inspection + local disassembly,3,"Kind-`3` control-packet handler in the same UDP callback-worker family. The helper requires decoded packet word4 to stay zero and word6 to be nonzero, resolves the matching timeout-registration record by word6 through `0x005a01a0`, optionally invokes the completion callback rooted at `0x00db9fd8` with the elapsed tick delta and source endpoint, and then erases the matched registration record from `0x00db9ff0`. Current grounded caller is the packet-kind dispatcher `0x005a0440`.","llvm-objdump + caller inspection + local disassembly + UDP-callback-worker correlation + control-packet correlation + timeout-registration correlation"
0x005a0440,68,multiplayer_gamespy_udp_dispatch_control_packet_kinds_1_2_3,shell,unknown,inferred,llvm-objdump + local disassembly + caller inspection,2,"Small packet-kind dispatcher over the decoded UDP control-packet header. The helper switches on decoded packet kind word `[packet+0x02]` and routes kinds `1`, `2`, and `3` into handlers `0x005a0200`, `0x005a02f0`, and `0x005a03d0` with the current source endpoint and timestamp. Current grounded caller is the main receive owner `0x005a0490`.","llvm-objdump + local disassembly + caller inspection + UDP-callback-worker correlation + control-packet correlation"
0x005a0490,186,multiplayer_gamespy_udp_service_global_socket_receive_decode_dispatch_loop,shell,cdecl,inferred,llvm-objdump + caller inspection + local disassembly,3,"Main receive-side service owner for the global UDP callback-worker family. While active flag `0x00dba000` remains set, the helper waits for readability on socket `0x00629f28` through `0x0058f4e0`, drains one datagram through `recvfrom` thunk `0x0058bc7e`, treats `WSAGetLastError == 0x2738` as a benign early exit, timestamps the packet through `0x0058f450`, decodes it through `0x0059fd00`, and dispatches successful decodes through `0x005a0440`. After the loop it stores the last service tick into global `0x00db9ff8`.","llvm-objdump + caller inspection + local disassembly + UDP-callback-worker correlation + receive-loop correlation"
0x005a0550,116,multiplayer_gamespy_udp_sweep_timeout_registrations_and_enqueue_expired_callbacks,shell,cdecl,inferred,llvm-objdump + caller inspection + local disassembly,3,"Timeout-sweep owner over the registration vector `0x00db9ff0`. The helper walks the live `0x20`-byte records in reverse, compares each expiry tick `[entry+0x0c]` against the current tick, and for every expired live entry optionally packages a timeout callback through `0x0059fef0` using result code `-1` plus a null payload before erasing that registration record through `0x0059e3d0`. Current grounded caller is the global worker service tick `0x005a05d0`.","llvm-objdump + caller inspection + local disassembly + UDP-callback-worker correlation + timeout-registration correlation + queued-callback correlation"
0x005a05d0,34,multiplayer_gamespy_udp_service_global_callback_worker_once,shell,cdecl,inferred,llvm-objdump + local disassembly + caller inspection,2,"One-shot service tick for the global UDP callback-worker family. When active flag `0x00dba000` is set and the reentrancy guard `0x00db9ffc` is clear, the helper runs the receive or decode loop `0x005a0490`, the timeout sweep `0x005a0550`, and the queued-callback drain `0x0059ff70` in sequence.","llvm-objdump + local disassembly + caller inspection + UDP-callback-worker correlation + service-tick correlation"
0x005a0600,248,multiplayer_gamespy_udp_send_kind1_query_stage_timeout_registration_and_optionally_wait_for_completion,shell,unknown,inferred,llvm-objdump + local disassembly + caller inspection,3,"Higher send-side owner above the global UDP callback-worker family. The helper builds one stack `sockaddr_in` from caller IPv4 dword `ECX` plus port word `EDX`, allocates a fresh cookie word through `0x0059fce0`, emits a kind-`1` control packet through `0x0059fdc0`, and on success appends one timeout-registration record into `0x00db9ff0` with the current tick, expiry tick, source endpoint, and deferred callback metadata. When the final caller flag is nonzero it then synchronously pumps the worker service tick `0x005a05d0` plus `Sleep(1)` through `0x0058f460` until that registration disappears, and finally drains queued callbacks through `0x0059ff70`.","llvm-objdump + local disassembly + caller inspection + UDP-callback-worker correlation + timeout-registration correlation + synchronous-wait correlation"
0x005a0700,30,intrusive_list_next20_append_tail,support,thiscall,inferred,llvm-objdump + local disassembly + caller inspection,2,"Appends one node to the tail of an intrusive singly linked list whose next-pointer field lives at node offset `+0x20`. The helper links the previous tail when present, seeds the new tail's next pointer to null, initializes the head when the list was empty, and increments the list count at `[list+0x08]`. Current grounded caller is the queue-side owner `0x005a07c0`.","llvm-objdump + local disassembly + caller inspection + intrusive-list correlation"
0x005a0720,21,intrusive_list_next20_prepend_head,support,cdecl,inferred,llvm-objdump + local disassembly + caller inspection,2,"Prepends one node to the head of the same intrusive singly linked list family. The helper stores the previous head into `[node+0x20]`, updates the head pointer, initializes the tail when the list was empty, and increments `[list+0x08]`. Current grounded caller is the compact server-descriptor queue insert path `0x005a09a0`.","llvm-objdump + local disassembly + caller inspection + intrusive-list correlation"
0x005a0740,22,intrusive_list_next20_pop_head,support,thiscall,inferred,llvm-objdump + local disassembly + caller inspection,2,"Pops the current head node from the same intrusive singly linked list family. When the head pointer is live the helper advances it through node field `+0x20`, clears the tail when the list becomes empty, and decrements the stored count `[list+0x08]`. Current grounded caller is the queue-family service strip `0x005a0b40`.","llvm-objdump + local disassembly + caller inspection + intrusive-list correlation"
0x005a0760,70,intrusive_list_next20_remove_exact_node,support,cdecl,inferred,llvm-objdump + local disassembly + caller inspection,2,"Removes one exact node pointer from the same intrusive singly linked list family by linear scan over next-link field `+0x20`. The helper updates predecessor, head, and tail pointers as needed, decrements `[list+0x08]`, and returns true only when the node was found. Current grounded callers are the queue-family erase and transition strips `0x005a0a70` and `0x005a0cd0`.","llvm-objdump + local disassembly + caller inspection + intrusive-list correlation"
0x005a07b0,11,intrusive_list_header_clear_head_tail_count,support,cdecl,inferred,llvm-objdump + local disassembly + caller inspection,1,"Tiny reset helper for the same intrusive list header. It clears the head pointer, tail pointer, and live-count dword at `[list+0x00/+0x04/+0x08]`. Current grounded callers are the compact server-descriptor queue constructor `0x005a08f0`, reset helper `0x005a0950`, and destructor `0x005a0970`.","llvm-objdump + local disassembly + caller inspection + intrusive-list correlation"
0x005a08f0,75,multiplayer_gamespy_server_descriptor_queue_init_udp_socket_and_clear_active_pending_lists,shell,thiscall,inferred,llvm-objdump + local disassembly + caller inspection,3,"Constructor-side initializer for one compact server-descriptor queue family. The helper runs the local `WSAStartup` guard `0x0058f470`, stores the caller metadata into owner fields `[this+0x00/+0x04/+0x40/+0x44]`, opens a UDP socket into `[this+0x20]` through thunk `0x0058bc6c`, zeros companion dword `[this+0x24]`, and clears both intrusive list headers at `[this+0x08]` and `[this+0x14]` through `0x005a07b0`. Current grounded siblings `0x005a0950`, `0x005a0970`, and `0x005a09a0` prove this as the queue-family constructor seam rather than a generic socket wrapper.","llvm-objdump + local disassembly + caller inspection + queue-family correlation + intrusive-list correlation + socket-correlation"
0x00597880,159,multiplayer_transport_find_pending_template_node,shell,cdecl,inferred,rizin,4,Searches the linked pending-template list rooted at `[this+0x550]` for the first node whose caller-provided query tuple array matches the node kind and its primary and secondary string selectors. When it finds a match it refreshes the node timeout field at `[node+0x04]` from GetTickCount plus 0xea60 and returns that node pointer otherwise it returns null.,rizin + llvm-objdump
0x00597960,32,multiplayer_transport_release_pending_template_node,shell,cdecl,inferred,llvm-objdump + caller inspection,3,"Release helper for one linked pending-template node. It frees the owned payload graph rooted at `[node+0x1c]`, the optional primary and secondary selector strings at `[node+0x08]` and `[node+0x0c]`, and finally the node body itself through tracked-heap release `0x58f3c0`. Current grounded caller is `multiplayer_transport_unlink_pending_template_node` `0x597980`, which removes the node from the linked list rooted at `[transport+0x550]` before tail-calling this helper.","llvm-objdump + caller inspection + pending-template-list correlation"
0x005979d0,1164,multiplayer_transport_dispatch_pending_template_node,shell,cdecl,inferred,rizin,3,Consumes one pending-template node and one caller dispatch descriptor. Depending on the node kind it emits one or more transport notifications through 0x0059b790 using the node-owned strings arrays and callback state then releases the node-owned heap strings arrays and child lists before unlinking the node from the pending-template list. Higher-level registered-name wrappers reuse it as the common completion path after multiplayer_transport_find_pending_template_node succeeds.,rizin + llvm-objdump
0x00435ac0,143,shell_handle_train_detail_lower_action_0x3f9_follow_current_route_object,shell,cdecl,inferred,llvm-objdump + caller correlation,3,"Special-case shell action handler gated to message `0xcb` and control `0x3f9`. It resolves the current train id from `0x0062be44`, validates that train through collection `0x006cfcbc`, resolves its linked route object twice through `train_resolve_linked_route_object` `0x4a77b0`, clears one auxiliary world-side latch through `0x52d160`, recenters the world view on that linked route object through `0x433900`, and then re-enters `shell_detail_panel_transition_manager` `0x4ddbd0` with detail-manager mode `2` and the current train id. The helper returns `1` only for nonmatching messages or controls; the grounded success path is the lower-action follow-current-route branch above the already-mapped train detail owners.","llvm-objdump + caller correlation + train-route-object correlation + shell-transition correlation"
0x00436070,24,shell_refresh_active_window_followons_without_subject_gate,shell,cdecl,inferred,llvm-objdump + callee correlation,3,"No-argument shell follow-on refresh strip keyed off the current active detail-manager mode at `[0x006d0818+0x8c]`. It refreshes the company-detail branch when mode `7` is active through `0x4c6c30`, the stock-buy branch when mode `0x0b` is active through `0x50c130`, and the `Overview.win` side when mode `9` is active through `0x452f20` with the fixed `0x270f` bounds. Unlike its argument-sensitive sibling `shell_refresh_active_window_followons_for_subject_and_optional_company_match` `0x4360d0`, this helper has no mode-`8` subject-id gate.","llvm-objdump + callee correlation + detail-manager-mode correlation"
0x004360d0,39,shell_refresh_active_window_followons_for_subject_and_optional_company_match,shell,cdecl,inferred,llvm-objdump + callee correlation,3,"Small shell follow-on refresh helper keyed off the current active detail-manager mode at `[0x006d0818+0x8c]`. It first refreshes the live company-detail branch when mode `7` is active through `0x4c6c30`, then refreshes the stock-buy branch when mode `0x0b` is active through `0x50c130`. For active mode `8` it also requires that the current subject id at `[state+0x90]` matches the caller dword before it triggers the world-side timed overlay refresh through `0x482150`. Finally, when mode `9` is active it refreshes the `Overview.win` side through `0x452f20` with the fixed `0x270f` bounds. This is the argument-sensitive sibling of the smaller no-arg follow-on strip at `0x436070`.","llvm-objdump + callee correlation + detail-manager-mode correlation"
0x00436170,24,shell_refresh_active_window_followons_and_adjacent_station_or_company_lists,shell,cdecl,inferred,llvm-objdump + callee correlation,3,"Broader shell follow-on wrapper above `shell_refresh_active_window_followons_for_subject_and_optional_company_match` `0x4360d0`. It first forwards the caller subject id into `0x4360d0`, then adds two adjacent list-window refresh branches keyed by the current active detail-manager mode: when mode `4` is active and singleton `0x006d1708` is live it refreshes the station list panel through `0x506f30`, and when mode `1` is active and singleton `0x006d3b34` is live it refreshes the company-list side through `0x5158f0(-1)`. This is the current grounded owner for the active-window follow-on sweep that spans company detail, station list, stock buy, overview, and the mode-`8` subject-gated overlay branch.","llvm-objdump + callee correlation + detail-manager-mode correlation + shell-singleton correlation"
0x00436170,24,shell_refresh_active_window_followons_and_adjacent_station_or_train_lists,shell,cdecl,inferred,llvm-objdump + callee correlation,3,"Broader shell follow-on wrapper above `shell_refresh_active_window_followons_for_subject_and_optional_company_match` `0x4360d0`. It first forwards the caller subject id into `0x4360d0`, then adds two adjacent list-window refresh branches keyed by the current active detail-manager mode: when mode `4` is active and singleton `0x006d1708` is live it refreshes the station list panel through `0x506f30`, and when mode `1` is active and singleton `0x006d3b34` is live it refreshes the train-list side through `shell_train_list_window_refresh_controls` `0x005158f0(-1)`. This is the current grounded owner for the active-window follow-on sweep that spans company detail, station list, train list, stock buy, overview, and the mode-`8` subject-gated overlay branch.","llvm-objdump + callee correlation + detail-manager-mode correlation + shell-singleton correlation + TrainList.win string correlation"
0x004361d0,120,world_refresh_collection_side_effects_after_broad_state_change,map,thiscall,inferred,llvm-objdump + caller correlation,3,"Shared broad refresh sweep over several live world collections after larger state changes. It walks the region collection at `0x006cfca8`, first re-entering `0x48b660` and then `0x48a9e0` on every region record; walks the placed-structure collection at `0x0062b26c` and refreshes each entry through `placed_structure_refresh_linked_peer_overlay_runtime` `0x40d2d0`; and then walks three more live collections rooted at `0x006ada80`, `0x0062bae0`, and `0x006cea50`, invoking each record's vtable slot `+0x54` with argument `0`. Current grounded callers include the broader world-side owner at `0x44b160` and the TrackLay teardown branch at `0x50dba7`, so this is the safest current read for a shared collection-side post-change refresh sweep rather than a subsystem-local helper.","llvm-objdump + caller correlation + collection-sweep correlation + vtable-refresh correlation"
0x00436350,576,simulation_service_world_outcome_mode_prompt_and_transition_effects,simulation,thiscall,inferred,llvm-objdump + caller correlation + outcome-latch correlation,3,"Frame-serviced owner for the live world outcome-mode latch at `[world+0x4a73]`. The helper immediately stamps `[world+0x4a77] = 1`, maps the current mode band `1..4` to selector values `0..3` for the shared helper `0x517a80`, and then runs a larger presentation/transition split keyed by scenario bytes `[0x006cec7c+0xc4/+0xc5/+0x7d]` plus the current mode. One early branch closes the active detail panel through `0x4ddbd0(-1, 0)`, clears one world-view scalar at `[0x006cec74+0x14]+0x110`, arms shell latch `0x006d4000`, and triggers the fixed world-side transition path through `0x482150(..., 0xcc, 0, 3, 0, 0)`. The broader common branch refreshes two presentation scalars through `0x531560`, re-enters `0x4e1af0` with the outcome-mode-derived selector, and then opens one callback-driven shell modal rooted at localized id `0x169` through `0x5193f0 -> 0x4c98a0`. On modal dismissal or fallback it can close the current detail panel through `0x4ddbd0`, tear down the live multiplayer session object at `0x006cd8d8`, trigger the alternate world-side transition through `0x482150` with selector `7` or `2` depending on `[0x006cec7c+0xc5]`, and refresh the same two presentation scalars again. Current grounded caller is the simulation frame cadence `simulation_frame_accumulate_and_step_world` `0x439140`, which reaches this owner only after the shell-window dirty-mark ladder when the outcome latch is live and the completion latch `[world+0x4a77]` is still clear. This is therefore the safest current owner for outcome-mode prompt and transition servicing above the already-grounded outcome text buffer `[world+0x4b47]`, not just another shell modal wrapper.","llvm-objdump + caller correlation + outcome-latch correlation + shell-modal correlation + transition-side correlation"
0x005996c0,304,multiplayer_transport_handle_pending_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Structural mode-3 wrapper over the pending-template path for registered-name updates. It normalizes the caller selector string against the shared default token at 0x005e1e1c builds a four-way pending-template query and dispatches the matched node through multiplayer_transport_dispatch_pending_template_node. Depending on the matched node kind it can mark the registered-name entry dirty through multiplayer_transport_mark_registered_name_dirty or forward the node-owned payload fields into the dispatch descriptor.,llvm-objdump
0x00565c90,208,shell_queue_indexed_world_anchor_marker,shell,cdecl,inferred,ghidra-headless,3,Variant world-anchor marker emitter that selects one indexed entry from the owner table at +0x24 using byte [this+0xd8] derives scale and packed color from the entry fields and enqueues the resulting type-0x01 deferred message through shell_enqueue_deferred_message_type1.,ghidra + rizin + llvm-objdump
0x005662a0,964,shell_emit_sprite_billboard_quad_vertex24,bootstrap,thiscall,inferred,ghidra-headless,4,Expands one sprite billboard into six vertex24 records forming two textured triangles. It derives an alpha byte from item timing flags at [this+0x48] [this+0x4c] and [this+0x5c] combines that alpha with packed color [this+0x70] scales a prepared four-corner basis by [this+0x44] and writes six 24-byte vertices using atlas uv pairs from [this+0x2c..0x38].,ghidra + rizin + llvm-objdump
0x00566670,84,shell_prepare_sprite_billboard_basis,bootstrap,thiscall,inferred,ghidra-headless,3,Builds the temporary four-corner sprite-billboard basis used by 0x005662a0 from the current shell transform state and writes the result into global scratch vectors around 0x00d97ae0 and 0x00d97b98.,ghidra + rizin + llvm-objdump
0x0055e2b0,179,shell_create_layout_state,bootstrap,thiscall,inferred,ghidra-headless,4,Allocates a 0x3715-byte layout-state object for the shell controller stores it at [this+0x2d] seeds the dirty flags invokes 0x0054bc10 with owner state and a template byte from the shell bundle then binds the first presentation asset bundle through 0x00543f10 before later update hooks run.,ghidra + rizin
0x005679b0,569,shell_emit_animated_quad_vertex24,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Expands one streamed patch item into one `0x90`-byte six-vertex quad for the shared `vertex24` buffer. The helper derives an 8-step brightness cycle from GetTickCount plus item field `[this+0x3a]`, combines that phase with the per-corner blend bytes at `+0x35..+0x38`, honors the per-corner mask bytes at `+0x31..+0x34` by forcing fully transparent colors on masked corners, and then writes six `0x18`-byte vertices from the four corner positions stored across `+0x00..+0x2c`. Current grounded callers are the primary and alternate list streamers `0x00567c70` and `0x00567ce0`.","objdump + caller inspection + local disassembly + streamed-patch correlation + vertex24 correlation"
0x00567bf0,128,shell_release_primary_and_alternate_streamed_patch_quad_lists,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared release helper for the streamed patch-quad owner. The function walks the intrusive lists rooted at `[this+0x20]` and `[this+0x1c]`, frees every queued quad item through `0x005a1145`, and then releases the two list roots themselves through `0x005570b0`. Current grounded callers are the broader teardown owner `0x00567d50` and the setup-side rebuild paths in the same family.","objdump + caller inspection + local disassembly + streamed-patch correlation + intrusive-list correlation"
0x00567c70,103,shell_stream_primary_cell_quad_list,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Streams the primary streamed-patch quad list rooted at `[this+0x1c]` into the caller's `vertex24` buffer. The helper seeds the shared color input through `0x00d97bbc`, iterates each queued quad item through `0x005679b0`, and advances the destination pointer by `0x90` bytes per emitted quad before finally incrementing the caller record count by `list_count * 6`.","objdump + caller inspection + local disassembly + streamed-patch correlation + vertex24 correlation"
0x00567ce0,105,shell_stream_alternate_cell_quad_list,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Streams the alternate streamed-patch quad list rooted at `[this+0x20]` into the caller's `vertex24` buffer using the same quad writer at `0x005679b0`. Unlike the primary path it forwards one extra caller selector into each emitted quad before advancing the destination pointer by `0x90` bytes and incrementing the caller record count by `list_count * 6`.","objdump + caller inspection + local disassembly + streamed-patch correlation + vertex24 correlation"
0x00567d50,72,shell_release_streamed_patch_quad_roots_and_clear_owner_slots,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Destructor-side sibling above `0x00567bf0`. The helper first releases every queued quad item and intrusive-list node through `shell_release_primary_and_alternate_streamed_patch_quad_lists` `0x00567bf0`, then drops the two list-root objects still stored at `[this+0x20]` and `[this+0x1c]` through `0x005571d0` plus `0x0053b080`, and finally clears both owner slots back to null. This is the safest current read for the streamed patch-quad root teardown helper rather than a generic two-pointer free wrapper.","objdump + caller inspection + local disassembly + streamed-patch correlation + intrusive-list correlation"
0x00567da0,4391,shell_rebuild_streamed_patch_primary_and_alternate_quad_lists_from_signed_height_grids_and_type_words,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Broader streamed-patch owner above `0x00567bf0`. The helper first clears any previously queued quads through `0x00567bf0`, then walks the live signed-byte height or mask grids rooted at `[this+0x08]` and `[this+0x0c]` together with the `u16` type-word table at `[this+0x10]` across the current interior tile rectangle. For each admitted cell it allocates one `0x3e` patch record, derives corner positions and color or blend bytes from the surrounding signed-byte samples plus the low three bits of the type words through table `0x00625c60`, and accumulates those records into the primary and alternate intrusive list roots at `[this+0x1c]` and `[this+0x20]`. After the initial build it also performs a second neighborhood-processing pass over the primary list, including local pair and radius gates plus caller-sensitive postprocessing of the generated blend-byte bands. Current grounded callers are the grid-owner service path `0x00536e67` and the constructor wrapper `0x00569372`, so this is the safest current read for rebuilding the streamed patch-quad lists from the current signed grids and type words rather than a single-purpose raster helper.","objdump + caller inspection + local disassembly + signed-grid correlation + type-word correlation + streamed-patch correlation"
0x005692e0,156,shell_construct_streamed_patch_quad_owner_and_build_lists,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Constructor-side wrapper for the streamed patch-quad owner family. The helper allocates and initializes the two intrusive list roots stored at `[this+0x1c]` and `[this+0x20]`, copies the caller bounds and grid-owner accessors into fields `[this+0x00..+0x18]` and `[this+0x24]` through the neighboring world-grid query helpers `0x00533970/0x00533980/0x00533ae0/0x00533af0/0x00533b00`, and then immediately enters `shell_rebuild_streamed_patch_primary_and_alternate_quad_lists_from_signed_height_grids_and_type_words` `0x00567da0`. Current grounded caller is `0x005692cd`, which passes the current streamed-record rectangle expanded by `-2/+0x12` before construction.","objdump + caller inspection + local disassembly + streamed-patch correlation + constructor-correlation"
