0x004010f0,521,city_compute_connection_bonus_candidate_weight,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Computes one city-side weight for the connection-bonus news and placement lanes. The helper rejects early when the city subtype field `[this+0x23e]` is nonzero, then builds a base float from the city-side scalar fields `[this+0x306]`, `[this+0x30a]`, and `[this+0x30e]`. When the optional stack company id is nonzero it also resolves the city's derived coordinates through `0x00455800` and `0x00455810`, probes the live world root at `0x0062c120` through `0x0044e270`, and rejects the city unless the selected company passes the follow-on world-side ownership or access check through `0x00424010`. The helper then scans the live placed-structure collection at `0x006cec20`, filters peers through `0x0041f6e0` plus the linked-instance class test `0x0047de00 -> 0x0040c990 == 1`, counts qualifying linked sites in the city, and detects whether one rival company already has an eligible linked site there. The final weight is scaled down by the inverse of `(qualifying_site_count + 1)` and then further damped when rival ownership is present, so the current grounded meaning is a city connection-bonus opportunity weight rather than a simple population or size score. Current grounded callers are the company-side news sweep at `0x00406050` and one neighboring setup-side branch at `0x00404d90`.","objdump + caller xrefs + callsite inspection + city-bonus correlation"
0x004014b0,1194,company_try_buy_unowned_industry_near_city_and_publish_news,simulation,thiscall,inferred,objdump + callsite inspection + RT3.lng strings,2,"Company-side acquisition and headline helper beneath the broader periodic company service pass at `0x004019e0`. The function requires at least two linked transit sites through `company_count_linked_transit_sites` `0x00426590`, rejects when scenario finance toggle `[0x006cec78+0x4abf]` is set, and then scans the live building or structure collection at `0x0062b26c` for the best current acquisition target. Current grounded candidate filters are: the record must not already have an owner in `[site+0x276]`, its linked candidate subtype gate through `0x0040d360` must identify subtype `4`, the company-specific price or affordability metric from `0x0040d540` must stay below the current company metric window, and the record must be at least three years old from `[site+0x3d5]`. Surviving candidates are scored through local profitability or demand helpers around `0x0040cac0`, `0x0042c820`, `0x00455f60`, and the current company support scalar, and the best surviving site id is then committed through `0x004269b0`. On success the helper localizes the acquired structure type through `localization_lookup_display_label_by_stem_or_fallback` `0x0051c920`, resolves the nearby city or region entry through `0x004220b0`, and emits RT3.lng `2880` `%1 has bought a %2 near %3` through the shell news helper at `0x004554e0`. This is now the strongest current match for the acquisition-side sibling beneath the broader company periodic pass, though some lower structure-side helper semantics remain open.","objdump + callsite inspection + RT3.lng strings + acquisition-news correlation + structure-scan correlation"
0x00401860,221,company_query_cached_linked_transit_route_anchor_entry_id,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Returns one cached route-entry anchor id used by the linked-transit company cache family. The helper first validates the cached id at `[this+0x0d35]` against the live route-entry collection `0x006cfca8`, requiring the resolved record to carry this company id in word `[entry+0x22e]` and byte value `2` in `[entry+0x216]`; otherwise it clears the cache to `-1`. When the cache is empty but the three company-side count lanes `[this+0x7664]`, `[this+0x7668]`, and `[this+0x766c]` still sum positive, it scans the route-entry collection for the first record that satisfies those same owner and class predicates and then caches the record's linked anchor id from `[entry+0x202]`. Current grounded caller is `placed_structure_is_linked_transit_site_reachable_from_company_route_anchor` `0x004801a0`, where the returned route-entry id is used as the company-side anchor for the narrower linked-transit reachability gate.","objdump + caller xrefs + callsite inspection + route-entry-anchor correlation"
0x00401940,152,company_reset_linked_transit_caches_and_reseed_empty_train_routes,simulation,thiscall,inferred,objdump + callsite inspection + linked-transit correlation,2,"Small linked-transit reset helper beneath the broader company service family. The function clears the two company-side linked-transit cache timestamps at `[this+0x0d3e]` and `[this+0x0d3a]`, immediately re-enters `company_service_linked_transit_site_caches` `0x00409720`, and then walks the live train collection `0x006cfcbc` for company-owned trains. For owned trains in operating modes `0x0a` or `0x13` it removes every existing route-list entry through `train_route_list_remove_entry_and_compact` `0x004b3000`; when the route list is empty it then re-enters `train_try_append_linked_transit_autoroute_entry` `0x00409770`. Current grounded meaning is a local linked-transit cache reset plus empty-route reseed pass rather than a broader train-service sweep.","objdump + callsite inspection + linked-transit correlation + train-route-reset correlation"
0x004019e0,611,company_service_periodic_city_connection_finance_and_linked_transit_lanes,simulation,thiscall,inferred,objdump + callsite inspection + caller correlation + RT3.lng strings,2,"Broader periodic company-side service pass above the currently grounded city-connection, finance, and linked-transit lanes. The helper first rejects inactive or special-case companies through `[this+0x3f]` and `0x00425b90`, clears the transient company-side latches at `[this+0x0d17]`, `[this+0x0d18]`, and `[this+0x0d56]`, and temporarily mirrors one locomotive-derived byte from `[this+0x0d17]` into scenario field `[0x006cec78+0x4c74]` while the earlier route-building side of the body runs, restoring the original scenario value on exit. Current evidence now bounds those byte latches more narrowly: `[this+0x0d17]` is this transient route-search preference override, currently seeded only when `company_select_preferred_available_locomotive_id` `0x004078a0` resolves one locomotive whose engine-type dword `[record+0x10]` equals `2`; wider engine-type evidence now makes that best-read as the electric lane, since the linked approval helper around `0x0041d550` dispatches the same `0/1/2` field across three scenario opinion slots while the local language family `706..709` and help text `3848` bound the player-facing triplet as `Steam`, `Diesel`, and `Electric`. The route-search side is tighter now too: this mirrored byte is not just reusing a display preference slot abstractly, it feeds the same initial path-sweep branch in `route_entry_collection_run_initial_candidate_path_sweep` `0x0049bd40` that explicit route-policy byte `4` uses, selecting the larger `1.8` quality multiplier instead of `1.4` before the later acceptance checks. `[this+0x0d18]` is the city-connection announcement-side latch reused by `company_evaluate_and_publish_city_connection_bonus_news` `0x00406050`; and `[this+0x0d56]` is the linked-transit train-service latch later set by the train-add, train-upgrade, and route-builder-side cache-refresh family around `0x00409830`, `0x00409300`, and `0x0040457e -> 0x004093d0`. The ordering matters too: this owner clears those latches up front, runs the city-connection and linked-transit branches first, and only later enters `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`, so the finance helper is reading same-cycle side-channel state rather than stale long-lived flags. It then gates and schedules several narrower service families: the city-connection announcement side through `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0` and `company_evaluate_and_publish_city_connection_bonus_news` `0x00406050`; the acquisition-side sibling through `company_try_buy_unowned_industry_near_city_and_publish_news` `0x004014b0`; the linked-transit train side through `company_balance_linked_transit_train_roster` `0x00409950`; the broader annual finance and governance helper through `company_evaluate_annual_finance_policy_and_publish_news` `0x00401c50`; and the linked-transit cache refresh tail through either `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` or `company_rebuild_linked_transit_autoroute_site_score_cache` `0x00407bd0` depending on current scenario mode byte `[0x006cec78+0x0f]`. This name stays intentionally conservative: it is the broader periodic owner above those lanes, not a fully split policy map yet.","objdump + callsite inspection + caller correlation + RT3.lng strings + linked-transit correlation + city-connection correlation + acquisition correlation + latch correlation + sequencing correlation + temporary-route-preference correlation + locomotive-choice correlation + engine-type correlation + route-search-threshold correlation"
0x004078a0,815,company_select_preferred_available_locomotive_id,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Selects one preferred locomotive id for the current company from the live locomotive collection at `0x006ada84`. The helper iterates the live locomotive records, applies company-and-chairman availability gating through the linked approval family around `0x0041d550`, accumulates one weighted preference score from locomotive fields `[record+0x20]`, `[+0x28]`, `[+0x18]`, `[+0x1c]`, `[+0x0c]`, and the linked class or era record at `[record+0x72]`, and keeps the strongest surviving locomotive id, falling back to `locomotive_collection_select_best_era_matched_non_electric_fallback_id` `0x00461cd0` when no scored candidate survives. Current grounded callers are the periodic company service pass `0x004019e0`, the temporary route-side mode chooser around `0x00402d5f`, the linked-transit train-upgrade news helper `0x00409300`, and the linked-transit train-add helper `0x00409830`. Current evidence now also bounds one route-policy side effect above it: `0x004019e0` only arms its temporary `[company+0x0d17] -> [0x006cec78+0x4c74]` override when the chosen locomotive record carries engine-type value `2` in `[record+0x10]`, which now best aligns with the electric lane rather than an unnamed class slot.","objdump + caller xrefs + callsite inspection + locomotive-collection correlation + preferred-choice correlation + engine-type correlation"
0x00401c50,3016,company_evaluate_annual_finance_policy_and_publish_news,simulation,thiscall,inferred,objdump + callsite inspection + RT3.lng strings,2,"Large annual company finance-policy helper beneath the broader periodic service pass at `0x004019e0`. The earliest creditor-pressure or bankruptcy lane is now bounded more tightly: it requires scenario mode `0x0c`, the bankruptcy toggle `[0x006cec78+0x4a8f]` to be clear, at least `13` years since the last bankruptcy stamp at `[this+0x163]`, and at least `4` years since founding year `[this+0x157]`. It then scans the last three years of derived finance lanes through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0`, accumulating the net-profits lane `0x2b`, counting one three-year failure condition from the revenue aggregate `0x2c`, selecting one negative cash-and-debt stress ladder `-600000 / -1100000 / -1600000 / -2000000` from the current slot-`0x2c` band split at roughly `120000 / 230000 / 340000`, requiring the current support-adjusted share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` to be at least `15` or `20` depending on whether all three years failed, checking the current fuel-cost lane in slot `0x09` against `0.08` times that ladder, and requiring both `edi >= 2` plus the three-year slot-`0x2b` accumulator to clear one final `-60000` threshold before it commits bankruptcy through `company_declare_bankruptcy_and_halve_bond_debt` `0x00425a90` and formats RT3.lng `2881` `%1 has declared bankruptcy!`. The helper also has one later deep-distress fallback bankruptcy lane on the no-action fallthrough before the build-`1.03+` stock-issue branch: with the same bankruptcy toggle clear, current cash below `-300000`, at least `3` years since founding, no recent automatic finance action already chosen, the first three recent net-profits lanes each at or below `-20000`, and at least `5` years since the last bankruptcy stamp, it commits the same bankruptcy path and news family again. The later debt-capital restructuring family mutates the live company through `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, `company_issue_bond_and_record_terms` `0x004275c0`, `company_repurchase_public_shares_and_reduce_capital` `0x004273c0`, and `company_issue_public_shares_and_raise_capital` `0x00427450`, then formats the RT3.lng `2882..2886` headlines `%1 has refinanced %2 of debt.`, `%1 has refinanced %2 of debt and borrowed %3 on top of that.`, `%1 has refinanced %2 and paid off a further %3 of debt.`, `%1 has paid off %2 of its debt.`, and `%1 has borrowed %2 in debt.` The message-side tail is tighter now too: it accumulates total retired principal in one counter and total newly issued principal in another, then chooses the debt headline family by comparing those two totals directly: equal -> `2882` refinance only, issued greater -> `2883` refinance plus extra borrowing, retired greater -> `2884` refinance plus additional payoff, issued zero -> `2885` debt payoff only, and retired zero with issued positive -> `2886` straight new borrowing. The middle annual bond lane is tighter now too: when the bond toggle `[+0x4a8b]` is clear, it first simulates full bond repayment through repeated `company_repay_bond_slot_and_compact_debt_table` `0x00423d70`, then uses the resulting cash-side window with the fixed `-250000` and `-30000` thresholds plus the broader linked-transit train-service latch `[this+0x0d56]` to decide whether to stage one or more `500000` principal, `30`-year bond issues through `company_issue_bond_and_record_terms` `0x004275c0`. The repurchase lane is distinct from the later share-issue path: when the city-connection announcement-side latch `[this+0x0d18]` is set, editor growth setting `2` does not suppress it, and the stock toggle `[+0x4a87]` is clear, it starts from one `1000`-share batch and one default factor `1.0`, can replace that with a linked-chairman personality scalar `([table byte * 39] + 300) / 400`, scales that factor by `1.6` when growth setting `[0x006cec78+0x4c7c] == 1`, uses the resul
0x00402c90,19,placed_structure_resolve_linked_candidate_record,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,2,"Tiny placed-structure-to-candidate resolver over the global candidate collection at `0x0062b268`. The helper reads one candidate id from `[this+0x173]`, re-enters the shared indexed-collection record resolver at `0x00518140`, and returns the resulting candidate record pointer. Current grounded caller is the BuildingDetail-side branch at `0x00506441`, where it is used immediately after resolving one placed-structure record from `0x0062b2fc`. This now looks like the direct placed-structure linked-candidate accessor rather than another anonymous local helper.","objdump + caller xrefs + callsite inspection + collection-resolver correlation"
0x00402cb0,3457,city_connection_try_build_route_with_optional_direct_site_placement,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Shared heavy route-builder and optional direct-placement helper beneath the city-connection route and news family. The function starts at a clean prologue at `0x00402cb0`, seeds one builder-state latch band at `[this+0xf5]`, `[this+0xf6]`, `[this+0xf8]`, `[this+0xfa]`, `[this+0xfc]`, and `[this+0x10a]`, and then splits into three grounded internal lanes. The first is an early route-entry search or synthesis lane through `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` over the global route-entry store `0x006cfca8`, which can seed the builder-state block and succeed without placing a new site. The second is a single-endpoint direct-placement lane around `0x00403d92..0x00403ef3`: it scans the live placed-structure collection `0x0062b2fc` for `Maintenance` and `ServiceTower` stems, projects one candidate placement through `0x00417840`, validates it through `0x004197e0`, and then commits through the first direct placement branch `0x00403ed5 -> placed_structure_collection_allocate_and_construct_entry` `0x004134d0` -> `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`. The third is a later paired-endpoint fallback lane around `0x00403f41..0x00404489`: it seeds two endpoint candidates from the same `Maintenance` and `ServiceTower` stem scan, builds one temporary route-entry candidate list, iterates that list against span and year-scaled step terms, projects trial placements through `0x00417840`, and on success commits through the second direct placement branch `0x0040446b -> 0x004134d0 -> 0x0040ef10` before clearing a small exclusion window in the temporary list. Outside those lanes it also re-enters geometry, region, and route-store helpers around `0x004423a0`, `0x00482e00`, `0x004931e0`, `0x00494310`, and the global route-entry stores `0x006cfcb4` / `0x006cfca8`, and it can still unwind through route-state cleanup without committing new placed structures. Current grounded external callers are still entirely in the city-connection family: the compact region-entry wrapper `city_connection_bonus_try_compact_route_builder_from_region_entry` `0x00404640`, the peer-route candidate builder `city_connection_bonus_build_peer_route_candidate` `0x004046a0`, the direct region-entry pair wrapper `city_connection_try_build_route_between_region_entry_pair` `0x00404c60`, and the direct retry paths inside `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0`. This now bounds the old unresolved `0x00403xxx..0x00404631` placement chooser as one shared city-connection route or placement helper with a cleaner internal policy split, even though some lower helper semantics remain open.","objdump + caller xrefs + callsite inspection + placement-correlation + route-builder correlation + Maintenance/ServiceTower scan correlation + route-entry search correlation"
0x004046a0,1388,city_connection_bonus_build_peer_route_candidate,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Reusable candidate builder beneath the city-connection bonus news and status family. The helper starts from one region or city entry in the collection at `0x0062bae0`, samples that entry's two derived coordinate terms through `0x00455800` and `0x00455810`, then re-enters `city_connection_bonus_select_first_matching_peer_site` at `0x00420280` with both selector flags forced on so it can recover one representative connected peer site. When a peer is found it samples the peer's derived coordinates through `0x0047df30` and `0x0047df50`; when an explicit caller-owned route anchor is present it first tries the heavier route builder at `0x00402cb0`, otherwise it falls back to the smaller helper at `0x00404640`. If neither early path succeeds the function collects one local candidate band from the two global route-entry stores at `0x006cfcb4` and `0x006cfca8`, filters those entries against the current city id and several route-state predicates, computes one compact bounding window around each surviving candidate, and then chooses the best remaining candidate by smallest span before retrying `0x00402cb0`. Current grounded callers are the wider company-side city-connection bonus sweep at `0x00406050` and one neighboring branch at `0x00406b73`, which together make this look like the shared peer-route candidate builder above the city bonus peer-selector family rather than a direct UI formatter.","objdump + caller xrefs + callsite inspection + peer-selector correlation + route-builder correlation"
0x00404640,82,city_connection_bonus_try_compact_route_builder_from_region_entry,map,thiscall,inferred,objdump + caller inspection + route-builder correlation,3,"Small route-builder helper beneath `city_connection_bonus_build_peer_route_candidate` `0x004046a0`. The helper resolves one caller-supplied region or city entry id through collection `0x0062bae0`, derives that entry's compact coordinate pair through `0x00401000`, reads one explicit route-anchor or peer-site id from `[this+0x00]`, and then re-enters the heavier route builder at `0x00402cb0` with that resolved coordinate pair plus default wildcard arguments `-1/0/-1` in the remaining route slots. Current grounded caller is the city-connection bonus candidate builder at `0x004047bf`, where this helper is used as the smaller fallback path when the earlier explicit-anchor route attempt does not apply. This now looks like the compact region-entry wrapper around the shared route builder rather than a generic coordinate helper.","objdump + caller inspection + route-builder correlation + city-bonus fallback correlation"
0x00404c60,124,city_connection_try_build_route_between_region_entry_pair,map,fastcall,inferred,objdump + caller inspection + route-builder correlation,3,"Compact fastcall route-builder above the shared route store at `0x006cfca8`. The helper resolves the two caller-supplied region or city entry ids through collection `0x0062bae0`, derives both endpoint coordinate pairs through `0x00401000`, and then re-enters the heavier route builder at `0x00402cb0` with those two endpoints plus the caller's remaining stack-side policy tuple. Current grounded callers are the pair-selection sweeps inside `simulation_try_select_and_publish_company_start_or_city_connection_news` `0x00404ce0`, where it is used both for the early dense score matrix and the later selected-pair retry. This now looks like the direct region-entry pair wrapper around the shared route builder rather than another anonymous internal callsite.","objdump + caller inspection + route-builder correlation + pair-selection correlation"
0x00404ce0,3124,simulation_try_select_and_publish_company_start_or_city_connection_news,simulation,fastcall,inferred,objdump + caller inspection + RT3.lng strings,3,"Broad fastcall city-pair chooser and news publisher above `city_connection_try_build_route_between_region_entry_pair` `0x00404c60`. When the stack company-id argument is zero the helper sweeps up to `0xa0` region-or-city entries from `0x0062bae0`; when it is nonzero it first validates that company through collection `0x0062be10`, stat family `0x2329` mode `0x0d` via `0x0042a5d0`, and the territory-access gate `0x00424010`. Eligible city entries are filtered through `city_connection_bonus_exists_matching_peer_site` `0x00420030`, weighted through `city_compute_connection_bonus_candidate_weight` `0x004010f0`, damped by map-size terms, territory access, and current region flags, and stored into temporary score bands. The helper then builds one dense pair matrix, repeatedly re-enters `0x00404c60` to validate candidate city pairs, can update one company-side selected endpoint pair through `0x00426f20`, and finally publishes shell news through `0x004554e0`. Current grounded publication ids are `2889` `%1 has started a new company - the %2` and `2890` `%1 has connected %2 to %3.`. Current grounded callers are `0x00401455`, which temporarily clears region-state dwords `[0x006cfc9c+0x2d]` before a global pass, and `0x00401b36`, which re-enters the same chooser with the active company and linked chairman after the smaller company-side city-connection bonus lane falls through. This now looks like the broader company-start-or-city-connection headline chooser above the smaller city-connection bonus sweep at `0x00406050` rather than another anonymous route-builder.","objdump + caller inspection + RT3.lng strings + route-builder correlation + pair-selection correlation + publication-path correlation"
0x00405920,189,company_query_min_linked_site_distance_to_xy,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Queries the minimum distance from one company to an input X or Y point pair. The helper walks the live placed-structure collection at `0x006cec20`, keeps only sites whose linked company id from `placed_structure_query_linked_company_id` at `0x0047efe0` matches `[this+0x00]`, samples each surviving site's derived coordinates through `0x0047ded0` and `0x0047df00`, and then computes one scalar distance against the caller-supplied coordinate pair through `0x0051dbe0`. It returns the minimum observed distance across all linked sites, clamped to a floor of `1.0` when a closer or degenerate result would go lower. The current grounded caller is `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, where this helper provides the distance term later blended into each city candidate score.","objdump + caller xrefs + callsite inspection + distance-term correlation"
0x00406050,2966,company_evaluate_and_publish_city_connection_bonus_news,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Broader company-side city-connection bonus sweep above `city_connection_bonus_build_peer_route_candidate` at `0x004046a0`. The function starts by building one announcement-value floor from several company-side support or governance helpers: the generic metric readers at `0x0042a5d0` and `0x00426ef0`, the linked transit-site counter `company_count_linked_transit_sites` at `0x00426590`, the small bonus-lane gate at `0x00427590`, and the longer company value ladder at `0x00425320`. Once that floor is high enough it walks the region-or-city collection at `0x0062bae0` and computes one per-city opportunity score from three terms: the city-side opportunity weight from `city_compute_connection_bonus_candidate_weight` at `0x004010f0`, the minimum linked-site distance from `company_query_min_linked_site_distance_to_xy` at `0x00405920`, and one city-side coordinate or spacing term around `0x00455800` and `0x00455810`. Those city scores are then adjusted by rival-company presence, chairman-profile scaling, the map-editor building-density setting at `0x006cec78+0x4c78`, and a linked-transit-site-count cap before the function keeps up to ten city ids in the persistent band at `[this+0x0d42]`. It repeatedly re-enters `city_connection_bonus_build_peer_route_candidate` to validate the best remaining entry, and when one validated winner survives it formats company and city names into the localized news strings `2888` `%1 has connected to %2.`, `2890` `%1 has connected %2 to %3.`, or `2921` `%1 has put a station in %2, but to win the %3 connection bonus, this station must be connected to ANOTHER city.` before publishing the result through the shell news helper at `0x004554e0`. When no winner survives it sets the byte latch at `[this+0x0d18]` instead. This is now the first grounded announcement owner above the city-connection bonus status formatter and peer-selector pair rather than just an anonymous caller around `0x004064c0`.","objdump + caller inspection + RT3.lng strings + peer-route candidate correlation + publication-path correlation + score-component correlation"