0x00569380,123,shell_audio_open_selected_miles_3d_provider_and_seed_room_speaker_and_distance_defaults,shell,thiscall,inferred,objdump + import-table + local disassembly,3,"Miles 3D provider open helper. The routine opens the currently selected provider entry at `[this+0x28]` through `_AIL_open_3D_provider`, caches the room-type capability in global `0x00625c7c` through `_AIL_3D_room_type` when still unset, queries speaker-type support through `_AIL_3D_speaker_type`, stores the resulting support flag in provider field `[provider+0x0c]`, and applies fixed distance factor `0x3e806d98` through `_AIL_set_3D_distance_factor`. On open failure it clears `[this+0x28]` and returns `0`. Current grounded callers are the preferred-provider bootstrap paths `0x00569872` and `0x005698cc`.","objdump + import-table + local disassembly + Miles-3D correlation"
0x00569400,237,shell_audio_enumerate_miles_3d_providers_and_mark_preferred_entries,shell,thiscall,inferred,objdump + import-table + local disassembly + string correlation,3,"Miles 3D provider enumeration owner. The routine clears the global provider table rooted at `0x00d97bc0`, repeatedly calls `_AIL_enumerate_3D_providers@12` to fill up to `0x20` provider records, and increments global count `0x00d97dc0` for each accepted row. Each row starts with preferred flag `[entry+0x08] = 1`, but that flag is cleared back to `0` unless the provider name matches one of the preferred strings `Miles`, `Dolby`, or `RAD`. Current grounded caller is the broader bootstrap owner `0x005698a0`.","objdump + import-table + local disassembly + string correlation + Miles-3D correlation"
0x005694f0,74,shell_audio_find_enumerated_miles_3d_provider_entry_by_name,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Linear search over the enumerated Miles 3D provider table rooted at `0x00d97bc4`. The helper compares the caller string against each stored provider name through `0x005a1ff0` and returns the matching `0x10`-byte provider entry under `0x00d97bc0`, or `0` when no match exists. Current grounded callers are the selected-provider and fallback bootstrap paths `0x00569742`, `0x00569868`, and `0x005698c2`.","objdump + local disassembly + caller inspection + Miles-3D correlation"
0x00569540,131,shell_audio_set_active_miles_3d_speaker_type_selection_and_apply_if_provider_live,shell,thiscall,inferred,objdump + import-table + local disassembly,3,"Speaker-type selection setter in the Miles 3D branch. The routine stores the caller selection into global `0x00625c78`, special-cases selector `0x63` against cached room type `0x00625c7c`, waits through repeated `0x0051d890` tick reads when the requested selection differs from the previous live selection, and then applies the chosen speaker type to the current provider at `[this+0x28]` through `_AIL_set_3D_speaker_type`.","objdump + import-table + local disassembly + Miles-3D correlation + speaker-type correlation"
0x005695d0,6,shell_audio_get_active_miles_3d_speaker_type_selection,shell,cdecl,inferred,objdump + local disassembly,1,"Tiny getter returning the current Miles 3D speaker-type selection from global `0x00625c78`.","objdump + local disassembly + Miles-3D correlation"
0x00569660,67,shell_audio_set_miles_3d_listener_position_xyz,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,3,"Miles 3D listener-position setter. The helper lazily opens the listener handle at `[this+0x2c]` from the current provider `[this+0x28]` through `_AIL_open_3D_listener`, stores the caller XYZ triple into `[this+0x30/+0x34/+0x38]`, and then forwards those coordinates into `_AIL_set_3D_position`. Current grounded caller is the shared owner-family rebuild path `0x00531c92`.","objdump + import-table + local disassembly + caller inspection + Miles-3D correlation"
0x005696b0,103,shell_audio_set_miles_3d_listener_orientation_basis,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,3,"Miles 3D listener-orientation setter. The helper lazily opens the listener handle at `[this+0x2c]` from the current provider `[this+0x28]`, stores the caller six-float basis vectors into `[this+0x3c..+0x50]`, and then forwards them into `_AIL_set_3D_orientation`. Current grounded caller is the shared owner-family rebuild path `0x00531c72`.","objdump + import-table + local disassembly + caller inspection + Miles-3D correlation"
0x00569720,7,shell_audio_get_selected_miles_3d_provider_name_pointer,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Tiny field getter over the current Miles 3D provider entry. The helper returns pointer `[[this+0x28]+0x04]` unchanged, which local caller-side evidence now grounds as the current provider-name pointer rather than a secondary handle because `0x00531640` compares it bytewise against callback-selected provider-name stems from `0x005314b0`. Current grounded callers are the active-mode name query wrapper `0x00531620` and the selected-index resolver `0x00531640`.","objdump + local disassembly + caller inspection + Miles-3D correlation + provider-name correlation"
0x00569730,46,shell_audio_query_miles_3d_provider_preferred_flag_for_current_or_named_entry,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small query helper over the enumerated Miles 3D provider table. When the caller string is null, the helper returns flag dword `[[this+0x28]+0x08]` from the current selected provider entry; otherwise it resolves the named entry through `0x005694f0` and returns that same flag field. Current grounded callers are the callback-selected query wrapper `0x005316d0` and the local bootstrap strip.","objdump + local disassembly + caller inspection + Miles-3D correlation"
0x00569830,91,shell_audio_try_bind_current_provider_from_fixed_miles_3d_fallback_order,shell,thiscall,inferred,objdump + local disassembly + string correlation,3,"Fallback-provider binder in the Miles 3D branch. When no current provider entry is selected at `[this+0x28]`, the helper tries the hardcoded provider names `Creative Labs EAX (TM)`, `DirectSound3D 7+ Software - Pan and Volume`, `Miles Fast 2D Positional Audio`, and `Miles` in that order, resolving each candidate through `0x005694f0`, storing it into `[this+0x28]`, and attempting to open it through `0x00569380` until one succeeds. The helper returns `1` only when a live provider is bound. Current grounded caller is the broader bootstrap owner `0x005698a0`.","objdump + local disassembly + string correlation + Miles-3D correlation"
0x005698a0,238,shell_audio_bootstrap_miles_3d_provider_tables_bind_requested_or_fallback_provider_and_allocate_local_state,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection + string correlation,3,"Broader Miles 3D bootstrap owner above the provider and listener strip. The routine enumerates providers through `0x00569400`, optionally resolves and opens one caller-requested provider name through `0x005694f0 -> 0x00569380`, falls back through `0x00569830`, and only proceeds when a live provider is available. On success it dispatches the object vtable entry at slot `+0x00`, allocates and zeros the local `0x11`-record table at `[this+0x14]`, a `0x14`-byte scratch block at `[this+0x10]`, and the `0x38`-record local state at `[this+0x0c]` through `0x0053dbf0/0x0053dcf0`. On failure it closes the provider through `_AIL_close_3D_provider` and clears `[this+0x28]`. Current grounded caller is the global-owner constructor `0x005318f0`.","objdump + import-table + local disassembly + caller inspection + Miles-3D correlation + local-state correlation"
0x00569750,112,shell_audio_pop_oldest_live_miles_3d_sample_record_from_active_list_and_refresh_serial,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,3,"Active-list pop helper in the Miles 3D sample branch. Under the Miles lock or unlock gate, the routine removes the oldest live record from owner list `[this+0x08]`, increments global serial `0x00625c80`, stores that new serial into the popped record, and returns the associated 3D sample handle from record field `[record+0x04]`. Current grounded callers are the sample-release and pool-drain owners `0x00569eb9`, `0x0056a350`, and `0x0056abf3`.","objdump + import-table + local disassembly + caller inspection + Miles-3D correlation + active-list correlation"
0x005697d0,94,shell_audio_return_miles_3d_sample_handle_to_free_pool_or_release_untracked_handle,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,3,"Sample-handle return helper in the same Miles 3D branch. Under the Miles lock or unlock gate, the routine resolves one sample handle in the free-pool hash rooted at `[this+0x04]`; when the handle belongs to the tracked pool it pushes the matching record back into owner list `[this+0x08]`, otherwise it releases the untracked handle allocation directly. Current grounded callers are the local sample-record release owners `0x00569bf8`, `0x0056a41f`, `0x0056a9ba`, `0x0056aad4`, and `0x0056ac95`.","objdump + import-table + local disassembly + caller inspection + Miles-3D correlation + free-pool correlation"
0x00569990,222,shell_audio_allocate_miles_3d_sample_handle_pool_and_record_tables_for_current_provider,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,3,"Sample-pool bootstrap owner above the Miles 3D provider branch. The routine repeatedly allocates up to `0x20` 3D sample handles from the current provider through `_AIL_allocate_3D_sample_handle`, stores the resulting count in `[this+0x54]`, allocates the free-pool hash at `[this+0x04]`, allocates one `0x5c`-byte-per-handle record slab, inserts each handle into the free-pool hash, and then allocates the active-list owner at `[this+0x08]` over the same record size. Current grounded caller is the bootstrap path immediately below `0x005698a0`, so this is the safest current read for allocating the Miles 3D sample-handle pool and its local record tables rather than a generic resource constructor.","objdump + import-table + local disassembly + caller inspection + Miles-3D correlation + sample-pool correlation"
0x00569d20,102,shell_audio_release_local_miles_3d_sample_pool_hash_and_active_list,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Local table teardown helper in the Miles 3D sample branch. The routine releases the free-pool hash at `[this+0x04]`, then releases the active-list owner at `[this+0x08]` including its backing record cursor, and clears both fields back to `0`. Current grounded caller is the broader local sample-record reset strip `0x0056ac2a`.","objdump + local disassembly + caller inspection + Miles-3D correlation + sample-pool correlation"
0x00569d90,271,shell_audio_shutdown_miles_3d_provider_listener_pool_and_restore_room_based_speaker_type_before_close,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,3,"Broader shutdown owner for the current Miles 3D branch. The routine first drains the live sample state through `0x00569a80`, closes the listener at `[this+0x2c]` through `_AIL_close_3D_listener`, releases the active-list and scratch tables at `[this+0x14]`, `[this+0x10]`, and `[this+0x0c]`, and then, when the cached room-type capability and current speaker-type selection are both in range, restores the provider speaker type from cached room type `0x00625c7c` through `_AIL_set_3D_speaker_type` before closing the provider through `_AIL_close_3D_provider`. The helper finally clears `[this+0x28]` and mode field `[this+0x60]`.","objdump + import-table + local disassembly + caller inspection + Miles-3D correlation + shutdown correlation"
0x00569cf0,40,shell_audio_mark_miles_3d_sample_record_pending_flag_0x100_by_key,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small lookup-side helper in the Miles 3D sample branch. The routine resolves one keyed record through pool owner `[this+0x04]`, then resolves the matching live record through active-list owner `[this+0x14]` and sets pending flag bit `0x100` in `[record+0x44]` when found. Current grounded caller is the global owner-family dispatch wrapper `0x00531840`.","objdump + local disassembly + caller inspection + Miles-3D correlation + record-flag correlation"
0x00569ea0,143,shell_audio_release_all_miles_3d_sample_handles_and_clear_pool_tables,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,3,"Pool-drain teardown owner in the Miles 3D sample branch. The routine repeatedly pops live sample handles through `0x00569750` and releases them through `_AIL_release_3D_sample_handle`, then zeroes the current pool count fields `[this+0x54]` and `[this+0x5c]`, releases the free-pool hash at `[this+0x04]`, releases the active-list owner at `[this+0x08]`, and clears both fields back to `0`. Current grounded callers include the broader owner-family teardown strips `0x0056a740` and `0x0056afd0`, so this is the safest current read for releasing all tracked Miles 3D sample handles and clearing the local pool tables rather than a generic destructor fragment.","objdump + import-table + local disassembly + caller inspection + Miles-3D correlation + sample-pool correlation"
0x00569c40,85,shell_audio_release_miles_3d_sample_record_by_key_or_direct_body,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,2,"Release-side helper in the Miles 3D sample branch. Under the shared reentrancy drain and lock or unlock gate, the routine either accepts one direct record body pointer or resolves a keyed live record under owner `[this+0x14]`, then re-enters `0x00569be0` with that record body and its cached sample-handle key to stop or recycle the sample record and clear its live state. Current grounded callers are the broader dispatcher `0x00569f30` and the mode-gated shell wrapper `0x005317b0`, which uses this helper in keyed-release mode by forcing the direct-body argument to `0`.","objdump + import-table + local disassembly + caller inspection + Miles-3D correlation + sample-record correlation"
0x00569f30,976,shell_audio_dispatch_miles_3d_sample_record_command,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,3,"Broader command dispatcher over one Miles 3D sample record or aggregate request block. The routine switches on request type `0..8` from the caller command record, then routes through the local sample-record helpers `0x00569b70`, `0x00569be0`, and `0x00569c40`, the distance scorer `0x005695e0`, and the Miles imports `_AIL_set_3D_sample_volume`, `_AIL_stop_3D_sample`, `_AIL_resume_3D_sample`, `_AIL_set_3D_position`, `_AIL_set_3D_sample_distances`, `_AIL_set_3D_sample_effects_level`, `_AIL_set_3D_orientation`, `_AIL_set_3D_sample_playback_rate`, and `_AIL_set_3D_sample_occlusion`. The grounded cases include release or recycle, nearest-distance selection, volume apply, stop or resume control, and pending-flag service for one live sample record. Current grounded caller is the global owner-family dispatch selector `0x005318dd`.","objdump + import-table + local disassembly + caller inspection + Miles-3D correlation + command-dispatch correlation"
0x0056a330,480,shell_audio_acquire_or_evict_miles_3d_sample_record_for_key_and_world_position,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,3,"Acquisition owner above the Miles 3D sample dispatcher. The routine first tries to recycle one free sample record by popping a handle through `0x00569750` and resolving it back through the free-pool hash. When no free record is immediately available, it computes one squared distance score from the caller XYZ through `0x005695e0`, then uses the callback-driven selection strip over active-list owner `[this+0x14]` to identify a reclaimable record, ends that sample through `_AIL_end_3D_sample`, returns the handle to the free pool through `0x005697d0`, and retries until a record is available or selection fails. Once a record slot exists, the helper resolves or allocates a keyed record under owner `[this+0x10]`, stores the caller key and derived payload, increments the record refcount, and returns the live record body at `record+0x04`. Current grounded caller is the higher configure-and-start owner `0x0056a520`.","objdump + import-table + local disassembly + caller inspection + Miles-3D correlation + sample-record correlation"
0x0056a520,432,shell_audio_configure_and_optionally_start_miles_3d_sample_record_from_payload_key_mode_and_world_position,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,3,"Main configure-and-start owner in the Miles 3D sample branch. The routine acquires one live record through `0x0056a330`, inserts that record into the active-list owner `[this+0x14]`, seeds the record's mode, payload key, world-position triplet, scalar ranges, and timing fields, conditionally transforms the world position through `0x005315c0`, then configures the Miles sample through `_AIL_set_3D_sample_file`, `_AIL_set_3D_sample_loop_count`, `_AIL_set_3D_position`, `_AIL_set_3D_sample_effects_level`, `_AIL_set_3D_sample_occlusion`, `_AIL_set_3D_sample_distances`, `_AIL_set_3D_sample_volume`, and the orientation-side Miles call at `0x001c83f8`. It also registers callback `0x00531f90`, optionally starts playback through `_AIL_start_3D_sample`, and snapshots the current tick into record field `[record+0x4c]`. Current grounded caller is the string-driven active-mode sink `0x0056a520`'s surrounding owner family, and the direct inner acquisition call is explicit at `0x0056a541`.","objdump + import-table + local disassembly + caller inspection + Miles-3D correlation + sample-record correlation + playback-setup correlation"
0x0056a6e0,88,shell_audio_init_miles_3d_sample_service_object_defaults,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Constructor-style initializer for the local Miles 3D sample-service object. The helper installs vtable `0x005de4cc`, zeroes the provider, listener, table, and record-state fields, and seeds the default unit scalars at `[this+0x44]`, `[this+0x4c]`, and `[this+0x58]`. Current grounded caller is the global owner-family constructor path `0x00531948`.","objdump + caller inspection + local disassembly + Miles-3D correlation + constructor correlation"
0x0056a740,32,shell_audio_destruct_miles_3d_sample_service_object_and_release_local_tables,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Destructor-side companion to `0x0056a6e0`. The helper restores the local Miles 3D sample-service vtable, runs the broader provider and listener shutdown owner `0x00569d90`, releases the keyed-record owner at `[this+0x14]`, switches back to base vtable `0x005de460`, and tail-calls `0x00569d20` to release the remaining local pool tables. Current grounded callers are the controller-side teardown paths `0x005319c4` and `0x00531bb9`.","objdump + caller inspection + local disassembly + Miles-3D correlation + destructor correlation"
0x0056a770,73,shell_audio_open_miles_digital_driver_and_build_non3d_table_owner,shell,thiscall,inferred,objdump + import-table + local disassembly,3,"Bootstrap owner for the non-3D Miles sample-service sibling. The routine sets one Miles preference through `_AIL_set_preference(0, 0x64)`, opens the digital driver at `[this+0x2c]` through `_AIL_open_digital_driver(0x5622, 0x10, 0x02, 0)`, allocates the keyed owner table at `[this+0x0c]`, and dispatches the object vtable slot `+0x00` with current selector `[this+0x28]` once the driver is live. It returns `1` only when the driver and local table owner were successfully created.","objdump + import-table + local disassembly + Miles correlation + digital-driver correlation"
0x0056a7c0,176,shell_audio_allocate_miles_sample_handle_pool_and_record_tables_for_current_digital_driver,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,3,"Sample-pool bootstrap owner for the non-3D Miles sample-service object. The routine allocates a free-pool hash at `[this+0x04]`, then allocates `count` sample handles from digital driver `[this+0x2c]` through `_AIL_allocate_sample_handle`, writes them into one `0x5c`-byte-per-handle record slab, inserts each handle into the free-pool hash, and finally allocates the active-list owner at `[this+0x08]`. Current grounded caller is the object vtable slot `+0x00` reached from `0x0056a770`.","objdump + import-table + local disassembly + caller inspection + Miles correlation + sample-pool correlation"
0x0056a880,93,shell_audio_reset_non3d_active_sample_registry_and_clear_looping_count,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Reset-side owner in the non-3D Miles sample branch. Under the shared lock or unlock gate, the helper runs the callback-driven dispatch strip over active-list owner `[this+0x0c]`, reinitializes that owner through `0x0053dbf0`, and clears local count field `[this+0x24]` back to `0`. Current grounded callers are the non-3D shutdown strips `0x0056aeb8` and `0x0056af30`.","objdump + local disassembly + caller inspection + Miles correlation + active-list correlation"
0x0056a8e0,130,shell_audio_set_non3d_master_scalar_and_refresh_active_sample_registry,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Scalar-refresh owner in the non-3D Miles sample branch. The helper clamps one caller float into local scalar `[this+0x20]`, then, when active looping count `[this+0x24]` is positive, dispatches selector `2` over active-list owner `[this+0x0c]` through the callback-driven strip. Current grounded caller is the global owner-family rebuild path `0x00531c00`, which uses this as the non-3D sibling of the earlier Miles 3D scalar seeding path.","objdump + local disassembly + caller inspection + Miles correlation + scalar-refresh correlation"
0x0056a970,573,shell_audio_dispatch_non3d_sample_record_command,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,3,"Broader command dispatcher over one non-3D Miles sample record. The routine switches on request types `1..7` from the caller command record, then routes through the local record helpers `0x005697d0`, `0x00569b70`, and `0x00569be0` plus the Miles sample imports `_AIL_register_EOS_callback`, `_AIL_end_sample`, `_AIL_set_sample_volume_levels`, `_AIL_stop_sample`, `_AIL_resume_sample`, `_AIL_set_sample_volume_pan`, `_AIL_set_sample_playback_rate`, and `_AIL_start_sample`. The grounded cases cover release or recycle, volume-level refresh, stop or resume control, and pending-flag service for one live non-3D sample record. Current grounded caller is the global owner-family dispatch selector `0x005318d1`.","objdump + import-table + local disassembly + caller inspection + Miles correlation + command-dispatch correlation"
0x0056ad20,249,shell_audio_configure_and_optionally_start_non3d_sample_record_from_payload_key_mode_volume_and_pan,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,3,"Main configure-and-start owner in the non-3D Miles sample branch. The routine acquires one live record through `0x0056abe0`, inserts that record into active-list owner `[this+0x0c]`, seeds the record's mode, payload key, volume or pan scalars, and timing fields, initializes the sample through `_AIL_init_sample`, binds the caller file payload through `_AIL_set_sample_file`, applies scaled volume levels and pan through `_AIL_set_sample_volume_levels` and `_AIL_set_sample_volume_pan`, applies loop count through `_AIL_set_sample_loop_count`, registers the shared callback through `0x00531f90`, optionally starts playback through `_AIL_start_sample`, and snapshots the current tick into `[record+0x4c]`. Current grounded inner acquisition call is explicit at `0x0056ad38`.","objdump + import-table + local disassembly + caller inspection + Miles correlation + sample-record correlation + playback-setup correlation"
0x0056ae30,60,shell_audio_dispatch_selector3_over_non3d_active_sample_registry,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small dispatch owner over the non-3D active-sample registry. Under the shared lock or unlock gate, the helper forwards selector `3` through the callback-driven dispatch strip over owner `[this+0x0c]`, then unlocks and returns. Current grounded caller is the non-3D service family directly above this strip.","objdump + local disassembly + caller inspection + Miles correlation + active-list correlation"
0x0056ae80,40,shell_audio_mark_non3d_sample_record_pending_flag_0x100_by_key,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small lookup-side helper in the non-3D Miles sample branch. The routine resolves one keyed record through free-pool owner `[this+0x04]`, then resolves the matching live record through active-list owner `[this+0x0c]` and sets pending flag bit `0x100` in `[record+0x44]` when found. Current grounded caller is the global owner-family dispatch wrapper `0x0053181f`.","objdump + local disassembly + caller inspection + Miles correlation + record-flag correlation"
0x0056aeb0,39,shell_audio_close_miles_digital_driver_and_reset_non3d_registry,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,2,"Digital-driver shutdown owner in the non-3D Miles sample branch. When driver `[this+0x2c]` is live, the helper resets the active registry through `0x0056a880`, clears the keyed owner `[this+0x0c]`, dispatches object vtable slot `+0x04`, and then clears the driver field back to `0`.","objdump + import-table + local disassembly + caller inspection + Miles correlation + digital-driver correlation"
0x0056aee0,52,shell_audio_init_non3d_sample_service_object_defaults,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Constructor-style initializer for the non-3D Miles sample-service object. The helper installs vtable `0x005de4d4`, zeroes the table and record-state fields, seeds unit scalar `[this+0x20] = 1.0f`, and stores default selector `8` in `[this+0x28]`. Current grounded caller is the global owner-family constructor path `0x005318f0`.","objdump + caller inspection + local disassembly + Miles correlation + constructor correlation"