0x00407bd0,1697,company_rebuild_linked_transit_autoroute_site_score_cache,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Slower per-company follow-on above the fast linked-transit peer cache. The helper stamps the current scenario tick into `[this+0x0d3a]`, then walks the live placed-structure collection and keeps only sites whose company-side cache cell at `[site+0x5bd][company_id]` is present and eligible. For each such site it refreshes the cache-cell tick at `+0x0a`, zeroes the three accumulated float lanes at `+0x0e`, `+0x12`, and `+0x16`, and then rebuilds those lanes from two phases. First it uses `placed_structure_count_candidates_with_local_service_metrics` `0x0047e330`, `0x0047e620`, and the issue-opinion helper `0x00437d20` to populate bounded candidate-local amount bands at stack `0x1a0..` and normalized scaling bands at `0x350..`. Then it re-enters the per-site peer buffer at cache `+0x06`, resolves each peer site's live service words through `0x0047de20`, and only keeps candidate lanes whose local amount still exceeds the peer baseline. The surviving excess amount accumulates raw into cache float `+0x12`, while the continuity share at peer float `+0x09` and route-step count at peer dword `+0x05` feed a second step-biased weighted accumulator in cache float `+0x0e` through the local `+0x28` denominator bias. A later grouped promotion pass chooses the strongest adjacent candidate bands and folds their weighted contribution into cache float `+0x16`, which is the final site-ranking lane consumed by the downstream site selector. That split now matters for the tracker compatibility question too: the pre-`1.03` versus `1.03+` pair-metric dispatcher at `0x004a65b0` can perturb peer step counts and continuity share, but on current evidence that only flows into the weighted `+0x0e` and promoted `+0x16` lanes, not the raw `+0x12` amount total. Current grounded callers are the company-side mode gate at `0x00401c2a`, the timed wrapper at `0x00409766`, and the fast-cache tail path at `0x004093cd`. This now reads as the slower autoroute-site score rebuild over the linked-transit peer cache family rather than an unnamed tail call.","objdump + caller xrefs + callsite inspection + linked-transit score-cache correlation + linked-transit consumer correlation + version-compatibility impact correlation"
0x00408280,255,company_select_best_owned_linked_transit_site_by_autoroute_score,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Selects one owned linked transit site from the company-side autoroute cache family. The helper walks the live placed-structure collection, keeps only sites whose company cache cell `[site+0x5bd][company_id]` is present and eligible, whose linked company id matches the current company, and which still pass the station-or-transit gate `0x0047fd50`. It then ranks the surviving sites by cache float `[cell+0x16]`, applying a small bonus when the placed-structure-side lanes `[site+0x5c1]` and `[site+0x5c5]` are both clear, and returns the winning site id or `-1` when no candidate survives. Current grounded caller is `company_build_linked_transit_autoroute_entry` `0x00408380`, where this helper provides the fallback start site when the caller does not already supply one.","objdump + caller xrefs + callsite inspection + linked-transit autoroute correlation"
0x00408380,3215,company_build_linked_transit_autoroute_entry,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Builds one `0x33`-byte train route-list entry from the company-side linked-transit autoroute caches. When the caller-supplied site id is absent or invalid, the helper first falls back to `company_select_best_owned_linked_transit_site_by_autoroute_score` `0x00408280`. It then walks the chosen site's peer buffer from `[site+0x5bd][company_id]+0x06`, recomputes grouped candidate-local deltas against the peer site's service words from `0x0047de20`, chooses the strongest surviving peer site, and finally formats one route-list record into the caller-owned output buffer: it clears the `0x33`-byte record, preserves the low nibble of flag byte `+0x28`, writes the chosen target site id into word `+0x29`, seeds the route-kind dword at `+0x24` with `0x384`, and fills the remaining route-anchor or metadata lanes through the auxiliary route-entry tracker family at `0x006cfcb4` when a linked train record is supplied. The downstream effect boundary is tighter now too: because this builder ranks peer-site candidates from the weighted peer-derived bands rather than the raw site totals, the pre-`1.03` versus `1.03+` tracker metric split is now best read as perturbing autoroute peer choice and seeded route-entry selection here, not the later company-wide train-pressure target at `0x00408f70`. Current grounded callers are `train_try_seed_route_list_from_company_linked_transit_sites` `0x00409770` and two neighboring stack-built retry branches in the same family. This now looks like the shared route-entry builder above the linked-transit autoroute cache rather than another raw site query.","objdump + caller xrefs + callsite inspection + route-list-entry correlation + linked-transit autoroute correlation + version-compatibility impact correlation"
0x00408f70,864,company_compute_owned_linked_transit_site_score_total,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Aggregates one company-side linked-transit train-pressure target from the placed-structure cache family. The helper walks the live placed-structure collection at `0x006cec20`, keeps only records whose company-specific cache cell `[site+0x5bd][company_id]` is present and eligible, whose linked company id matches the current company, and which still pass the narrower station-or-transit gate `0x0047fd50`, then accumulates the raw site score float at cache offset `+0x12` across the surviving sites while also retaining the first two representative site pointers and the eligible-site count. It then converts that raw total into the returned roster target through a year-dependent divisor ladder, later year-side multipliers, and site-count bands. On build `1.03+`, when exactly two eligible sites survive, it also measures the inter-site distance between those retained sites and applies an extra distance-side scaling branch before the final train-balance comparison. The compatibility boundary is now tighter too: because this helper sums cache `+0x12` rather than the weighted `+0x0e` or promoted `+0x16` lanes, current evidence says the pre-`1.03` versus `1.03+` tracker metric split does not directly change this company-wide roster target except through any earlier coarse candidate-survival effects, not through the step-count or continuity-weighting lanes themselves. Current grounded caller is the linked-transit train-roster balancer at `0x00409950`, where this returned float is compared against the current owned-train count and train-age heuristics before the add, upgrade, or removal branches run.","objdump + caller xrefs + callsite inspection + linked-transit score-total correlation + linked-transit consumer correlation + version-compatibility impact correlation"
0x00409300,200,company_publish_train_upgrade_news,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,3,"Formats and publishes the linked-transit train-upgrade news item. After one scenario gate through `[0x006cec78+0x4a97]`, the helper chooses one preferred locomotive id through `0x004078a0`, resolves the caller-supplied train id through the live train collection `0x006cfcbc`, formats the old and new locomotive names through the locomotive collection `0x006ada84` and the name helper at `0x00461ca0`, and then emits RT3.lng id `2897` `%1 has just upgraded a %2 to a %3.` through the shell news helper at `0x004554e0`. It finally sets the byte latch at `[company+0x0d56]`. Current grounded callers are the train-roster balancer at `0x00409950` and one neighboring branch at `0x00409b52`, so this now reads as the shared company-side train-upgrade headline helper rather than an anonymous news formatter.","objdump + caller xrefs + callsite inspection + RT3.lng strings + train-upgrade news correlation"
0x004093d0,837,company_rebuild_linked_transit_site_peer_cache,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Per-company fast refresh over the placed-structure-side linked-transit peer cache. The helper stamps the current scenario tick from `[0x006cec78+0x15]` into `[this+0x0d3e]`, then walks the live placed-structure collection at `0x006cec20`. For each site it resolves the company-specific cache cell from the site's pointer table `[site+0x5bd][company_id]`, marks the cell present, clears its eligible byte, and frees any prior peer-record buffer at `+0x06`. It then marks a site eligible when it passes the station-or-transit gate `0x0047fd50`, the linked-instance class test `0x0047de00 -> 0x0040c990 == 1`, and either already belongs to this company through `placed_structure_query_linked_company_id` `0x0047efe0` or survives the neighboring route-anchor reachability gate `0x004801a0` plus the minimum-distance threshold built from `company_query_min_linked_site_distance_to_xy` `0x00405920`. In the second pass each eligible site receives a zeroed `(eligible_count*0x0d)+1` byte peer buffer at cache offset `+0x06`, and the helper fills one `0x0d`-byte record per eligible peer: byte `+0x00` is a route-side reachability flag, dword `+0x01` stores the peer site id, dword `+0x05` stores the returned route-step count from `aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks` `0x004a6630`, and float `+0x09` stores the normalized continuity share computed from that step count and the companion mismatch-count output of the same helper. The function then tails into the heavier company-side follow-on at `0x00407bd0`. Current grounded callers are the company-side world or service wrapper `0x00409742`, the mode-gated company pass at `0x00401c23`, the route-builder-side company refresh at `0x0040457e`, and the active-company collection sweep `0x00429c5b`.","objdump + caller xrefs + callsite inspection + linked-transit cache correlation + placed-structure cache-cell correlation + route-step-count correlation + continuity-ratio correlation"
0x00409720,80,company_service_linked_transit_site_caches,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Timed service wrapper above the two company-side linked-transit cache lanes. The helper refreshes the fast peer cache through `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` when `[this+0x0d3e]` is zero or older than `0x7ff80` ticks, and otherwise refreshes the slower follow-on lane at `0x00407bd0` when `[this+0x0d3a]` is zero or older than `0x31380` ticks. Current grounded direct callers are `0x004097b8`, which re-enters it after one larger local mode change, and several neighboring company-side service paths. This now looks like the bounded timed owner for the company-side linked-transit cache family rather than another anonymous small wrapper.","objdump + caller xrefs + callsite inspection + timed-service correlation"
0x00409770,88,train_try_append_linked_transit_autoroute_entry,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Attempts to append one linked-transit autoroute entry onto a live train route list. After validating the train-side state and one current route-kind gate through `0x004a8840`, the helper clears one local staging byte, re-enters `company_service_linked_transit_site_caches` `0x00409720` on the owning company, and then asks `company_build_linked_transit_autoroute_entry` `0x00408380` for a single staged `0x33`-byte route-list record using the current anchor site id at `[this+0x0a0]`. On success it either appends that record through `train_route_list_insert_staged_entry_at_index` `0x004b3160` and refreshes the new trailing selection through `train_route_list_select_entry_and_refresh_linked_site_state` `0x004b2f00`, or when the list is already at the local two-entry cap it rotates the target slot via `[this+0x08] mod [this+0x04]` and overwrites that `0x33`-byte entry in place. Current grounded caller is the company-side service sweep at `0x004019cc`, so this now reads as the single-entry train-side autoroute append helper rather than a two-entry seeding pass.","objdump + caller xrefs + callsite inspection + linked-transit autoroute correlation + train-route-list correlation"
0x00409830,274,company_try_add_linked_transit_train_and_publish_news,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,3,"Local add-train branch beneath the linked-transit company train-roster balancer. The helper first respects scenario gate `[0x006cec78+0x4aa3]`, clears and seeds one staged route-entry buffer through `0x004b2ba0`, services the owning company's linked-transit caches, asks `company_build_linked_transit_autoroute_entry` `0x00408380` for two route-list entries, inserts those entries through `train_route_list_insert_staged_entry_at_index` `0x004b3160`, chooses one preferred locomotive id through `0x004078a0`, and then hands the staged route plus locomotive choice into the train-construction helper at `0x004b2140`. On success it emits RT3.lng id `2896` `%1 has added a new train (%2) at %3` through `0x004554e0` and sets the byte latch at `[company+0x0d56]`. Current grounded callers are the local add branches inside `company_balance_linked_transit_train_roster` `0x00409950`, while multiplayer callers package opcode `0x75` instead.","objdump + caller xrefs + callsite inspection + RT3.lng strings + linked-transit train-add correlation"
0x00409950,923,company_balance_linked_transit_train_roster,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Balances one company's linked-transit train roster against the linked-site cache family. The helper first requires at least one linked transit site through `company_count_linked_transit_sites` `0x00426590`, then computes one aggregate train-pressure target through `company_compute_owned_linked_transit_site_score_total` `0x00408f70` and counts currently owned trains through `company_count_owned_trains` `0x004264c0`. It walks the live train collection `0x006cfcbc`, keeps only trains owned by the current company, derives one year-dependent age scalar from current scenario year `[0x006cec78+0x0d]`, and applies that scaled age against two thresholds. Very old trains above the upper band are either removed outright through the train collection vtable when the roster already exceeds target, or upgraded in place through `company_publish_train_upgrade_news` `0x00409300` when the target still needs capacity. Mid-age trains above the lower band can trigger one narrower upgrade branch when the roster is still below target. After pruning, it computes the remaining deficit between the aggregate target and the owned-train count, then repeatedly either packages multiplayer opcode `0x75` through `0x00469d30` or locally re-enters `company_try_add_linked_transit_train_and_publish_news` `0x00409830` until that deficit collapses, with one later add-train retry branch when the residual target is still high enough. Current grounded callers are the company-side service sweep at `0x00401b9d` and a neighboring company wrapper at `0x004097b8`, so this now looks like the live train-balance owner above the linked-transit autoroute and news helpers rather than an unnamed local maintenance pass.","objdump + caller xrefs + callsite inspection + linked-transit train-balance correlation + linked-transit consumer correlation"
0x004264c0,96,company_count_owned_trains,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Counts the live trains owned by the current company. The helper walks the train collection at `0x006cfcbc`, compares each record's owning company byte at `[train+0x51]` against `[this+0x00]`, and returns the number of matches. Current grounded callers are the linked-transit train-roster balancer at `0x00409950` and the `LoadScreen.win` company train-list page at `0x004e7670`, where the count gates the no-trains fallback before the detailed roster rows are built.","objdump + caller xrefs + callsite inspection + company-owned train count correlation"
0x00426590,135,company_count_linked_transit_sites,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Counts the live linked placed structures for this company that also pass the station-or-transit gate. The helper walks the placed-structure collection at `0x006cec20`, keeps only peers whose linked company id from `placed_structure_query_linked_company_id` at `0x0047efe0` matches `[this+0x00]`, requires the linked-instance class byte through `0x0047de00 -> 0x0040c990 == 1`, and optionally enforces the narrower station-or-transit predicate through `0x0047fd50` when the caller passes a nonzero stack flag. The current grounded caller is `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, where the helper contributes the current linked transit-site count used in the bonus-value ladder and later building-density caps.","objdump + caller xrefs + callsite inspection + connection-bonus count correlation"
0x00427590,47,company_connection_bonus_lane_is_unlocked,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small boolean gate above `company_compute_connection_bonus_value_ladder` at `0x00425320`. The helper rejects immediately when the scenario-state flag at `0x006cec78+0x4a8b` is set or when the company age-like counter at `[this+0x5b]` has reached `0x14`; otherwise it computes the zero-argument connection-bonus value ladder through `0x00425320` and returns true only when the resulting integer value is at least `5`. Current grounded callers are `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050` and the later mid-function gate around `0x004064a9`, so current best meaning is one unlock or eligibility gate for the stronger city-connection bonus lane rather than a generic support predicate.","objdump + caller xrefs + callsite inspection + connection-bonus correlation"
0x0040a590,892,simulation_service_periodic_boundary_work,simulation,cdecl,inferred,objdump + analysis-context,3,"Periodic simulation-maintenance dispatcher inside the world-step family. It switches on the local calendar or phase byte at [this+0x0f] routes one heavy mode through the larger recurring service branch at 0x0040a160 falls back to the simpler one-step advance at 0x00409e80 for other modes and runs several global manager sweeps across 0x0062be10 0x006ceb9c 0x006cfcbc 0x006cec20 and 0x0062bae0 before handing control back to the enclosing stepper. The route-style lane is tighter here now too: one recurring branch at `0x0040a91f` re-enters `placed_structure_collection_refresh_quarter_subset_route_style_state` `0x00413580`, which refreshes every fourth live placed structure for route-style candidate scoring and peer-link emission. One conditional branch also re-enters shell_map_file_world_bundle_coordinator at 0x00445de0 which keeps the save-or-package family connected to the live simulation cadence.",objdump + analysis-context + caller xrefs
0x0040ab50,339,simulation_advance_to_target_calendar_point,simulation,cdecl,inferred,objdump + analysis-context,3,Advances the active world state toward one caller-selected packed calendar target while guarded by the recursion counter at 0x0062b240. The helper compares the current local tuple fields [this+0x0d] [this+0x0f] [this+0x11] and [this+0x14] against a target resolved through 0x0051d550 and 0x0051d5f0 then either recurses in larger 0x168-sized chunks or advances through the smaller periodic step family rooted at 0x00409e80 and 0x0040a9c0. Each successful step notifies the live world root at 0x0062c120 through 0x00450030. Grounded callers include the frame-time accumulator at 0x00439140 the larger fast-forward helper at 0x00437b20 and one shell UI command path.,objdump + analysis-context + caller xrefs
0x0040e360,235,placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Subtype-specific local-runtime follow-on beneath `0x0040eba0` and `0x0040ee10`. The helper resolves the current placed structure's candidate from `[this+0x3cc]` through `0x0062b2fc` and `0x0062b268`, requires subtype byte `[candidate+0x32] == 1` plus candidate class byte `[candidate+0x8c] == 3`, then requires a linked site id at `[this+0x2a8]`. When the linked peer exists and its route-entry anchor at `[peer+0x08]` is live in collection `0x006cfca8`, the helper samples one anchor-side float through `0x0048aab0`, subtracts the fixed offset at `0x005c8738`, combines that result with the current placed structure's coordinate pair through `0x00455810` and `0x00455800`, and publishes the resulting triplet through the shared position setter `0x00530720`. Current grounded caller is the broader local side helper `0x0040ee10`, plus the heavier subtype-driven refresh path at `0x0040eba0`, so this is now the safest current read for the linked-site anchor position-triplet refresh beneath the placed-structure local-runtime family rather than a generic route query.","objdump + caller inspection + local disassembly + linked-site-anchor correlation + local-runtime correlation"
0x0040e450,131,placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small wrapper that rebuilds one placed structure's cloned local-runtime record from its current candidate stem and cached profile slot. The helper copies the current stem string from the candidate referenced by `[this+0x3cc]`, resolves the matching live candidate id through `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, seeds the projected-rectangle profile-slot cache from `[this+0x252]` through `placed_structure_cache_projected_rect_profile_slot_id` `0x00414470`, and then re-enters `placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds` `0x00418a60` with the current placed-structure pointer. It stores the returned cloned record into `[this+0x24e]`, refreshes the local cached profile slot from `[record+0x732]` into `[this+0x252]`, and ties the clone back to the owning placed structure through `[record+0x73a] = this`. Current grounded caller is the collection-wide wrapper `0x004133b0`, so this now reads as the cloned local-runtime rebuild helper for one live placed structure rather than an unowned stem lookup.","objdump + caller inspection + local disassembly + local-runtime-clone correlation + projected-rect-profile correlation"
0x0040eba0,620,placed_structure_set_world_coords_and_refresh_local_runtime_side_state,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Heavier placed-structure world-coordinate mutation helper above the local-runtime side refresh family. The function updates the current record's world position through `0x00455860`, recomputes cached grid coordinates `[this+0x388]` and `[this+0x38c]`, and rewrites the world-grid owner mapping through `0x0042c9f0` and `0x0042c9a0`. On the candidate subtype-`4` branch it also removes and then re-appends the current site to the nearby-transit proximity bucket family through `placed_structure_collection_remove_site_id_from_all_proximity_bucket_lists` `0x004814c0` and `placed_structure_collection_append_site_into_all_proximity_bucket_lists` `0x00481480`. After that it rebuilds the same local position or scalar triplet family later serviced by `0x0040ee10`, caches the accepted scalar pair in `[this+0x392]` and `[this+0x396]`, publishes the chosen triplet through the shared setter `0x00530720`, optionally refreshes the linked peer route-entry anchor through `0x00480710`, and finally tails into `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`. Current grounded callers include the broader rebuild paths `0x0040ef10` and `0x0040f6d0`, later site-mutation branches `0x00419110`, `0x0046ef40`, `0x004707da`, and `0x00473bf0`, plus shell-side subject updates around `0x00507cf0` and `0x00508bb0`, so this is now the safest current owner for world-coordinate updates plus local-runtime side-state refresh rather than a generic movement helper.","objdump + caller inspection + local disassembly + world-coordinate mutation correlation + local-runtime correlation + proximity-bucket correlation"
0x0040ee10,248,placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small placed-structure local-runtime side refresh over one live record. The helper samples the current structure coordinate pair through `0x00455800` and `0x00455810`, converts that pair through the basis at `0x006d4024`, `0x0051f090`, and `0x00534490` into one base scalar, and then conditionally adjusts that scalar when the linked candidate-side structure record keeps nonzero byte `[candidate+0xba]` via the rounded world-grid sampler `0x0044ae40` and the fixed subtractive offset at `0x005c8840`. When the auxiliary preview owner gate `shell_has_auxiliary_preview_owner` `0x00434050` is active, it rounds that scalar to an integer float. It then publishes the resulting position triplet through the shared setter `0x00530720` and tails into `placed_structure_refresh_linked_site_anchor_position_triplet_for_local_runtime` `0x0040e360`. Current grounded callers are the collection-wide local-runtime refresh wrapper `0x004133b0` and the connected-component recursion tail `placed_structure_recursive_collect_connected_component_tile_bounds` `0x00415f20`, so this is now the strongest current owner for the per-site local-runtime position-triplet refresh rather than a generic coordinate helper.","objdump + caller inspection + local disassembly + local-runtime correlation + connected-component correlation"
0x0040ef10,1984,placed_structure_finalize_creation_or_rebuild_local_runtime_state,map,thiscall,inferred,objdump + caller inspection + placement and mutation correlation,3,"Broad placed-structure post-create or post-edit rebuild above the narrower route-style lane. The helper validates several linked-site and world-state preconditions before keeping the current site live, increments the global live-site count at `0x0062be40`, seeds runtime mode and year fields at `[this+0x390]`, `[this+0x3d4]`, and `[this+0x3d5]`, refreshes the adjacent site-status or overlay family through `0x0040d2d0`, and rebuilds one larger local owner or service bundle through `0x00418be0`, `0x0040eba0`, and the scalar-staging family `0x00475ed0` / `0x00474fe0` / `0x00475010` / `0x00475030` into fields such as `[this+0x24e]`, `[this+0x252]`, `[this+0x25a]`, and `[this+0x25e]`. Later in the same body it re-enters `0x0040db30`, and when the local latch at `[this+0x29e]` is still zero it also re-enters `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `1`. Current grounded callers include the placement-side builders at `0x00403ef3` and `0x00404489`, later site-mutation paths at `0x0046f073` and `0x004707ff`, and one train-side site operation at `0x005098eb`, so this now looks like the broad post-create or post-edit runtime rebuild above route-style scoring and peer-link emission rather than a route-style-only helper.","objdump + caller inspection + placement and mutation correlation + route-style rebuild correlation"
0x0040f6d0,891,placed_structure_construct_entry_from_candidate_and_world_args,map,thiscall,inferred,objdump + constructor inspection + caller correlation,3,"Lower constructor beneath the shared placed-structure allocator at `0x004134d0`. The helper writes the new placed-structure id into `[this+0x2a4]`, clears a large band of local runtime fields, copies the candidate stem or label payload from the caller-supplied construction scratch record, initializes local world geometry through `0x0040cd70`, `0x0045b9b0`, `0x00455750`, and `0x00455720`, quantizes the input coordinates into the cached grid terms at `[this+0x388]` and `[this+0x38c]`, seeds the current scenario year into `[this+0x3d5]`, and initializes the class-weight lanes near `[this+0x28a]` from the linked candidate vtable owner. It then zeroes the local route-style and service-score bands, conditionally builds the first local owner or service record through `0x00418be0` and `0x0040eba0`, resolves the initial linked site id at `[this+0x2a8]` through `0x00481390` when the backing candidate subtype byte `[candidate+0x32]` is `1`, seeds region linkage through `0x0044a800` and `0x0041f7e0`, optionally re-enters `0x0040db30` for subtype `4`, and finally seeds the trailing random-like dwords at `[this+0x3d9]` and `[this+0x3dd]` from `0x518d70`. Current grounded caller is `placed_structure_collection_allocate_and_construct_entry` `0x004134d0`, so this is now the concrete placed-structure constructor rather than an anonymous lower helper beneath the placement-side builders.","objdump + constructor inspection + caller correlation + placed-structure runtime-state correlation"
0x0040fbe0,224,placed_structure_endpoint_pair_has_shared_route_entry_key,map,thiscall,inferred,objdump + caller inspection + world-grid chain comparison,3,"Boolean peer-test between one placed structure and one caller-supplied peer site id. The helper converts the current site and the peer site into their derived world-grid owner records through `0x00455800`, `0x00455810`, the world-grid tables rooted at `[0x0062c120+0x2129]`, and the placed-structure resolver `0x0040fa50`. It then compares the two route-entry chains rooted at `[cell+0x0ef]`, using the chain lengths at `[cell+0x0eb]`, and returns `1` on the first shared leading `u16` route-entry key; otherwise it returns `0`. Current grounded callers are the route-link emitter at `0x0040fef0`, where it blocks duplicate endpoint pairing before `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50`, and the neighboring cleanup sweep at `0x0040d2aa`, where it decides whether an existing site-owned route-link should be erased. This now looks like the shared duplicate-or-overlap test for the route-link family rather than a generic proximity check.","objdump + caller inspection + world-grid chain comparison + route-link duplicate-check correlation"
0x0040fef0,752,placed_structure_try_emit_best_route_style_peer_link_for_candidate_class,map,thiscall,inferred,objdump + caller inspection + placed-structure sweep inspection,3,"Scans the live placed-structure collection for one best peer site and emits a missing route-link for one caller-selected candidate class when a qualifying endpoint pair survives. The helper first derives one distance cap from the current placed-structure population size at `0x0062b26c`, scales that cap by the caller-supplied float, and then walks the live placed-structure ids in a wrapped pseudo-random order. Candidate peers must have a positive class-specific weight in the placed-structure lane `[peer+class*4+0x27e]`, differ from the source site, pass the linked-instance class gate `0x0040c990 == 1`, and lie inside the chosen distance window after the coordinate and span checks built from `0x00455800`, `0x00455810`, `0x00455f60`, and nearby math helpers. The strongest surviving peer is kept through a weighted comparison, and if one remains the helper re-enters `placed_structure_endpoint_pair_has_shared_route_entry_key` `0x0040fbe0`; only when that duplicate check fails does it call `placed_structure_route_link_allocate_site_pair_for_candidate_class` `0x00467f50` with the source site id from `[this+0x2a4]`, the chosen peer id, and the same candidate-class argument. Current grounded callers are the larger per-site world pass around `0x00410665` and the route-style grid contribution branch at `0x0042cafe`, so this now looks like the current peer-selection emitter for site-owned route-style links rather than a low-level allocator wrapper.","objdump + caller inspection + placed-structure sweep inspection + route-link emission correlation"
0x004101e0,6843,placed_structure_rebuild_route_style_candidate_scores_and_peer_links,map,thiscall,inferred,objdump + caller inspection + route-style emission correlation,3,"Large per-site rebuild pass above the route-style link emitter. The helper first requires the current placed structure to pass the linked-instance class gate `0x0040c990 == 1` and several scenario-state gates rooted at `0x006cec78` and `0x006cec7c`, then derives one set of per-class route-style score scalars from the current site's local state, scenario opinion multipliers through `0x00436590`, year-dependent dampers, and the placed-structure class-weight lanes near `[this+0x28a]`. The early compatibility side is tighter now too: it probes the current placed-structure stem against `Nuclear Power Plant`, `Electric Plant`, and `Recycling Plant`, stages three local boolean latches from those matches, and then clears the `Recycling Plant` latch again when the shared build-version query `0x00482e00` reports below `0x68` (`1.04`), so that stem-specific branch is now bounded as a post-`1.04` compatibility lane rather than one timeless route-style rule. For the first three route-style classes it conditionally re-enters `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0` with the caller-supplied mode flag and one computed float score. The function then continues into a larger descriptor-driven scoring phase over the current candidate's runtime descriptor array at `[candidate+0x37]`, building temporary score bands and normalizing them against the same local totals before later write-back. That later phase has another bounded version gate: on one descriptor-accumulation subbranch the helper consults `0x00482e00` again at `0x41109f`, and build `1.05+` (`>= 0x69`) skips one older fallback attenuation path that earlier builds still apply through the local multiplier tables. Current grounded callers are the local per-site branch at `0x0040f640`, which reaches it with stack flag `1`, and the broader placed-structure sweep at `0x004135e3`, which reaches it with stack flag `0`; this is therefore the strongest current owner for route-style candidate scoring and peer-link emission on one live placed structure rather than a narrow one-off helper.","objdump + caller inspection + route-style emission correlation + descriptor-loop inspection + version-gate correlation + stem-probe correlation"
0x004134d0,112,placed_structure_collection_allocate_and_construct_entry,map,thiscall,inferred,objdump + caller xrefs + constructor inspection,3,"Shared direct placement helper above the broader placed-structure runtime rebuild. The helper first obtains one temporary `0x3e1`-sized construction scratch object through `0x53b070` and `0x0040c950`, then allocates one live placed-structure entry from the current collection through `0x518900`, resolves the new record through `0x518140`, and finally re-enters the lower constructor at `0x0040f6d0` with the new entry id plus the caller-supplied coordinate and candidate payload tuple. Current grounded callers include the candidate-placement branches at `0x00403ed5`, `0x0040446b`, and `world_region_try_place_candidate_structure` `0x00422ee0`, plus later mutation or editor-side branches at `0x0046efbf`, `0x0047074b`, `0x00472bef`, `0x00472d03`, and `0x00508fd1`. This now looks like the shared placed-structure allocator and constructor entrypoint beneath the placement-side builders rather than a route-style-specific helper.","objdump + caller xrefs + constructor inspection + placement correlation"
0x0041d550,574,locomotive_era_and_engine_type_pass_company_policy_gate,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + engine-type correlation,2,"Policy gate beneath the preferred-locomotive chooser and its non-electric fallback. The helper operates on one locomotive-era or availability record whose linked locomotive id sits at `[this+0x126]`. On the fuller policy path, reached when record field `[this+0x41]` is `2` or `3`, it first respects several scenario-state locks rooted at `[0x006cec74+0x180]`, `[0x006cec78+0x4c8c]`, `[0x006cec7c+0x82]`, and `[0x006cec74+0x247]`, then resolves the linked locomotive record from `0x006ada84` and dispatches its engine-type dword `[locomotive+0x10]` across three scenario opinion slots through `scenario_state_sum_issue_opinion_terms_raw` `0x00436710`: `0x1c6`, `0x1c7`, and `0x1c8`, which current evidence now best aligns with the steam, diesel, and electric lanes. It also special-cases the locomotive stem at `[locomotive+0x34]` against the local string `WhaleL`; current data-file correlation now ties that stem to the `Orca NX462` locomotive family and its `WhaleL_NE` asset set, and when that compare hits the helper explicitly zeros the accumulated issue-opinion result before the later availability checks, so that family loses the positive-opinion shortcut rather than taking a bonus branch. It then consults one neighboring locomotive-derived issue or policy id through `0x00442a85`, and applies a late scenario availability triplet from `[0x006cec78+0x4c97..0x4c99]` against three per-record bytes `[this+0x30..0x32]` plus record field `[this+0x7b]`. That triplet now has a stronger player-facing read: the same three scenario bytes are the live editor-policy fields owned by `map_editor_locomotive_availability_panel_construct` `0x004cd680` and `map_editor_locomotive_availability_panel_handle_message` `0x004cf0d0`, and their localized labels `2863..2865` are `All Steam Locos Avail.`, `All Diesel Locos Avail.`, and `All Electric Locos Avail.`. The current gate is narrower than a plain override: when the issue-opinion result stays positive and none of those three editor bytes are enabled, that positive result alone seeds the local availability flag; but once any of the editor family bytes is nonzero, the helper instead requires one matching intersection between the per-record family bytes `[this+0x30..0x32]` and the corresponding scenario bytes `0x4c97..0x4c99`. Independent of that family check, record field `[this+0x7b]` can still carry the path into the later year-window gate. On the simpler path it falls straight to an era-window gate using the current scenario year with floor `0x726` against `[this+0x105]` and `[this+0x109]`, plus one current-month-like check from `[0x006cec78+0x0f]`. The helper returns `1` when the era and engine family pass those combined scenario, opinion, availability, and year gates; otherwise `0`. Current grounded callers are `company_select_preferred_available_locomotive_id` `0x004078a0` and `locomotive_collection_select_best_era_matched_non_electric_fallback_id` `0x00461cd0`.","objdump + caller xrefs + callsite inspection + engine-type correlation + year-window correlation + scenario-gate correlation + editor-locomotive-availability correlation + WhaleL carveout correlation + engine-data correlation"
0x00417790,160,map_angle_rotate_grid_offset_pair_into_world_offset_pair,map,cdecl,inferred,objdump + callsite inspection + math-table correlation,2,"Small angle-table rotation helper beneath the placement projection family. The helper normalizes the caller-supplied heading float into the engine's cyclic angle domain, indexes one sine or cosine-like basis table under `0x006d4024`, and then applies that basis pair to the caller-supplied X or Y grid offsets before writing the rotated world-space offset pair through the two out-pointers. Current grounded caller is `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, so this now looks like the low-level offset-rotation helper rather than a generic trig wrapper.","objdump + callsite inspection + math-table correlation"
0x00417840,205,placed_structure_project_candidate_grid_extent_offset_by_rotation,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Projects one candidate-sized local grid extent into rotated world-space X or Y offsets for placement and mutation previews. The helper resolves the caller-supplied placed-structure id through the current collection, pulls one local grid basis pair through `0x00413d80`, reads the linked candidate footprint bytes `[candidate+0xb8]` and `[candidate+0xb9]`, converts those grid extents into local offset terms, and then re-enters `map_angle_rotate_grid_offset_pair_into_world_offset_pair` `0x00417790` with the caller-supplied heading float to produce the rotated output pair. Current grounded callers include the city-connection placement chooser `0x00402cb0`, the placed-structure local rebuild lane at `0x0040de78`, subtype-`1` placement validation inside `0x004197e0`, and later world-side update branches at `0x00417b6f`, `0x00417e27`, `0x0041a250`, `0x0041a615`, `0x004802c6`, `0x00480875`, and `0x00480d50`. This now looks like the shared projected-footprint offset helper beneath placement validation rather than an unnamed geometry routine.","objdump + caller xrefs + callsite inspection + placement-correlation"
0x004185a0,100,world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small world-grid mask helper beneath the neighboring projected-rectangle raster family. The helper walks one caller-supplied rectangle from the four dwords rooted at stack arg `+0x04`, reads the aligned float sample band from the caller buffer at stack arg `+0x08`, skips cells whose sample is still the sentinel `0x497423f0`, and otherwise toggles bit `0x01` in the grid-byte mask rooted at `[0x0062c120+0x2135]` by XORing it with the low bit of the caller-supplied byte flag at stack arg `+0x0c`. Current grounded callers are the higher projected-rectangle workers at `0x00418610`, `0x00418a60`, and `0x00418d40`, so this is now bounded as a non-sentinel mask-toggle helper rather than another generic grid writer.","objdump + caller inspection + local disassembly + grid-mask correlation"
0x00418610,584,world_grid_refresh_projected_rect_sample_band_and_flag_mask,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared projected-rectangle world-grid helper above the flagged-region float-stats refresher `0x00415020` and the non-sentinel mask-toggle helper `0x004185a0`. The function resolves one placed-structure record from the caller-supplied id, optionally clears an out flag, validates the current global scan rectangle at `0x0062b7a8..0x0062b7b4` against the live world bounds, and then derives the two boolean mode inputs for `0x00415020` from the linked candidate helpers `0x0040cc80`, `0x0040cc60`, and `0x0040cc40`. On success it repopulates the temporary float band at `0x0062b7d0` by sampling every cell in the rectangle through `0x00448aa0`, publishes the rectangle through `0x0044d410`, and on the single-sample path re-enters `0x004185a0` to toggle the corresponding bit-mask cells. The richer branch also probes the current candidate subtype and per-candidate flags, checks local neighborhood acceptance through `0x00414c50`, samples one midpoint float through `0x00448bd0`, and stamps one or more world-grid cells through `0x0044dca0`. Current grounded callers are the neighboring placed-structure runtime helper at `0x00418be0` and the placement validator `placed_structure_validate_projected_candidate_placement` `0x004197e0`, so the safest current read is a projected-rectangle sample-band and flag-mask refresh pass rather than a generic float scan.","objdump + caller inspection + local disassembly + world-grid sample-band correlation + placement-validator correlation"
0x00418a60,372,placed_structure_clone_template_local_runtime_record_for_subject_and_refresh_component_bounds,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small local-runtime record builder above the projected-rectangle and connected-component helpers. The function selects one template slot from the local runtime scratch family rooted at `0x0062b2f8` using index `0x0062ba74`, resolves one caller-supplied subject coordinate pair through `0x0052e720`, clones the chosen template block into one queued runtime record from the caller-owned list, refreshes its local side fields through `0x00415820`, and then re-enters `world_grid_toggle_flagged_mask_bit0_for_nonsentinel_rect_samples` `0x004185a0` plus `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` over the cloned record's rectangle at `[record+0x4a0]`. It also refreshes several subject-link fields including `[record+0x742]`, `[record+0x74a]`, and the optional derived value at `[record+0x736]` through `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, then increments `0x0062ba74` and returns the cloned record. Current grounded caller is `0x0040e450`, which stores the result into `[site+0x24e]` and ties it back to the current placed-structure through `[record+0x73a]`, so this now looks like the current-subject local-runtime clone or refresh helper rather than another generic grid scan.","objdump + caller inspection + local disassembly + local-runtime-template correlation + projected-rect-profile correlation"
0x00418be0,346,placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader local-runtime record builder used during placed-structure construction and rebuild. The helper first resolves one live candidate id from the caller-supplied stem string through `indexed_collection_resolve_live_entry_id_by_stem_string` `0x00416e20`, then builds one projected runtime scratch payload through `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0`. It next re-enters `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, optionally refreshes one neighboring local scratch result through `placed_structure_render_local_runtime_overlay_payload_from_projected_bounds` `0x00418040`, and then copies the finished scratch block rooted at `0x0062b308` into one queued runtime record from the caller-owned list. After seeding the cloned record's link fields at `[record+0x742]`, `[record+0x74a]`, and `[record+0x736]`, it finally re-enters `placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh` `0x00416170` when the record's rectangle at `[record+0x4a0]` is valid. Current grounded callers are `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10`, `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, and the neighboring local-runtime refresh caller at `0x0040dc40`, so this is now the strongest current owner for building one placed-structure local runtime record from candidate stem plus projected scratch rather than an unnamed neighboring helper.","objdump + caller inspection + local disassembly + local-runtime-record correlation + overlay-payload correlation"
0x004197e0,5232,placed_structure_validate_projected_candidate_placement,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy placement validator beneath the city-connection chooser and several direct mutation paths. The helper resolves one anchor placed-structure id from the current collection at `0x0062b2fc`, optionally validates the caller-supplied company through `0x0062be10`, scenario-state and shell-mode gates around `0x004338c0` and `[0x006cec7c+0x82]`, the current world tile through `0x00414bd0` and `0x00534e10`, and territory access through `0x00424010`, and then walks a large footprint-validation pass over the linked candidate record from `0x0062b268`. That deeper pass uses the candidate footprint bytes `[candidate+0xb8]` and `[candidate+0xb9]`, multiple temporary occupancy banks on the stack, route or road-side probes through `0x00448af0`, `0x004499c0`, and `0x00413df0`, and subtype-specific follow-on branches keyed by `[candidate+0x32]` plus optional route-entry and company-side arguments. The strongest current subtype-specific branch is `[candidate+0x32] == 1`, where the helper re-enters `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, checks route-entry ownership and company track-laying capacity through `0x004240a0`, tries one explicit track-attachment path through `0x00494cb0`, and then falls back to one steeper world-space sweep through `0x00448bd0`. In that branch the optional failure buffer now has a concrete station-attachment or upgrade-style family: `0x0b55` `2901` not enough room to upgrade the station, `0x0b56` `2902` ground not flat enough for the upgraded station, `0x0b57` `2903` not your track, `0x0b58` `2904` not enough available track laying capacity, `0x0b59` `2905` cannot connect to existing track but too close to lay new track, and `0x0b5a` `2906` ground too steep for this building, with older fallback strings `0x00be/0x00bf` still used on neighboring exits. The helper returns a placement-success boolean and is currently grounded as the shared go-or-no-go gate immediately before direct placement commits, without yet proving that every caller is station-only. Current grounded callers include both direct-placement lanes inside `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`, the placed-structure local rebuild branch at `0x0040dedb`, later mutation or editor-side branches at `0x00422afa`, `0x0046ef6b`, `0x0047070f`, `0x00472bcc`, `0x00472cd4`, and two shell-side callers at `0x00507f57` and `0x005083cc`.","objdump + caller xrefs + callsite inspection + company-access correlation + footprint-validation correlation + RT3.lng failure-text correlation"
0x00480210,448,placed_structure_construct_linked_site_record_from_anchor_and_coords,map,thiscall,inferred,objdump + caller inspection + constructor inspection,3,"Lower constructor beneath the linked-site allocator at `0x00481390`. The helper writes the new placed-structure id into `[this+0x00]`, stages one anchor or parent placed-structure id at `[this+0x04]`, clears the route-anchor field at `[this+0x08]`, the display-name buffer at `[this+0x46b]`, and several local list or scratch bands rooted at `[this+0x18]`, `[this+0x112]`, and `[this+0x5bd]`, then seeds local world-space state from the anchor site through `0x00455730`, `placed_structure_project_candidate_grid_extent_offset_by_rotation` `0x00417840`, and the grid helper at `0x0040cec0`. It quantizes the caller-supplied coordinate pair into `[this+0x4a8]` and `[this+0x4ac]`, initializes one grid-keyed owner lane through `0x0042bbb0`, and then chooses an initial route-entry anchor into `[this+0x08]` through `0x00417b40` when one compatible route entry already covers the projected point window. When that early anchor path does not hold, the helper falls back into the neighboring literal-policy-`1` route-entry synthesis family around `0x00493cf0`: current caller correlation says that byte is the direct linked-site endpoint-anchor creation or replacement lane, after which the helper rebinds `[this+0x08]` through `0x0048abc0` and updates the boolean marker at `[this+0x46a]`. Current direct caller is `placed_structure_collection_allocate_and_construct_linked_site_record` `0x00481390`, which makes this the clearest current lower constructor for the linked-site records later published through `[site+0x2a8]`.","objdump + caller inspection + constructor inspection + route-anchor correlation + linked-site correlation + linked-site policy-byte split correlation"
0x00413580,160,placed_structure_collection_refresh_quarter_subset_route_style_state,map,thiscall,inferred,objdump + caller inspection + collection-iteration inspection,3,"Collection-wide placed-structure sweep that refreshes one quartered subset of the route-style lane on each call. The helper computes a start index from the scenario time byte at `0x006cec78+0x11` modulo `4`, then walks every fourth live placed-structure record in the collection, requiring each record to pass the linked-instance class gate `0x0040c990 == 1` before re-entering `placed_structure_rebuild_route_style_candidate_scores_and_peer_links` `0x004101e0` with stack flag `0`. After each qualifying per-site rebuild it seeds the two trailing dword fields at `[site+0x3d9]` and `[site+0x3dd]` from `0x518d70`. Current grounded caller is the recurring simulation-maintenance branch at `0x0040a91f`, which makes this the strongest current owner for the periodic quarter-subset refresh of route-style peer-link state rather than a one-shot world-build pass.","objdump + caller inspection + collection-iteration inspection + periodic-cadence correlation"