0x0056af20,61,shell_audio_destruct_non3d_sample_service_object_and_release_local_tables,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Destructor-side companion to `0x0056aee0`. The helper restores vtable `0x005de4d4`, closes the digital-driver side through `0x0056aeb0`, releases the active-list owner at `[this+0x0c]`, switches back to base vtable `0x005de460`, and tail-calls `0x00569d20` to release the remaining local pool tables.","objdump + caller inspection + local disassembly + Miles correlation + destructor correlation"
0x0056af70,77,secondary_overlay_chunk_init_quantized_origin_and_clear_4x4_local_page_table,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Initializer for one `0x54`-byte secondary-overlay coarse chunk. The helper clears the full `4x4` local-page pointer table rooted at `[this+0x14]`, stores the two caller chunk-origin scalars into `[this+0x08/+0x0c]`, quantizes both through `0x005a10d0` into header dwords `[this+0x00/+0x04]`, and clears total live-cell count `[this+0x10]`. Current grounded callers are `world_secondary_overlay_ensure_coarse_chunk_and_seed_local_marks` `0x00534160` and the later stream-load owner `0x00553560`, so this is the safest current read for initializing one quantized coarse chunk and clearing its local-page table rather than a generic constructor.","objdump + caller inspection + local disassembly + secondary-overlay correlation + coarse-chunk correlation"
0x0056afc0,49,secondary_overlay_chunk_release_all_4x4_local_pages,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Release-side companion to `0x0056af70` over the same coarse secondary-overlay chunk. The helper walks the full `4x4` local-page pointer table at `[this+0x14]`, frees every live `0x8a`-byte page through `0x005a1145`, and returns. Current grounded caller is the stream-load replacement path `0x00553560`, so this is the safest current read for releasing all local pages in one chunk rather than a generic table clear.","objdump + caller inspection + local disassembly + secondary-overlay correlation + coarse-chunk correlation"
0x0056b000,102,secondary_overlay_chunk_toggle_local_cell_low_nibble_flag_mask,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small local-cell write helper beneath the coarse secondary-overlay chunk family. The function resolves the caller local `(x, y)` cell into one of the chunk's `4x4` local pages, then into one `4x4` cell slot inside that page, and XOR-updates the low nibble flag mask in byte `[page + cell*8 + 0x0a]` with the caller mask. Current grounded caller is `world_secondary_overlay_write_local_chunk_cell_value` `0x00533fe0`, so this is the safest current read for toggling the low-nibble local-cell flag mask rather than a broad chunk write path.","objdump + caller inspection + local disassembly + secondary-overlay correlation + local-cell correlation"
0x0056b070,102,secondary_overlay_chunk_query_local_cell_low_nibble_flag_mask,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Local-cell query sibling to `0x0056b000` in the same coarse secondary-overlay chunk family. The helper resolves the caller local `(x, y)` cell into its backing page and returns the low nibble flag mask from byte `[page + cell*8 + 0x0a]`, or `0` when the page is absent. Current grounded caller is the world-side query wrapper at `0x00534040`, so this is the safest current read for querying the low-nibble local-cell flag band rather than a broader overlay owner.","objdump + caller inspection + local disassembly + secondary-overlay correlation + local-cell correlation"
0x0056b0e0,149,secondary_overlay_chunk_decrement_local_cell_sample_slot_count_free_empty_page_and_return_total_live_cells,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Release-side local-cell helper over the same coarse secondary-overlay chunk family. The function resolves the caller local `(x, y)` cell, decrements the three-bit sample-slot count stored in `[page + cell*8 + 0x0a]` when that count is above `1`, decrements the page live-cell word `[page+0x00]`, decrements chunk total live-cell count `[this+0x10]`, and frees the whole page when its live-cell word reaches zero. It returns the updated chunk total live-cell count. Current grounded caller is the world-side release sweep `0x00534270`, so this is the safest current read for decrementing the local-cell sample-slot count and freeing empty pages rather than a generic clear helper.","objdump + caller inspection + local disassembly + secondary-overlay correlation + local-cell correlation + page-lifetime correlation"
0x0056b180,100,secondary_overlay_chunk_query_local_cell_sample_slot_count,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Local-cell query helper over the same coarse secondary-overlay chunk family. The function resolves the caller local `(x, y)` cell and returns bits `4..6` of byte `[page + cell*8 + 0x0a]` as the bounded sample-slot count, or `0` when the page is absent. Current grounded caller is the world-side wrapper at `0x005340a0`, so this is the safest current read for querying the local-cell sample-slot count band rather than a broader overlay-state accessor.","objdump + caller inspection + local disassembly + secondary-overlay correlation + local-cell correlation"
0x0056b1f0,107,secondary_overlay_chunk_store_local_cell_sample_slot_count,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Local-cell write sibling to `0x0056b180` in the same coarse secondary-overlay chunk family. The helper resolves the caller local `(x, y)` cell and replaces bits `4..6` of byte `[page + cell*8 + 0x0a]` with the caller-supplied three-bit sample-slot count, leaving the low nibble unchanged. Current grounded caller is the world-side wrapper at `0x00534100`, so this is the safest current read for storing the local-cell sample-slot count band rather than a generic byte setter.","objdump + caller inspection + local disassembly + secondary-overlay correlation + local-cell correlation"
0x0056b260,92,secondary_overlay_chunk_query_local_cell_aux_byte_0x0b,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small auxiliary-byte query helper beneath the coarse secondary-overlay chunk family. The function resolves the caller local `(x, y)` cell into its backing page and returns byte `[page + cell*8 + 0x0b]`, or `0` when the page is absent. Current grounded caller is the world-side query wrapper at `0x00533f90`, so this is the safest current read for querying the local-cell auxiliary byte rather than a broader overlay lookup.","objdump + caller inspection + local disassembly + secondary-overlay correlation + local-cell correlation + aux-byte correlation"
0x0056b2c0,450,secondary_overlay_chunk_seed_local_page_minmax_height_band_from_5x5_world_samples,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Page-seeding helper beneath the same coarse secondary-overlay chunk family. Given one local page coordinate and the broader world owner, the function samples a `5x5` lattice of world heights through `0x00533970`, `0x00533980`, and `0x00533b10`, tracks the resulting minmax pair across that lattice, and stores the final two-float height band into the destination page at offsets `+0x02` and `+0x06` after one fixed rescale. Current grounded caller is `0x0056b580`, so this is the safest current read for seeding one local page's minmax height band from world samples rather than a generic math loop.","objdump + caller inspection + local disassembly + secondary-overlay correlation + page-seeding correlation + world-sample correlation"
0x0056b490,116,secondary_overlay_chunk_load_header_and_present_local_pages_from_stream,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Stream-load owner for one coarse secondary-overlay chunk. The helper reads the `0x54`-byte chunk header through `0x00531150`, then walks the full `4x4` local-page table, reading one presence byte per slot and allocating plus loading one `0x8a`-byte page for every present slot. Current grounded caller is the world-side stream-load owner at `0x005536e4`, so this is the safest current read for loading one chunk header and its present local pages from a stream rather than a broader world-loader body.","objdump + caller inspection + local disassembly + secondary-overlay correlation + stream-load correlation"
0x0056b510,96,secondary_overlay_chunk_serialize_header_and_present_local_pages_to_stream,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Stream-save companion to `0x0056b490` over the same coarse secondary-overlay chunk family. The helper writes the `0x54`-byte chunk header through `0x00531030`, then walks the `4x4` local-page table, writing one presence byte per slot and the full `0x8a`-byte page payload for every present slot. Current grounded caller is the world-side stream-save owner at `0x005539ac`, so this is the safest current read for serializing one chunk header and its present local pages rather than a generic writer.","objdump + caller inspection + local disassembly + secondary-overlay correlation + stream-save correlation"
0x0056b580,368,secondary_overlay_chunk_ensure_local_page_stamp_aux_byte_and_append_quantized_sample_slot,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader local-page owner beneath `world_secondary_overlay_ensure_coarse_chunk_and_seed_local_marks` `0x00534160`. The helper resolves the caller local `(x, y)` cell to one of the chunk's `4x4` local pages, allocates and zeroes a `0x8a`-byte page when needed, seeds that new page through `0x0056b2c0`, writes the caller auxiliary byte into `[page + cell*8 + 0x0b]`, derives one local quantized sample byte from world-height sampling when the current three-bit sample-slot count is still below `6`, stores that derived byte into the per-cell sample-slot side band at `[page + cell*8 + 0x02 + count]`, increments the page live-cell word `[page+0x00]`, increments the cell's sample-slot count in `[page + cell*8 + 0x0a]`, and increments chunk total live-cell count `[this+0x10]`. Current grounded callers are the world-side coarse-chunk ensure owner `0x00534160` and nearby overlay builders that re-enter it transitively, so this is the safest current read for ensuring one local page and appending quantized sample-slot metadata for the addressed cell rather than a generic allocator.","objdump + caller inspection + local disassembly + secondary-overlay correlation + local-page correlation + local-cell correlation"
0x0056b700,105,secondary_overlay_chunk_store_local_cell_aux_byte_0x0b_and_mark_shell_dirty,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Local-cell auxiliary-byte write helper over the same coarse secondary-overlay chunk family. The function resolves the caller local `(x, y)` cell, stores the caller byte into `[page + cell*8 + 0x0b]`, and then marks shell controller dirty byte `[0x006d4024+0x374a] = 1` after re-entering `0x0051f070`. Current grounded caller is the world-side wrapper at `0x00533f71`, so this is the safest current read for storing the local-cell auxiliary byte and marking the shell dirty rather than a broader refresh owner.","objdump + caller inspection + local disassembly + secondary-overlay correlation + local-cell correlation + aux-byte correlation"
0x0056b770,367,secondary_overlay_chunk_refresh_local_page_sample_slot_sidebands_from_world_callbacks,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Chunk-wide refresh owner over the same coarse secondary-overlay chunk family. The helper walks every present local page in the chunk's `4x4` page table, reseeds that page's minmax height band through `0x0056b2c0`, then for each `4x4` cell whose sample-slot count in `[page + cell*8 + 0x0a]` is nonzero it replays the world callback path, resamples the local height through `0x00534490`, and rebuilds the per-cell sample-slot side bytes at `[page + cell*8 + 0x02 + i]` for every active slot. Current grounded caller is `world_secondary_overlay_refresh_coarse_chunks_in_rect` `0x00533e70`, so this is the safest current read for refreshing a chunk's local-page sample-slot sidebands from the current world callbacks rather than a release pass.","objdump + caller inspection + local disassembly + secondary-overlay correlation + coarse-chunk correlation + local-page correlation"
0x0056b8f0,67,buffered_callback_stream_read_byte_from_global_input_0xd9fdd0,shell,fastcall,inferred,objdump + caller inspection + local disassembly,2,"Small buffered-byte reader beneath the `0x10/0x91` callback-stream codec family. The helper consumes one byte from global input pointer `0x00d9fdd0`, refilling the `0x8000`-byte source buffer through callback `ESI` when remaining-count dword `0x00d9fdc8` reaches zero, and returns `-1` on callback failure. Current grounded callers are the `0x0056be10` decode owner and the `0x0056bfe0` encode owner, which use it as their shared byte-reader primitive.","objdump + caller inspection + local disassembly + callback-stream correlation + codec-0x91 correlation"
0x0056b940,34,buffered_callback_stream_write_byte_to_global_output_0xd97dc8,shell,fastcall,inferred,objdump + caller inspection + local disassembly,2,"Small buffered-byte writer paired with `0x0056b8f0` under the `0x10/0x91` codec family. The helper appends one caller byte to the global output buffer rooted at `0x00d97dc8`, flushes the buffer through callback `ESI` when the local write cursor reaches `0x8000`, and resets the write cursor after a successful flush. Current grounded callers are the `0x0056be10` decode owner and the encoder-side helper strip rooted at `0x0056bfe0`.","objdump + caller inspection + local disassembly + callback-stream correlation + codec-0x91 correlation"
0x0056b990,381,codec_0x91_promote_or_insert_dictionary_slot_by_current_0x42_byte_window,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Adaptive dictionary update helper beneath the `0x10/0x91` encoder. The routine writes current slot id `[this+0x08]` into the paired index tables at `[this+0x28/+0x2c]`, then uses the caller slot and the current `0x42`-byte window rooted at `[this+0x38]` to walk and compare candidate entries in five-byte chunks, updating best-match fields `[this+0x1c/+0x20]` and finally either inserting or promoting one dictionary slot through the three table bands `[this+0x24/+0x28/+0x2c]`. Current grounded callers are the encode owner `0x0056bfe0`, which uses this helper both for the initial dictionary seeding pass and while advancing the source window.","objdump + caller inspection + local disassembly + codec-0x91 correlation + dictionary-table correlation"
0x0056bb10,157,codec_0x91_relink_dictionary_slot_after_window_advance,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Dictionary-maintenance companion to `0x0056b990` under the `0x10/0x91` encoder. Given one slot index in `EDX`, the helper unlinks or rotates that slot through the same three dictionary tables `[this+0x24/+0x28/+0x2c]`, repairing predecessor and successor references when the advanced source window invalidates the old current position. Current grounded caller is the encode owner `0x0056bfe0`, which re-enters this helper every time it consumes another source byte.","objdump + caller inspection + local disassembly + codec-0x91 correlation + dictionary-table correlation"
0x0056bbb0,71,codec_0x91_flush_pending_token_bytes_to_output_callback,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small flush helper beneath the `0x10/0x91` encoder. The routine walks the pending token-byte strip stored at `[state+0x3c]` for count `[state+0x18]`, appends those bytes to the buffered output sink rooted at `0x00d97dc8`, and flushes through the caller callback in `EBX` when the global output cursor reaches `0x8000`. Current grounded caller is the token-emission helper `0x0056bc00`.","objdump + caller inspection + local disassembly + codec-0x91 correlation + token-buffer correlation"
0x0056bc00,151,codec_0x91_emit_next_literal_or_backreference_token_byte,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Token-emission helper in the `0x10/0x91` encoder. When current match length field `[state+0x20]` is still at most `2`, the helper folds literal byte `[state+0x38 + [state+0x14]]` into the pending token strip at `[state+0x3c]`; otherwise it encodes the pending backreference from fields `[state+0x1c/+0x20/+0x0c/+0x10/+0x4d]` into the same strip. After every appended token byte it advances the local pending-count fields and flushes the strip through `0x0056bbb0` once the pending flag byte `[state+0x4d]` rolls over. Current grounded caller is the broader encoder owner `0x0056bfe0`.","objdump + caller inspection + local disassembly + codec-0x91 correlation + token-buffer correlation"
0x0056bca0,112,codec_0x91_init_dictionary_state_tables,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Initializer for the `0x10/0x91` encoder state object. The helper allocates the three main dictionary tables at `[this+0x24/+0x28/+0x2c]` plus the current `0x241`-byte source window at `[this+0x38]`, seeds root sentinel `[this+0x08] = 0x200`, and initializes the table heads so every initial entry points back to that sentinel. Current grounded caller is the broader encode owner `0x0056bfe0`.","objdump + caller inspection + local disassembly + codec-0x91 correlation + dictionary-table correlation"
0x0056be10,450,callback_stream_decode_header_0x10_0x91_ring_backreference_payload,shell,fastcall,inferred,objdump + caller inspection + local disassembly,3,"Decode owner for the `0x10/0x91` callback-stream payload family. The routine validates input callbacks, reads and checks fixed header words `0x10` and `0x91`, seeds a `0x200`-byte ring buffer with initial cursor `0x1be`, and then consumes flag bits from the input stream through `0x0056b8f0`. Literal bits route one byte directly to the sink callback through `0x0056b940`; match bits read the packed offset or length pair, replay one backreference from the ring buffer, and write the resulting expanded bytes through the same buffered sink path. Current grounded caller is the bundle-side decode wrapper `0x00553120`, which dispatches here when stored codec word `[record+0x0e] == 0x91`.","objdump + caller inspection + local disassembly + codec-0x91 correlation + ring-buffer correlation + bundle-wrapper correlation"
0x0056bfe0,820,callback_stream_encode_header_0x10_0x91_adaptive_dictionary_payload,shell,fastcall,inferred,objdump + caller inspection + local disassembly,3,"Encode owner paired with `0x0056be10` for the `0x10/0x91` callback-stream family. The routine validates input and output callbacks, seeds header words `0x10/0x91`, initializes the dictionary state through `0x0056bca0`, preloads a `0x42`-byte source window through `0x0056b8f0`, builds the initial dictionary slots through `0x0056b990`, and then iteratively emits either literals or packed backreferences through `0x0056bc00` while advancing the adaptive dictionary through `0x0056b990` and `0x0056bb10`. It flushes the final buffered output on exit and returns `1` on success or one negative status on callback failure. Current grounded caller is the bundle-side encode wrapper `0x00553000`, which dispatches here when selector `[this+0x00] == 0x91`.","objdump + caller inspection + local disassembly + codec-0x91 correlation + adaptive-dictionary correlation + bundle-wrapper correlation"
0x0056c320,64,buffered_callback_stream_write_byte_to_global_output_0xdafde8,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small buffered-byte writer beneath the `0x10/0x92` callback-stream family. The helper appends one caller byte into the global output buffer rooted at `0x00dafde8`, flushes through callback `ESI` when the write cursor reaches `0x8000`, and resets the cursor after a successful flush. Current grounded callers are the `0x0056c3e0` encode owner and the `0x0056c630` decode owner.","objdump + caller inspection + local disassembly + callback-stream correlation + codec-0x92 correlation"
0x0056c370,110,buffered_callback_stream_read_span_from_global_input_0xdafde8,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Buffered span-reader paired with `0x0056c320` under the `0x10/0x92` callback-stream family. The helper copies up to the caller-requested byte count from global input pointer `0x00dafde0`, refilling the `0x8000`-byte source buffer through callback `EDI` when remaining-count dword `0x00db7de8` reaches zero, and returns the number of bytes actually copied. Current grounded callers are the `0x0056c3e0` encode owner and the `0x0056c630` decode owner.","objdump + caller inspection + local disassembly + callback-stream correlation + codec-0x92 correlation"
0x0056c3e0,581,callback_stream_encode_header_0x10_0x92_literal_or_rle_payload,shell,fastcall,inferred,objdump + caller inspection + local disassembly,3,"Encode owner for the `0x10/0x92` callback-stream family. The routine validates input and output callbacks, writes fixed header words `0x10/0x92`, then repeatedly reads source spans through `0x0056c370` and partitions them into two token kinds: repeated-byte runs of length `1..0x80` and literal spans of length `1..0x80`. Repeated runs emit one control byte with the high bit set plus one repeated byte, while literal spans emit one control byte with the high bit clear plus the raw span bytes, all through buffered sink helper `0x0056c320`. Current grounded caller is the bundle-side encode wrapper `0x00553000`, which dispatches here when selector `[this+0x00] == 0x92`.","objdump + caller inspection + local disassembly + codec-0x92 correlation + run-length correlation + bundle-wrapper correlation"
0x0056c630,501,callback_stream_decode_header_0x10_0x92_literal_or_rle_payload,shell,fastcall,inferred,objdump + caller inspection + local disassembly,3,"Decode owner paired with `0x0056c3e0` for the `0x10/0x92` callback-stream family. The routine validates input and output callbacks, checks fixed header words `0x10` and `0x92`, then repeatedly reads one control byte plus the following payload bytes through `0x0056c370`. When the control byte has its high bit set, the next byte is replayed as one repeated run of length `(control & 0x7f) + 1`; otherwise the helper copies the next `(control & 0x7f) + 1` literal bytes directly to the sink through `0x0056c320`. Current grounded caller is the bundle-side decode wrapper `0x00553120`, which dispatches here when stored codec word `[record+0x0e] == 0x92`.","objdump + caller inspection + local disassembly + codec-0x92 correlation + run-length correlation + bundle-wrapper correlation"
0x0056c890,42,math_dispatch_sample_cubic_basis_vec2_from_four_control_points_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small CPU-dispatch wrapper in the shared x87 math table. The helper first ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, then forwards one scalar parameter plus four caller vec2 control-point pointers through slot `0x00625ccc`. The default slot target is the local x87 fallback sibling `0x0056c8ba`, which mirrors later SSE helper `0x005823e0` until the dispatch table is patched to a faster implementation.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + cubic-basis correlation"
0x0056c8ba,142,math_sample_cubic_basis_vec2_from_four_control_points_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"x87 vec2 cubic-basis interpolation helper beneath dispatch wrapper `0x0056c890`. The function derives four basis weights from the caller scalar parameter through the local constant strip at `0x005c8554/0x005c85b4/0x005c8900`, applies those weights to four caller vec2 control points, and writes the blended vec2 result through the caller output. The current formula and caller shape line up with later SSE sibling `0x005823e0`, so the safest read is the shared x87 fallback for the same cubic-basis sampler rather than a subsystem-specific curve owner.","objdump + local disassembly + x87 arithmetic inspection + cubic-basis correlation + SSE-sibling correlation"
0x0056c948,42,math_dispatch_sample_alternate_cubic_basis_vec2_from_four_control_points_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small CPU-dispatch sibling to `0x0056c890`. After `0x00571493(1)` has prepared the shared table, the helper forwards one scalar parameter plus four caller vec2 control-point pointers through slot `0x00625d44`. The default slot target is the local x87 fallback `0x0056c972`, which matches the alternate-basis vec2 family later exposed through `0x00582680` and `0x0058a2ce`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + alternate-basis correlation"
0x0056c972,175,math_sample_alternate_cubic_basis_vec2_from_four_control_points_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"x87 vec2 alternate-cubic-basis interpolation helper beneath dispatch wrapper `0x0056c948`. The function derives one second four-weight family from the caller scalar parameter through the same local constant strip, applies those weights to four caller vec2 control points, and writes the blended vec2 result through the caller output. The weight pattern and sibling coverage match the later alternate-basis helpers `0x00582680` and `0x0058a2ce`, so the safest read is the x87 fallback for that same alternate cubic-basis sampler.","objdump + local disassembly + x87 arithmetic inspection + alternate-basis correlation + sibling correlation"