0x00414fa0,118,world_grid_count_flagged_cells_and_collect_float_samples,map,cdecl,inferred,objdump + callsite inspection,3,"Counts flagged cells inside the current global rectangular scan window rooted at `0x0062b7a8..0x0062b7b4` and collects one float sample per hit. The helper walks the byte-mask grid rooted through `0x0062c120+0x2135`, requires bit `0x01` on each scanned cell, reads the aligned float field through `0x00448aa0`, stores the samples into the caller buffer, and returns the number of collected entries. Current grounded caller is `0x00415020`, where this sample list is reduced into one mean value before the wider flagged-region pass continues.","objdump + callsite inspection + world-grid scan correlation"
0x00415020,1968,world_grid_refresh_flagged_region_float_extrema_and_mean,map,cdecl,inferred,objdump + caller inspection,3,"Refreshes one global flagged-region float summary family rooted at `0x0062b7b8`, `0x0062b7bc`, `0x0062b7c0`, and `0x0062b7c4`. The helper first resets the current extrema sentinels, seeds one region-dependent threshold from the world-side `0x0062b2fc+0x9c` latch, collects up to `0x80` flagged-cell float samples through `world_grid_count_flagged_cells_and_collect_float_samples` `0x00414fa0`, and reduces them to one average stored at `0x0062b7c4`. It then rescans the same flagged rectangle, updating the min and max extrema from per-cell float values while applying one build-`1.04+` compatibility branch at `0x41518e`: when no current mode override is active and the world-side latch at `0x0062b2fc+0x9c` is clear, builds below `1.04` still allow one older fallback acceptance path that later builds skip. The tail publishes one blended midpoint into `0x0062b7c0` and can reject the whole pass through the neighboring scenario or world-state gates before returning success. Current grounded caller is the higher world-grid worker at `0x0041870d`, so this is now bounded as the flagged-region float-stats refresher rather than one route-entry helper.","objdump + caller inspection + version-gate correlation + world-grid scan correlation"
0x00415f20,403,placed_structure_recursive_collect_connected_component_tile_bounds,map,thiscall,inferred,objdump + caller inspection,3,"Recursive connected-component bounds collector over linked placed-structure records. Starting from one placed-structure node, the helper expands four caller-owned tile-bound out slots from the record-local rectangle fields `[record+0x4a0..0x4ac]`, tags the record with the current component pass id at `[record+0x73e]`, then walks the component membership map rooted at `0x0062ba7c` to find adjacent records whose packed tile key falls inside the current rectangle and whose prior pass id differs. Matching adjacent records recurse through the same helper until the reachable component rectangle is exhausted. On return the helper also seeds one default local rectangle owner through `0x004159e0` when `[record+0x732] == -1`, then refreshes the neighboring runtime side through `0x0040ee10`. Current grounded callers are the wrapper at `0x004160c0` and internal recursive self-calls.","objdump + caller inspection + recursive-component correlation + placed-structure-bound correlation"
0x004160c0,168,placed_structure_collect_connected_component_tile_bounds_with_version_gate,map,cdecl,inferred,objdump + caller inspection,3,"Wrapper above `placed_structure_recursive_collect_connected_component_tile_bounds` `0x00415f20`. The helper initializes four tile-bound accumulators to sentinel values, increments one world-grid reentry depth counter at `0x0062c120+0x2205`, and then chooses between two paths. On builds `1.03` and earlier, or when scenario field `[0x006cec78+0x46c38]` is still clear, it re-enters the recursive component walk through `0x00415f20`; otherwise it skips that older walk entirely. In both cases it decrements the reentry counter and then expands the surviving rectangle by `2` tiles on each side before publishing it through `0x0044d410`. Current grounded caller is the route-entry-backed component wrapper at `0x004161a0`, so this now looks like the version-gated connected-component bounds collector rather than another generic tracker helper.","objdump + caller inspection + version-gate correlation + connected-component correlation"
0x00416170,345,placed_structure_map_tile_range_to_connected_component_records_with_optional_bounds_refresh,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tile-range wrapper above `placed_structure_collect_connected_component_tile_bounds_with_version_gate` `0x004160c0`. The helper seeds the current connected-component pass keys at `0x0062ba7c` and `0x0062ba80`, iterates the caller-supplied tile rectangle, allocates or reuses one small per-tile record from the caller-owned queue, and looks up the packed `(row << 16) | col` key through the component map rooted at `0x0062ba7c` via `0x0053dae0`. When one mapped component record exists and the current placed-structure owner at stack arg `+0x0c` still has `[site+0x732] == -1`, the world-side latch at `[0x0062b2fc+0x9c]` is clear, scenario field `[0x006cec74+0x4fd]` is clear, and the caller-supplied suppress-refresh flag at stack arg `+0x10` is zero, it follows the mapped component chain and re-enters `0x004160c0` for each linked record; otherwise it clears one world-grid byte through `0x00448a70`. The resolved or refreshed record is then stored back through `0x0053d9e0` and `0x0053d960`. Current grounded callers are the neighboring local-runtime passes at `0x00418a60` and `0x00418be0`, so this is now the strongest current owner for mapping one tile rectangle into connected-component records with optional bounds refresh rather than another bare recursive walk.","objdump + caller inspection + local disassembly + connected-component-map correlation"
0x00416e20,156,indexed_collection_resolve_live_entry_id_by_stem_string,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small live-entry resolver over an indexed collection. The helper walks the live slot count through `indexed_collection_slot_count` `0x00517cf0`, fetches each live id through `indexed_collection_get_nth_live_entry_id` `0x00518380`, resolves the backing record through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and compares the caller-supplied string against the record stem at `[record+0x04]` through `0x005a57cf`. On success it returns the matching live id. On failure it emits localized id `189` through the shell string helpers and returns `-1`. Current grounded callers are the neighboring placed-structure local-runtime builders at `0x00418be0` and `0x0040e450`, plus one shell-side branch at `0x00507e80`, so this is now the strongest current match for a stem-to-live-id resolver rather than an unowned search loop.","objdump + caller inspection + local disassembly + stem-compare correlation"
0x00416ec0,1867,placed_structure_build_projected_runtime_scratch_from_candidate_and_coords,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Heavy projected-runtime scratch builder beneath the neighboring local placed-structure runtime family. The helper resolves one candidate record from the caller-supplied id, derives rotated footprint extents and centered world-space bounds from the caller-supplied coordinate and heading inputs, allocates and clears several temporary per-footprint mask bands on the stack, then walks up to four candidate-side shape or access sublanes rooted at `[candidate+0xcf]`, `[candidate+0xd3]`, `[candidate+0xd7]`, and `[candidate+0xdb]`. Within that deeper loop it projects rotated footprint cells through the basis pair at `0x006d4024`, rejects out-of-bounds or duplicate cells, checks multiple world-grid acceptance gates through `0x00448af0`, `0x00534e10`, `0x004499c0`, and `0x00413df0`, and marks the surviving cells into both temporary stack masks and the live world-grid byte lane at `[0x0062c120+0x2131]`. The tail publishes the finished scratch payload through `0x00416620`. Current grounded caller is `0x00418be0`, which then copies that scratch block into one queued local runtime record, so this is now the safest current name for the projected-runtime scratch builder rather than a generic placement validator.","objdump + caller inspection + local disassembly + projected-footprint correlation"
0x00418040,1168,placed_structure_render_local_runtime_overlay_payload_from_projected_bounds,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Heavy local-runtime overlay-payload builder beneath the broader local-runtime record family. The helper derives one projected bounds rectangle through `0x004142e0` and `0x00417f20`, rejects very small payloads, allocates one temporary dword buffer, folds that buffer through `0x00415370`, and then walks the projected rectangle producing one packed dword payload per cell. Current bounded gates include a duplicate-entry or occupancy fast path keyed by `[var_10h]`, world-grid rejection through `0x004499c0`, and several distance- and ratio-shaped thresholds built from the projected rectangle geometry. On accepted cells it writes one four-byte packed value into the caller output stream. Current grounded caller is `placed_structure_build_local_runtime_record_from_candidate_stem_and_projected_scratch` `0x00418be0`, where the result is stored into `[0x0062b7c8]`, so this is now the safest current read for the local-runtime overlay payload renderer rather than a generic geometric sweep.","objdump + caller inspection + local disassembly + overlay-payload correlation"
0x00414470,10,placed_structure_cache_projected_rect_profile_slot_id,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tiny setter for the projected-rectangle profile-slot cache at `0x005ee030`. The helper just stores the caller-supplied dword into that global cache. Current grounded caller is `0x0040e450`, where the cached value is set immediately before the current-subject local-runtime clone path at `0x00418a60`.","objdump + caller inspection + local disassembly + global-cache correlation"
0x00416620,521,placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Publishes one projected-runtime rectangle and its companion globals beneath the local-runtime scratch builder. The helper copies the current scratch owner id from `0x0062b304` into `0x0062b308`, stores the caller-supplied pair into `0x0062b30c/0x0062b310`, grows the active rectangle bounds at `0x0062b7ac` and `0x0062b7b4` when needed, clears one current index slot in `0x0062b318`, and then validates the rectangle against the route-entry store `0x006cfca8` through `route_entry_collection_query_rect_window_passes_entry_type_gate` `0x00494240`. On failure it raises localized id `185`; on one special-candidate branch keyed by `[record+0x123]` it re-enters `placed_structure_try_select_projected_rect_profile_slot` `0x00415570`, either expands the rectangle by three cells on each side and refreshes the per-cell side tables through `world_grid_refresh_projected_rect_surface_and_region_byte_tables` `0x00414e10` or fails with localized id `186`; and on the ordinary branch it can scan the temporary cell-value bank at `0x0062b300` across the rectangle and fail with localized id `187` before again tailing into `0x00414e10`. Current grounded callers are `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0` and the placement validator `0x004197e0`, so this now looks like the projected-runtime rectangle publisher plus side-window validator rather than an anonymous scratch tail.","objdump + caller inspection + local disassembly + projected-rectangle-global correlation"
0x00415570,317,placed_structure_try_select_projected_rect_profile_slot,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Small projected-rectangle profile selector beneath `0x00416620`. The helper ensures the temporary dword cell-value bank at `0x0062b300` exists, resets the shared slot id at `0x0062ba3a`, derives one companion value through `0x00413eb0` into `0x0062ba3e`, and then probes the current rectangle at `0x0062b7a8..0x0062b7b4` through repeated `0x004153f0` checks. One fast path reuses the cached selector at `0x005ee030`; another starts from localized id `11` through `0x00518be0`; and both update `0x0062ba3a` on success. Current grounded caller is the special-candidate branch inside `0x00416620`, where the returned success decides whether the rectangle can be expanded and the companion byte tables refreshed. This is therefore best-read as a projected-rectangle profile-slot selector rather than a broad route or placement policy helper.","objdump + caller inspection + local disassembly + rectangle-probe correlation"
0x00414e10,200,world_grid_refresh_projected_rect_surface_and_region_byte_tables,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Refreshes two compact per-cell byte tables for the current projected rectangle rooted at `0x0062b7a8..0x0062b7b4`. The helper scans every cell in that rectangle, counts processed entries in `0x0062ba36`, writes one nibble-packed byte into the table at `0x0062b96c` from the paired world-grid queries `0x00534040` and `0x005340a0`, writes one companion byte into `0x0062b9d1` through `0x00533f80`, and zeroes both tables for out-of-bounds cells. Current grounded callers are the two success paths inside `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, so this is now the safest current read for the projected-rectangle per-cell surface or region byte refresh rather than a generic grid scan.","objdump + caller inspection + local disassembly + projected-rectangle-byte-table correlation"
0x00494240,195,route_entry_collection_query_rect_window_passes_entry_type_gate,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Rectangle-window gate over the route-entry collection `0x006cfca8`. The helper first derives one route-entry search window from the caller-supplied projected rectangle through `0x00449df0`, then scans every route-entry id in that window through `0x00492130` and `indexed_collection_resolve_live_entry_by_id` `0x00518140`. It rejects when a covered entry owns byte `[entry+0x226]` outside the tolerated family, except for the caller-enabled permissive branch that still admits kinds `0x0c` and `0x0d`. Current grounded caller is `placed_structure_publish_projected_runtime_rect_globals_and_validate_side_windows` `0x00416620`, where a failing result produces localized id `185`, so this is now the strongest current read for the route-entry-type gate over the projected rectangle rather than a generic collection scan.","objdump + caller inspection + local disassembly + route-entry-window correlation"
0x00411ee0,451,structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables,map,thiscall,inferred,objdump + callsite inspection,3,"Rebuilds the per-candidate cargo summary tables after one runtime descriptor array has been materialized. The helper clears the two cargo-id pointer tables at `[this+0x79c]` and `[this+0x7a0]`, their counts at `[this+0x7a4]` and `[this+0x7a8]`, and one float-like per-cargo accumulator band rooted at `[this+0x0a1]`, then walks every live `0xbc` descriptor in `[this+0x37]` against the current scenario year at `[0x006cec78+0x0d]`. For each active subordinate cargo row in the descriptor-owned `0x1c`-byte entry band it resolves one cargo id through the global cargo collection at `0x0062ba8c`, updates the per-cargo accumulator, and tracks one or two levels of cargo membership before compacting those marks into the two emitted cargo-id tables. The stronger production-mode result is now bounded here rather than only in the editor importer: when the descriptor-side mode flag at `[desc+0x00]` is zero the subordinate row amount is multiplied by the shared recipe-book production cap at `[this+0x2a]` and divided by the descriptor amount at `[desc+0x04]`; when that mode flag is nonzero the helper bypasses that scaling path. That matches the editor-side split where production mode keeps the entered annual amount on the supply half while the demand half is normalized to `1.0`, so the demand-side production branch now looks like a normalized input selector or gate while the supply side is the branch that receives cap-scaled runtime rates. Current grounded callers are the collection-wide rebuild sweeps at `0x00412bd0` and `0x00412d70`.","objdump + callsite inspection + scenario-state correlation + cargo-collection correlation"
0x00412560,144,structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Descriptor-level activity gate beneath the port or warehouse cargo runtime family. The helper first special-cases descriptor mode `0` by resolving the primary cargo id at `[desc+0x1c]` through the global cargo collection at `0x0062ba8c`; it then requires the current scenario year at `[0x006cec78+0x0d]` to lie inside the descriptor year window `[desc+0x20]..[desc+0x22]`, and finally checks one caller-selected mode byte at `[desc+0x24]` or `[desc+0x25]` for the active mode bank. When the runtime cargo-economy latch at `[0x006cec78+0x4afb]` is clear and the descriptor owns subordinate cargo rows, it also requires every subordinate cargo id in the `0x1c`-byte row band at `[desc+0x44]` to resolve through the same cargo collection. Current grounded callers are `structure_candidate_count_active_scaled_supply_descriptors` at `0x004125f0`, `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, and neighboring world-side query branches around `0x0040fb8d`, `0x00410721`, and `0x00410b71`.","objdump + caller xrefs + callsite inspection + cargo-collection correlation"
0x004125f0,87,structure_candidate_count_active_scaled_supply_descriptors,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Counts active runtime descriptors that participate in the scaled supply-side production lane for one caller-selected mode bank. The helper walks the current descriptor array at `[this+0x37]`, selects only descriptors whose mode dword at `[desc+0x00]` is zero and whose subordinate row count at `[desc+0x2c]` is positive, and then reuses `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560` before incrementing the returned count. Current grounded caller is `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650`, where the resulting count is used to divide the shared production-cap float across the active scaled-supply descriptors.","objdump + caller xrefs + callsite inspection"
0x00412650,543,structure_candidate_query_cargo_runtime_summary_channels,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Lazy per-candidate cargo summary query over the runtime descriptor array rebuilt from the editor's port or warehouse recipe books. On a year change it clears four `0x6a`-dword summary banks rooted at `[this+0x0e8]`, `[this+0x290]`, `[this+0x438]`, and `[this+0x5e0]`, then walks every live `0xbc` descriptor across two mode banks through `structure_candidate_runtime_descriptor_is_active_for_current_year_and_mode` at `0x00412560`. Demand-side descriptors with nonzero mode dword accumulate subordinate-row weights into the bank rooted at `[this+0x10e]`; direct supply descriptors with no subordinate rows accumulate annual amounts into `[this+0x03a]`; and scaled supply descriptors with subordinate rows first divide the shared production-cap float at `[this+0x2a]` by the active-descriptor count from `structure_candidate_count_active_scaled_supply_descriptors` at `0x004125f0`, then publish the per-descriptor share into `[this+0x0a4]` and the subrow-scaled outputs into `[this+0x178]`. The helper finally returns one caller-selected cargo entry from all four banks through out-pointers, so current grounded meaning is one direct-supply channel, one cap-normalized supply channel, one demand or input channel, and one scaled production-output subrow channel rather than a single aggregate total. Current grounded callers are the lightweight wrappers at `0x00412960` and `0x004129a0`, the cargo-membership helper at `0x004129d0`, and the broader world-side accumulator at `0x0041e7be`.","objdump + caller xrefs + callsite inspection + scenario-state correlation"
0x004129d0,179,structure_candidate_supports_or_references_cargo_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Returns whether the current runtime structure candidate materially references one requested cargo id. The helper first scans the compact secondary cargo-membership table rooted at `[this+0x7a0]` with count `[this+0x7a8]`; when no direct match is found it queries `structure_candidate_query_cargo_runtime_summary_channels` at `0x00412650` for mode bank `0` and treats the candidate as relevant when the returned demand-side plus scaled-output channels are positive. One final fallback checks the cached per-cargo accumulator bands rooted at `[this+0x0a1]` and `[this+0x0ad]` through the candidate-to-collection remap at `0x0062ba8c+0x9a`, which keeps the direct runtime cargo-membership arrays tied into the same decision. Current grounded caller is the placed-structure sweep around `0x00452e60`, where the result gates per-instance activation against one requested cargo id.","objdump + caller xrefs + callsite inspection + cargo-summary correlation"
0x00412d70,563,structure_candidate_collection_rebuild_runtime_records_from_scenario_state,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Collection-wide runtime-state rebuild over the structure or candidate manager at `0x0062ba8c`. The helper iterates the collection twice against the paired availability bytes at `[candidate+0xba]` and `[candidate+0xbb]`, chooses one existing record to clone when the scenario-side owner id at `[candidate+0x794]` matches, otherwise clears the target record, and then repopulates the candidate runtime fields from the active scenario state rooted at `0x006cec78`. For each rebuilt candidate it copies the recipe-line count from `[state+0x1024]`, the shared production-cap float from `[state+0x13d4]`, and the packed `0xbc` descriptor array from `[state+0x1028]`, then refreshes the dependent cargo summary tables through `structure_candidate_rebuild_cargo_membership_and_scaled_rate_tables` at `0x00411ee0` and the neighboring mode-flag pass at `0x00411ce0`. One bounded text side branch also republishes the candidate label from the scenario-side recipe-book name around `[state+0x0fe8]` when that string ends in `:`. Current grounded callers are the tail of `scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables` at `0x00435630` and the larger collection load path at `0x00412fb0`, so this now looks like the candidate-side bridge that projects editor recipe-book state into live runtime records rather than another generic collection copy loop.","objdump + caller xrefs + callsite inspection + scenario-state correlation"
0x00412ca0,192,world_region_pick_commercial_profile_label_by_region_rank,map,thiscall,inferred,objdump + strings + callsite inspection,4,"Selects one category-3 candidate label from the global structure pool `0x0062b268` for the current region bucket. The helper converts the caller-supplied region rank through the region-count manager at `0x0062bae0`, uses that derived bucket to read per-candidate weights from `[candidate+region_index*4+0x8d]`, repeatedly subtracts those weights across up to five passes while only considering pool entries whose category byte at `[candidate+0x32]` is `3`, and copies the chosen candidate name into the caller buffer. When no weighted category-3 candidate survives the sweep it falls back to the static token `Commercial` at `0x005c92e8`. A later region-stats panel lines the same third slot up with localized id `1040` `City Support`, so current evidence treats this as the low-level label picker for a broader city-support family whose fallback token happens to be `Commercial`. The current grounded caller is `world_region_balance_structure_demand_and_place_candidates` at `0x004235c0`.","objdump + rdata strings + callsite inspection + region stats disassembly + RT3.lng strings"
0x004133b0,132,placed_structure_collection_refresh_local_runtime_records_and_position_scalars,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Collection-wide wrapper above the placed-structure local-runtime clone and side-refresh helpers. The function first drains the queued placed-structure id list rooted at `0x0062ba64/0x0062ba6c/0x0062ba70` by reading the queue count through `placed_structure_local_runtime_site_id_queue_count` `0x00414480` and popping ids through `placed_structure_local_runtime_site_id_queue_pop_next` `0x00413f50`; for each popped id it resolves the owning placed structure through collection `0x0062b26c` and re-enters `placed_structure_refresh_cloned_local_runtime_record_from_current_candidate_stem` `0x0040e450`. It then pumps the scenario-side service at `0x004834e0`, walks every live placed structure in `0x0062b26c`, and re-enters `placed_structure_refresh_local_runtime_position_triplet_and_linked_anchor_followon` `0x0040ee10` on each one. The current grounded caller is no longer just an anonymous raw callsite: it sits inside the `Setting up Players and Companies...` `319` lane of `world_run_post_load_generation_pipeline` immediately after the auxiliary route-entry tracker collection refresh on `0x006cfcb4` through `0x004a41b0`, and immediately before the flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0` plus the later route-entry post-pass `0x00491c20` on `0x006cfca8`. That makes this the clearest current owner for refreshing cloned local-runtime records plus the per-site position-scalar side pass rather than an anonymous collection sweep.","objdump + caller inspection + local disassembly + local-runtime-queue correlation + collection-refresh correlation + post-load-pipeline correlation"
0x00413f50,47,placed_structure_local_runtime_site_id_queue_pop_next,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Pop-next helper over the temporary placed-structure id queue rooted at `0x0062ba64/0x0062ba6c/0x0062ba70`. When queue storage exists and the current count at `0x0062ba64` is positive, the helper returns the current head dword from `0x0062ba70`, advances that cursor by four bytes, and decrements the count; otherwise it returns `-1`. Current grounded caller is `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, where the popped ids are resolved through collection `0x0062b26c` before cloned local-runtime records are rebuilt.","objdump + caller inspection + local disassembly + local-runtime-queue correlation"