0x0056ca21,47,math_dispatch_blend_vec2_from_origin_and_two_targets_by_two_scalars_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small CPU-dispatch wrapper for the x87 vec2 affine-blend helper. The wrapper ensures dispatch table `0x00625c88` is live through `0x00571493(1)`, then forwards one output pointer, three caller vec2 control points, and two scalar weights through slot `0x00625d48`. The default slot target is the local fallback `0x0056ca50`, which mirrors later SSE helper `0x005827c0`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + affine-blend correlation"
0x0056ca50,64,math_blend_vec2_from_origin_and_two_targets_by_two_scalars_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"x87 vec2 affine-blend helper beneath dispatch wrapper `0x0056ca21`. The function computes `p0 + s*(p1-p0) + t*(p2-p0)` from one caller origin point, two target points, and two scalar weights, then writes the blended vec2 through the caller output. This is the x87 fallback analogue of later SSE helper `0x005827c0`.","objdump + local disassembly + x87 arithmetic inspection + affine-blend correlation + SSE-sibling correlation"
0x0056cacd,42,math_dispatch_sample_cubic_basis_vec3_from_four_control_points_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Vec3 CPU-dispatch sibling to `0x0056c890`. After `0x00571493(1)` has prepared the shared table, the helper forwards one scalar parameter plus four caller vec3 control-point pointers through slot `0x00625d4c`. The default slot target is the local x87 fallback `0x0056caf7`, which mirrors later SSE helper `0x00582320` and MMX sibling `0x005897a2`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + cubic-basis correlation"
0x0056caf7,174,math_sample_cubic_basis_vec3_from_four_control_points_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"x87 vec3 cubic-basis interpolation helper beneath dispatch wrapper `0x0056cacd`. The function derives four basis weights from the caller scalar parameter, applies those weights to four caller vec3 control points, and writes the blended XYZ triple through the caller output. The structure matches later SSE helper `0x00582320`, so the safest read is the x87 fallback for the shared vec3 cubic-basis sampler.","objdump + local disassembly + x87 arithmetic inspection + cubic-basis correlation + SSE-sibling correlation"
0x0056cba5,42,math_dispatch_sample_alternate_cubic_basis_vec3_from_four_control_points_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Vec3 alternate-basis CPU-dispatch sibling to `0x0056c948`. The helper ensures dispatch table `0x00625c88` is initialized, then forwards one scalar parameter plus four caller vec3 control-point pointers through slot `0x00625d50`. The default slot target is the local x87 fallback `0x0056cbcf`, which lines up with the later alternate-basis vec3 helper `0x00582520`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + alternate-basis correlation"
0x0056cbcf,209,math_sample_alternate_cubic_basis_vec3_from_four_control_points_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"x87 vec3 alternate-cubic-basis interpolation helper beneath dispatch wrapper `0x0056cba5`. The function derives one second four-weight family from the caller scalar parameter, applies those weights to four caller vec3 control points, and writes the blended XYZ triple through the caller output. The weight pattern and sibling coverage match the later alternate-basis helper `0x00582520`, so the safest read is the x87 fallback for that same vec3 sampler.","objdump + local disassembly + x87 arithmetic inspection + alternate-basis correlation + sibling correlation"
0x0056cca0,47,math_dispatch_blend_vec3_from_origin_and_two_targets_by_two_scalars_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Vec3 affine-blend CPU-dispatch sibling to `0x0056ca21`. After `0x00571493(1)` has prepared the shared table, the wrapper forwards one output pointer, three caller vec3 control points, and two scalar weights through slot `0x00625d54`. The default slot target is the local x87 fallback `0x0056cccf`, which mirrors later SSE helper `0x00582710`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + affine-blend correlation"
0x0056cccf,93,math_blend_vec3_from_origin_and_two_targets_by_two_scalars_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"x87 vec3 affine-blend helper beneath dispatch wrapper `0x0056cca0`. The function computes `p0 + s*(p1-p0) + t*(p2-p0)` from one caller origin point, two target points, and two scalar weights, then writes the blended XYZ triple through the caller output. This is the x87 fallback analogue of later SSE helper `0x00582710`.","objdump + local disassembly + x87 arithmetic inspection + affine-blend correlation + SSE-sibling correlation"
0x0056cf7f,42,math_dispatch_sample_cubic_basis_vec4_from_four_control_points_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Vec4 CPU-dispatch sibling to `0x0056c890`. The helper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, then forwards one scalar parameter plus four caller vec4 control-point pointers through slot `0x00625d58`. The default slot target is the local x87 fallback `0x0056cfa9`, which mirrors later SSE helper `0x00582470` and MMX sibling `0x0058a5fd`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + cubic-basis correlation"
0x0056cfa9,209,math_sample_cubic_basis_vec4_from_four_control_points_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"x87 vec4 cubic-basis interpolation helper beneath dispatch wrapper `0x0056cf7f`. The function derives four basis weights from the caller scalar parameter, applies those weights across four caller vec4 control points, and writes the blended XYZW tuple through the caller output. The structure matches later SSE helper `0x00582470`, so the safest read is the x87 fallback for the shared vec4 cubic-basis sampler.","objdump + local disassembly + x87 arithmetic inspection + cubic-basis correlation + SSE-sibling correlation"
0x0056d07a,42,math_dispatch_sample_alternate_cubic_basis_vec4_from_four_control_points_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Vec4 alternate-basis CPU-dispatch sibling to `0x0056c948`. After `0x00571493(1)` has prepared the shared table, the helper forwards one scalar parameter plus four caller vec4 control-point pointers through slot `0x00625d5c`. The default slot target is the local x87 fallback `0x0056d0a4`, which lines up with later alternate-basis vec4 helpers `0x005825e0` and `0x0058a6c5`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + alternate-basis correlation"
0x0056d0a4,240,math_sample_alternate_cubic_basis_vec4_from_four_control_points_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"x87 vec4 alternate-cubic-basis interpolation helper beneath dispatch wrapper `0x0056d07a`. The function derives one second four-weight family from the caller scalar parameter, applies those weights across four caller vec4 control points, and writes the blended XYZW tuple through the caller output. The weight pattern and sibling coverage match the later alternate-basis helper `0x005825e0`, so the safest read is the x87 fallback for that same vec4 sampler.","objdump + local disassembly + x87 arithmetic inspection + alternate-basis correlation + sibling correlation"
0x0056d197,42,math_dispatch_blend_vec4_from_origin_and_two_targets_by_two_scalars_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Vec4 affine-blend CPU-dispatch sibling to `0x0056ca21`. The helper ensures dispatch table `0x00625c88` is initialized, then forwards one output pointer, three caller vec4 control points, and two scalar weights through slot `0x00625d60`. The default slot target is the local x87 fallback `0x0056d1c6`, which mirrors later SSE helper `0x00582770` and MMX sibling `0x0058a58c`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + affine-blend correlation"
0x0056d1c6,117,math_blend_vec4_from_origin_and_two_targets_by_two_scalars_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"x87 vec4 affine-blend helper beneath dispatch wrapper `0x0056d197`. The function computes `p0 + s*(p1-p0) + t*(p2-p0)` from one caller origin point, two target points, and two scalar weights, then writes the blended XYZW tuple through the caller output. This is the x87 fallback analogue of later SSE helper `0x00582770`.","objdump + local disassembly + x87 arithmetic inspection + affine-blend correlation + SSE-sibling correlation"
0x0056cd2f,13,math_dispatch_apply_3d_basis_rows_and_translation_to_vec4_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small CPU-dispatch wrapper in the same x87 math table. The helper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, then forwards one output pointer, one caller vec3 input, and one 4x4 basis or translation block through slot `0x00625c8c`. The default slot target is the local x87 fallback `0x0056cd42`, which mirrors later SSE helper `0x00581830`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + matrix-transform correlation"
0x0056cd42,136,math_apply_3d_basis_rows_and_translation_to_vec4_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"x87 transform helper beneath dispatch wrapper `0x0056cd2f`. The function multiplies one caller XYZ triple by the first three rows of a caller 4x4 basis block, adds the translation row at `[basis+0x30]`, and writes the resulting full vec4 through the caller output. This is the x87 fallback analogue of later SSE helper `0x00581830` and MMX sibling `0x005895fa`.","objdump + local disassembly + x87 arithmetic inspection + matrix-transform correlation + sibling correlation"
0x0056cde0,13,math_dispatch_apply_3d_basis_rows_to_vec3_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small CPU-dispatch wrapper for the translation-free 3D basis helper. After `0x00571493(1)` has prepared the shared table, the helper forwards one output pointer, one caller vec3 input, and one 3x3 basis block through slot `0x00625ca0`. The default slot target is the local x87 fallback `0x0056cded`, which mirrors later SSE helper `0x00581770`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + matrix-transform correlation"
0x0056cded,99,math_apply_3d_basis_rows_to_vec3_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"x87 translation-free 3D basis helper beneath dispatch wrapper `0x0056cde0`. The function multiplies one caller XYZ triple by the first three rows of a caller basis block, sums the three product bands, and writes the resulting XYZ triple through the caller output. This is the x87 fallback analogue of later SSE helper `0x00581770` and MMX sibling `0x0058966b`.","objdump + local disassembly + x87 arithmetic inspection + matrix-transform correlation + sibling correlation"
0x0056ce53,17,math_dispatch_apply_vec3_through_optional_4x4_chain_and_optional_viewport_map_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Small CPU-dispatch wrapper in the same x87 math table. The helper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, then jumps through slot `0x00625cc0`. The default slot target copied from seed table `0x00625da8` is the broader x87 fallback `0x0056f496`, which matches the later MMX projective owner `0x00589bb7`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + seed-table correlation + projective-correlation"
0x0056ce64,17,math_dispatch_apply_vec3_through_optional_inverse_4x4_chain_and_optional_inverse_viewport_map_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Small CPU-dispatch wrapper sibling to `0x0056ce53`. The helper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, then jumps through slot `0x00625cc4`. The default slot target copied from seed table `0x00625dac` is the broader x87 inverse-side fallback `0x0056f623`, which matches the later MMX unproject or inverse-projective owner family under `0x00589d3f` and `0x00589f67`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + seed-table correlation + inverse-projective correlation"
0x0056ce75,13,math_dispatch_compute_4d_cross_product_from_three_vec4_inputs_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Small CPU-dispatch wrapper in the same x87 math table. The helper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, then forwards one output vec4 pointer plus three caller vec4 inputs through slot `0x00625cc8`. The default slot target copied from seed table `0x00625db0` is the local x87 fallback `0x0056ce82`, which matches the later SSE helper `0x005821d0`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + seed-table correlation + 4d-cross-product correlation"
0x0056ce82,247,math_compute_4d_cross_product_from_three_vec4_inputs_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"x87 4D vector helper beneath dispatch wrapper `0x0056ce75`. The function computes the alternating-sign generalized cross-product style combination of three caller vec4 inputs and writes the resulting vec4 through the caller output. Current evidence is strongest for the scalar x87 predecessor of later SSE helper `0x005821d0` rather than a subsystem-specific owner.","objdump + local disassembly + x87 arithmetic inspection + 4d-cross-product correlation + sibling correlation"
0x0056d23d,13,math_dispatch_multiply_4x4_matrices_x87_variant_a,support,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small CPU-dispatch wrapper for the x87 4x4 multiply seam. The helper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, then forwards one output matrix plus two caller 4x4 source matrices through slot `0x00625c90`. The default slot target is the local x87 fallback `0x0056d24a`, which is the older scalar predecessor of the later 4x4 multiply family under `0x0058584a` and `0x00588eb2`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + matrix-multiply correlation"
0x0056d24a,157,math_multiply_4x4_matrices_x87_variant_a,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"x87 4x4 matrix-multiply helper beneath dispatch wrapper `0x0056d23d`. The function contracts the four rows of one caller matrix against the four columns of the second caller matrix and writes the resulting four-row product through the caller output. Current evidence is strongest for the scalar x87 predecessor of the later packed and MMX matrix-multiply families rather than a subsystem-specific owner.","objdump + local disassembly + x87 arithmetic inspection + matrix-multiply correlation + sibling correlation"
0x0056d2f6,200,math_measure_4x4_matrix_determinant_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Standalone x87 4x4 determinant helper. The function forms the required cofactor combinations from the caller matrix rows, contracts them against the first row, and returns the resulting determinant scalar through the x87 return path. Current evidence is strongest for the scalar x87 predecessor of later determinant helpers `0x005828e0` and `0x00583cc0`.","objdump + local disassembly + x87 arithmetic inspection + matrix-determinant correlation + sibling correlation"
0x0056d61c,108,math_copy_4x4_matrix_x87,support,cdecl,inferred,objdump + local disassembly,2,"Small 4x4 matrix copy helper in the same x87 family. The function copies all sixteen dwords from one caller matrix to the caller output, preserving alias safety through the direct `dst == src` fast path. Current grounded callers are the neighboring alias-safe multiply seams, so the safest current read is the shared scalar copy helper for one 4x4 matrix block.","objdump + local disassembly + matrix-copy correlation + alias-safety correlation"
0x0056d689,13,math_dispatch_multiply_4x4_matrices_x87_variant_b,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Small CPU-dispatch wrapper for the broader alias-safe x87 4x4 multiply seam. The helper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, then forwards one output matrix plus two caller 4x4 source matrices through slot `0x00625c98`. The default slot target copied from seed table `0x00625d80` is the local x87 fallback `0x0056d696`, which lines up with the later alias-safe MMX multiply family under `0x00588eb2`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + seed-table correlation + matrix-multiply correlation"
0x0056d696,881,math_multiply_4x4_matrices_with_alias_safe_rhs_staging_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Broader x87 4x4 matrix-multiply owner beneath dispatch wrapper `0x0056d689`. The helper multiplies two caller 4x4 matrices, but when the destination aliases either source it first stages the result in one temporary contiguous 4x4 block on the stack and copies that staged product back to the caller output at the end. Current evidence is strongest for the scalar x87 predecessor of later alias-safe MMX multiply helper `0x00588eb2` rather than a subsystem-specific owner.","objdump + local disassembly + x87 arithmetic inspection + matrix-multiply correlation + alias-staging correlation + sibling correlation"
0x0056d8d9,6,math_dispatch_invert_4x4_matrix_and_optionally_store_determinant_x87_variant_b,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Small dispatch entry in the same x87 matrix family. The wrapper jumps through slot `0x00625cd0`, whose default target copied from seed table `0x00625db8` is the local inverse helper `0x0056d8df`. Current grounded caller is the new inverse-projective owner `0x0056f623`, so the safest current read is the dispatch front door for the second x87 4x4 inverse variant.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + seed-table correlation + matrix-inversion correlation"
0x0056d8df,907,math_invert_4x4_matrix_and_optionally_store_determinant_x87_variant_b,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Broader x87 4x4 inverse helper beneath dispatch wrapper `0x0056d8d9`. The function expands one caller matrix into the expected cofactor bands, optionally stores the determinant through caller outparam `[ebp+0x0c]` when that pointer is non-null, uses the determinant reciprocal when the matrix is invertible, and writes the scaled adjugate through the caller output. Current evidence is strongest for a scalar x87 sibling of the later packed or MMX inverse helpers `0x00581db0`, `0x00588bd0`, and `0x005892aa` rather than a subsystem-specific owner.","objdump + local disassembly + x87 arithmetic inspection + matrix-inversion correlation + determinant correlation + sibling correlation"
0x0056dc6c,43,math_dispatch_build_4x4_scale_matrix_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Small CPU-dispatch wrapper for the scalar 4x4 scale-matrix constructor. The helper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, forwards one output matrix and three caller scale lanes through slot `0x00625d0c`, and by default routes to local x87 constructor `0x0056dca0` from seed entry `0x00625df4`. Current evidence is strongest for the x87 predecessor of later MMX helper `0x00585e7c`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + seed-table correlation + scale-matrix correlation"
0x0056dca0,89,math_build_4x4_scale_matrix_x87,support,cdecl,inferred,objdump + local disassembly,2,"Scalar x87 diagonal scale-matrix constructor. The helper writes the three caller scalar scale lanes onto the homogeneous 4x4 diagonal, clears the off-diagonal lanes, and seeds the trailing homogeneous `1.0f` lane at `[out+0x3c]`. Current evidence is strongest for the x87 predecessor of later MMX helper `0x00585e7c`.","objdump + local disassembly + matrix correlation + scale correlation + sibling correlation"
0x0056dd2a,95,math_build_4x4_translation_matrix_x87,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Scalar x87 4x4 translation-matrix constructor. The helper seeds identity on the homogeneous diagonal, writes the three caller translation lanes into the translation row at `[out+0x30/+0x34/+0x38]`, and clears all remaining off-diagonal terms. Current grounded callers are the `0x5deba0` helper-generated composition owners `0x00570e8e` and `0x00570f0a`.","objdump + local disassembly + caller correlation + matrix correlation + translation correlation"
0x0056dd8c,26,math_dispatch_build_single_angle_4x4_x_axis_rotation_matrix_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Small CPU-dispatch wrapper for the x87 single-angle `X`-axis rotation-matrix constructor. The helper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, forwards one output matrix and one caller angle through slot `0x00625d00`, and by default routes to local constructor `0x0056ddae` from seed entry `0x00625de8`. Current evidence is strongest for the dispatch front door of the same `X`-axis rotation-matrix family rather than a separate helper family.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + seed-table correlation + x-axis-rotation correlation + trig correlation"
0x0056ddae,121,math_build_single_angle_4x4_x_axis_rotation_matrix_x87,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Scalar x87 single-angle `X`-axis 4x4 rotation-matrix constructor. The helper routes one caller angle through `fsincos`, leaves the first basis row fixed at identity, writes the sine/cosine pair into the trailing `YZ` submatrix with one off-diagonal sign flip, and seeds the homogeneous lane `[out+0x3c]` to `1.0f`. This is the safest current read for the x87 predecessor of a standard `X`-axis rotation matrix.","objdump + local disassembly + caller correlation + x-axis-rotation correlation + matrix correlation + trig correlation"
0x0056de28,26,math_dispatch_build_single_angle_4x4_y_axis_rotation_matrix_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Small CPU-dispatch wrapper for the x87 single-angle `Y`-axis rotation-matrix constructor. The helper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, forwards one output matrix and one caller angle through slot `0x00625d04`, and by default routes to local constructor `0x0056de4a` from seed entry `0x00625dec`. Current evidence is strongest for the dispatch front door of the same `Y`-axis rotation-matrix family rather than a separate helper family.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + seed-table correlation + y-axis-rotation correlation + trig correlation"
0x0056de4a,121,math_build_single_angle_4x4_y_axis_rotation_matrix_x87,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Scalar x87 single-angle `Y`-axis 4x4 rotation-matrix constructor. The helper routes one caller angle through `fsincos`, leaves the middle basis row fixed at identity, writes the sine/cosine pair into the `XZ` submatrix with one off-diagonal sign flip, and seeds the homogeneous lane `[out+0x3c]` to `1.0f`. This is the safest current read for the x87 predecessor of a standard `Y`-axis rotation matrix.","objdump + local disassembly + caller correlation + y-axis-rotation correlation + matrix correlation + trig correlation"
0x0056dee1,121,math_build_single_angle_4x4_z_axis_rotation_matrix_x87,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Scalar x87 single-angle `Z`-axis 4x4 rotation-matrix constructor. The helper routes one caller angle through `fsincos`, leaves the final basis row fixed at identity, writes the sine/cosine pair into the leading `XY` submatrix with one off-diagonal sign flip, and seeds the homogeneous lane `[out+0x3c]` to `1.0f`. This is the safest current read for the x87 predecessor of a standard `Z`-axis rotation matrix.","objdump + local disassembly + caller correlation + z-axis-rotation correlation + matrix correlation + trig correlation"
0x0056e092,6,math_dispatch_build_4x4_rotation_matrix_from_quaternion_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Jump-only dispatch entry for the x87 quaternion-to-matrix helper. The wrapper forwards one output matrix and one caller quaternion through slot `0x00625d20`, which self-patches from the neighboring init stub `0x0056e085` and then routes to the local x87 body `0x0056e098`. Current evidence is strongest for the dispatch front door of the same quaternion-to-4x4 rotation-matrix family later exposed in SSE form at `0x00582c30`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + quaternion correlation + matrix correlation"
0x0056e098,223,math_build_4x4_rotation_matrix_from_quaternion_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 quaternion-to-matrix helper. The function derives the expected doubled-product bands from one caller quaternion-like vec4, combines those bands into the diagonal and off-diagonal terms of one homogeneous `4x4` rotation matrix, zeroes the translation row, and seeds `[out+0x3c]` to `1.0f`. Current evidence is strongest for the x87 predecessor of later SSE helper `0x00582c30` and packed sibling `0x00584010`.","objdump + local disassembly + x87 arithmetic inspection + quaternion correlation + matrix correlation + sibling correlation"
0x0056e7b6,46,math_dispatch_build_quaternion_from_three_euler_angles_via_half_angle_trig_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Small CPU-dispatch wrapper for the x87 three-angle quaternion constructor. The helper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, repacks the three caller angles onto the stack, and then calls through slot `0x00625cec`, which routes to local body `0x0056e7ea`. Current evidence is strongest for the dispatch front door of the same half-angle trig family later exposed in SSE form at `0x00582fd0`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + quaternion correlation + trig correlation"
0x0056e7ea,217,math_build_quaternion_from_three_euler_angles_via_half_angle_trig_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 three-angle quaternion builder. The function halves each of the three caller angles, routes those half angles through repeated `fsincos`, and combines the resulting sine and cosine terms into one quaternion vec4 before storing it through the caller output. Current evidence is strongest for the x87 predecessor of later SSE helper `0x00582fd0` and MMX sibling `0x005848ba`, without overclaiming the exact axis order.","objdump + local disassembly + x87 arithmetic inspection + quaternion correlation + trig correlation + sibling correlation"
0x0056e8c3,11,math_dispatch_multiply_quaternions_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Small CPU-dispatch wrapper in the same x87 vector-math family. The helper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, then jumps through slot `0x00625cd4`. The default slot target copied from seed table `0x00625dbc` is the local quaternion-product helper `0x0056e8d6`, which matches later SSE helper `0x00582d10`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + seed-table correlation + quaternion correlation"
0x0056e8d6,147,math_multiply_quaternions_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 quaternion product helper over two caller vec4 inputs. The function applies the expected alternating-sign Hamilton-product-style combination and writes the resulting vec4 through the caller output. Current evidence is strongest for the x87 predecessor of later SSE helper `0x00582d10` and MMX sibling `0x005842e0`.","objdump + local disassembly + x87 arithmetic inspection + quaternion correlation + sibling correlation"
0x0056e96c,11,math_dispatch_normalize_vec4_or_zero_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Small CPU-dispatch wrapper for the shared x87 vec4 normalize-or-zero helper. The helper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, then jumps through slot `0x00625cd8`. The default slot target copied from seed table `0x00625dc0` is the local fallback `0x0056e97f`, which matches the later MMX helper `0x00584379`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + seed-table correlation + normalization correlation"
0x0056e97f,183,math_normalize_vec4_or_zero_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 vec4 normalize-or-zero helper. The function computes squared length from the caller vec4, compares it against the nearby epsilon constant at `0x005de4e8`, and when the length is large enough scales the full vec4 by one reciprocal-square-root path before writing it to the caller output; smaller inputs collapse to zero. Current evidence is strongest for the x87 predecessor of later MMX helper `0x00584379` rather than a quaternion-only normalizer.","objdump + local disassembly + x87 arithmetic inspection + normalization correlation + sibling correlation"
0x0056ea38,13,math_dispatch_invert_quaternion_by_conjugate_over_squared_length_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Small CPU-dispatch wrapper for the x87 quaternion-inverse helper. The wrapper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, then jumps through slot `0x00625d38`. The default slot target copied from seed table `0x00625e20` is the local fallback `0x0056ea4b`, which matches the later MMX quaternion-inverse sibling `0x00584c41`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + seed-table correlation + quaternion correlation + sibling correlation"
0x0056ea4b,178,math_invert_quaternion_by_conjugate_over_squared_length_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 quaternion inverse helper over one caller vec4. The function flips the sign of the spatial XYZ lanes, preserves the scalar W lane, divides that conjugate by the squared quaternion length when the quaternion is invertible, and writes the resulting vec4 through the caller output; degenerate inputs collapse to zero. Current evidence is strongest for the x87 predecessor of later SSE helper `0x00582e40` and MMX sibling `0x00584c41`.","objdump + local disassembly + x87 arithmetic inspection + quaternion correlation + sibling correlation"
0x0056eb05,123,math_build_scaled_axis_vec4_from_quaternion_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 quaternion-to-scaled-axis helper. The function reads the quaternion `W` lane, derives one angle-like term through `0x005a2f70` and `fsin`, conditionally rescales the `XYZ` lanes by the reciprocal sine factor when that angle is not degenerate, and writes the resulting scaled-axis vec3 through the caller output with `W` cleared to zero. Current evidence is strongest for a shared quaternion-to-scaled-axis helper rather than a tighter axis-angle label.","objdump + local disassembly + x87 arithmetic inspection + quaternion correlation + scaled-axis correlation"
0x0056eb89,152,math_build_quaternion_from_scaled_axis_vec3_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 scaled-axis-to-quaternion helper. The function measures the length of the caller vec3, routes that magnitude through `fsincos`, conditionally rescales the `XYZ` lanes by the reciprocal magnitude, and writes a quaternion-style vec4 whose `XYZ` lanes hold the scaled-axis contribution and whose `W` lane receives the cosine-like scalar result. Current evidence is strongest for the x87 predecessor of later MMX helper `0x00584d4c`.","objdump + local disassembly + x87 arithmetic inspection + quaternion correlation + scaled-axis correlation + sibling correlation"
0x0056ec24,36,math_dispatch_interpolate_quaternion_slerp_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Small CPU-dispatch wrapper in the same x87 quaternion family. The helper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, then forwards one output quaternion, two caller quaternions, and one scalar interpolation factor through slot `0x00625d14`. The default slot target copied from seed table `0x00625dfc` is the local x87 slerp helper `0x0056ec4e`, which matches later MMX helper `0x005849eb`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + seed-table correlation + quaternion correlation + slerp correlation"
0x0056ec4e,225,math_interpolate_quaternion_slerp_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 quaternion slerp helper over two caller quaternions and one scalar interpolation factor. The function measures the quaternion dot product, flips hemisphere sign when needed, takes the small-angle fast path when the relative angle is nearly degenerate, otherwise derives one angular term through `fpatan`, evaluates the required sine-weight terms, and writes the weighted combination through the caller output. Current evidence is strongest for the x87 predecessor of later MMX helper `0x005849eb`.","objdump + local disassembly + x87 arithmetic inspection + quaternion correlation + slerp correlation + sibling correlation"
0x0056ed5b,287,math_blend_three_quaternion_controls_by_quadratic_nested_slerp_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 quadratic nested quaternion-slerp helper. The function first builds two intermediate slerps at the same parameter `t` through `0x0056ec48`, derives the classic quadratic blend scalar `2*t*(1-t)`, and then slerps between those intermediates into the caller output. Current evidence is strongest for the x87 predecessor of later MMX helper `0x00584baf`.","objdump + local disassembly + x87 arithmetic inspection + quaternion correlation + nested-slerp correlation + sibling correlation"
0x0056edc3,45,math_dispatch_blend_three_quaternion_controls_by_two_parameter_nested_slerp_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Small CPU-dispatch wrapper in the same x87 quaternion-curve family. The helper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, then forwards one output quaternion, three caller control quaternions, and two scalar parameters through slot `0x00625d18`. The default slot target copied from seed table `0x00625e00` is the local nested-slerp helper `0x0056edf2`, which matches later MMX helper `0x00584b22`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + seed-table correlation + quaternion correlation + nested-slerp correlation"
0x0056edf2,136,math_blend_three_quaternion_controls_by_two_parameter_nested_slerp_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 two-parameter nested quaternion-slerp helper. The function first forms `u+v`, performs two intermediate slerps from one shared control quaternion to two neighboring controls through `0x0056ec48`, derives the relative blend weight `v/(u+v)`, and then slerps between those intermediates into the caller output. Current evidence is strongest for the x87 predecessor of later MMX helper `0x00584b22`.","objdump + local disassembly + x87 arithmetic inspection + quaternion correlation + nested-slerp correlation + sibling correlation"
0x0056ee8a,6,math_dispatch_normalize_vec4_or_zero_x87_variant_c,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Jump-only dispatch entry for the third x87 vec4 normalize-or-zero seam. The wrapper forwards one output vec4 and one caller vec4 input through slot `0x00625cdc`, which self-patches from neighboring init stub `0x0056ee7d` and then routes to local body `0x0056ee90`. Current grounded callers are the older x87 plane-matrix constructors `0x0056fb6f` and `0x0056fc49`, so the safest current read is the dispatch front door for their shared plane-normalization helper.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + normalization correlation + plane-correlation"
0x0056ee90,162,math_normalize_vec4_or_zero_x87_variant_c,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 vec4 normalization sibling used by the older plane-matrix constructors. The function computes squared length from the caller XYZW tuple, treats near-unit inputs as already normalized through `0x0056c856`, returns a zero vec4 when the length is too small, and otherwise applies one reciprocal-square-root scale before writing the normalized result through the caller output. Current evidence is strongest for a third x87 vec4 normalize-or-zero variant rather than a subsystem-specific plane helper.","objdump + local disassembly + x87 arithmetic inspection + normalization correlation + plane-correlation + sibling correlation"
0x0056efe3,13,math_dispatch_intersect_plane_vec4_with_vec3_segment_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Small CPU-dispatch wrapper for the older x87 plane-versus-segment intersection helper. The wrapper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, then jumps through slot `0x00625cb8`. The default slot target copied from seed table `0x00625da0` is the local x87 fallback `0x0056ef41`, which matches later SSE helper `0x00582820`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + seed-table correlation + plane-correlation + geometry correlation"
0x0056ef41,162,math_intersect_plane_vec4_with_vec3_segment_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 plane-versus-segment intersection helper over one caller plane vec4 and two caller vec3 endpoints. The function evaluates the plane against both endpoints, compares the segment denominator against the nearby zero constant at `0x005c8598`, derives the affine parameter `(dot(plane.xyz, p0) + plane.w) / (dot(plane.xyz, p0) - dot(plane.xyz, p1))` when that denominator is nondegenerate, rejects non-finite factors through `0x005a4d01`, and otherwise writes the intersection point `p0 + t*(p1-p0)` through the caller output. Current evidence is strongest for the x87 predecessor of later SSE helper `0x00582820`.","objdump + local disassembly + x87 arithmetic inspection + plane-correlation + geometry correlation + sibling correlation"
0x0056eff0,53,math_build_plane_vec4_from_normal_vec3_and_point_vec3_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 plane builder over one caller normal vec3 and one caller point vec3. The helper copies the normal into output `[+0x00..+0x08]`, evaluates the negated dot product `-dot(point, normal)`, and stores that signed plane constant at `[out+0x0c]`. Current evidence is strongest for the x87 predecessor of later plane-construction helpers rather than a subsystem-specific owner.","objdump + local disassembly + x87 arithmetic inspection + plane-correlation + geometry correlation"
0x0056f028,13,math_dispatch_build_plane_vec4_from_three_vec3_points_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Small CPU-dispatch wrapper in the same x87 geometry strip. The helper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, then forwards one output plane vec4 and three caller vec3 points through slot `0x00625cbc`. The default slot target copied from seed table `0x00625da4` is the local x87 fallback `0x0056f035`, which matches the later SSE helper `0x005829b0`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + seed-table correlation + plane-correlation"
0x0056f035,159,math_build_plane_vec4_from_three_vec3_points_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 three-point plane builder beneath dispatch wrapper `0x0056f028`. The function forms two edge vectors from three caller vec3 points, computes their cross product, normalizes that resulting normal through `0x0056cac7`, stores the plane normal through output `[+0x00..+0x08]`, and writes the signed plane constant `-dot(normal, p0)` to `[out+0x0c]`. Current evidence is strongest for the x87 predecessor of later SSE helper `0x005829b0`.","objdump + local disassembly + x87 arithmetic inspection + plane-correlation + geometry correlation + sibling correlation"
0x0056f0d7,13,math_dispatch_apply_4x4_basis_to_vec4_x87,support,cdecl,inferred,objdump + caller inspection + local disassembly + dispatch-table correlation,2,"Small CPU-dispatch wrapper in the same x87 matrix table. The helper ensures dispatch table `0x00625c88` is initialized through `0x00571493(1)`, then forwards one output vec4, one caller vec4 input, and one caller 4x4 matrix through slot `0x00625d10`. The default slot target copied from seed table `0x00625df8` is the local x87 fallback `0x0056f0e4`, which matches the later packed full-vec4 basis helper `0x00583320`.","objdump + caller inspection + local disassembly + cpu-dispatch-table correlation + seed-table correlation + matrix-transform correlation"
0x0056f0e4,156,math_apply_4x4_basis_to_vec4_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 4x4 basis helper beneath dispatch wrapper `0x0056f0d7`. The function contracts one caller vec4 input against the four rows of one caller 4x4 matrix and writes the resulting transformed vec4 through the caller output. Current evidence is strongest for the x87 predecessor of later packed full-vec4 transform helper `0x00583320` rather than a subsystem-specific owner.","objdump + local disassembly + x87 arithmetic inspection + matrix-transform correlation + sibling correlation"
0x0056f183,139,math_normalize_vec2_or_zero_below_epsilon_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 vec2 normalization helper. The function computes squared length from the caller XY pair, treats near-unit inputs as already normalized through the local epsilon compare at `0x0056c856`, returns a zero vec2 when the length is too small, and otherwise applies one reciprocal-square-root scale before writing the normalized XY result through the caller output. Current evidence is strongest for the x87 predecessor of later MMX helper `0x0058a28b`.","objdump + local disassembly + x87 arithmetic inspection + normalization correlation + sibling correlation"
0x0056f210,105,math_apply_2d_basis_rows_and_translation_to_vec4_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 2D basis-plus-translation helper over one caller XY pair and one caller 4x4 basis block. The function multiplies the input X and Y scalars by the first two matrix rows, adds translation row `[basis+0x30]`, and writes the resulting full vec4 through the caller output. Current evidence is strongest for the x87 predecessor of later SSE helper `0x00581690` and MMX sibling `0x0058a0b8`.","objdump + local disassembly + x87 arithmetic inspection + matrix-transform correlation + translation correlation + sibling correlation"
0x0056f27b,126,math_apply_2d_basis_rows_translation_and_project_xy_by_reciprocal_lane3_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 projective 2D sibling to `0x0056f210`. The function builds the same translated four-lane transform result from one caller XY pair and one caller 4x4 basis block, derives a reciprocal from lane `3` when that lane is not already near `1`, scales the transformed vector by that reciprocal, and stores the resulting XY pair through the caller output. Current evidence is strongest for the x87 predecessor of later SSE helper `0x005816d0` and MMX sibling `0x0058a146`.","objdump + local disassembly + x87 arithmetic inspection + matrix-transform correlation + projective correlation + sibling correlation"
0x0056f2fb,58,math_apply_2d_basis_rows_to_vec2_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 translation-free 2D basis helper. The function multiplies one caller XY pair by the first two rows of one caller basis block, sums the two product bands, and writes the resulting vec2 through the caller output. Current evidence is strongest for the x87 predecessor of later SSE helper `0x00581730` and MMX sibling `0x0058a10d`.","objdump + local disassembly + x87 arithmetic inspection + matrix-transform correlation + sibling correlation"
0x0056f337,158,math_normalize_vec3_or_zero_below_epsilon_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 vec3 normalization helper. The function computes squared length from the caller XYZ triple, treats near-unit inputs as already normalized through the local epsilon compare at `0x0056c856`, returns a zero vec3 when the length is too small, and otherwise applies one reciprocal-square-root scale before writing the normalized XYZ result through the caller output. Current evidence is strongest for the x87 predecessor of later SSE helper `0x00581c00` and MMX sibling `0x005896d2`.","objdump + local disassembly + x87 arithmetic inspection + normalization correlation + sibling correlation"
0x0056f3d7,189,math_apply_3d_basis_rows_translation_and_project_vec3_by_reciprocal_lane3_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 projective 3D sibling to `0x0056cd42`. The function builds the same translated four-lane transform result from one caller XYZ triple and one caller 4x4 basis block, derives a reciprocal from lane `3` when that lane is not already near `1`, scales the transformed vector by that reciprocal, and stores the resulting XYZ triple through the caller output. Current evidence is strongest for the x87 predecessor of later SSE helper `0x005818f0` and MMX sibling `0x00589960`.","objdump + local disassembly + x87 arithmetic inspection + matrix-transform correlation + projective correlation + sibling correlation"
0x0056f496,365,math_apply_vec3_through_optional_4x4_chain_and_optional_viewport_map_x87,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection,2,"Broader x87 projective transform owner over one caller vec3, up to three optional 4x4 matrix inputs, and one optional integer viewport-style range block. The helper selects identity, one matrix, or the ordered composition of two or three matrices through `0x0056d3cd`, applies the resulting chain through `0x0056cdda`, and when the optional range block is present remaps the projected normalized result into that caller integer range before returning. Current evidence is strongest for the scalar x87 predecessor of later MMX helper `0x00589bb7`.","objdump + local disassembly + caller-shape inspection + matrix correlation + projective correlation + viewport-range correlation + sibling correlation"
0x0056f623,387,math_apply_vec3_through_optional_inverse_4x4_chain_and_optional_inverse_viewport_map_x87,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection,2,"Inverse-side x87 sibling to `0x0056f496`. The helper selects identity or the ordered composition of up to three optional 4x4 matrices through `0x0056d3cd`, routes the chosen chain through inverse-side helper `0x0056d8d9`, optionally maps one caller integer viewport-style coordinate triple back into the normalized projective range, and then applies the resulting chain through `0x0056cdda`. The safest current read is an x87 unproject or inverse-projective helper without overclaiming one subsystem-specific API.","objdump + local disassembly + caller-shape inspection + matrix correlation + inverse correlation + projective correlation + viewport-range correlation"
0x0056f7c9,183,math_normalize_vec4_or_zero_below_epsilon_x87_variant_b,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 vec4 normalization sibling with an explicit near-unit fast path. The function computes squared length from the caller XYZW tuple, treats values already near `1.0f` as normalized through `0x0056c856`, returns a zero vec4 when the length is too small, and otherwise applies one reciprocal-square-root scale before writing the normalized result through the caller output. Current evidence is strongest for a second x87 vec4 normalize-or-zero variant adjacent to the later quaternion and matrix helpers rather than a subsystem-specific owner.","objdump + local disassembly + x87 arithmetic inspection + normalization correlation + sibling correlation"
0x0056f882,57,math_build_4x4_rotation_matrix_from_three_euler_angles_via_half_angle_trig_x87,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Small x87 Euler-to-matrix owner. The helper first builds one quaternion from the three caller angles through `0x0056e7e4`, then forwards that quaternion into `0x0056e092` to materialize the final homogeneous `4x4` rotation matrix in the caller output. Current evidence is strongest for the x87 predecessor of the later Euler-to-matrix helper family without overclaiming the exact axis order.","objdump + local disassembly + caller correlation + quaternion correlation + matrix correlation + trig correlation"
0x0056fb6f,218,math_build_4x4_projective_matrix_from_plane_vec4_and_vec4_input_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 plane-driven 4x4 projective-matrix helper. The function first normalizes one caller plane vec4 through `0x0056ee8a`, computes one diagonal dot term against the second caller vec4 input, combines that term with the expected per-plane outer-product bands, and writes the resulting homogeneous `4x4` matrix through the caller output. Current evidence is strongest for the x87 predecessor of later SSE helper `0x00582aa0` and packed or MMX siblings `0x00583e80` and `0x00585b9b`.","objdump + local disassembly + x87 arithmetic inspection + plane-correlation + projective-matrix correlation + sibling correlation"
0x0056fc49,191,math_build_4x4_reflection_matrix_from_plane_vec4_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Scalar x87 plane-reflection matrix helper. The function first normalizes one caller plane vec4 through `0x0056ee8a`, forms the expected `1 - 2*n*n^T` diagonal terms plus the paired `-2*n_i*n_j` off-diagonal bands and translation terms from plane `D`, and writes the resulting homogeneous `4x4` reflection-style matrix through the caller output. Current evidence is strongest for the x87 predecessor of later MMX helper `0x00585c86`.","objdump + local disassembly + x87 arithmetic inspection + plane-correlation + reflection-matrix correlation + sibling correlation"
0x0056fd08,986,math_build_two_inner_quaternion_spline_controls_from_four_quaternions_x87,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection + sibling-formula correlation,2,"Broader x87 quaternion-curve owner over four caller quaternions and two caller output quaternions. The function first flips neighboring inputs into a consistent hemisphere when the dot product is negative, then builds the two relative quaternions `inv(q1)*q0` and `inv(q1)*q2`, converts those relatives into scaled-axis form through `0x0056eaff`, averages that pair with the fixed `-0.25f` scalar at `0x005ddb10`, converts the averaged scaled-axis back into a quaternion through `0x0056eb83`, and multiplies that result back into `q1` for the first output; it then repeats the same construction around `q2` using the aligned `q1` and `q3` neighbors for the second output. Current evidence is strongest for the x87 predecessor of a classic inner quaternion spline or squad-control builder rather than a subsystem-specific owner.","objdump + local disassembly + x87 arithmetic inspection + quaternion correlation + scaled-axis correlation + spline-control correlation + sibling-formula correlation"
0x0056abe0,99,shell_audio_acquire_free_non3d_sample_record_from_pool_and_optionally_attach_payload,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small acquire-side helper in the non-3D Miles sample branch. Under the shared lock or unlock gate, the routine pops one free sample handle through `0x00569750`, resolves the matching free-pool record through owner `[this+0x04]`, and returns the live record body at `record+0x08`. When the caller requests payload attachment, the helper rebuilds record field `[record+0x04]` through `0x00564390`; otherwise it clears that field to `0`. Current grounded caller is the higher configure-and-start owner `0x0056ad20`.","objdump + local disassembly + caller inspection + Miles correlation + free-pool correlation"