0x00414480,6,placed_structure_local_runtime_site_id_queue_count,map,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Tiny count getter over the temporary placed-structure id queue used by the local-runtime refresh family. The helper simply returns the current queue count at `0x0062ba64`. Current grounded caller is `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, where the returned count bounds the queue-drain loop before the later all-sites side refresh.","objdump + caller inspection + local disassembly + local-runtime-queue correlation"
0x0041ea50,179,world_setup_building_collection_phase,map,cdecl,inferred,objdump + strings + callsite inspection,3,"Post-load world-generation subphase inside world_run_post_load_generation_pipeline. The helper iterates the building-related collection at `0x0062ba8c`, chooses either the full pass or one modulo-selected bucket from the current world byte at `[0x006cec78+0x0f]`, resolves each entry through `0x00518380` and `0x00518140`, and then dispatches the selected record into the lower setup worker at `0x0041e2b0`. Current grounded callsite is the early collection sweep inside world_run_post_load_generation_pipeline immediately before the localized progress update `Setting up Players and Companies...`, so this looks like the collection-owned building-setup staging phase rather than one of the later player-speed or shell-frame loops.",objdump + caller context + RT3.lng strings
0x0041e220,52,structure_candidate_is_enabled_for_current_year,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Common live-availability gate for one structure-candidate record. The helper first requires the cargo-economy or editor filter flag at `[this+0x56]` to be nonzero, then compares the current scenario year against the candidate threshold at `[this+0x21]`, using either `[0x006cec78+0x05]` or `[+0x0d]` depending on the runtime branch latched at `[0x006cec78+0x46c38]`. Current grounded callers include the collection counter refresh at `0x0041e970`, the placed-structure cargo-bitset sweep at `0x0042c690`, and several later shell or world-side candidate-selection branches, so this now looks like the shared year-and-filter gate beneath the editor's cargo-economy path rather than a setup-only helper.","objdump + caller xrefs + callsite inspection + cargo-economy filter correlation"
0x0041e650,142,structure_candidate_query_route_style_or_local_availability_metric,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + collection-correlation,3,"Returns one candidate-side float metric whose meaning splits on the route-style byte at `[this+0x46]`. When that byte is zero the helper simply returns the cached local float at `[this+0x5a]`. When it is nonzero it resolves one grouped routing-class value from candidate field `[this+0x3e]` through the structure-candidate collection side table at `0x0062ba8c+0x9a`, then walks collection `0x006ada90` through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140` to count entries whose class byte at `[entry+0x10]` matches, whose state byte at `[entry+0x12]` carries bit `0x2`, and whose word at `[entry+0x08]` is zero. It returns that matched count divided by the fixed float constant at `0x005c8554`. Current grounded callers include two sortable-value branches inside `shell_load_screen_render_map_cargo_list_panel` at `0x004e9460` and one neighboring shell renderer around `0x004f46d0`, so this now looks like the shared route-style-versus-local availability metric beneath candidate cargo summaries rather than a generic price reader.","objdump + caller xrefs + callsite inspection + collection-correlation + route-style-byte correlation"
0x00467eb0,104,placed_structure_route_link_attach_site_owner,map,thiscall,inferred,objdump + caller xrefs + chain-layout inspection,3,"Attaches one `0x006ada90` route-link record onto the owner chain of one placed structure. The helper first detaches the current record through `0x00467df0`, stages the caller-supplied placed-structure id into route-link field `+0x0a`, links the record into the placed-structure-owned chain at `[site+0x272]` through route-link field `+0x04`, and then re-enters `0x00467c30` to recompute the route-link flag byte at `+0x12` against neighboring site pairs. When that flag byte keeps bit `0x2` set, the helper also projects one class-indexed signed contribution through `0x0040fa50` and accumulates it into the placed structure through `0x0042b310`. Current grounded caller is the route-link allocator path at `0x00468067`, which makes this the clearest current owner bridge from one freshly allocated `0x006ada90` record into the site-linked chain later scanned by `placed_structure_query_candidate_directional_route_overlay_summary` at `0x0047e690` and `structure_candidate_query_route_style_or_local_availability_metric` at `0x0041e650`.","objdump + caller xrefs + chain-layout inspection + route-link-correlation"
0x00467df0,183,placed_structure_route_link_detach_current_owner_chain,map,thiscall,inferred,objdump + caller xrefs + chain-layout inspection,3,"Detaches one `0x006ada90` route-link record from whichever owner chain currently anchors it. The helper first checks route-link field `+0x08`; when nonzero it treats that field as one route-node-like owner id in collection `0x006cfcbc` and unlinks the record through owner field `+0x04` plus route-node link slot `+0x29`. Otherwise it falls back to the placed-structure owner path, using route-link field `+0x0a` as one site id in collection `0x0062b26c`, optionally applying the same class-indexed signed contribution rollback through `0x0040fa50` and `0x0042b310` when flag byte `+0x12` keeps bit `0x2` set, and then unlinking through `[site+0x272]`. Current grounded callers are the site-owner attach path at `0x00467eb0`, the route-node attach path at `0x00467f20`, and the route-link destructor path at `0x004680b0`, so this now looks like the shared detach helper beneath all owner-chain rewrites for the route-link family.","objdump + caller xrefs + chain-layout inspection + owner-slot correlation"
0x00467c30,443,placed_structure_route_link_recompute_endpoint_pair_state,map,thiscall,inferred,objdump + caller xrefs + endpoint-pair inspection,3,"Recomputes the route-link state byte at `+0x12` from the active site-endpoint pair and updates the linked site contribution when that state flips. The helper only runs on the site-owned branch where route-link field `+0x08` is zero; it resolves the two endpoint site ids from fields `+0x0a` and `+0x0e` through collection `0x0062b26c`, clears the prior bit-`0x2` state, then compares the two endpoint-side route-entry chains through `0x00455f60`, `0x0047de00`, `0x0040c990`, and `0x0047f2d0` until it finds a compatible shared peer. On the first match it restores bit `0x2` in the state byte. If the boolean substate derived from bit `0x1` changes across the recomputation, the helper applies one signed class-indexed contribution through candidate class byte `+0x10`, the class-weight table at `0x0062ba8c+0x8e`, and `0x0042b310` against the first endpoint owner. Current grounded callers are the site-owner attach path `0x00467eb0`, the route-link rebuild sweep around `0x004682e6`, and the route-link allocator path at `0x0046809b`, so this now looks like the endpoint-pair state reconciler beneath the route-link family rather than a generic chain walk.","objdump + caller xrefs + endpoint-pair inspection + shared-peer correlation"
0x00467f20,45,placed_structure_route_link_attach_route_node_owner,map,thiscall,inferred,objdump + caller xrefs + chain-layout inspection,3,"Attaches one `0x006ada90` route-link record onto the owner chain of one route-node-like record in collection `0x006cfcbc`. The helper first detaches the current record through `0x00467df0`, then stages the caller-supplied route-node id into route-link field `+0x08` and links the route-link through owner field `+0x04` plus route-node link slot `+0x29`. Current grounded caller is the route-node-side rewrite path at `0x004680e0`, which keeps this as the route-node owner companion to `placed_structure_route_link_attach_site_owner` rather than another site-chain helper.","objdump + caller xrefs + chain-layout inspection + route-node-owner correlation"
0x00467f50,352,placed_structure_route_link_allocate_site_pair_for_candidate_class,map,cdecl,inferred,objdump + caller xrefs + stack-layout inspection + class-counter correlation,3,"Allocates and seeds one new `0x006ada90` route-link record for a caller-supplied placed-structure pair and candidate class. The helper builds one `0x19`-byte local template whose current grounded creation-side writes seed route-link fields `+0x0c` and `+0x0e` from the two input site ids, class byte `+0x10` from the supplied candidate-class argument, and one masked initial state template from the class side table at `0x005f2adc[class]`. It then allocates the live record from the route-link collection, attaches it to the first site through `placed_structure_route_link_attach_site_owner` `0x00467eb0`, increments the grouped class counters at `[class_record+0x5a]` and `[class_record+0x5e]` through the candidate-class table at `0x0062ba8c+0x8e`, and finally re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`. Current direct creation-side caller is `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0`, while grounded internal calls land at `0x00468067` and `0x0046809b`; this is therefore the strongest current owner for creation-side site-pair seeding in the route-link family.","objdump + caller xrefs + stack-layout inspection + class-counter correlation + route-link-collection correlation"
0x004680b0,96,placed_structure_route_link_release_and_detach,map,thiscall,inferred,objdump + caller xrefs + class-counter correlation,3,"Releases one live `0x006ada90` route-link record's class-side counters and then detaches it from its current owner chain. The helper resolves the candidate-class record from route-link byte `+0x10` through `0x0062ba8c+0x8e`, subtracts the fixed creation-side increment from `[class_record+0x5a]`, then chooses one of the two trailing accumulator slots `[class_record+0x62]` or `[class_record+0x66]` by testing state byte `+0x12 & 0x1`. After that class-side rollback it tails into `placed_structure_route_link_detach_current_owner_chain` `0x00467df0`. Current grounded caller is the route-link collection sweep around `0x004681ae`, which keeps this as the clearest release-side companion to `placed_structure_route_link_allocate_site_pair_for_candidate_class` rather than another attach helper.","objdump + caller xrefs + class-counter correlation + detach-tail correlation"
0x00468110,39,placed_structure_route_link_collection_construct,map,thiscall,inferred,objdump + world-bringup correlation + collection-layout inspection,3,"Constructs the world-side route-link collection later published at `0x006ada90`. The helper seeds the collection vtable at `0x005ce130`, then initializes one indexed collection through `0x00518570` with grounded parameters `(record_size=0x19, initial_slots=0x64, growth=0x64, id_base=1)`. Current grounded caller is the world bring-up path at `0x004488a3`, where the resulting manager is stored into `0x006ada90` beside the placed-structure and candidate collections. This is the strongest current owner name for the record family later scanned by the route-style overlay and availability helpers.","objdump + world-bringup correlation + collection-layout inspection + manager-publication correlation"
0x00468140,18,placed_structure_route_link_collection_destroy,map,thiscall,inferred,objdump + world-shutdown correlation + collection-layout inspection,3,"Destroys the world-side route-link collection rooted at `0x006ada90`. The helper restores the same collection vtable at `0x005ce130`, releases the indexed-collection payload through `0x00518600`, and then tails into the common collection teardown at `0x00518bd0`. Current grounded callers are the global world-shutdown path at `0x0044931d` and the route-link collection sweep at `0x004681ae`, which keep this as the clear destructor companion to `placed_structure_route_link_collection_construct`.","objdump + world-shutdown correlation + collection-layout inspection + manager-publication correlation"
0x004681f0,100,placed_structure_route_link_collection_remove_links_touching_site_id,map,thiscall,inferred,objdump + caller xrefs + field-match inspection,3,"Collection-wide cleanup sweep over `0x006ada90` that removes every route-link record whose grounded site-reference triple matches one caller-supplied placed-structure id. The helper walks the live route-link collection and deletes any record whose `u16` fields at `+0x0a`, `+0x0c`, or `+0x0e` equal the requested id, reusing the collection erase vfunc for each match. Current grounded callers include the placed-structure teardown path at `0x0040e23b`, where the supplied id comes from `[site+0x2a4]`, so this now looks like the site-side cleanup companion for the route-link family rather than a generic collection filter.","objdump + caller xrefs + field-match inspection + site-cleanup correlation"
0x00468260,84,placed_structure_route_link_collection_remove_links_by_route_node_id,map,thiscall,inferred,objdump + caller xrefs + field-match inspection,3,"Collection-wide cleanup sweep over `0x006ada90` that removes every route-link record whose route-node owner field at `+0x08` matches one caller-supplied id. The helper walks the live route-link collection, compares each record's `u16` field `+0x08` against the requested route-node id, and erases matching records through the same collection vfunc used by the broader cleanup paths. Current grounded caller is the neighboring runtime teardown at `0x004acf03`, which keeps this as the route-node-side cleanup companion to `placed_structure_route_link_collection_remove_links_touching_site_id` rather than another site sweep.","objdump + caller xrefs + field-match inspection + route-node-cleanup correlation"
0x004682c0,58,placed_structure_route_link_collection_recompute_all_endpoint_pair_state,map,thiscall,inferred,objdump + caller inspection + collection-iteration inspection,3,"Collection-wide recompute sweep over the live `0x006ada90` route-link family. The helper iterates every live route-link id through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, then re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30` on each resolved record. This is the clean whole-collection state refresh companion to the per-record recompute helper rather than another allocator or cleanup path.","objdump + caller inspection + collection-iteration inspection + recompute-helper correlation"
0x00468300,235,placed_structure_route_link_rebuild_route_style_grid_counters_and_endpoint_state,map,thiscall,inferred,objdump + caller inspection + world-grid correlation + collection-iteration inspection,3,"Higher-level rebuild pass above the route-link family that resets the route-style world-grid counters and then recomputes live endpoint state across `0x006ada90`. The helper first reads three candidate-class ids from the structure-candidate side table at `0x0062ba8c+0x88/+0x8a/+0x8c`, walks the active world-grid tables rooted at `[0x0062c120+0x2129]`, and clears the aligned per-cell dword lanes at offset `+0x103` for those three classes. It then iterates every live route-link record in `0x006ada90`, clears state bit `0x2` in each record's flag byte at `+0x12`, and re-enters `placed_structure_route_link_recompute_endpoint_pair_state` `0x00467c30`. Current grounded callers include the recurring simulation-maintenance branch at `0x0040a575`, the world bring-up side near `0x00444b2f`, and one later world-side update path at `0x00481157`, which makes this the clearest current owner of the full-family route-style counter-and-state rebuild rather than just another collection walk.","objdump + caller inspection + world-grid correlation + collection-iteration inspection + route-style-class correlation"
0x0041e2b0,589,structure_candidate_rebuild_local_service_metrics,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Setup-side local-metrics rebuild for one live structure candidate after it has passed `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. The helper clears the metric bands at `[this+0x6a]`, `[+0x6e]`, `[+0x72]`, `[+0x76]`, and `[+0x7a]`, then samples repeated world-grid slices off the active world root at `0x0062c120` through `0x0042c960` and the per-cell tables rooted at `[world+0x2129]`. It accumulates one broad local magnitude at `[this+0x6a]`, folds two optional positive channels into `[this+0x6e]` and `[this+0x72]`, and finally normalizes and scales the trailing summary pair `[this+0x76]` and `[this+0x7a]` with fixed constants. Current grounded caller is `world_setup_building_collection_phase` at `0x0041ea50`, so this still looks like a setup-time local service or demand scorer rather than the recurring owner of the whole cargo-economy lane, but it is now one clear downstream consumer of the same `[candidate+0x56]` live-availability gate.","objdump + caller xrefs + callsite inspection + world-grid correlation"
0x0042db20,1040,scenario_event_refresh_runtime_record_from_packed_state,scenario,thiscall,inferred,objdump + caller inspection + local disassembly + shell-event-window correlation,2,"Heavy per-event runtime materializer beneath the live event collection at `0x0062be18`. The helper reads one packed event definition from the caller-supplied state or stream object, conditionally clears and repopulates several fixed text bands on the destination event record at offsets such as `+0x0e0`, `+0x401`, `+0x4ca`, `+0x593`, `+0x65c`, and `+0x725`, then rebuilds two event-runtime row families from caller-supplied counts and packed row payloads. Current shell-side xrefs now tighten that split. The first family allocates `0x1e`-byte rows, fills scalar and byte fields from the packed source, conditionally extends the row on later-format branches, remaps bounded id ranges through the live structure-candidate collection `0x0062ba8c`, and links the resulting rows through one standalone event-side list anchor; the adjacent helper cluster `0x0042df30/0x0042df70/0x0042dfb0/0x0042dff0` is only consumed by `EventConditions.win`, so this first family now reads as the runtime condition-row list. The second family repeats the same materialization pattern with `0x28`-byte rows across four grouped slots on the destination event record, applying version-gated field extension and bounded remap logic against the locomotive collection `0x006ada84`, the live structure-candidate collection `0x0062ba8c`, and the global candidate pool `0x0062b268` before linking each rebuilt row into one of four grouped list anchors; the generic deep-copy helper `0x0042e050` now clones those same grouped lists during event duplication, so this second family still reads as the grouped event-effect row side rather than another condition list. Current grounded caller is the collection-wide wrapper `0x00433130`, so this is now the safest current read for one live event's runtime-record refresh from packed scenario-state data rather than a generic collection helper.","objdump + caller inspection + local disassembly + event-record materialization correlation + candidate-and-locomotive-remap correlation + shell-event-window correlation"
0x0042d700,59,scenario_event_query_standalone_condition_row_list_class_and_modifier_flags,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + local disassembly,2,"Aggregates the class and modifier bits implied by one live event's standalone `0x1e`-row condition list. The helper first short-circuits to literal `0x7f` when event byte `[event+0x82b]` is set, then otherwise walks the list rooted at `[event+0x00]`, OR-ing the static row-class byte from `0x005f3e04 + id*0x81` for ordinary nonnegative row ids and using the negative-id fallback branch only to preserve special marker value `0x7f`. Current grounded callers are the condition-window summary refreshes `0x004d9970` and the broader control refresh `0x004da0f0`, so this is the safest current read for the standalone condition-list class or modifier aggregate rather than a generic linked-list scan.","objdump + EventConditions.win refresh correlation + local disassembly + condition-row-class-table correlation"
0x0042d740,87,scenario_event_query_grouped_effect_row_list_type_flags,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + local disassembly,2,"Aggregates one grouped effect-row type bitfield for a live event. The caller supplies the grouped list ordinal on the stack, and the helper walks the selected grouped anchor at `[event + group*4 + 0x04]`, OR-ing one descriptor byte from `0x006103fd + opcode*0x6e` across the linked `0x28`-row family. One caller-controlled boolean also enables a narrower normalization path that remaps a small special opcode subset to shared bit `0x08` before the OR step. Current grounded callers are the conditions-window refresh family `0x004d9d10` and `0x004da0f0`, plus one world-side branch at `0x00431120`, so this is the safest current read for grouped effect-row type flags rather than a standalone condition helper.","objdump + EventConditions.win refresh correlation + local disassembly + grouped-effect-descriptor correlation"
0x0042df30,63,scenario_event_condition_row_list_has_class_bit0_or_flag7f9_fallback,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + static-bit-table inspection,2,"Tiny predicate over the standalone `0x1e`-row event-condition list rebuilt by `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20`. The helper walks the linked list rooted at the caller-supplied event record, tests each nonnegative row id against class-bit `0x01` in the static per-condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to event-record byte `[event+0x7f9]`. Current grounded callers are the `EventConditions.win` refresh path at `0x004da19a` and `0x004da23c`, so this now reads as the class-bit-0 condition-summary gate rather than a generic list scan.","objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation"
0x0042df70,63,scenario_event_condition_row_list_has_class_bit1_or_flag7fa_fallback,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + static-bit-table inspection,2,"Companion predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as `0x0042df30`, tests each nonnegative row id against class-bit `0x02` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to event-record byte `[event+0x7fa]`. Current grounded caller is the `EventConditions.win` refresh path at `0x004da1de`, so this now reads as the class-bit-1 condition-summary gate rather than another anonymous list helper.","objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation"
0x0042dfb0,62,scenario_event_condition_row_list_has_class_bit2_or_type63_fallback,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + static-bit-table inspection,2,"Companion predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as `0x0042df30`, tests each nonnegative row id against class-bit `0x04` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to the event-record dword check `[event+0x7f0] == 0x63`. Current grounded caller is the `EventConditions.win` refresh path at `0x004da2be`, so this now reads as the class-bit-2 condition-summary gate rather than another generic scan.","objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-type correlation"
0x0042dff0,82,scenario_event_condition_row_list_has_any_class_bit012_or_special_fallback,scenario,thiscall,inferred,objdump + EventConditions.win refresh correlation + static-bit-table inspection,2,"Broad predicate over the standalone `0x1e`-row event-condition list. The helper walks the same linked list as the smaller `0x0042df30/0x0042df70/0x0042dfb0` family, tests each nonnegative row id against any of class bits `0x01|0x02|0x04` in the static condition table at `0x005f3e04 + id*0x81`, and returns true on the first match. Rows with id `-1` instead fall back to any of the three special event-record checks `[event+0x7f9]`, `[event+0x7fa]`, or `[event+0x7f0] == 0x63`. Current grounded caller is the early `EventConditions.win` refresh gate at `0x004da17d`, so this now reads as the broad condition-summary eligibility probe rather than a generic linked-list walk.","objdump + EventConditions.win refresh correlation + static-bit-table inspection + fallback-flag correlation"
0x0042e050,603,scenario_event_clone_runtime_record_deep_copy,scenario,cdecl,inferred,objdump + caller xrefs + local disassembly + shell-event-window correlation,2,"Deep-copy helper for one already-materialized live event runtime record. The helper copies the six fixed text bands at destination offsets `+0x0e0`, `+0x401`, `+0x4ca`, `+0x593`, `+0x65c`, and `+0x725`, mirrors the compact event metadata band at `+0x7ee..+0x80e`, then deep-copies the standalone `0x1e`-row linked list and the four grouped `0x28`-row linked lists from one live event-runtime record into the caller-supplied destination record. Current grounded caller is `shell_event_conditions_window_append_blank_or_clone_selected_event_via_name_modal` `0x004db8b0`, where it clones the currently selected live event into a newly created event record before selector refresh. This is therefore the safest current owner for deep-copy of an already-materialized event runtime record rather than another packed-state loader or an effects-only staging helper.","objdump + caller xrefs + local disassembly + shell-event-window correlation + deep-copy correlation"