0x0056ac50,120,shell_audio_release_non3d_sample_record_by_key_and_return_handle_to_pool,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,2,"Release-side helper in the non-3D Miles sample branch. Under the shared reentrancy drain and lock or unlock gate, the routine resolves one live record by key under owner `[this+0x0c]`, decrements active one-shot count `[this+0x24]` when the record mode field equals `1`, returns the sample handle to the free pool through `0x005697d0`, removes the keyed record from owner `[this+0x0c]`, releases any attached payload handle from `[record+0x04]`, and clears that payload field back to `0`. Current grounded callers are the mode-gated shell wrapper `0x005317b0`, the world-view teardown strip `0x0043a50c`, and the train-visual release path `0x0045e3c2`.","objdump + import-table + local disassembly + caller inspection + Miles correlation + sample-record correlation + free-pool correlation"
0x0056acd0,66,shell_audio_update_non3d_sample_volume_levels_by_key_scaled_by_master_scalar,shell,thiscall,inferred,objdump + import-table + local disassembly + caller inspection,2,"Keyed volume-refresh helper in the non-3D Miles sample branch. Under the shared lock or unlock gate, the routine resolves one live record by key through active-list owner `[this+0x0c]`, scales the caller float by master scalar `[this+0x20]`, and then applies the resulting left or right level pair to the sample through `_AIL_set_sample_volume_levels`.","objdump + import-table + local disassembly + caller inspection + Miles correlation + volume-refresh correlation"
0x005a644d,81,__heap_init,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,3,"Initializes the CRT heap root at `0x00dbb8c0`. The helper creates the process heap through `HeapCreate`, stores the selected heap mode from `0x005a6433` into `0x00dbb8c4`, and when that mode equals `3` also tries to initialize the small-block heap through `0x005a6601(0x3f8)`. If that subsidiary init fails it destroys the just-created heap and returns failure; otherwise it returns success. This is the concrete heap bootstrap owner beneath the later local-heap fast path.","llvm-objdump + local disassembly + startup correlation + heap-bootstrap correlation"
0x005a649e,73,startup_init_multithread_lock_table,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,3,"Initializes the fixed CRT multithread lock table rooted at `0x0062a380`, using the per-slot mode dwords at `0x0062a384` to decide which entries need real lock objects. For each mode-`1` slot the helper assigns the next `0x18`-byte record from the static lock-storage band at `0x00dba078`, initializes that record through `0x005b082f(0x0fa0)`, and advances to the next slice; on failure it clears the just-assigned slot and returns `0`. Current grounded caller is `startup_init_tls_state` `0x005abd49`.","llvm-objdump + local disassembly + startup correlation + CRT-lock correlation"
0x005a64e7,85,startup_release_multithread_lock_table,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,3,"Shared startup cleanup path for the CRT multithread lock table rooted at `0x0062a380..0x0062a4a0`. The helper first frees every non-null non-mode-`1` slot through the imported release primitive at `0x5c81f4` plus local heap free `0x005a1145`, then makes a second pass that releases the remaining mode-`1` slots through the same imported release primitive. Current grounded caller is the TLS cleanup owner `0x005abcba`.","llvm-objdump + local disassembly + startup correlation + CRT-lock correlation"
0x005a653c,20,crt_unlock_multithread_lock_slot,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,2,"Tiny unlock wrapper over one CRT multithread lock slot index. The helper resolves the slot root from `0x0062a380[index]` and forwards it into the imported unlock primitive at `0x5c81f8`. Current grounded callers include `crt_unlock_onexit_callback_table_slot8` `0x005a2d5b` and the lazy lock allocator `0x005a6551`.","llvm-objdump + local disassembly + startup correlation + CRT-lock correlation"
0x005a6551,127,crt_try_init_multithread_lock_slot_if_absent,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,3,"Lazily initializes one CRT multithread lock slot when `0x0062a380[index]` is still null. The helper allocates one `0x18`-byte record through the local heap, acquires lock slot `10`, rechecks whether the target slot was filled concurrently, and if still empty initializes the record through `0x005b082f(0x0fa0)` before publishing it into the table. Failed allocations report runtime error `0x0c`, initialization failures free the temporary record and retry the loop, and losing the race frees the temporary record before unlocking. Current grounded caller is `crt_lock_multithread_lock_slot_with_lazy_init` `0x005a65d0`.","llvm-objdump + local disassembly + startup correlation + CRT-lock correlation"
0x005a65d0,49,crt_lock_multithread_lock_slot_with_lazy_init,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,3,"Acquires one CRT multithread lock slot by index. The helper checks whether `0x0062a380[index]` is already populated, calls the lazy initializer `0x005a6551` when needed, raises runtime error `0x11` if initialization still fails, and finally forwards the resolved slot handle into the imported lock primitive at `0x5c81fc`. Current grounded callers include `crt_lock_onexit_callback_table_slot8` `0x005a2d52` and the lazy allocator `0x005a6551` itself while it holds lock slot `10`.","llvm-objdump + local disassembly + startup correlation + CRT-lock correlation"
0x005abcd8,113,crt_get_or_create_current_thread_data_preserving_last_error,startup,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Returns the current CRT per-thread data block from TLS slot `0x0062aa3c`, allocating and binding one zeroed `0x88`-byte block when no thread-local record exists yet. The helper preserves the caller's `GetLastError` value across the `TlsGetValue` or allocation path, seeds the new record with thread id, `[block+0x14] = 1`, `[block+0x04] = -1`, and thread-local pointer band `[block+0x54] = 0x0062ab50`, then restores the saved last-error state before returning the record pointer. Current grounded callers include the locale-aware signed-decimal core `0x005a1e1d` and other older CRT helper paths that consult per-thread locale or ctype state.","llvm-objdump + local disassembly + caller correlation + TLS correlation + per-thread-data correlation + locale-table correlation"
0x005abcba,30,startup_release_tls_slot_and_multithread_lock_table,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,3,"Shared cleanup owner beneath the CRT TLS bootstrap. The helper first runs `startup_release_multithread_lock_table` `0x005a64e7` to tear down the fixed multithread lock table, then frees the current TLS slot through `TlsFree` when global `0x0062aa3c` is not `-1`, and finally restores `0x0062aa3c` to `-1`. Current grounded caller is the failure path in `startup_init_tls_state` `0x005abd49`.","llvm-objdump + local disassembly + startup correlation + TLS correlation + CRT-lock correlation"
0x005abd49,111,startup_init_tls_state,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,3,"Initializes the CRT multithread or TLS startup state. The helper first runs the lock-table initializer at `0x005a649e`, allocates one TLS slot through `TlsAlloc` into global `0x0062aa3c`, allocates a zeroed `0x88`-byte per-thread data block, binds that block through `TlsSetValue`, seeds the thread-local pointer band at `[block+0x54]` from `0x0062ab50`, marks `[block+0x14] = 1`, stores the current thread id at `[block+0x00]`, and initializes `[block+0x04] = -1`. On failure it falls back to the shared cleanup path `0x005abcba`. This is the concrete TLS bootstrap owner rather than a generic per-thread placeholder.","llvm-objdump + local disassembly + startup correlation + TLS correlation + per-thread-data correlation"
0x005abf1b,510,startup_init_file_handle_table,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,3,"Initializes the CRT file-handle table rooted at `0x00dba780`. The helper allocates the initial `0x20`-entry block of `0x24`-byte descriptors, seeds each slot to `handle = -1` plus default text mode `0x0a`, then reads `STARTUPINFO` to import inherited handle metadata and grows the table in `0x20`-entry chunks when the startup handle count demands it. After that it walks the imported entries, clones valid inherited handles plus their flags into the descriptor pages, initializes each descriptor's auxiliary buffer through `0x005b082f`, and finally ensures the three standard streams are populated from `GetStdHandle(-10/-11/-12)` with `GetFileType`-based flag bits for character or pipe handles before committing the final descriptor count through `SetHandleCount`. This is the concrete CRT file-handle bootstrap owner rather than a generic startup-info consumer.","llvm-objdump + local disassembly + startup correlation + file-handle-table correlation + startupinfo correlation"
0x005aca5d,61,startup_run_init_callback_table,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,2,"Walks the fixed startup callback band rooted at `0x005eab20` in 4-byte steps and calls each non-null entry in order before returning. In the current binary this band is empty, so the helper is effectively a no-op fixed-table walker. This is the startup-side counterpart to the later fixed callback walker `0x005acaa1`.","llvm-objdump + local disassembly + startup correlation + callback-table correlation"
0x005ad12d,199,__setenvp,startup,cdecl,inferred,llvm-objdump + local disassembly + startup correlation,3,"Builds the CRT-owned `envp` pointer table from the current environment block at `0x00dba054`. The helper first counts candidate entries and the number of pointer slots needed, skipping strings whose first byte is `=` so the table only exposes ordinary `name=value` pairs, allocates the pointer array into global `0x00dba030`, clones each admitted environment string into its own heap buffer through `0x005a125d + 0x005ac3b0`, then frees the original environment block through `0x005a1145`, null-terminates the pointer table, and marks the environment initialized through `0x00dbb8d4 = 1`. This is the concrete startup envp-construction owner rather than a generic splitter around `=`.","llvm-objdump + local disassembly + startup correlation + envp-table correlation"
0x005ad1f4,364,startup_parse_command_line_into_argv_vector_and_char_count,startup,thiscall,inferred,llvm-objdump + local disassembly + caller correlation,3,"Shared two-pass CRT command-line parser used by `startup_build_argv` `0x005ad360`. The helper accepts one source command-line string in `EAX`, one optional argv-pointer cursor at stack arg `+0x08`, one argc output pointer at stack arg `+0x0c`, one destination character buffer in `ECX`, and one copied-character count output in `ESI`. It first emits the program-name token, then walks the remaining command line using the CRT multibyte lead-byte table at `0x00dba541`, honoring the usual quote and backslash folding rules, optionally storing each argument pointer and copied byte into the caller buffers while always counting both argument slots and character bytes. This is the safest current read for the shared argv parser and sizing helper beneath the startup two-pass allocation path.","llvm-objdump + local disassembly + caller correlation + argv-parser correlation + multibyte-leadbyte correlation"
0x005ad360,162,startup_build_argv,startup,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Builds the CRT-owned `argv` table from the current raw command line. The helper first caches the module filename in `0x00dba1e8` through `GetModuleFileNameA`, chooses the active source string as `0x00dbb8d0` when nonempty or that module path fallback otherwise, and stores the chosen source root in `0x00dba040`. It then runs the shared parser `0x005ad1f4` twice: first with null output buffers to measure argument count and copied character bytes, then after one combined heap allocation large enough for the pointer table plus character payload to materialize both regions in place. On success it stores `argc-1` in `0x00dba024` and the argv table root in `0x00dba028`. This is the concrete two-pass argv-construction owner rather than a generic multibyte init wrapper.","llvm-objdump + local disassembly + caller correlation + argv-table correlation + two-pass-allocation correlation"
0x005ad402,290,___crtGetEnvironmentStringsA,startup,cdecl,inferred,llvm-objdump + import correlation + local disassembly + startup correlation,3,"Builds one CRT-owned multibyte copy of the current Windows environment block. On first entry the helper probes whether the wide-character path is usable by calling `GetEnvironmentStringsW` and caches mode `1` or fallback mode `2` in global `0x00dba2f0`, again treating `GetLastError == 0x78` as the unsupported-API cutoff. In mode `1` it measures the UTF-16 environment block length, converts it into one heap-allocated multibyte buffer through `WideCharToMultiByte`, frees the original wide block through `FreeEnvironmentStringsW`, and returns the CRT-owned copy. In fallback mode it uses `GetEnvironmentStringsA`, measures the double-NUL-terminated block, clones it through `0x005a125d + 0x005aa9e0`, frees the OS block through `FreeEnvironmentStringsA`, and returns that copy. This is the concrete environment-block materializer used before `__setenvp` builds the filtered envp table.","llvm-objdump + import correlation + local disassembly + startup correlation + environment-block correlation"
0x005a16f4,76,buffered_stream_close_nolock_and_release_handle_and_aux_buffer,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"Core older-CRT stream-close helper over one FILE-like object. When stream flag byte `[stream+0x0c]` carries any of `0x01/0x02/0x80`, the helper runs the paired pre-close and flush path through `0x005a27e5` and `0x005a90ed`, closes low-level handle `[stream+0x10]` through `0x005a440d`, releases optional auxiliary buffer `[stream+0x1c]`, clears the stream flags, and returns the flush result or `-1` on close failure. Current grounded wrapper is `buffered_stream_close_with_lock_scope` `0x005a1740`.","llvm-objdump + import correlation + local disassembly + caller correlation + stream-close correlation"
0x005a1740,81,buffered_stream_close_with_lock_scope,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Lock-scoped wrapper around `buffered_stream_close_nolock_and_release_handle_and_aux_buffer` `0x005a16f4`. For streams already marked with flag `0x40`, the helper just clears the flag word and returns `0`; otherwise it acquires the stream lock through `0x005a91d5`, runs the nolock close owner, then releases the lock through `0x005a9227`. Current grounded callers include the CRT global stream sweep `0x005b09bb` plus many shell and data-family cleanup paths that close FILE-like objects.","llvm-objdump + local disassembly + caller correlation + stream-close correlation + lock-scope correlation"
0x005b09bb,155,crt_close_all_open_streams_and_release_dynamic_entries,startup,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Broader older-CRT stream-table cleanup owner. Under CRT lock slot `1`, the helper walks the live stream pointer table at `0x00dba880` from index `3` up to `0x00dbb8a0`, closes any stream whose flag byte `[stream+0x0c]` carries `0x01/0x02/0x80` through `buffered_stream_close_with_lock_scope` `0x005a1740`, counts the successful closes, and for dynamic slots `>= 0x14` additionally releases the per-stream lock object at `[stream+0x20]`, frees the stream record, and clears the table entry. It then releases CRT lock slot `1` and returns the close count.","llvm-objdump + local disassembly + caller correlation + stream-table correlation + CRT-lock correlation"
0x005b0a56,68,buffered_stream_ensure_heap_or_inline_ungetc_buffer,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Allocates or seeds the pushback buffer for one FILE-like stream. The helper increments global `0x00dba1d0`, tries to allocate a `0x1000`-byte heap buffer, and when that succeeds stores it at `[stream+0x08]` with size `[stream+0x18] = 0x1000` and flag bit `0x08`; otherwise it falls back to the small inline buffer at `[stream+0x14]`, stores size `2`, and marks flag bit `0x04`. In either case it resets the current cursor to the start of that buffer and zeroes the pending count at `[stream+0x04]`. Current grounded callers are the adjacent pushback helper `0x005b0a9a` and older stream-fill or flush paths.","llvm-objdump + local disassembly + caller correlation + stream-buffer correlation"
0x005b0a9a,108,buffered_stream_push_back_one_byte,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Single-byte pushback helper in the older CRT stream family. The helper rejects `-1`, validates the stream mode bits in `[stream+0x0c]`, ensures the stream carries a pushback buffer through `0x005b0a56` when needed, moves the current pointer back by one byte when possible, stores or matches the pushed byte depending on text-mode bit `0x40`, increments the pending count at `[stream+0x04]`, sets readable-state bit `0x01`, and returns the pushed byte or `-1` on failure. This is the safest current read for the shared one-byte `ungetc`-style helper rather than a generic buffer writer.","llvm-objdump + local disassembly + caller correlation + stream-buffer correlation + pushback correlation"
0x005b0b06,188,string_convert_one_multibyte_character_to_wide_with_locale_core,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly,3,"Core locale-aware multibyte-to-wide conversion helper over one source byte sequence. When the active locale band reports no multibyte table at `[locale+0x14]`, the helper accepts one plain single-byte character and either stores it as a zero-extended UTF-16 code unit or just reports success. Otherwise it consults the lead-byte table at `[locale+0x48]`, uses `MultiByteToWideChar(codepage = [locale+0x04], flags = 0x09)` for one-byte or multibyte sequences when enough source bytes are available, and reports runtime error `0x2a` on invalid or incomplete input. Current grounded wrapper is `string_convert_one_multibyte_character_to_wide_with_current_thread_locale` `0x005b0bc6`.","llvm-objdump + import correlation + local disassembly + locale-conversion correlation + multibyte-to-wide correlation"
0x005b0bc6,27,string_convert_one_multibyte_character_to_wide_with_current_thread_locale,support,cdecl,inferred,llvm-objdump + caller correlation + local disassembly,2,"Small wrapper that resolves the current per-thread locale band through `crt_get_or_create_current_thread_data_preserving_last_error` `0x005abcd8`, refreshes locale state through `0x005a35f5` when needed, and then forwards into the core multibyte-to-wide helper `0x005b0b06`.","llvm-objdump + caller correlation + local disassembly + locale-conversion correlation"
0x005b0bf1,42,crt_query_file_handle_text_mode_bit,startup,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Tiny CRT file-handle descriptor probe over one low-level handle index. The helper bounds-checks the index against descriptor count `0x00dba774`, resolves the owning `0x24`-byte descriptor page under `0x00dba780`, and returns bit `0x40` from the descriptor flag byte at offset `+0x04`. This is the safest current read for the shared text-mode descriptor query beneath the adjacent locale conversion seam.","llvm-objdump + local disassembly + caller correlation + file-handle-table correlation"
0x005b0c1b,96,string_convert_one_wide_character_to_multibyte_with_locale_core,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly,3,"Core locale-aware wide-to-multibyte conversion helper over one UTF-16 code unit. When the active locale band reports no multibyte table at `[locale+0x14]`, the helper accepts only code units `<= 0xff` and writes the low byte directly. Otherwise it calls `WideCharToMultiByte(codepage = [locale+0x04], flags = 0, cchWideChar = 1)` into the caller byte buffer, tracks the local `used default char` flag, and reports runtime error `0x2a` if conversion fails or falls back to a default character. Current grounded wrapper is `string_convert_one_wide_character_to_multibyte_with_current_thread_locale` `0x005b0c7b`.","llvm-objdump + import correlation + local disassembly + locale-conversion correlation + wide-to-multibyte correlation"
0x005b0c7b,39,string_convert_one_wide_character_to_multibyte_with_current_thread_locale,support,cdecl,inferred,llvm-objdump + caller correlation + local disassembly,2,"Small wrapper that resolves the current per-thread locale band through `crt_get_or_create_current_thread_data_preserving_last_error` `0x005abcd8`, refreshes locale state through `0x005a35f5` when needed, and then forwards into the core wide-to-multibyte helper `0x005b0c1b`.","llvm-objdump + caller correlation + local disassembly + locale-conversion correlation"
0x005b0cb0,147,support_divide_unsigned_u64_and_return_quotient_and_remainder,support,cdecl,inferred,llvm-objdump + local disassembly,2,"Compiler-style unsigned 64-bit divide helper over `(dividend_hi:lo, divisor_hi:lo)`. The fast path uses ordinary 32-bit division when the divisor high dword is zero; otherwise it normalizes the divisor, performs the wider divide, adjusts the tentative quotient when needed, and returns the quotient in `EDX:EAX` plus the remainder in `EBX:ECX`. This is the standard quotient-and-remainder helper seam rather than a subsystem-specific arithmetic owner.","llvm-objdump + local disassembly + 64-bit-arithmetic correlation"
0x005b0d45,19,math_round_f64_to_integral_value_x87,support,cdecl,inferred,llvm-objdump + local disassembly,1,"Tiny x87 round-to-integral helper over one caller `f64`. The function loads the input, applies `frndint`, spills the rounded value back to a stack `f64`, and returns it through x87.","llvm-objdump + local disassembly + x87-rounding correlation"
0x005b0d58,47,locale_map_dbcs_codepage_to_default_lcid,support,cdecl,inferred,llvm-objdump + local disassembly + literal inspection,2,"Small DBCS codepage-to-default-LCID mapper. The helper maps codepages `932`, `936`, `949`, and `950` to default locale ids `0x0411`, `0x0804`, `0x0412`, and `0x0404` respectively, and returns `0` for all other inputs. This is the safest current read for the adjacent locale bootstrap lookup rather than overclaiming a broader policy owner.","llvm-objdump + local disassembly + literal inspection + locale-correlation"
0x005b0d87,40,locale_reset_multibyte_tables_and_global_state,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Resets the older CRT multibyte-locale tables and related globals rooted at `0x00dba520..0x00dba650`. The helper clears the character-class table band at `0x00dba540`, zeroes the active-codepage and locale globals at `0x00dba520/0x00dba528/0x00dba644`, and clears the small trailing state band at `0x00dba650`. Current grounded caller is the broader locale bootstrap owner `0x005b0db0`.","llvm-objdump + local disassembly + caller correlation + locale-correlation"
0x005b0db0,402,locale_rebuild_multibyte_character_type_and_case_tables_for_active_codepage,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"Broader older-CRT locale-table rebuild owner over active codepage `0x00dba644`. The helper first queries `GetCPInfo`, clears temporary classification buffers, seeds the lead-byte or space mask band, and then uses the adjacent locale conversion helpers rooted at `0x005aec88` and `0x005ac579` to materialize three `0x100`-entry tables: character-type bits in `0x00dba541` plus paired lower/upper-case maps in `0x00dba660`. When `GetCPInfo` fails it falls back to the plain ASCII `A..Z/a..z` tables instead. Current grounded callers include the multibyte-codepage setup strip rooted at `0x005b0f42` and later codepage-switch owners.","llvm-objdump + import correlation + local disassembly + caller correlation + locale-correlation + codepage-table correlation"
0x005b0f42,99,locale_get_current_thread_locinfo_with_refcount,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Returns the current thread's refcounted locinfo object under CRT lock slot `13`. The helper acquires the lock, fetches the current per-thread data block through `crt_get_or_create_current_thread_data_preserving_last_error` `0x005abcd8`, compares `[ptd+0x60]` against the global default locinfo at `0x00dba524`, releases any old nondefault locinfo when its refcount drops to zero, stores the global default into `[ptd+0x60]`, increments that default refcount, unlocks slot `13`, and returns the resulting locinfo pointer. This is the safest current read for the shared current-thread locinfo getter rather than a broader codepage-switch owner.","llvm-objdump + local disassembly + caller correlation + locale-correlation + refcount correlation + CRT-lock correlation"
0x005b0fb1,406,locale_configure_global_multibyte_tables_for_codepage,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"Configures the older CRT global multibyte tables for one requested codepage. The helper first checks the small built-in preset table at `0x0062ae18..0x0062af08`; when a preset matches it installs the associated character-type masks, default-LCID mapping, and small side table directly into `0x00dba541/0x00dba520/0x00dba528/0x00dba650`. Otherwise it falls back to `GetCPInfo`, builds the lead-byte and printable-range masks, records the requested codepage in `0x00dba644`, and rebuilds the wider tables through `locale_rebuild_multibyte_character_type_and_case_tables_for_active_codepage` `0x005b0db0`. Invalid requests either fail with `-1` or reset and rebuild the default tables when the wrapper-side fallback flag `0x00dba454` permits it. Current grounded caller is the broader codepage-set owner `0x005b1147`.","llvm-objdump + import correlation + local disassembly + caller correlation + locale-correlation + codepage-table correlation"
0x005b1147,336,locale_set_multibyte_codepage_and_refresh_global_locinfo_cache,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"Broader older-CRT multibyte-codepage setter under CRT lock slot `13`. The helper accepts an explicit codepage or the sentinel requests `-2` OEM, `-3` ANSI, and `-4` current cached codepage, marks those sentinel paths through `0x00dba454`, and when the resolved codepage differs from the current one it allocates or reuses a `0x220`-byte locinfo snapshot, calls `locale_configure_global_multibyte_tables_for_codepage` `0x005b0fb1`, and then copies the resulting global codepage, flags, and table bands from `0x00dba644/0x00dba528/0x00dba520/0x00dba650/0x00dba540/0x00dba660` into that locinfo object before publishing it as the new global default at `0x00dba524`. On failure it frees any newly allocated snapshot and returns `-1`; otherwise it returns `0`.","llvm-objdump + import correlation + local disassembly + caller correlation + locale-correlation + codepage-set correlation + refcount correlation + CRT-lock correlation"
0x005b1297,27,locale_ensure_multibyte_codepage_initialized_once_from_ansi_cp,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"One-shot bootstrap wrapper for the older CRT multibyte-codepage state. When global `0x00dbb8e0` is still zero, the helper calls `locale_set_multibyte_codepage_and_refresh_global_locinfo_cache` `0x005b1147` with sentinel `-3` to seed the ANSI-codepage tables, then marks the initialization flag. Current grounded callers are later locale and CRT setup branches that require the multibyte tables to exist before use.","llvm-objdump + local disassembly + caller correlation + locale-correlation + one-shot-init correlation"
0x005b12b5,1034,string_parse_ascii_floating_literal_to_internal_12_byte_record,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Broader older-CRT decimal floating parser over one ASCII or locale-decimal string. The helper skips leading ASCII whitespace, runs a local state machine over optional sign, digits, locale decimal separator byte `0x0062acf4`, and optional exponent marker with sign, stores up to `0x19` significant decimal digits into a temporary buffer while tracking truncated digits and decimal-point displacement, and updates the caller end-pointer as parsing advances. When digits were found it builds one internal 12-byte decimal record through `0x005b2045`, combines the explicit exponent with the collected decimal offset, clamps the effective exponent to about `+/-0x1450`, and either returns underflow or overflow status or scales the record through `0x005b279c` before writing the final 12-byte result to the caller output. Current grounded caller correlation keeps this as the shared ASCII floating-literal parser rather than overclaiming a specific public CRT entry point.","llvm-objdump + local disassembly + caller correlation + floating-parse correlation + decimal-record correlation"
0x005b16ef,73,locale_query_default_ansi_codepage_from_lcid,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly,2,"Small LCID-to-ANSI-codepage helper. The function queries `GetLocaleInfoA(lcid, 0x1004)` into a small stack buffer, then parses the returned decimal string through `string_parse_signed_decimal_with_locale_space_skip_core` `0x005a1e1d` and returns that integer codepage, or `-1` on failure. This is the safest current read for the direct `LCID -> default ANSI codepage` helper beneath the broader locale parser and setup paths.","llvm-objdump + import correlation + local disassembly + locale-correlation + codepage-query correlation"
0x005b1738,463,locale_transcode_multibyte_string_between_codepages_via_utf16_bridge_when_needed,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"ANSI-side locale helper beneath `locale_map_multibyte_string_via_lcmapstringw_or_lcmapstringa_fallback` `0x005ac579`. The function compares `GetCPInfo` results for the source and destination codepages, uses a direct single-byte fast path when both ends are simple SBCS layouts, and otherwise computes the required UTF-16 length through `MultiByteToWideChar`, allocates a temporary wide buffer, converts the source bytes into that buffer, and then either queries or materializes destination bytes through `WideCharToMultiByte`. When the caller supplies a length pointer at `[arg+0x14]`, the helper updates it with the produced byte count. Current grounded caller is the ANSI fallback path inside `0x005ac579`.","llvm-objdump + import correlation + local disassembly + caller correlation + locale-correlation + codepage-transcode correlation"
0x005b1907,249,crt_report_runtime_error_via_user32_message_box_or_callback,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + literal inspection + caller correlation,3,"GUI-side runtime-report owner beneath `crt_emit_runtime_error_or_math_error_message_by_code_and_mode` `0x005acdb0`. On first entry the helper loads `user32.dll`, resolves `MessageBoxA`, `GetActiveWindow`, and `GetLastActivePopup`, and in GUI mode `0x00dba010 == 2` also resolves `GetProcessWindowStation` plus `GetUserObjectInformationA`. It then optionally checks whether interactive UI is available, derives a parent window through the active-window and last-active-popup pair when possible, and finally calls `MessageBoxA(parent, text, caption, flags)` with the caller-supplied text and caption plus modality bits derived from the UI-availability check. This is the safest current read for the shared CRT runtime-error message-box owner rather than a generic dynamic-import stub.","llvm-objdump + import correlation + local disassembly + literal inspection + caller correlation + runtime-report correlation"
0x005b1a00,49,locale_test_character_against_mbctype_mask_and_optional_extra_table,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Shared character-class predicate over one byte value, one optional extra mask, and one primary mbctype bit mask. The helper first tests the primary classification byte in `0x00dba541[value]`, then optionally consults the secondary `wctype`-style table at `0x005e6f12[value]`, and returns `1` when either requested mask matches. Current grounded wrapper is `locale_is_alpha_character` `0x005b1a31`, and the same predicate shape is reused by adjacent locale-string helpers.","llvm-objdump + local disassembly + caller correlation + character-class correlation"
0x005b1a31,17,locale_is_alpha_character,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,1,"Tiny wrapper around `locale_test_character_against_mbctype_mask_and_optional_extra_table` `0x005b1a00` with primary mask `0x04` and no secondary table mask. This is the safest current read for the shared locale alpha-character predicate.","llvm-objdump + local disassembly + caller correlation + character-class correlation"
0x005b1a42,304,locale_materialize_numeric_byte_or_allocated_multibyte_info_field,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"Shared locale-field materializer used by the broader CRT locale-structure builders. With mode `1`, the helper queries one locale-info string through `locale_query_info_multibyte_with_getlocaleinfow_or_getlocaleinfoa_fallback` `0x005b2958`, retries on `GetLastError == 0x7a` with a heap-sized temporary buffer, then allocates an exact-sized destination string and copies the locale text into the caller out-pointer. With mode `0`, it queries a short locale-info string through `locale_query_info_wide_with_getlocaleinfow_or_getlocaleinfoa_fallback` `0x005b2828` into scratch `0x00dba470..0x00dba478`, verifies that the returned bytes are decimal digits, and accumulates the resulting numeric value into one caller output byte. The function returns `0` on success and `-1` on failure. Current grounded callers are the locale-structure setup passes rooted at `0x005ad520`, `0x005adb80`, `0x005addc0`, and `0x005adfe0`.","llvm-objdump + import correlation + local disassembly + caller correlation + locale-info correlation + locale-structure correlation"
0x005b1b73,62,string_format_unsigned_integer_to_ascii_in_base,support,cdecl,inferred,llvm-objdump + local disassembly,2,"Formats one unsigned integer into an ASCII string in the requested radix. The helper optionally emits a leading `-` when the caller-supplied sign flag is nonzero, repeatedly divides by the radix to emit digits `0..9` or `a..z` in reverse order, NUL-terminates the temporary reversed run, and then reverses the digit span in place before returning. Current grounded wrapper is `string_format_signed_integer_to_ascii_in_base` `0x005b1bb1`.","llvm-objdump + local disassembly + integer-format correlation"
0x005b1bb1,42,string_format_signed_integer_to_ascii_in_base,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Small signed wrapper around `string_format_unsigned_integer_to_ascii_in_base` `0x005b1b73`. The helper detects the `radix == 10 && value < 0` case, passes an explicit sign flag when needed, and otherwise forwards the original value and radix into the unsigned formatter before returning the destination string pointer. This is the safest current read for the signed integer-to-ASCII helper rather than a subsystem-specific formatter.","llvm-objdump + local disassembly + caller correlation + integer-format correlation"
0x005b1bdb,86,security_cookie_initialize_from_time_pid_tid_tickcount_and_qpc,startup,cdecl,inferred,llvm-objdump + import correlation + local disassembly,2,"Initializes the global security cookie at `0x0062ace0`. The helper xors together `GetSystemTimeAsFileTime`, `GetCurrentProcessId`, `GetCurrentThreadId`, `GetTickCount`, and `QueryPerformanceCounter`, stores the result as the new cookie, and falls back to literal `0xbb40e64e` if that xor collapses to zero. This is the standard stack-cookie initialization seam rather than a game-specific entropy owner.","llvm-objdump + import correlation + local disassembly + security-cookie correlation"
0x005b1c31,330,crt_report_security_failure_or_buffer_overrun_and_abort,startup,cdecl,inferred,llvm-objdump + literal inspection + import correlation + local disassembly + caller correlation,3,"Broader older-CRT fatal security report owner. If callback global `0x00dba478` is set, the helper forwards `(kind, text)` to that callback and then terminates. Otherwise it chooses one of the two fixed long-body message pairs at `0x005e9c58/0x005e9cf8` and `0x005e9d18/0x005e9dcc` for the buffer-overrun vs unknown-security-failure cases, queries the module filename through `GetModuleFileNameA`, substitutes `<program name unknown>` when needed, trims the displayed path, formats the final `Runtime Error!` body into a temporary buffer, and emits it through `crt_report_runtime_error_via_user32_message_box_or_callback` `0x005b1907` with caption `Microsoft Visual C++ Runtime Library` before forcing CRT termination through `0x005a2ead(3)`.","llvm-objdump + literal inspection + import correlation + local disassembly + caller correlation + runtime-report correlation + security-failure correlation"
0x005b1ddd,70,crt_top_level_unhandled_exception_filter_dispatch_cpp_hook_then_previous_filter,startup,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"Top-level unhandled-exception filter callback installed through the older CRT startup seam. The helper first recognizes the VC++ exception signature `0xe06d7363` plus parameter marker `0x19930520` and forwards that case into `0x005afbd7`, then validates the previously registered filter pointer in global `0x00dba47c` through `IsBadCodePtr` and calls that previous filter when it is still callable. If no valid previous filter remains, the function returns `0`. Current grounded installers are `0x005b1e23` and `0x005b1e36`.","llvm-objdump + import correlation + local disassembly + caller correlation + unhandled-exception correlation"
0x005b1e23,19,crt_install_top_level_unhandled_exception_filter_bridge,startup,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,2,"Installs `crt_top_level_unhandled_exception_filter_dispatch_cpp_hook_then_previous_filter` `0x005b1ddd` through `SetUnhandledExceptionFilter` and stores the returned previous filter in global `0x00dba47c`. This is the small install-side bridge for the older CRT exception-report seam.","llvm-objdump + import correlation + local disassembly + caller correlation + unhandled-exception correlation"
0x005b1e36,13,crt_restore_previous_unhandled_exception_filter,startup,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,1,"Tiny restore-side bridge that forwards the saved previous filter in global `0x00dba47c` back into `SetUnhandledExceptionFilter`. Current grounded pairing is with `crt_install_top_level_unhandled_exception_filter_bridge` `0x005b1e23`.","llvm-objdump + import correlation + local disassembly + caller correlation + unhandled-exception correlation"
0x005b1eab,129,crt_find_environment_value_pointer_nolock,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Older CRT environment lookup over the global `envp` table at `0x00dba030`, with lazy materialization through `0x005b2ae6` when only the wider backing band at `0x00dba038` is present. The helper walks the `name=value` string table, compares the caller name against each entry through locale-aware comparator `0x005b2a98`, and returns a pointer to the value bytes immediately after the first matching `'='`, or `0` when no entry matches. Current lock-scoped wrapper is `0x005b1f2c`.","llvm-objdump + local disassembly + caller correlation + environment-correlation"
0x005b1f2c,63,crt_find_environment_value_pointer_with_lock,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Lock-scoped wrapper around `crt_find_environment_value_pointer_nolock` `0x005b1eab`. The helper acquires CRT multithread lock slot `7` through `0x005a65d0`, calls the nolock environment lookup, then releases the same slot through `0x005a653c` before returning the found value pointer.","llvm-objdump + local disassembly + caller correlation + environment-correlation + crt-lock correlation"
0x005b1f6b,33,support_add_u32_with_overflow_check_and_outparam,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,1,"Small unsigned-add helper with overflow detection. The function computes `a + b`, stores the sum through the caller out-pointer, and returns `1` when the addition overflowed the 32-bit range. Current grounded callers are the neighboring 96-bit decimal-record accumulation helpers `0x005b1f8c` and `0x005b2045`.","llvm-objdump + local disassembly + caller correlation + integer-arithmetic correlation"
0x005b1f8c,94,decimal_add_u96_triplet_with_carry,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Adds one three-dword unsigned triplet into another with carry propagation. The helper reuses `support_add_u32_with_overflow_check_and_outparam` `0x005b1f6b` across the low, middle, and high dwords, incrementing the next limb when a carry is reported. Current grounded callers are `decimal_accumulate_ascii_digits_into_internal_12_byte_record` `0x005b2045` and the adjacent decimal multiply path `0x005b2564`.","llvm-objdump + local disassembly + caller correlation + decimal-record correlation"
0x005b1fea,46,decimal_shift_u96_triplet_left_one,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,1,"Shifts one three-dword unsigned triplet left by one bit in place, propagating the carry bit across the 32-bit limbs. Current grounded callers are the decimal multiply and normalization helpers `0x005b2564` and `0x005b2045`.","llvm-objdump + local disassembly + caller correlation + decimal-record correlation"
0x005b2018,45,decimal_shift_u96_triplet_right_one,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,1,"Shifts one three-dword unsigned triplet right by one bit in place, propagating the borrow bit across the 32-bit limbs. Current grounded caller is the decimal multiply helper `0x005b2564`.","llvm-objdump + local disassembly + caller correlation + decimal-record correlation"
0x005b2045,227,decimal_accumulate_ascii_digits_into_internal_12_byte_record,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Accumulates one ASCII digit string into the older CRT internal 12-byte decimal record. The helper zeroes the output record, iterates each digit byte, repeatedly multiplies the current record by ten through the adjacent helpers `0x005b1fea/0x005b1f8c`, adds the next digit, then left-shifts the final record until bit `0x8000` is set in the high word while tracking the resulting exponent adjustment in output field `+0x0a`. Current grounded caller is the broader floating parser `0x005b12b5`.","llvm-objdump + local disassembly + caller correlation + decimal-record correlation"
0x005b2a98,78,locale_compare_multibyte_prefix_return_comparestring_minus_two,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Small locale-aware prefix-compare wrapper. The helper refreshes the active locinfo pointer when thread-data stamp `[thread_data+0x60]` no longer matches `0x00dba524`, then calls `locale_compare_strings_with_comparestringw_or_comparestringa_fallback` `0x005b2b6d` with compare flag `1`, the caller string pair, the caller prefix length, and the active locale codepage or sort data from locinfo. On success it returns `CompareString* result - 2`, so equality becomes `0`; on failure it returns `0x7fffffff`. Current grounded caller is `crt_find_environment_value_pointer_nolock` `0x005b1eab`.","llvm-objdump + local disassembly + caller correlation + locale-compare correlation + environment-correlation"
0x005b2ae6,107,crt_materialize_multibyte_environment_vector_from_wide_env_list,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"Builds the multibyte `envp` table at `0x00dba030` from the wider backing vector at `0x00dba038`. The helper walks each wide environment string pointer, queries and materializes the corresponding multibyte bytes through `WideCharToMultiByte`, allocates one exact-sized clone, and appends that clone through `0x005b2fa5` into the global multibyte environment vector. It returns `0` on success and `-1` on allocation or conversion failure. Current grounded caller is `crt_find_environment_value_pointer_nolock` `0x005b1eab`.","llvm-objdump + import correlation + local disassembly + caller correlation + environment-correlation + codepage-transcode correlation"
0x005b2b6d,906,locale_compare_strings_with_comparestringw_or_comparestringa_fallback,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"Broader locale-string comparison owner over one compare flag set, two input strings plus optional lengths, and one requested locale or codepage. The helper probes and caches `CompareStringW` support in `0x00dba49c`, trims explicit lengths through local helper `0x005b2b51`, and then either calls `CompareStringW` directly after converting the caller multibyte inputs through `MultiByteToWideChar`, or falls back to `CompareStringA` after choosing a destination ANSI codepage through `locale_query_default_ansi_codepage_from_lcid` `0x005b16ef` and optional source-to-destination transcode through `locale_transcode_multibyte_string_between_codepages_via_utf16_bridge_when_needed` `0x005b1738`. Current grounded caller is `locale_compare_multibyte_prefix_return_comparestring_minus_two` `0x005b2a98`.","llvm-objdump + import correlation + local disassembly + caller correlation + locale-compare correlation + codepage-transcode correlation"
0x005b2ef7,77,crt_find_environment_entry_index_or_negative_end_slot,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Searches the multibyte `envp` table at `0x00dba030` for one environment entry name. The helper walks the table, compares each candidate prefix through `locale_compare_multibyte_prefix_return_comparestring_minus_two` `0x005b2a98`, and only treats the candidate as a match when the next byte is `'='` or NUL. On match it returns the nonnegative entry index; when the name is absent it returns the negated end-slot index for insertion. Current grounded caller is `crt_set_or_unset_environment_entry_and_sync_process_env` `0x005b2fa5`.","llvm-objdump + local disassembly + caller correlation + environment-correlation"
0x005b2fa5,437,crt_set_or_unset_environment_entry_and_sync_process_env,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"Older CRT multibyte environment owner above the local `envp` table at `0x00dba030` and the wider backing vector at `0x00dba038`. The helper first finds the `'='` separator through `locale_find_character_or_dbcs_pair_in_string` `0x005b315a`, ensures the local environment tables exist, resolves the current slot through `crt_find_environment_entry_index_or_negative_end_slot` `0x005b2ef7`, and then either replaces, removes, or inserts the caller `name=value` string in the multibyte table. When the caller requests process-wide synchronization, it clones the input string, derives the value substring or a null value pointer for deletes, and forwards the update into `SetEnvironmentVariableA(name, value_or_null)`. Current grounded caller is `crt_materialize_multibyte_environment_vector_from_wide_env_list` `0x005b2ae6`, and this is the safest current read for the shared multibyte `putenv`-style owner.","llvm-objdump + import correlation + local disassembly + caller correlation + environment-correlation + process-environment correlation"
0x005b315a,119,locale_find_character_or_dbcs_pair_in_string,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"DBCS-aware character search helper beneath the older CRT locale and environment paths. The function refreshes the active locinfo when needed, uses the lead-byte classification table under the current locinfo to decide whether to treat the current bytes as one SBCS byte or one two-byte DBCS pair, and returns the first pointer whose byte or pair matches the caller code. When no multibyte tables are active it falls back to the simple byte-search helper at `0x005a2a00`. Current grounded caller is `crt_set_or_unset_environment_entry_and_sync_process_env` `0x005b2fa5`.","llvm-objdump + local disassembly + caller correlation + locale-correlation + environment-correlation"
0x005b23bd,46,crt_lookup_thread_signal_action_record_by_signal_number,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Small lookup helper over the per-thread signal-action table at `[thread_data+0x54]`. The function walks the fixed `0x0c`-byte records using count global `0x0062abd4`, compares signal number field `[record+0x04]` against the caller signal id in `ESI`, and returns the matching record pointer or `0` when no entry matches. Current grounded caller is `crt_raise_signal_and_invoke_installed_handler` `0x005b23eb`.","llvm-objdump + local disassembly + caller correlation + signal-correlation"
0x005b23eb,377,crt_raise_signal_and_invoke_installed_handler,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Older CRT signal-dispatch owner. Depending on the caller signal id, the helper either uses one of the fixed global handler slots at `0x00dba480..0x00dba48c` or looks up the per-thread signal-action record through `crt_lookup_thread_signal_action_record_by_signal_number` `0x005b23bd`. It treats handler values `0` and `1` specially, acquires CRT lock slot `0` around the global-handler cases, temporarily clears the live thread-data signal state at `[thread_data+0x58/+0x5c]` for the `SIGILL/SIGSEGV/SIGFPE` style cases, and then calls the installed handler with either the signal id or the special `SIGFPE` two-argument form. After dispatch it restores the saved thread-data state and returns `0`, or `-1` when the caller signal id is unsupported.","llvm-objdump + local disassembly + caller correlation + signal-correlation + crt-lock correlation"
0x005b279c,140,decimal_scale_internal_12_byte_record_by_power_of_ten,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Scales one internal 12-byte decimal record by a signed power-of-ten exponent. The helper chooses the positive or negative cached power table at `0x0062af70` or `0x0062b0d0`, decomposes the exponent into low three bits plus repeated groups of eight, and applies the selected cached factors through `0x005b2564` until the requested scale has been consumed. Current grounded caller is the broader floating parser `0x005b12b5`, which uses this helper after it has accumulated the significant digits.","llvm-objdump + local disassembly + caller correlation + decimal-record correlation + power-of-ten correlation"
0x005b2828,304,locale_query_info_wide_with_getlocaleinfow_or_getlocaleinfoa_fallback,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"Wide-output locale-info wrapper over `GetLocaleInfoW`. The helper probes once whether `GetLocaleInfoW` is available, caches mode `1` or fallback mode `2` in global `0x00dba494`, and on the wide-path simply forwards `(lcid, lctype, out_wide, cch)` to `GetLocaleInfoW`. On the fallback path it calls `GetLocaleInfoA`, allocates a temporary multibyte buffer when needed, and converts that ANSI result into the caller wide buffer through `MultiByteToWideChar` using the requested or default codepage. Current grounded caller is `0x005b1a42`.","llvm-objdump + import correlation + local disassembly + caller correlation + locale-info correlation"