0x0042c1b0,886,placed_structure_redistribute_local_service_pressure_from_neighbors,map,thiscall,inferred,objdump + caller xrefs + neighborhood sweep inspection,3,"Neighbor-aware local-service post-pass for one placed-structure or site record. The helper first builds a bounded set of nearby site references by scanning offset patterns from `0x00624b28` and `0x00624b48` against the world-grid tables rooted at `[0x0062c120+0x2129]`, keeping only neighbors whose state byte at `+0x0e6` is compatible with the current site and recording per-neighbor weights derived from the local word tables near `[site+0x00]` and `[site+0x0f3]`. It then walks the live candidate collection and, for each live non-remapped candidate, chooses the strongest positive neighbor deficit after scaling through the candidate-side weight at `[candidate+0x52]`; when a positive deficit remains it commits the redistribution through `0x0042bf80`. Current grounded caller is the composite local refresh `0x0042d580`, so this looks like the neighboring-site redistribution pass beneath the local service-score bundle rather than an independent outer loop.","objdump + caller xrefs + neighborhood sweep inspection + candidate-weight correlation"
0x0041eac0,794,structure_candidate_collection_refresh_cargo_economy_filter_flags,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + rdata strings,3,"Collection-wide refresh of one cargo-economy-sensitive candidate flag in the live structure collection at `0x0062ba8c`. The helper first walks the global candidate pool at `0x0062b268`, filters category-`2` entries through the paired availability bytes `[candidate+0xba]` and `[candidate+0xbb]` plus the recipe-runtime latch `[candidate+0x7ac]`, and builds one temporary per-cargo mask keyed by cargo names such as `Clothing`, `Cheese`, `Meat`, `Ammunition`, `Weapons`, `Diesel`, `Troops`, and `Passengers`; one special-case branch also uses structure labels such as `Barracks` and `Recycling Plant` while consulting the region collection at `0x0062bae0`. It then iterates the live structure collection itself, combines that temporary cargo mask with the candidate-local bytes `[entry+0x47]`, `[entry+0x48]`, and `[entry+0x49]`, the runtime cargo-economy latch at `[0x006cec74+0x25f]`, and one neighboring mode gate at `[0x006cec78+0x4afb]`, and writes the resulting enabled-or-filtered state into `[entry+0x56]` before re-entering `0x0041e970` to rebuild the derived visible counts. Current grounded callers are the collection-side setup path around `0x0041f4cb` and the runtime toggle branch at `0x0046577c`, where the same `0x006cec74+0x25f` bit is flipped directly; that makes this the strongest current bridge from the editor's `Disable Cargo Economy` rule into live structure-candidate filtering rather than a purely editor-side helper.","objdump + caller xrefs + callsite inspection + rdata strings + special-condition correlation"
0x00421b60,180,world_region_collection_seed_default_regions,map,thiscall,inferred,objdump + strings + callsite inspection,4,"Seeds the default numbered region family on the manager collection at `0x0062bae0`. The helper pumps shell progress through `0x004834e0`, repeatedly creates collection entries through `0x00421660`, formats their labels from localized string id `2908` `Region %1` plus the `%02d` pattern at `0x005c9aec`, marks the created records live through `[entry+0x23e]`, and then finalizes the region set through `0x00421730` against the active world root at `0x0062c120`. Current grounded callsites are the post-load generation pipeline at `0x004384d0` and the broader world-build path around `0x004476ec`, so this now looks like region-set seeding rather than generic player or company setup.","objdump + RT3.lng strings + caller xrefs + callsite inspection"
0x00421c20,187,world_region_collection_run_building_population_pass,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Region-owned building-population dispatcher over the collection at `0x0062bae0`. For each region entry it forwards one caller-selected scale and mode flag into the lower worker at `0x004235c0`, pumps shell progress through `0x004834e0` between entries, and guards the sweep with the region-collection reentrancy counter at `[this+0x88]`. The same setup lane now shows one direct shell-state coupling too: constructor-time helpers in the same region family copy shell-state gate `[0x006cec74+0x174]` into local region-side state, and the post-load pipeline only reaches this dispatcher behind that same gate after posting localized id `320` `Setting Up Buildings...`. The per-region worker consults the region subcollection at `[region+0x37f]`, the global candidate pool at `0x0062b268`, the placed-instance registry at `0x0062b26c`, and one world-side notification or state owner at `0x0062b2fc`, which makes this look like a building spawn or allocation pass rather than a generic region refresh. Grounded callers include the post-load `Setting Up Buildings...` branch in world_run_post_load_generation_pipeline with arguments `(1.0, 1)` and a slower recurring simulation-side caller at `0x0040a804/0x0040a826` with scale `0.08333334` and mode `0`, which suggests the same lower subsystem also has a later maintenance cadence after initial setup.","objdump + caller xrefs + callsite inspection"
0x0041f9b0,125,world_region_count_structure_profiles_before_year_for_category,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Counts region-subcollection structure profiles whose backing candidate resolves through `0x00412b70`, passes the availability gate at `0x0041f998`, matches one caller-selected category byte, and has threshold year `[profile+0x26]` less than or equal to the caller-supplied year. Current grounded callers include the region stats path at `0x004cbd41`, where category `2` feeds the localized `Industry Weightings` report, and the deeper per-region worker at `0x004235c0`, where the same count bounds demand for the weighted category-2 profile family.",objdump + caller xrefs + callsite inspection + RT3.lng strings
0x0041fa30,133,world_region_find_named_structure_profile_weight,map,thiscall,inferred,objdump + strings + caller xrefs,3,"Looks up one named structure profile in the current region subcollection `[region+0x37f]`. The helper linearly compares the caller-supplied text against each profile label and returns the float-like weight at `[profile+0x1e]` for the first exact match, otherwise `0.0`. The same region-subcollection string block is now partially grounded from nearby `.rdata` as labels such as `House`, `Hotel`, `Iron Mine`, `Furniture Factory`, `Fertilizer Factory`, and `farm`. Current grounded callers sit in world-side UI or telemetry branches around `0x004cbb74`, `0x004cc054`, and `0x004ccc54`.","objdump + caller xrefs + rdata strings"
0x0041fac0,60,world_region_read_structure_profile_label_and_weight_by_index,map,thiscall,inferred,objdump + caller xrefs + strings,4,"Reads one 1-based structure-profile entry from the current region subcollection `[region+0x37f]`. It copies the profile label string into the caller buffer and writes the float-like weight at `[profile+0x1e]` into the caller-provided out-slot. This is the label/value helper used beneath the region structure-demand worker and the adjacent UI or telemetry callers. The grounded profile-name block around `0x005c9100` now includes labels such as `House`, `Hotel`, `Iron Mine`, `Furniture Factory`, and `Fertilizer Factory`.","objdump + caller xrefs + rdata strings"
0x00422900,352,world_region_accumulate_structure_category_totals,map,thiscall,inferred,objdump + callsite inspection,3,"Aggregates the current structure-category totals for one region entry. The helper walks the placed-instance chain rooted at `[region+0x383]` through the global registry `0x0062b26c`, resolves each live record's category byte through the vtable `+0x80` object view, and returns both counts and accumulated weight-like totals across four categories via the caller-provided out-pointers. Current grounded caller is world_region_balance_structure_demand_and_place_candidates at `0x004235c0`, where the outputs feed the later demand-balancing logic for the region-owned building-population pass.","objdump + callsite inspection"
0x00422be0,768,world_region_count_placed_structures_for_category,map,thiscall,inferred,objdump + callsite inspection,3,"Counts already-placed structures in one requested category for the current region entry. It walks the placed-instance chain rooted at `[region+0x383]` through `0x0062b26c`, filters live records by the requested category byte, and applies several additional placement gates including one cap on `[record+0x276]`, one disable byte at `[record+0x390]`, and special handling for category `2`. Current grounded caller is world_region_balance_structure_demand_and_place_candidates at `0x004235c0`, where the result is subtracted from the region's computed category demand before more candidates are chosen.","objdump + callsite inspection"
0x00422ee0,884,world_region_try_place_candidate_structure,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Attempts one candidate-structure placement for the current region entry and requested category. It derives one region-ranking bucket from `[region+0x256]` and `[region+0x25e]`, uses the region count at `0x0062bae0` to index the weighting table at `0x005ee1e0`, chooses one trial budget of `10` or `15` depending on the setup latch at `[0x006cec78+0x46c3c]`, and then repeatedly evaluates candidates from the global site pool `0x0062b268`. The chooser matches candidate names and scores against region subcollection entries, rejects over-cap or already-satisfied sites through the placed-instance registry `0x0062b26c`, and when successful either dispatches one direct placement through `0x004134d0` or routes the selected site into the shell-facing side path through `0x004337c0`. Current grounded callers are the region building worker at `0x004235c0` and the separate world-side branch at `0x004d1871`, so this now looks like the core candidate-placement helper beneath the region-owned building-population family.","objdump + caller xrefs + callsite inspection"
0x004235c0,1887,world_region_balance_structure_demand_and_place_candidates,map,thiscall,inferred,objdump + callsite inspection,4,"Core per-region worker beneath world_region_collection_run_building_population_pass. It first checks the broader shell-state master flag at `[0x006cec74+0x68]` and diverts into a separate alternate path when that flag is nonzero. The same flag now aligns with the editor-map `.gmp` family in the shell file coordinators, so the ordinary demand-balancing and placement flow currently looks grounded for the non-editor world mode while the alternate branch likely belongs to the editor-map side. In that ordinary path it aggregates existing category counts and weights through world_region_accumulate_structure_category_totals at `0x00422900`, samples the current region subcollection size through `0x0041f6a0`, and computes target demand for three structure categories by comparing those totals against caller-provided scale and mode inputs plus several randomized clamps. The three grounded category families are now narrower: category `0` uses the fixed fallback label `House` from `0x005c9114`; category `2` is the year-gated weighted region-profile family read through world_region_read_structure_profile_label_and_weight_by_index at `0x0041fac0` and bounded by world_region_count_structure_profiles_before_year_for_category at `0x0041f9b0`, which also feeds the localized `Industry Weightings` report in the region stats UI; and category `3` reaches world_region_pick_commercial_profile_label_by_region_rank at `0x00412ca0`, whose fallback token is `Commercial` but whose aligned region-stats label slot is localized as `City Support`. After subtracting already-placed coverage through world_region_count_placed_structures_for_category at `0x00422be0`, the worker tries placements through world_region_try_place_candidate_structure at `0x00422ee0` until demand is exhausted or the attempt budget runs out. This makes the worker a region structure-demand balancing and placement pass over houses, weighted region profiles, and the broader city-support branch rather than a generic setup loop.","objdump + callsite inspection + region stats disassembly + RT3.lng strings + rdata strings + file-flow correlation"
0x00423d70,176,company_repay_bond_slot_and_compact_debt_table,simulation,thiscall,inferred,objdump + caller inspection,4,"Repays and removes one indexed bond entry from the live company debt table. The helper validates the requested slot against the current bond count at `[this+0x5b]`, compacts the remaining 12-byte entries rooted at `[this+0x5f]`, and then recomputes the dependent finance accumulators through `0x0042a040` and `0x0042a080`. Current grounded shell caller is the repay-bond branch beneath `CompanyDetail.win`, which makes this the company-side debt-table mutator rather than a territory-access helper.","objdump + caller inspection + finance-field correlation"
0x00423ec0,33,company_adjust_available_track_laying_capacity_with_floor_zero,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,2,"Small saturating company-side counter adjuster over `[this+0x7680]`. When that field is not `-1`, the helper adds the caller-supplied delta, clamps the result at zero on underflow, and writes it back. The surrounding lifecycle is tighter now too: nearby company initialization around `0x004285c0` seeds `[this+0x7680]` to `50` when scenario byte `[0x006cec78+0x4aaf]` is enabled and to sentinel `-1` otherwise, while the companion getter `0x004240a0` returns either the live counter or fixed fallback `29999`. Current language-table correlation now gives that scenario byte a stronger player-facing read: it is the live gate behind RT3.lng `2576` `Company track laying is limited...` and event variable label `2358` `Company Track Pieces Buildable`. Current grounded caller is `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`, where company-bound endpoint synthesis passes either `-1` or `-2` through this helper before the new route-entry payload is committed. That makes this the strongest current match for available track-laying capacity consumption rather than a generic finance counter.","objdump + caller xrefs + callsite inspection + route-build-capacity correlation + capacity-lifecycle correlation + RT3.lng correlation"
0x004240a0,28,company_query_available_track_laying_capacity_or_unlimited,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,2,"Returns the current company's available track-laying capacity. When scenario byte `[0x006cec78+0x4aaf]` is enabled, the helper returns the live company counter at `[this+0x7680]`; otherwise it returns fixed fallback `29999`, which currently reads as an effectively-unlimited path. Current language-table correlation now ties that scenario byte to RT3.lng `2576` `Company track laying is limited...` and event variable label `2358` `Company Track Pieces Buildable`, so this helper is best read as the live getter beneath that scenario rule rather than only as an internal company counter accessor. Current grounded callers include `placed_structure_validate_projected_candidate_placement` `0x004197e0`, `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`, and `route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380`, where the returned value is used as the company-side track-laying-capacity gate for route synthesis and station-attachment placement.","objdump + caller xrefs + callsite inspection + track-laying-capacity correlation + RT3.lng correlation"
0x00424010,29,company_has_territory_access_rights,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns whether the current company has access rights in one requested territory id. The helper indexes the per-territory access byte at `[this + territory*0x38d + 0x1d9f]` and returns `1` when that byte is nonzero. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the territory-access purchase flow at `0x004c5fc9`.","objdump + caller inspection + territory-access table correlation"
0x00423e40,112,company_compute_weighted_average_bond_interest_rate,simulation,thiscall,inferred,objdump + caller xrefs + debt-record inspection,4,"Computes the company's current weighted average bond interest rate from the live debt table rooted at `[this+0x5f]`. The helper rejects inactive companies and companies with no live bond slots, then walks each 12-byte debt record, accumulates total principal from `[slot+0x00]`, accumulates principal-times-rate from `[slot+0x08]`, and returns the weighted quotient `sum(principal*rate) / sum(principal)`. Current grounded callers are the bond-quote wrapper at `0x00427540`, the CompanyDetail capital summary panel at `0x004c23a0`, and the city-connection bonus ladder at `0x00425320`, so this is the shared average coupon or interest-rate helper rather than a generic finance multiplier.","objdump + caller xrefs + debt-record inspection + finance-summary correlation + bond-quote correlation"
0x00423eb0,6,company_query_cached_share_price_scalar,simulation,thiscall,inferred,objdump + caller xrefs + per-share panel correlation,3,"Tiny cached-float accessor that returns the company field at `[this+0x0d7b]`. Current grounded shell callers are the CompanyDetail per-share panel at `0x004c2720` and later train-side consumer paths, where this cached scalar is used in the same lane as the `Share Price` readout. The write-side owner is now tighter too: `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` optionally snapshots its final float into the same field when the caller requests a cache refresh, so this remains the narrow cached share-price accessor rather than an arbitrary finance-field read.","objdump + caller xrefs + per-share panel correlation + cached-float-field correlation + stock-price-cache-write correlation"
0x00424030,22,company_set_territory_access_rights_byte,simulation,thiscall,inferred,objdump + caller inspection,4,"Stores one territory-access byte for the requested company and territory id. The helper writes the supplied byte value into the same per-territory access table rooted at `[this + territory*0x38d + 0x1d9f]`. Current grounded shell caller is the immediate commit path inside `shell_company_detail_buy_territory_access_rights_flow` at `0x004c5fc9`, where the purchase path writes value `1` after the access-rights dialog is accepted.","objdump + caller inspection + territory-access table correlation"
0x004241e0,23,company_sum_control_transfer_offer_policy_fields_raw,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the raw sum of two company-side floating fields at `[this+0x124f]` and `[this+0x12a7]`. Current grounded callers are the merger-offer builder around `0x004eb5a9` and adjacent control-transfer offer-side stat readers, where the returned value is paired with surrounding formatter setup for mode `0x0b` but is not itself passed an issue argument. This now looks like a narrow raw control-transfer offer policy total rather than a generic finance calculation.","objdump + caller inspection + merger-offer dialog correlation"
0x00424200,37,company_sum_control_transfer_offer_policy_fields_scaled_tenths,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the same `[this+0x124f] + [this+0x12a7]` company-side policy total as `company_sum_control_transfer_offer_policy_fields_raw`, but scaled by the `0.1` constant at `0x005c9b50`. Current grounded callers are the merger and chairmanship-takeover offer builders at `0x004eb588` and `0x0050c7cb`, where the scaled result is immediately paired with surrounding formatter setup for mode `0x0b`. The helper itself does not consume an issue id, so this now reads as the scaled control-transfer offer policy total rather than a broader vote-weight function.","objdump + caller inspection + takeover and merger dialog correlation"
0x004248d0,759,company_compute_cached_recent_per_share_performance_subscore,simulation,thiscall,inferred,objdump + caller inspection,3,"Builds one cached company-side per-share performance subscore from recent yearly stock-data history and current scenario difficulty. When the company is inactive via `[this+0x3f]` it returns the fixed negative fallback at `0x005c8598`; otherwise it reuses the cache in `[this+0x0cfb]` and `[this+0x0cff]` when the current year at `[0x006cec78+0x15]` matches. On a cold pass it first walks up to five recent years above founding year `[this+0x157]`, weighting yearly `Revenue Per Share` from slot `0x1e` and yearly `Earnings Per Share` from slot `0x1f` through `0x0042a5d0`. It then runs a second trend pass over `Dividend Per Share` slot `0x20`, rewarding surviving years where the sampled value does not fall below the previous year. The tail blends those weighted yearly lanes with current `Book Value Per Share` from slot `0x1d`, applies one difficulty-table scalar under `0x005f33b8`, applies a post-bankruptcy smoothing factor from the years since `[this+0x163]`, stores one bounded intermediate subscore into `[this+0x0d19]`, and finally caches the resulting float in `[this+0x0cff]` with the current year in `[this+0x0cfb]`. Current grounded caller is `company_compute_public_support_adjusted_share_price_scalar` at `0x00424fd0`, where this helper now reads as the recent per-share performance feeder rather than a generic governance-support history walker.","objdump + caller inspection + cache-field correlation + stock-data-family correlation + per-share-panel correlation"
0x00425a90,194,company_declare_bankruptcy_and_halve_bond_debt,simulation,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the grounded company bankruptcy commit path. The helper walks the live bond table rooted at `[this+0x5f]`, halves each outstanding principal, recomputes finance metrics through `0x0042a040` and `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, reduces the company value field at `[this+0x47]`, and stamps the current year into `[this+0x163]` as the localized bankruptcy-cooldown anchor. Current grounded shell caller is `shell_company_detail_bankruptcy_flow` on the `CompanyDetail.win` path.","objdump + RT3.lng strings + caller inspection + finance-field correlation"
0x004261b0,74,company_count_unassigned_shares_after_active_chairman_holdings,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the current company share pool at `[this+0x47]` minus the positive holdings found in each active chairman profile record under `0x006ceb9c`. The helper uses the company collection index from `[this+0x00]` to read per-profile holdings from `[profile + company_index*4 + 0x15d]`, sums only positive entries, and subtracts that total from the company share count. Current grounded callers are the takeover and merger vote resolvers, which stage the result into `0x006d1a04` and `0x006d1104` before the lower public-vote support formulas run.","objdump + caller inspection + takeover and merger vote correlation"
0x00426260,607,company_compute_board_approved_dividend_rate_ceiling,simulation,thiscall,inferred,objdump + caller inspection,4,"Computes one nonnegative per-share dividend ceiling for the selected company. The helper starts from the current support or governance lane `0x2329/0x0d`, normalizes that value by the current outstanding-share band at `[this+0x47]`, then scans a bounded recent-year window relative to the founding year `[this+0x157]` and current scenario year `[0x006cec78+0x0d]`, taking minima from the shareholder-facing slots `0x2b` and `0x2c`. In the early-company path it also folds in `[this+0x57]` and the previous-year slot `0x1c`, applies several scale constants, and clamps the result at zero before returning the final per-share ceiling. Current grounded shell caller is `shell_company_detail_handle_change_dividend_rate_dialog_message` at `0x004c5140`, where this is the direct board-approval limit behind localized id `991` when the player tries to raise the dividend too far.","objdump + caller inspection + dividend-ceiling correlation"
0x004273c0,132,company_repurchase_public_shares_and_reduce_capital,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Repurchases one caller-supplied quantity of public shares and reduces company capital accordingly. The helper converts the share count into one cash-side total through the current support-adjusted share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0` and fixed market-scale constants, posts the resulting negative amount into company stat slots `0x0c` and `0x0d` through `0x0042a080` and `0x0042a040`, and subtracts the same share count from the outstanding-share field `[this+0x47]`. Current grounded callers are the `CompanyDetail.win` stock-buyback flow at `0x004c46d0` and the annual finance-policy helper at `0x00401c50`, where it contributes the RT3.lng `2887` repurchase headline.","objdump + caller xrefs + callsite inspection + stock-buyback correlation + annual-finance correlation"
0x00427450,224,company_issue_public_shares_and_raise_capital,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Issues one caller-supplied quantity of public shares and increases company capital. When the optional pricing flag is clear, the helper derives one implied share-price scalar from `company_compute_public_support_adjusted_share_price_scalar` `0x00424fd0`, the current stock-valuation helper at `0x00425320`, and fixed underwriting constants; when the flag is set it reuses the caller-supplied scalar instead. It then posts the resulting proceeds into company stat slot `0x0c`, records the issued-share quantity in stat slot `0x0d`, optionally snapshots the prior year and tick into `[this+0x16b..0x177]`, and increases the outstanding-share field `[this+0x47]` by the issued quantity. Current grounded callers are the `CompanyDetail.win` stock-issue flow at `0x004c3f30` and the annual finance-policy helper at `0x00401c50`, where it contributes the debt-refinance-plus-borrowing and straight new-borrow capital side.","objdump + caller xrefs + callsite inspection + stock-issue correlation + annual-finance correlation"
0x00427540,76,company_compute_bond_interest_rate_quote,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Computes one company-specific bond interest-rate quote from the requested term and current support or credit state. When the company is active it combines the zero-argument value ladder from `0x00425320`, the current rating helper at `0x00424580`, and one term-dependent adjustment from the caller-supplied year span, then returns the resulting float rate; otherwise it falls back to `1.0`. Current grounded caller is `company_issue_bond_and_record_terms` `0x004275c0`, where this helper supplies the quoted rate when the caller does not already provide one.","objdump + caller xrefs + callsite inspection + bond-rate correlation"