0x005b2958,320,locale_query_info_multibyte_with_getlocaleinfow_or_getlocaleinfoa_fallback,support,cdecl,inferred,llvm-objdump + import correlation + local disassembly + caller correlation,3,"Multibyte-output locale-info wrapper paired with `locale_query_info_wide_with_getlocaleinfow_or_getlocaleinfoa_fallback` `0x005b2828`. The helper probes and caches `GetLocaleInfoW` support in global `0x00dba498`; on the direct fallback path it simply forwards `(lcid, lctype, out_ansi, cch)` to `GetLocaleInfoA`, while on the wide-path it first materializes the locale string through `GetLocaleInfoW` into a temporary wide buffer and then converts that result into the caller multibyte buffer through `WideCharToMultiByte` using the requested or default codepage. Current grounded caller is `0x005b1a42`.","llvm-objdump + import correlation + local disassembly + caller correlation + locale-info correlation"
0x005b0040,78,string_compare_casefolded_ascii_nul_terminated,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Plain byte-side fallback beneath the older locale-aware compare family. The helper compares two NUL-terminated strings byte by byte, folds ASCII `A..Z` into lowercase on both sides when the first direct byte compare fails, and returns `0` on equality or `-1/+1` according to the first mismatching folded byte. Current grounded caller is `string_compare_casefolded_current_locale_nul_terminated` `0x005a57cf`, which uses this helper when the active locinfo has no multibyte or locale tables.","llvm-objdump + local disassembly + caller correlation + ascii-compare correlation"
0x005b0100,96,string_compare_casefolded_ascii_bounded,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Bounded ASCII-only sibling to `string_compare_casefolded_ascii_nul_terminated` `0x005b0040`. The helper returns zero immediately when the caller count is zero, otherwise compares both strings one byte at a time up to the requested bound, folding only ASCII `A..Z` into lowercase before the mismatch test. It returns `0` on bounded equality or `-1/+1` according to the first folded mismatch. Current grounded caller is `string_compare_casefolded_current_locale_bounded` `0x005a5f26`, which uses this helper when no current-locale tables are active.","llvm-objdump + local disassembly + caller correlation + ascii-compare correlation"
0x005b0459,22,decimal_record_convert_to_two_dword_integer_pair_via_table_0x62add0,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Thin fixed-table conversion wrapper over `0x005b0301`. The helper forwards one parsed decimal record plus one caller out-buffer into the shared conversion body with lookup table root `0x0062add0`. Current grounded callers are the local parse-and-convert owner `0x005b0485` and the nearby legacy numeric conversion strip at `0x005abe3f`.","llvm-objdump + local disassembly + caller correlation + decimal-record correlation"
0x005b046f,22,decimal_record_convert_to_single_dword_integer_via_table_0x62ade8,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Sibling fixed-table conversion wrapper over `0x005b0301`. The helper forwards one parsed decimal record plus one caller out-buffer into the shared conversion body with lookup table root `0x0062ade8`. Current grounded caller is the local parse-and-convert owner `0x005b04c8`.","llvm-objdump + local disassembly + caller correlation + decimal-record correlation"
0x005b0485,67,decimal_parse_ascii_and_convert_to_two_dword_integer_pair,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Parse-and-convert owner above the older decimal-record strip. The helper parses one caller ASCII numeric string into the shared 12-byte decimal record through `0x005b12b5`, then converts that parsed record into one two-dword integer pair through `decimal_record_convert_to_two_dword_integer_pair_via_table_0x62add0` `0x005b0459`. Current grounded caller is the first branch of the legacy dispatch entry `0x005a6046`.","llvm-objdump + local disassembly + caller correlation + decimal-record correlation"
0x005b04c8,67,decimal_parse_ascii_and_convert_to_single_dword_integer,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Sibling parse-and-convert owner above the same decimal-record strip. The helper parses one caller ASCII numeric string into the shared 12-byte decimal record through `0x005b12b5`, then converts that parsed record into one single-dword integer through `decimal_record_convert_to_single_dword_integer_via_table_0x62ade8` `0x005b046f`. Current grounded caller is the second branch of the legacy dispatch entry `0x005a6046`.","llvm-objdump + local disassembly + caller correlation + decimal-record correlation"
0x005b050b,119,decimal_record_materialize_rounded_significand_digits_into_ascii_buffer,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"ASCII significand materializer for the older floating-format strip. The helper copies up to the requested number of digits from digit-string field `[record+0x0c]` into the caller buffer after seeding a leading `0`, pads the tail with ASCII `0` when the stored digit string is shorter, then performs one lookahead rounding step on the next source digit and propagates any carry back across trailing `9`s. When that carry turns the leading digit into `1`, it also increments decimal-exponent field `[record+0x04]`. Current grounded callers are the adjacent legacy formatting owners `0x005a61c3`, `0x005a60a1`, and `0x005b063c`.","llvm-objdump + local disassembly + caller correlation + decimal-record correlation + ascii-format correlation"
0x005b0582,186,math_normalize_x87_extended_to_internal_float_record,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Converts one x87 80-bit extended value into the local compact float-record form used by the older formatting strip. The helper unpacks the sign bit, exponent field, and mantissa from the caller extended value, handles zero, denormal, infinity, and NaN-style cases, normalizes the mantissa when needed, and stores the rebuilt two-dword mantissa plus signed exponent word into the caller out-record. Current grounded caller is `0x005b063c`.","llvm-objdump + local disassembly + caller correlation + x87-extended correlation + float-record correlation"
0x005b063c,114,math_materialize_float_record_and_digit_buffer_from_x87_extended,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Broader bridge from one x87 80-bit extended input into the older decimal-format strip. The helper first normalizes the caller extended value through `math_normalize_x87_extended_to_internal_float_record` `0x005b0582`, then forwards that normalized record into the digit builder `0x005b2129` with fixed precision `0x11`, stores the returned metadata into the caller out-record, and appends the generated digit buffer through `0x005ac3b0`. Current grounded callers are the adjacent legacy numeric-format owners `0x005a616f`, `0x005a627e`, and `0x005a62ea`.","llvm-objdump + local disassembly + caller correlation + x87-extended correlation + decimal-format correlation"
0x005b06b7,146,math_map_x87_control_word_to_abstract_control_mask,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Maps one raw x87 control word into the older CRT abstract floating-control mask. The helper translates exception-mask bits, precision-control bits, rounding-control bits, and infinity-control bit into the `0x10/0x8/0x4/0x2/0x1`, `0x100/0x200/0x300`, `0x10000/0x20000/0x30000`, and `0x40000/0x80000` style abstract flags used by the neighboring control setters. Current grounded caller is `math_apply_abstract_floating_control_value_and_mask` `0x005b07d7`.","llvm-objdump + local disassembly + caller correlation + x87-control correlation"
0x005b0749,142,math_map_abstract_control_mask_to_x87_control_word,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Inverse sibling to `math_map_x87_control_word_to_abstract_control_mask` `0x005b06b7`. The helper translates the older CRT abstract floating-control flags back into one raw x87 control word, rebuilding exception-mask bits, precision-control bits, rounding-control bits, and infinity-control state. Current grounded caller is `math_apply_abstract_floating_control_value_and_mask` `0x005b07d7`.","llvm-objdump + local disassembly + caller correlation + x87-control correlation"
0x005b07d7,50,math_apply_abstract_floating_control_value_and_mask,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,3,"Primary older CRT floating-control owner beneath `math_apply_floating_point_control_word_value_and_mask_with_bit0x80000_cleared` `0x005b0809`. The helper snapshots the current x87 control word with `fstcw`, maps it into the abstract flag space through `0x005b06b7`, merges the caller value and mask there, converts the merged result back through `0x005b0749`, loads the new control word with `fldcw`, and returns the previous abstract control setting. Current grounded callers are `0x005b0809` and the legacy bootstrap wrapper `0x005a63b8`.","llvm-objdump + local disassembly + caller correlation + x87-control correlation"
0x005b08ba,245,math_build_matherr_report_record_and_dispatch_default_runtime_message,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,2,"Broader older-CRT math-report owner beneath the x87 wrappers `0x005a77f7` and `0x005a790a`. The helper reads the staged math-error record, selects one operand-format width from record kind `[record+0x00]`, formats the operand payload through `0x005a8af0` and `0x005a884b`, updates the floating-point report mode through `0x005a9070`, and then either consults the default matherr-style hook stub `0x005b09b8` or falls through directly to the default runtime-message path `0x005a8d12`. This is the safest current read for the common matherr-report formatter and dispatcher rather than overclaiming one single formatting helper.","llvm-objdump + local disassembly + caller correlation + math-error-report correlation"
0x005b09b8,3,math_default_matherr_hook_stub_return_zero,support,cdecl,inferred,llvm-objdump + local disassembly + caller correlation,1,"Trivial default hook stub in the older CRT math-report seam. The function just returns `0`, and current grounded caller `0x005b08ba` uses that zero result before falling through to the default runtime-message path.","llvm-objdump + local disassembly + caller correlation + math-error-report correlation"
0x00437c00,237,simulation_dispatch_runtime_effect_queue_record_by_kind_into_shell_or_world_handlers,simulation,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + queue-family correlation,4,"Kind-dispatch owner for one queued runtime-effect or queue-record node. The helper switches on dword `[node+0x08]`, and the jump table is now resolved exactly. Kinds `1` and `2` are no-op success arms that return `1` immediately. Kinds `0` and `4` both open the fixed callback-driven custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0`, using localized id `[node+0x04]` plus the standard all-zero payload and `-1.0f` scalar pair. Kind `3` forwards `[node+0x10]` plus `[node+0x14]` into `0x004dc540` and returns `0`. Kind `5` dispatches `[node+0x10]` into `0x004f29c0` with `dl=1`. Kind `6` first validates route-entry id `[node+0x10]` against collection `0x006cfcbc` and then forwards that id plus `[node+0x04]` into `0x00436820`, with failed validation falling back to the fixed modal arm. Kind `7` forwards `[node+0x10]` into `0x004c7520`. Kind `8` forwards `[node+0x10]` plus `[node+0x14]` into `0x004f2d80`. Unsupported kinds also fall back to the fixed modal arm. Current grounded callers are `simulation_frame_service_runtime_effect_queue_and_mark_custom_modal_dirty_if_needed` `0x00438710` and `simulation_frame_dispatch_active_runtime_effect_queue_record_or_open_fixed_fallback_modal_0x153` `0x00438840`, so this is now the real queued-record kind table rather than one loose arm list.","llvm-objdump + local disassembly + caller correlation + queue-family correlation + resolved-jump-table correlation + route-entry-lookup correlation + custom-modal correlation"
0x00438710,300,simulation_frame_service_runtime_effect_queue_and_mark_custom_modal_dirty_if_needed,simulation,thiscall,inferred,llvm-objdump + local disassembly + caller correlation + queue-family correlation,4,"Recurring service owner for the linked `0x20`-byte runtime-effect or queue-record family rooted at `[this+0x66a6]`, above the older append helper `scenario_state_append_runtime_effect_or_queue_record` `0x004337c0`. When a live custom modal already exists through `shell_has_live_custom_modal_dialog` `0x004c8680`, the helper first walks the queued-record list looking for any node whose promotion-latch dword `[node+0x0c]` equals `1`; when such a node exists and shell latch `0x0062be80` is already live it takes the short path through `shell_mark_custom_modal_dialog_dirty` `0x004c8670`. Otherwise it enters a recursion guard at `0x0062be3c`, samples the broader shell-block gate through `0x004348e0`, walks the queued-record list at `[this+0x66a6]`, and for each node either accepts it immediately when the shell gate is open or the node kind plus live shell state allows direct promotion, or falls back to node-specific handlers through `0x00437c00`. Accepted nodes are either unlinked and preserved as the new active queue pointer at `[this+0x66aa]`, or replace the previously active node there after releasing the earlier owned payloads through `0x0053afd0`; rejected nodes are released through the same payload helper before the walk continues. Current grounded callers are the frame-owned outcome follow-on branch at `0x0043963d` and the earlier world-side notification path at `0x00432cb0`, where this owner runs only after a stricter local gate. This is therefore the safest current read for the queue-record service and custom-modal dirty-mark owner above `[this+0x66a6]` and `[this+0x66aa]`, with the key short-path gate now tied to `[node+0x0c]` rather than the queue kind field itself.","llvm-objdump + local disassembly + caller correlation + queue-family correlation + custom-modal correlation + active-node-slot correlation + promotion-latch correlation"
0x0043963d,236,simulation_frame_service_outcome_followon_windows_overview_and_pause_toggle_after_transition,simulation,thiscall,inferred,llvm-objdump + local disassembly + callee correlation,3,"Post-outcome follow-on branch inside `simulation_frame_accumulate_and_step_world` `0x00439140`, reached only when the current outcome-sequence marker `[world+0x4a7b]` still matches the latched step-local marker. The branch first services the queued runtime-effect or queue-record family rooted at `[world+0x66a6]` through `simulation_frame_service_runtime_effect_queue_and_mark_custom_modal_dirty_if_needed` `0x00438710`, then conditionally opens `Overview.win` through `shell_open_or_focus_overview_window` `0x004f3a10` when no overview window is already live, the shell is not blocked by mode-`0x0c` plus input bit `0x400`, and the preview fixed-record collection at `0x006cea4c` still has one admissible entry through `0x00473e20/0x00473e70`. After that it runs a second follow-on gate for `LoadScreen.win`: when no live overview or ledger is open, shell latch `0x006d4000` is clear, and world flag `[this+0x4d]` is still nonzero, it clears that flag, rechecks the same overview-entry gate, and then opens or focuses `LoadScreen.win` page `0` through `shell_open_or_focus_load_screen_page` `0x004e4ee0`. The same branch also conditionally toggles world pause or resume through `world_toggle_pause_or_restore_game_speed` `0x00437a60` when no multiplayer session object is live at `0x006cd8d8`, before falling back into `world_view_service_shell_input_pan_and_hover` `0x0043db00` at the end of the frame. This is therefore the safest current owner for the post-transition outcome follow-on window and pause strip, not just another loose tail inside the frame cadence.","llvm-objdump + local disassembly + callee correlation + outcome-latch correlation + overview-correlation + loadscreen-correlation + pause-toggle-correlation"
0x00438840,76,simulation_frame_dispatch_active_runtime_effect_queue_record_or_open_fixed_fallback_modal_0x153,simulation,thiscall,inferred,llvm-objdump + caller correlation + queue-family correlation,3,"Small owner beside the queued runtime-effect record family. When the active queue slot `[this+0x66aa]` is nonnull it forwards that node into the same node-specific handler table at `0x00437c00` used by `simulation_frame_service_runtime_effect_queue_and_mark_custom_modal_dirty_if_needed` `0x00438710`. When no active node is staged it instead opens one fixed callback-driven custom modal rooted at localized id `0x153` through `0x5193f0 -> 0x4c98a0`, with the same all-zero option payload and default `-1.0f` scalar pair every time. Current grounded caller is the small shell-side branch at `0x004414d0`, which only reaches this owner when the live world object exists and the active shell presentation stack is otherwise idle. This is therefore the safest current read for the queued-record dispatch-or-fallback prompt owner above `[this+0x66aa]`, not a generic modal opener.","llvm-objdump + caller correlation + queue-family correlation + custom-modal correlation"
0x004414d0,33,shell_try_dispatch_active_runtime_effect_queue_record_prompt_when_shell_stack_idle,shell,cdecl,inferred,llvm-objdump + caller correlation + queue-family correlation,3,"Small shell-side gate above `simulation_frame_dispatch_active_runtime_effect_queue_record_or_open_fixed_fallback_modal_0x153` `0x00438840`. It first requires a live world object at `0x006cec78`, then requires the current shell presentation stack depth `[0x006d401c+0xc64]` to be nonpositive, and only then forwards the live world object into `0x00438840`. This is therefore the idle-shell dispatcher for the queued-record prompt family.","llvm-objdump + caller correlation + queue-family correlation + shell-stack-idle correlation"
0x00413f80,681,aux_candidate_collection_restore_temp_record_bank_and_queue_keys_from_packed_state,map,thiscall,inferred,objdump + local disassembly + caller correlation + packed-state correlation,4,"Restore-side packed-state loader for the auxiliary or source record family rooted at `0x0062b2fc`. The helper first reads one `0x0c`-byte header from the caller stream, stores the queued-record count into `0x0062ba64`, allocates the queued-key array at `0x0062ba6c/0x0062ba70`, frees any prior temporary record bank at `0x0062b2f8`, allocates a fresh bank sized as `count * 0x74e`, and then walks every temporary record image in that bank. For each image it reads the queued key, the fixed scalar header at `[record+0x00/+0x04/+0x08/+0x0c/+0x4b8/+0x4bc]`, the counted inline dword run rooted at `[record+0x10]`, the fixed `0x10`-byte payload at `[record+0x498]`, the optional counted byte payload rooted at `[record+0x4c0]`, the counted dword run rooted at `[record+0x4c8]`, the paired one-byte streams rooted at `[record+0x65c]` and `[record+0x6c1]`, and the trailing dword at `[record+0x72a]`. On exit it seeds queue index `0x0062ba74 = 0` and stores the restored record count into `0x0062ba68`. Current grounded caller is the world-entry restore branch at `0x004443ed`, immediately before the optional live reimport through `0x0041a950`, so this is the safest current read for the packed-state restore of the temporary aux-candidate record bank plus queued keys rather than a generic bundle reader.","objdump + local disassembly + caller correlation + packed-state correlation + temp-record-bank correlation"
0x0041a950,55,aux_candidate_collection_release_live_entries_then_reimport_records_and_refresh_runtime_followons,map,thiscall,inferred,objdump + local disassembly + caller correlation + restore-path correlation,3,"Restore-side sibling over the auxiliary or source record pool rooted at `0x0062b2fc`. When the collection currently holds live entries, the helper walks every live id through `0x00518380` and dispatches entry vtable slot `+0x08` to release per-entry state, then tail-jumps directly back into `aux_candidate_collection_construct_stream_load_records_and_refresh_runtime_followons` `0x004196c0`. Current grounded caller is the world-entry restore branch at `0x0044440f`, which uses it only when the shell-side restore flags demand a live reimport after `aux_candidate_collection_restore_temp_record_bank_and_queue_keys_from_packed_state` `0x00413f80`, so this is the safest current read for the in-place aux-candidate reset-and-reimport sibling rather than a generic collection destructor.","objdump + local disassembly + caller correlation + restore-path correlation + entry-release correlation"
0x004931e0,186,route_entry_collection_run_optional_refresh_hooks_and_validate_world_cell_side_lists,map,thiscall,inferred,llvm-objdump + local disassembly + caller correlation,3,"Optional refresh owner over the live route-entry collection `0x006cfca8`. When shell gate `[0x006cec74+0x1cb]` is nonzero, the helper first walks every live route-entry record and dispatches the current per-entry hook `0x0048a780`, which is presently a no-op. It then scans the world-grid dimensions stored at `[0x0062c120+0x2155/+0x2159]`, resolves each cell-side route-entry side-list through `0x00492130`, and validates every linked route-entry id in those per-cell lists against the live collection through `0x00517d40`. Current grounded callers are the zero-depth optional refresh dispatcher `scenario_state_run_optional_collection_refresh_hooks_when_mutation_depth_zero` `0x00433b80` and the city-connection route-builder family at `0x00402ccf` and `0x0040461d`, so this is the safest current read for the route-entry collection's optional refresh-and-validation owner rather than a narrower in-place mutator.","llvm-objdump + local disassembly + caller correlation + route-entry-collection correlation + world-cell-side-list correlation"
0x00493be0,265,route_entry_collection_refresh_records_from_tagged_bundle_and_reseed_tracker_sidecars,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + tag-family correlation,3,"Collection-wide tagged load owner for the main route-entry collection rooted at `0x006cfca8`. The helper opens tag family `0x38a5/0x38a6/0x38a7` through `0x00531360`, refreshes collection-side metadata through `0x00518680`, restores dword `[this+0x90]` and mirrors it into `[this+0x94]`, then walks every live route-entry record through `0x00517cf0/0x00518380/0x00518140`. For each entry it seeds one small stack-local helper through `0x00489e60`, stores that helper's root dword back into the record, dispatches the record through `0x0048dcf0` with the active bundle handle, conditionally re-enters `0x00491e60` when the entry's class byte `[entry+0x216]` is nonzero or collection field `[this+0xe9]` is live, and finally resets the record through `0x0048a5c0(-1, -1)` before releasing the stack helper. Current grounded caller is the world-entry restore branch at `0x0044461a`, where this helper refreshes the live route-entry store before the auxiliary route-entry tracker collection. This is the safest current read for the route-entry tagged load owner plus tracker-sidecar reseed rather than an anonymous collection walk.","objdump + local disassembly + caller correlation + tag-family correlation + route-entry correlation + sidecar-reseed correlation"
0x004a41b0,127,route_entry_tracker_collection_refresh_records_from_tagged_bundle,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + tag-family correlation,3,"Collection-wide tagged load owner for the auxiliary route-entry tracker collection rooted at `0x006cfcb4`. The helper opens tag family `0x396d/0x396e` through `0x00531360`, refreshes collection-side metadata through `0x00518680`, forces collection latch `[this+0x8c] = 1`, and then walks every live tracker entry through `0x00517cf0/0x00518380/0x00518140` before dispatching each record through `0x00495020` with the active bundle handle. Current grounded caller is the world-entry restore branch at `0x0044466c`, immediately after the main route-entry collection reload at `0x00493be0`, so this is the safest current read for the tagged restore of the route-entry tracker family rather than another generic collection loader.","objdump + local disassembly + caller correlation + tag-family correlation + tracker-collection correlation"
0x004a4240,102,aux_route_entry_tracker_collection_serialize_records_into_tagged_bundle,simulation,thiscall,inferred,objdump + local disassembly + caller correlation + tag-family correlation,3,"Collection-wide tagged save owner for the auxiliary route-entry tracker collection rooted at `0x006cfcb4`. The helper emits tag family `0x396d/0x396e` through `0x00531340`, serializes collection-side metadata through `0x00517d90`, and then walks every live tracker entry through `0x00517cf0/0x00518380/0x00518140` before dispatching each record through `aux_route_entry_tracker_serialize_noop_per_entry_payload_stub` `0x00494ef0`. Current grounded caller is the early package-save prelude `0x00444dd0`, where this helper runs immediately after the main route-entry tagged save owner `0x00491c60`. This is the safest current read for the auxiliary tracker tagged save owner rather than another generic collection serializer.","objdump + local disassembly + caller correlation + tag-family correlation + tracker-collection correlation"