0x004275c0,255,company_issue_bond_and_record_terms,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Issues one new bond and appends its term record to the live company debt table. The helper first rejects companies already at the `0x14` bond-slot cap, computes or accepts one quoted interest rate through `company_compute_bond_interest_rate_quote` `0x00427540`, posts the bond proceeds into company stat slot `0x0c`, posts the principal into stat slot `0x12`, posts the coupon rate into stat slot `0x0d`, and then writes one new three-dword bond record into the next 12-byte entry rooted at `[this+0x5f]`: principal, maturity year, and quoted rate. It increments the bond count at `[this+0x5b]` and returns success. Current grounded callers are the `CompanyDetail.win` bond-issue flow at `0x004c3890` and the annual finance-policy helper at `0x00401c50`, where it supplies both straight new borrowing and refinance-plus-borrow follow-ons.","objdump + caller xrefs + callsite inspection + bond-issue correlation + annual-finance correlation"
0x00426890,68,company_find_collection_index_by_company_id,simulation,thiscall,inferred,objdump + caller inspection,4,"Finds one live company collection index by comparing the requested company id against the first dword of each entry in the company manager at `0x0062be10`. The helper returns the zero-based index on a match or `-1` when no live company record matches. Current grounded callers are the takeover and merger vote resolvers, which use that index before reading profile-side per-company holdings from `0x006ceb9c`.","objdump + caller inspection + company collection correlation"
0x00426be0,53,company_can_purchase_territory_access_rights,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Returns whether the current company may purchase territory-access rights for one requested territory id. The helper first rejects territories where the company already has access through the byte table at `[this + territory*0x38d + 0x1d9f]`, then resolves the territory through `0x006cfc9c` and only returns `1` when the territory-side mode byte at `[territory+0x2d]` equals `1`. Current grounded callers are the `CompanyDetail.win` territory-access summary helper at `0x004c1b60` and the buy-rights flow at `0x004c5fc9`, where this is the direct gate between localized ids `947` and `948` plus the actionable `961` purchase prompt.","objdump + caller inspection + RT3.lng strings + territory-flag correlation"
0x00426d60,393,company_deactivate_and_clear_chairman_share_links,simulation,thiscall,inferred,objdump + caller inspection + collection-state correlation,4,"Runs the destructive selected-company clear path currently reached from `CompanyDetail.win`. The helper first rejects inactive companies through `[this+0x3f]`, then zeroes all active-chairman share holdings for this company across `0x006ceb9c`, clears the linked chairman backpointer `[company+0x3b]` and the profile-side owning-company field `[profile+0x1dd]`, clears the selected-company latch when the scenario currently points at this company, marks the company inactive by zeroing `[company+0x3f]`, and walks two live collections to drop or invalidate remaining references that still point back to this company. The tail then rebuilds one local name block from `[company+0x4]` and publishes the change through the scenario-state helper at `0x004360d0`. Current grounded shell caller is the `0x9493` section-0 control under `shell_company_detail_window_handle_message`, so current best meaning is a company deactivation or liquidation-style clear path rather than an ordinary governance vote helper.","objdump + caller inspection + collection-state correlation + CompanyDetail control correlation"
0x00426ef0,43,company_get_linked_chairman_profile_record,simulation,thiscall,inferred,objdump + caller inspection,4,"Resolves the linked chairman profile record for one company. The helper reads the linked chairman id from `[this+0x3b]`, validates it against the live profile collection at `0x006ceb9c`, and returns the resolved profile record through `0x00518140`; zero or invalid ids return null. Current grounded callers include the CompanyDetail section-0 overview formatter at `0x004e5cf0`, where this is the direct bridge from a selected company to the chairman profile used for ownership and governance text.","objdump + caller inspection + chairman-link correlation"
0x0042a0e0,77,company_query_highest_coupon_bond_slot_index,simulation,thiscall,inferred,objdump + caller inspection + debt-record layout correlation,3,"Returns the live bond-slot index with the highest coupon rate from the debt table rooted at `[this+0x5f]`. The helper walks the current bond count at `[this+0x5b]`, compares each slot's rate field at `[this+0x67 + slot*0xc]`, and returns the zero-based index of the strongest surviving slot or `-1` when no bond slots are live. Current grounded caller is the annual finance-policy helper at `0x00401c50`, where this picks the reference bond used by the build-`1.03+` stock-issue lane before it checks current cash against that slot's principal plus a small fixed buffer.","objdump + caller inspection + debt-record layout correlation + annual-finance correlation"
0x0042a040,55,company_add_delta_into_stat_series_and_current_slot,simulation,thiscall,inferred,objdump + caller xrefs + field-write correlation,3,"Adds one caller-supplied float delta into the company stat-family series lane selected by the requested slot id. The helper increments both the year-indexed series rooted at `[this+0x0d7f]` and the current aggregate lane rooted at `[this+0x1c47]`, but does not touch the broader cash-side shadow totals. Current grounded callers include bond repayment `0x00423d70`, bankruptcy `0x00425a90`, stock buyback `0x004273c0`, territory-access purchase `0x004c5fc9`, and several placement or world-service mutations, so this now reads as the shared company stat poster without the optional cash-side follow-on.","objdump + caller xrefs + field-write correlation + finance-mutator correlation"
0x0042a080,95,company_add_delta_into_stat_series_current_slot_and_optional_cash_totals,simulation,thiscall,inferred,objdump + caller xrefs + field-write correlation,3,"Adds one caller-supplied float delta into the selected company stat-family lane, exactly like `company_add_delta_into_stat_series_and_current_slot` `0x0042a040`, and optionally mirrors the same delta into the broader cash-side shadow totals when the third argument is nonzero. The shared stat writes still land in the year-indexed series rooted at `[this+0x0d7f]` and current aggregate lane `[this+0x1c47]`; the optional follow-on also increments the cash-pair totals at `[this+0x11f7]` and `[this+0x1caf]`. Current grounded callers include stock buyback `0x004273c0`, chairman-salary and dividend policy paths around `0x00427920`, linked world-service updates, and several company-side cash or capital mutators, so this is the stronger shared company stat poster when cash-side shadow totals must stay synchronized.","objdump + caller xrefs + field-write correlation + cash-pair correlation + finance-mutator correlation"
0x0042a2e0,645,company_read_control_transfer_metric_slot,simulation,thiscall,inferred,objdump + caller inspection,3,"Reads one derived company metric from the bounded slot family `0x13..0x2f` used by control-transfer, public-support, annual governance logic, report-history pages, and stock-data readouts. The dispatcher mixes direct company fields such as `[this+0x4b]`, `[this+0x53]`, `[this+0x323]`, `[this+0x327]`, `[this+0x333]`, `[this+0x33f]`, and the later counters near `[this+0x34b]` and `[this+0x14f]` with a few computed ratios and helper-backed terms. The first grounded slot `0x13` already resolves through `company_compute_public_support_adjusted_share_price_scalar` at `0x00424fd0`, which now reads as a broader investor-support and share-price lane rather than a vote-only term. Wider shell-side xrefs now tighten the stock-data subfamily too: slot `0x1c` is `Share Price`, slot `0x1d` is `Book Value Per Share`, slot `0x1e` is `Revenue Per Share`, slot `0x1f` is `Earnings Per Share`, slot `0x20` is `Dividend Per Share`, slot `0x21` now routes through `company_compute_five_year_weighted_shareholder_return` `0x004246b0` for `5 Year Weighted Return`, and the adjacent slot `0x23` is now best bounded as the hidden current or fallback shareholder-payout lane rooted at `[this+0x53]` that feeds that five-year return formula. The higher derived switch at `company_read_derived_financial_report_metric_slot` `0x00429c70` also now narrows the shared finance-family semantics reused beside this slot reader: `0x2b` is the net-profits-style derived lane, `0x2c` is the broader revenue aggregate, and raw slot `0x09` aligns with the Income Statement fuel-cost lane surfaced by tooltip `1309`; the adjacent special interest-help row uses a different metric id and `2815` rather than raw slot `0x09` itself. That keeps nearby annual finance, CompanyDetail, and ledger readouts consistent with shell labels such as `925` `Profits:`, `928` `Largest Shareholders`, `929` `Shares`, and `930` `Per Share Data`. This now looks like a generic company support-and-finance metric dispatcher rather than a merger-only issue reader.","objdump + caller inspection + metric-slot correlation + governance-string correlation + company-detail correlation + stock-data-label correlation + income-statement-row correlation + derived-report-metric correlation + share-price-scalar correlation + weighted-return correlation + shareholder-payout-lane correlation"
0x0042a5d0,131,company_read_year_or_control_transfer_metric_value,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,3,"Reads one company-side float from either a year-relative stat series or the local support-and-governance metric slot family. When the family argument is `0x2329` or one of the neighboring current-year offsets, the helper resolves one year-relative table entry from the series rooted at `[this+0x0d7f]`; when the request falls back to the bounded slot family it delegates to `company_read_control_transfer_metric_slot` at `0x0042a2e0`, and requests at `0x2b` or above then continue into `company_read_derived_financial_report_metric_slot` `0x00429c70`. The `0x2329` token is no longer treated as an issue id here: it is the stat-family selector paired with the localized company-stat label id `2329`, and current grounded callers use this wrapper beneath merger, takeover, bankruptcy, annual shareholder-revolt, creditor-liquidation, and other company-policy dialogs to fetch yearly or current support-side values. This makes the helper a generic company stat reader rather than an issue-specific vote formula.","objdump + caller inspection + RT3.lng strings + stat-family correlation + governance-string correlation + derived-report-metric correlation"
0x0042c690,311,placed_structure_rebuild_candidate_cargo_service_bitsets,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Rebuilds two per-cargo bitsets on one placed-structure or site record using the live structure-candidate collection at `0x0062ba8c`. The helper clears the bitsets rooted at `[this+0x0d8]` and `[this+0x0df]`, walks the linked placed-structure chain starting at `[this+0x0d6]` through `0x0062b26c`, selects only linked instances whose backing candidate resolves through vtable `+0x80` with category byte `2`, and then scans the live candidate collection for entries that pass `structure_candidate_is_enabled_for_current_year` at `0x0041e220`. For each passing candidate it queries the direct and scaled supply-side cargo channels through the wrappers at `0x00412960` and `0x004129a0`; positive direct supply sets bits in `[this+0x0df]`, while positive scaled supply on candidates with runtime cargo state at `[candidate+0x78c]` sets bits in `[this+0x0d8]`. Current grounded callers sit immediately above the sibling helper at `0x0042cdf0`, which makes this the strongest current steady-state consumer of the rebuilt editor cargo runtime tables rather than a pure setup path.","objdump + caller xrefs + callsite inspection + cargo-summary correlation"
0x0042c8f0,112,placed_structure_refresh_linked_candidate_flag4,map,thiscall,inferred,objdump + caller xrefs + linked-instance inspection,3,"Refreshes bit `0x4` in the placed-structure state byte at `[this+0x0e6]` from the currently linked placed-instance chain rooted at `[this+0x0d6]`. The helper walks linked instances through `0x0062b26c`, keeps only entries whose backing instance passes `0x0040c990 == 1`, resolves each surviving instance through vtable slot `+0x80`, and sets the local flag when any resolved candidate record has nonzero byte `[candidate+0xba]`; otherwise it clears that bit. Current grounded callers are the immediate wrapper `0x0042cdf0` plus the relink helpers at `0x0042c9a0` and `0x0042c9f0`, so this looks like the sibling state refresh that runs beside the cargo-service bitset rebuild even though the exact player-facing meaning of `[candidate+0xba]` is still open.","objdump + caller xrefs + linked-instance inspection + candidate-flag correlation"
0x0042cab0,117,placed_structure_accumulate_candidate_metric_or_emit_route_style_peer_link,map,thiscall,inferred,objdump + caller inspection + route-style remap inspection,3,"Small candidate-side projection helper used by the broader route-style rebuild lane. The helper starts by querying one integer local metric through `0x0042c960` for the caller-supplied candidate index, then resolves the matching structure-candidate record through `0x0062ba8c` and re-enters `0x0041e1f0` to stage one floating contribution. It next reads the candidate's route-style remap slot at `0x0062ba8c+0x9a`: when that slot is negative it adds the contribution directly into the local route-style grid lane at `[this+candidate*4+0x103]`; when the slot is nonnegative it instead re-enters `placed_structure_try_emit_best_route_style_peer_link_for_candidate_class` `0x0040fef0` with the remapped class id and the same floating contribution. Current grounded caller is the larger per-site route-style rebuild pass at `0x004101e0`, which makes this the clearest current branch where ordinary candidate metrics stay local but remapped route-style candidates become peer-link emission requests.","objdump + caller inspection + route-style remap inspection + peer-link emission correlation"
0x0042cb30,124,placed_structure_clamp_candidate_service_age_table,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Late clamp pass over the primary per-candidate word table rooted at `[this+0x00]`. When the site owns a nonzero route latch at `[this+0x0d4]` and `0x0042c880` signals the pass should run, the helper walks every live non-remapped candidate, queries one route-linked age or freshness value through `0x0042c110`, shifts that result into the local word-table scale, and replaces `[this+candidate*2]` with the smaller of the current value and the new clamp. Current grounded callers are the local bundle wrapper `0x0042d580` and the later world-grid sweep at `0x00450133`, so this now looks like the final recent-service clamp on the local candidate age table rather than another raw scoring helper.","objdump + caller xrefs + callsite inspection + route-age correlation"
0x0042cbb0,145,placed_structure_route_supports_candidate_local_service_mode,map,thiscall,inferred,objdump + caller xrefs + route-record inspection,3,"Boolean route-linked predicate for one candidate-local service branch. The helper walks the route or service record chain owned by the current site through `[this+0x0d4]` and collection `0x006cec20`, reads one candidate-indexed float lane at `[route+0x3e]`, and compares the route-side threshold at `[route+0x112]` against the current local word-table value for that candidate after scaling through `0x00437d20`. It returns `1` on the first matching route record and `0` otherwise. Current grounded caller is `placed_structure_rebuild_candidate_local_service_tables` at `0x0042ce00`, where this predicate selects one of the route-backed scoring transforms.","objdump + caller xrefs + route-record inspection + candidate-table correlation"
0x0042cc50,402,placed_structure_apply_route_linked_service_caps,map,thiscall,inferred,objdump + caller xrefs + route-record inspection,3,"Route-linked cap pass over the aligned local service tables. The helper walks the route or service record chain rooted at `[this+0x0d4]` through `0x006cec20`, then for each live non-remapped candidate that passes `structure_candidate_is_enabled_for_current_year` it compares the route-side candidate float at `[route+0x42]` against the current site float table at `[this+0x107]` and the current primary word-table value at `[this+0x00]`. When the route-linked ratio stays inside the live clamp window it writes a lower capped value back into the primary word table. Current grounded caller is the composite local refresh `0x0042d580`, so this now looks like the first route-backed cap pass that shapes the rebuilt local service tables before the later neighborhood redistribution and recent-service clamp run.","objdump + caller xrefs + route-record inspection + local-table correlation"
0x0042cdf0,16,placed_structure_refresh_candidate_service_state,map,thiscall,inferred,objdump + caller xrefs + wrapper inspection,4,"Tiny composite refresh for one placed-structure or site record. The helper first rebuilds the candidate cargo-service bitsets through `placed_structure_rebuild_candidate_cargo_service_bitsets` at `0x0042c690`, then tail-calls `placed_structure_refresh_linked_candidate_flag4` at `0x0042c8f0` to refresh the sibling state bit at `[this+0x0e6]`. Current grounded callers include the world-grid sweep at `0x00450003`, so this now looks like the common steady-state placed-structure service-state refresh immediately above the editor-driven cargo runtime tables.","objdump + caller xrefs + wrapper inspection"
0x0042ce00,1394,placed_structure_rebuild_candidate_local_service_tables,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Large per-site rebuild over the live candidate collection at `0x0062ba8c`. The helper walks every candidate with live runtime state at `[collection+0x16e]` and no remap entry at `[collection+0x9a]`, decays positive floats in the aligned per-candidate table rooted at `[this+0x107]`, and commits those float updates back through `0x0041e1b0`. It then combines that float table with two aligned per-candidate word tables rooted at `[this+0x02]` and `[this+0x6c]`, the direct-supply cargo bitset at `[this+0x0df]`, the site-side latch at `[this+0x0d4]`, and the branch predicate `0x0042cbb0` to choose among several normalized scoring transforms before writing the quantized result back into the destination word table. Current grounded callers now put this directly under the local wrapper at `0x0042d580`, so this looks like the first real site-side candidate service-score rebuild above the editor-driven cargo runtime lane rather than another candidate-only helper.","objdump + caller xrefs + callsite inspection + table-layout correlation"
0x0042d580,26,placed_structure_refresh_local_service_score_bundle,map,thiscall,inferred,objdump + caller xrefs + wrapper inspection,4,"Composite local-service refresh for one placed-structure or site record. The helper first runs `placed_structure_rebuild_candidate_local_service_tables` at `0x0042ce00`, then immediately chains into the neighboring local post-passes at `0x0042cc50`, `0x0042c1b0`, and `0x0042cb30` before returning. Current grounded caller is the world-grid sweep at `0x00450110`, which uses this as the stronger per-site local-service refresh after the lighter cargo-service-state pass at `0x00450003`.","objdump + caller xrefs + wrapper inspection"
0x00428a10,22,company_clear_selected_chairman_if_current_profile,simulation,thiscall,inferred,objdump + caller inspection,4,"Clears the linked chairman for the current company when the supplied profile id matches `[this+0x3b]`. On a match the helper zeroes the incoming profile id and tail-calls `0x00427c70`; otherwise it returns without changing company state. Current grounded shell caller is `shell_company_detail_resign_chairmanship_flow`, which uses this as the commit step behind the localized resignation confirmation.","objdump + caller inspection + chairman-link correlation"
0x00424fd0,751,company_compute_public_support_adjusted_share_price_scalar,simulation,thiscall,inferred,objdump + caller inspection,3,"Computes one bounded investor-support and share-price scalar used by stock-capital policy, cached share-price readouts, and adjacent governance or control-transfer vote lanes. The helper starts from `company_compute_cached_recent_per_share_performance_subscore` at `0x004248d0`, blends that score with the company-side field `[this+0x57]`, applies extra startup or age smoothing when the current year is still within five years of `[this+0x157]`, and interprets the first caller argument as one normalized share-count pressure term against current outstanding shares `[this+0x47]`, clamping that delta into a small bounded band. When the caller supplies nonzero control arguments it can also refresh the mutable support field `[this+0x4f]` from that staged pressure term. The tail then folds in company value and share-count state, one profile or company affinity term from `0x00436590`, the current linked chairman id `[this+0x3b]`, and one difficulty table under `0x005f33b8`, clamps the final float into a bounded positive range, and optionally snapshots it into the cached share-price field `[this+0x0d7b]` when the second control argument is nonzero. Current grounded callers include the cached share-price accessor `0x00423eb0`, the stock buyback and stock issue mutators `0x004273c0` and `0x00427450`, the bankruptcy recompute path `0x00425a90`, the merger vote resolver at `0x004ebd10`, the company-side takeover and policy family, and the annual creditor-pressure or shareholder-policy lane that surfaces localized ids `300..304`. The direct scenario-state issue lane here uses issue id `0x37`, which still looks like the broader company-management or public-sentiment slot rather than the narrower merger-only management-attitude slot.","objdump + caller inspection + support-field correlation + issue-id correlation + governance-string correlation + stock-buyback correlation + stock-issue correlation + share-price-cache correlation + per-share-performance correlation"
0x00424580,82,company_compute_prime_rate_from_issue39_scenario_baseline,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small company-side rate helper that produces the current prime-rate-style baseline from scenario state plus issue `0x39`. It first reads one normalized scenario baseline through `0x00433740` on active scenario state `0x006cec78`, then adds the scaled raw issue-39 total from `scenario_state_sum_issue_opinion_terms_raw` at `0x00436710` using the current company id `[this+0x00]`, linked chairman id `[this+0x3b]`, and no territory argument. Current grounded callers now bound the player-facing meaning more tightly: the bond-interest quote wrapper at `0x00427540`, the negative and positive cash interest helpers at `0x00425880` and `0x004258c0`, and the CompanyDetail capital summary row labeled `954` `Prime Rate:` at `0x004c23a0`. This now reads as the shared prime-rate or market-rate helper rather than a generic company-support scalar.","objdump + caller xrefs + callsite inspection + issue-39 correlation + prime-rate correlation + bond-quote correlation"
0x004246b0,544,company_compute_five_year_weighted_shareholder_return,simulation,thiscall,inferred,objdump + caller inspection + RT3.lng strings,3,"Computes the stock-data lane surfaced as `5 Year Weighted Return`. Inactive companies fall back to the fixed scalar at `0x005c8598`; otherwise the helper walks up to five recent years above founding year `[this+0x157]`, samples yearly `Share Price` from slot `0x1c`, measures year-over-year price appreciation against the prior sample, blends that with the paired historical shareholder-payout lane from slot `0x23`, and weights recent years more heavily through the same scenario-side year weighting byte at `[0x006cec78+0x0f]`. Current evidence now bounds that paired lane more tightly: slot `0x23` falls back to direct company field `[this+0x53]` on the current-company path and is only consumed here, so the strongest current read is the historical dividend-per-share or shareholder-payout component paired with yearly price appreciation. The tail normalizes the accumulated weighted return by the accumulated weights and returns one bounded annualized-style float. Current grounded caller is `company_read_control_transfer_metric_slot` at `0x0042a2e0` for slot `0x21`, which matches the stock-data label `942` `5 Year Weighted Return:` and tooltip `936`.","objdump + caller inspection + RT3.lng strings + stock-data-label correlation + weighted-return correlation + shareholder-payout-lane correlation"
0x00425880,64,company_compute_negative_cash_balance_interest_rate,shell,thiscall,inferred,objdump + LoadScreen report correlation + localized string correlation,4,"Small company-side rate helper used only by the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper reads one control-transfer or yearly metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x22`, combines that with the prime-rate helper `company_compute_prime_rate_from_issue39_scenario_baseline` at `0x00424580`, normalizes the result through two fixed constants, and returns one bounded float formatted as the first `%1` insert in localized strings `2815` and `2816`. Current grounded meaning is the company's negative-cash borrowing interest rate, i.e. the rate the company currently pays on negative cash balances in the Income Statement and Balance Sheet help rows.","objdump + LoadScreen report correlation + localized string correlation + helper call inspection + prime-rate correlation"
0x004258c0,396,company_compute_positive_cash_balance_interest_rate,shell,thiscall,inferred,objdump + LoadScreen report correlation + localized string correlation,4,"Company-side rate helper paired with `company_compute_negative_cash_balance_interest_rate` beneath the shared `LoadScreen.win` report-history renderer at `0x004e9b20`. The helper starts from the same prime-rate helper at `0x00424580`, subtracts one baseline constant, then reads the company cash metric through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` using family `0x2329` and slot `0x0d`. It applies a piecewise threshold ladder over that cash or liquidity lane, clamps the result into several fixed bands, and returns the second `%2` insert for localized strings `2815` and `2816`. Current grounded meaning is the company's positive-cash deposit interest rate, i.e. the rate the company currently earns on positive cash balances in the Income Statement and Balance Sheet help rows.","objdump + LoadScreen report correlation + localized string correlation + helper call inspection + piecewise-threshold correlation + prime-rate correlation"
0x00425320,607,company_compute_connection_bonus_value_ladder,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Builds one bounded company-side value scalar beneath the city-connection bonus lane. The helper returns `0` when the company-active flag at `[this+0x3f]` is clear; otherwise it walks a four-step recent-year window relative to the current scenario year at `0x006cec78+0x0d` and the company founding year at `[this+0x157]`, reads one pair of slots through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` with ids `0x2b` and `0x09`, accumulates their weighted differences with descending weights `4..1`, averages that ladder, blends in the current stat-family `0x2329` mode `0x12` term, and then scales the result by the weighted average bond interest rate from `company_compute_weighted_average_bond_interest_rate` `0x00423e40`. When the current support lane `0x2329` mode `0x0d` is high enough, it also folds in the current prime-rate baseline from `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580` together with the active scenario issue-39 total. Wider xrefs now tighten `0x2b` into the rolling net-profits lane reused by the annual finance checks and CompanyDetail per-share/history formatter, while the report-history descriptor table aligns `0x09` with the Income Statement fuel-cost lane surfaced by tooltip `1309`. So the ladder is currently best read as recent net profits minus recent fuel burden, then adjusted by current company borrowing conditions rather than by a vague governance-pressure term. The tail then clamps the result through a bounded piecewise ladder with extra startup smoothing across roughly the first five years after founding. Current grounded callers are `company_evaluate_and_publish_city_connection_bonus_news` at `0x00406050`, the smaller wrapper at `0x00427540`, and the boolean unlock gate at `0x00427590`, so current best meaning is the company-side connection-bonus value ladder rather than a generic public-support scalar.","objdump + caller xrefs + callsite inspection + issue-slot correlation + connection-bonus correlation + income-statement-row correlation + derived-report-metric correlation + average-interest correlation + prime-rate correlation"
0x00429c70,976,company_read_derived_financial_report_metric_slot,simulation,thiscall,inferred,objdump + caller inspection + shell-label correlation,3,"Reads one derived company metric from the higher report-style slot family rooted at `0x2b`. The jump-table body now has one safe finance-side core: slot `0x2c` sums raw slots `0x01..0x04` into the broader revenue aggregate, slot `0x2d` combines the neighboring expense-side derived lanes, and slot `0x2b` then combines `0x2c` and `0x2d` into the net-profits-style lane reused by shell labels `1212` `Profits`, `925` `Profits:`, and the annual finance policy. The same helper also owns several later derived ratios and aggregates, including one asset-side pair around `0x30/0x31` and the per-unit revenue lanes that divide the revenue aggregate `0x2c` by count or distance slots such as `0x24`, `0x16`, and `0x17`. Current grounded callers arrive indirectly through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0`, so this is the shared derived financial-report metric reader beneath CompanyDetail, LoadScreen, and annual finance rather than a shell-only formatter helper.","objdump + caller inspection + shell-label correlation + derived-metric correlation + income-statement correlation"
0x00429990,86,company_collection_get_nth_active_company_id,simulation,thiscall,inferred,objdump + caller inspection,4,"Returns the company id of one requested active-company ordinal within the live company collection rooted at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, tests the active company-state flag at `[entry+0x3f]`, decrements the caller-supplied ordinal only for active entries, and returns the first company id whose active ordinal matches zero. Current grounded callers use it as the forward mapping between active-company page indices and concrete company ids in shell-side roster, detail, and picker flows.","objdump + caller inspection + active-company roster correlation"
0x004299f0,84,company_collection_count_active_companies_before_company_id,simulation,thiscall,inferred,objdump + caller inspection,4,"Counts how many active companies precede one requested company id in the live company collection at `0x0062be10`. The helper linearly walks collection slots through `0x00518380`, stops when the entry id matches the requested company id, and increments the return counter only for active entries whose state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the inverse mapping for shell-side company paging and company-relative selector paths before converting back through `company_collection_get_nth_active_company_id` at `0x00429990`.","objdump + caller inspection + active-company roster correlation"
0x00429a50,62,company_collection_count_active_companies,simulation,thiscall,inferred,objdump + caller inspection,4,"Counts active companies in the live company collection rooted at `0x0062be10`. The helper walks collection slots through `0x00518380`, resolves each record through `0x00518140`, and increments the total only when the active-state flag at `[entry+0x3f]` is nonzero. Current grounded callers use this as the active-company roster size for shell-side company browsing and neighboring selector math.","objdump + caller inspection + active-company roster correlation"
0x00433130,169,scenario_event_collection_refresh_runtime_records_from_packed_state,scenario,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Collection-wide runtime materialization pass over the live event collection at `0x0062be18`. The helper stages one small packed header read from the caller-supplied state or stream object, walks every live event record in the collection through `indexed_collection_slot_count` `0x00517cf0`, `indexed_collection_get_nth_live_entry_id` `0x00518380`, and `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and re-enters `scenario_event_refresh_runtime_record_from_packed_state` `0x0042db20` on each resolved record. When the sweep completes it clears the collection-side reentrancy or dirty latch at `[this+0x88]`. Current grounded callers are the `Setting up Players and Companies...` `319` lane of `world_run_post_load_generation_pipeline` at `0x00444959` and one neighboring world-build path at `0x00448020`, so this now reads as the event-side runtime refresh pass beneath post-load world setup rather than an anonymous collection walk.","objdump + caller xrefs + local disassembly + event-collection correlation + post-load-pipeline correlation"
0x00434050,11,shell_has_auxiliary_preview_owner,shell,cdecl,inferred,objdump + caller inspection + side-owner correlation,4,"Tiny presence probe over the auxiliary preview or side owner rooted at `0x006cd8d8`. The helper returns `1` when that owner pointer is nonnull and `0` otherwise. Current grounded callers include the `.gmt` save-side branch in `shell_map_file_world_bundle_coordinator` `0x00445de0`, the shell-state frame service pass `0x00482160`, the `BuildingDetail.win` subject-sync and tutorial gate lane around `0x004b9e10` and `0x004bb9e0`, and adjacent train-side branches that round route scalars or finalize auxiliary route buffers only when this side owner is live.","objdump + caller inspection + side-owner correlation + caller xrefs"
0x00434300,881,world_runtime_release_global_services,map,cdecl,inferred,objdump + analysis-context,3,Releases or clears a broad set of world-runtime global services owned by the current map object before a new world entry or sibling save branch continues. The helper walks the owner collection at [this+0x66b2] and then touches many global manager slots including 0x0062b244 0x0062cfcbc 0x0062be10 0x0062c120 0x0062ba8c 0x0062ba88 0x0062b2fc 0x0062b268 0x006cea4c and 0x006acd34 through repeated release-style calls and nulling writes. Current grounded callers are the heavier world-entry branch at 0x00443a50 the sibling .smp world-state branch at 0x00446d40 and shell_transition_mode at 0x00482ec0.,objdump + analysis-context + caller xrefs
0x0043cb00,295,world_view_step_heading_quadrant,shell,thiscall,inferred,objdump + caller xrefs,3,Applies one discrete heading-step command to the live world-view owner at 0x0062be68. The helper quantizes the current heading-like field [this+0x10] into one of four wrapped sectors derives the neighboring sector selected by the signed caller step and writes the resulting snapped heading back before rebuilding the dependent view state through 0x0043a750 0x0052d640 and 0x0043bde0. Current grounded callers are the paired shell UI command branches at 0x004de83d and 0x004de857 so this looks like the discrete rotate-view command family rather than free camera drag.,objdump + caller xrefs + callsite inspection
0x0043cc30,437,world_view_step_zoom_bucket,shell,thiscall,inferred,objdump + caller xrefs,3,Applies one discrete zoom or view-height bucket step to the live world-view owner at 0x0062be68. It derives a seven-entry threshold table under 0x005ee4dc and 0x0062be4c compares the current view-height field [this+0x18] against those thresholds chooses the neighboring bucket selected by the signed caller step clamps the result into the supported range and then rebuilds the dependent view state through 0x0043c610 0x00439820 and 0x0043bde0. Current grounded callers are the signed shell UI command pair at 0x004de871 and 0x004de88b and the keyboard-owned smoothing branch inside world_view_service_shell_input_pan_and_hover at 0x0043dca4.,objdump + caller xrefs + callsite inspection
0x0043d050,111,world_view_set_focus_position_xyz,shell,thiscall,inferred,objdump + caller xrefs,4,Stores one new world-view focus position into the owner at 0x0062be68 by updating [this+0x04] [this+0x08] and [this+0x0c] as the requested X Y and Z coordinates then rebuilding the dependent view state through 0x0043cec0 0x0043a750 0x0052d640 0x00439820 and 0x0043b0e0. The helper also clamps the view-height or distance field at [this+0x18] before recomputing the derived pitch-like field at [this+0x14]. Current grounded callers are the screen-delta wrapper at 0x0043d0c0 the relative pan helper at 0x0043d130 and two larger world-view service branches at 0x0043ee76 and 0x0043f32d.,objdump + caller xrefs
0x0043af60,205,world_view_should_drive_primary_pan_channel,shell,thiscall,inferred,objdump,3,Returns whether the world-view owner should drive its primary pan channel on this pass. The predicate first honors the latched override at [this+0xa2] then checks several shell-view gates through 0x00543e00 0x00543e20 and 0x00543e40 on the active controller node plus one optional guard under 0x006d1a8c and the world-mode flag at [0x006cec74+0x120]. When the controller view is active it also treats packed shell input bits 0x3 in 0x006d4018+0xa8c as one enabling condition; `shell_input_apply_window_key_transition` grounds those bits as the left and right Shift modifiers from scan codes 0x2a and 0x36 which ties held Shift state back into the same world-view pan family. Current grounded callers sit in the larger recurring world-view input service at 0x0043db00 and the smaller motion helper at 0x0043e610.,objdump + callsite inspection
0x0043b030,173,world_view_should_drive_secondary_pan_channel,shell,thiscall,inferred,objdump,3,Returns whether the world-view owner should drive its secondary pan channel on this pass. Like the neighboring primary predicate it combines shell controller view gates through 0x00543e00 0x00543e20 and 0x00543e40 optional suppression under 0x006d1a8c and one world-mode check at [0x006cec74+0x120]; when the active controller view is present it also treats packed shell input bits 0x3 in 0x006d4018+0xa8c as an enabling condition. Those bits are now grounded as the left and right Shift modifiers from scan codes 0x2a and 0x36 rather than an opaque gameplay-only flag source. Current grounded callers sit in the larger recurring world-view input service at 0x0043db00 and in the smaller motion helpers at 0x0043e610 and 0x0043f4f0.,objdump + callsite inspection
0x0043d0c0,111,world_view_apply_screen_delta_to_focus_position,shell,thiscall,inferred,objdump + caller xrefs,4,Converts one screen-relative drag delta into a new world-view focus position and forwards it through world_view_set_focus_position_xyz. When the auxiliary object at [this+0x6e] is live it samples a derived center or height term through 0x00534490 and scales both incoming deltas by the world-view projection constant at 0x005c8700 before calling the lower focus-position setter. The current grounded caller is the cursor-drag helper at 0x00478d31 inside the larger input loop at 0x00478cb0.,objdump + caller xrefs
0x0043d130,292,world_view_pan_relative_offset_in_camera_plane,shell,thiscall,inferred,objdump + caller xrefs,4,Applies one local X/Z pan offset to the world-view owner at 0x0062be68 in the current camera plane and forwards the result through world_view_set_focus_position_xyz. The helper derives a scale from the active view-height field [this+0x18] rotates the incoming offset by the current heading-like field [this+0x10] through sine and cosine calls at 0x005a13e4 and 0x005a1494 adds the rotated result onto the current world focus position in [this+0x04] and [this+0x0c] preserves the current Y term in [this+0x08] and then calls the lower focus-position setter. Current grounded callers are the GameUppermost hotspot path at 0x004e094b and the keyboard-owned service branch inside world_view_service_keyboard_turn_and_pan_bindings at 0x0043dae4 which together indicate a shared world-view pan action rather than a separate gameplay command dispatcher.,objdump + caller xrefs
0x0043d740,937,world_view_service_keyboard_turn_pan_and_zoom_bindings,shell,thiscall,inferred,objdump + callsite inspection,4,"Keyboard-driven world-view interaction helper beneath world_view_service_shell_input_pan_and_hover. It samples elapsed wall-clock time through 0x0051d890 against the previous timestamp at 0x0062be74 clamps the per-pass delta into the 0x08 through 0xc8 range and polls four configurable binding-pair families through the shell input table at 0x006d4018 via 0x0054e7d0. The first two pair families at [this+0x0a6] through [this+0x0b2] and [this+0x0b6] through [this+0x0c2] now ground as the default `Camera Forward` or `Camera Backward` pair and `Camera Left` or `Camera Right` pair. The third family at [this+0x0c6] through [this+0x0d2] produces a signed zoom-step or view-height delta that is returned through the caller-owned out-parameter for later smoothing and grounds as the default `Camera Zoom In` or `Camera Zoom Out` pair, while the fourth family at [this+0x0d6] through [this+0x0e2] applies continuous heading turns through 0x0043c810 and grounds as the default `Camera Rotate Left` or `Camera Rotate Right` pair. When the pan families are active the helper reaches world_view_pan_relative_offset_in_camera_plane at 0x0043d130 after checking the active world-view state. Current grounded caller is world_view_service_shell_input_pan_and_hover at 0x0043db00.",objdump + callsite inspection + caller xrefs + registration xrefs + RT3.lng
0x00439e40,557,world_view_seed_keyboard_binding_slot_pairs,shell,thiscall,inferred,objdump + callsite inspection,4,"Initializes the eight world-view keyboard binding slot pairs rooted at [this+0x0a6] through [this+0x0e2]. The helper zeroes the paired 4-byte fields then queries the global action-binding registry through 0x0045f370 using eight distinct stub roots at 0x0043d2a0 through 0x0043d310. The registration block at 0x00460769 through 0x004608e7 plus `Data/Language/RT3.lng` show those eight roots are seeded as four labeled directional pairs: `Camera Forward` id 0x0d8a on Up, `Camera Backward` id 0x0d8b on Down, `Camera Left` id 0x0d8c on Left, `Camera Right` id 0x0d8d on Right, `Camera Zoom In` id 0x0d8e on Up, `Camera Zoom Out` id 0x0d8f on Down, `Camera Rotate Left` id 0x0d90 on Left, and `Camera Rotate Right` id 0x0d91 on Right. The first bank feeds the pan pairs later consumed at [this+0x0a6] through [this+0x0c2], while the second bank feeds the zoom-step and heading-turn pairs later consumed at [this+0x0c6] through [this+0x0e2]. After the registry lookups the helper normalizes several legacy companion values across all eight pairs by remapping 0x2 to 0x10 0x20 to 0x12 and 0x4 to 0x11 before storing the results back. This now looks like the live world-view setup path above world_view_service_keyboard_turn_pan_and_zoom_bindings at 0x0043d740 rather than a separate config-side binding store.",objdump + callsite inspection + callee inspection + registration xrefs + RT3.lng
0x0043db00,1968,world_view_service_shell_input_pan_and_hover,shell,thiscall,inferred,objdump + callsite inspection,4,Recurring world-view service that fuses shell input state into the live world-view owner at 0x0062be68. It begins by delegating keyboard-bound turn pan and zoom work to world_view_service_keyboard_turn_pan_and_zoom_bindings at 0x0043d740 then samples controller and view state through 0x00543c50 and 0x00543ba0 caches successive shell input coordinates from 0x006d4018 offsets 0xa94 and 0xa98 derives smoothed cursor or hover deltas against [this+0x2f6] [this+0x2fa] and [this+0x2fe] updates one world-under-cursor cache through 0x00448ac0 and 0x00448bd0 and refreshes the GameUppermost overlay through 0x004e0730 when the pan state changes. The helper repeatedly consults world_view_should_drive_primary_pan_channel at 0x0043af60 and world_view_should_drive_secondary_pan_channel at 0x0043b030 drives one of the lower motion branches at 0x0043e610 0x0043f4f0 or 0x0043e2c0 and smooths the keyboard zoom-step channel through the shared accumulator at 0x0062be78 before issuing discrete view-height bucket steps through world_view_step_zoom_bucket at 0x0043cc30. Current grounded callers include the recurring world-frame path at 0x00439730 and two setup or transition loops at 0x00516859 and 0x00516921. This now looks like the shared shell-input coordinator above keyboard turn pan zoom cursor drag and hotspot world-view motion rather than a mouse-only helper.,objdump + callsite inspection + caller xrefs
0x00420030,578,city_connection_bonus_exists_matching_peer_site,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Reusable placed-structure scan beneath the city-connection bonus note family. The helper walks the live placed-structure collection at `0x006cec20`, first requiring each candidate peer to match one site-class token from the caller's local six-byte class table through `0x0042b2d0`, then applying four bounded caller-controlled filters before returning success on the first matching peer. Current filter roles are tighter now: the first stack flag enables the station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the linked-instance class-byte test through `0x0047de00 -> 0x0040c990 == 1`; the third stack flag enables the deeper route or peer-reachability sweep through `0x0047f310` and `0x0048e3c0`; and the fourth stack dword is an optional owning-company id that is matched through `placed_structure_query_linked_company_id` at `0x0047efe0`. Current grounded callers include the adjacent city bonus or status formatter around `0x004207d0`, where the helper's boolean combinations choose localized ids `3868` through `3873`, plus wider world-side sweeps at `0x00404d66`, `0x004221ea`, `0x00422264`, `0x00435930`, and `0x00435944`. This now looks like the common city-connection peer probe rather than a generic anonymous scan.","objdump + caller xrefs + callsite inspection + city-bonus note correlation + filter-role decoding"
0x00420280,204,city_connection_bonus_select_first_matching_peer_site,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Companion selector beside `city_connection_bonus_exists_matching_peer_site`. The helper walks the live placed-structure collection at `0x006cec20`, requires each candidate peer to match one site-class token from the caller's six-byte class table through `0x0042b2d0`, and then applies two caller-controlled filters before returning the first matching placed-structure id from the collection instead of a boolean. The first stack flag enables the same station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the stricter linked-instance class-byte requirement through `0x0047de00 -> 0x0040c990 == 1`; when either flag is zero the corresponding predicate becomes permissive. Current grounded callers are the city bonus or status formatter at `0x004207d0`, which uses the selected peer to recover linked-company context after the boolean note checks, and the earlier world-side branch at `0x004046f5`, which passes both flags as `1` before sampling the selected peer's derived coordinates through `0x0047df30` and `0x0047df50`. This now reads as the first-match peer selector paired with the broader existence probe rather than as a second generic scan.","objdump + caller xrefs + callsite inspection + filter-role decoding + peer-selector correlation"
0x004207d0,1053,city_site_format_connection_bonus_status_label,map,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Adjacent city-site label formatter above the city-connection peer helpers at `0x00420030` and `0x00420280`. When the preview-global `0x0062be84` is armed or the city-side subtype field `[this+0x23e]` is nonzero the function falls back into the neighboring virtual-style formatter at `0x00455860`; otherwise it builds one visible text block from the base city label at `[this+0x356]`, optionally appends the numeric value in `[this+0x276]`, and can append localized id `207` `(Connected)` when the active linked world object and city class checks succeed. If `[this+0x276]` is nonzero it then chooses one of the city-connection bonus note strings `3868` through `3873` by calling `city_connection_bonus_exists_matching_peer_site` at `0x00420030` with three meaningful filter combinations: a deeper peer-reachability pass, an active-company-only pass using `scenario_state_get_selected_chairman_company_record` at `0x004337a0`, and a broader any-company pass. After those boolean note checks it also re-enters `city_connection_bonus_select_first_matching_peer_site` at `0x00420280` to recover one representative matching peer site, resolves that peer's linked company through `placed_structure_query_linked_company_id` at `0x0047efe0`, and uses the selected company record when formatting the follow-on company-oriented text lane. That current grounded split is enough to tie `3869` `Connected By Another Station`, `3870` `Already Connected`, `3871` `Connected By Another Company`, `3872` `Already Connected by Another Company`, and `3873` `Not Connected` to this formatter boundary rather than to the station-detail overlay body. The helper also writes one caller-owned color field and label-priority scalar before returning style code `3`, so it currently reads as a world-label or hover-summary formatter for city connection-bonus state rather than a generic text helper.","objdump + caller inspection + RT3.lng strings + city-bonus note correlation + filter-combination decoding + peer-selector correlation"
0x0043f640,3797,world_render_station_candidate_service_map_overlay,render,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Renders the world-side map overlay behind the active `StationDetail.win` candidate-service preview. The helper reads the currently previewed `(station id, candidate id)` pair from `0x005ee4fc` and `0x005ee500`, rejects early when shell preview mode or cargo-economy gates are inactive, re-enters `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`, and then scans the placed-structure collection at `0x006cec20` through either the direct local-service path or the heavier route-side helper at `0x0047e690`. The candidate byte at `[candidate+0x46]` now looks like the key legend split: when it is nonzero the overlay formats the directional route rows `3874` `Coming To %1` and `3875` `Going From %1`; when it is zero the same two legend lanes instead format `3876` `Current Supply @ < %1` and `3877` `Current Demand @ > %1`. Empty directional lanes collapse to `3878` `--None--`, and the title lane falls back to literal `All` when no specific candidate label is active. The neighboring connection-state notes `3872` `Already Connected by Another Company` and `3873` `Not Connected` no longer look like direct overlay-body emits; current grounded disassembly keeps them in the adjacent city bonus or status formatter `city_site_format_connection_bonus_status_label` at `0x004207d0`, which reuses `city_connection_bonus_exists_matching_peer_site` at `0x00420030` plus `placed_structure_query_linked_company_id` at `0x0047efe0` before choosing those strings. `3879` `Out of Sync` is also outside this function body and belongs to the multiplayer preview dataset path at `0x0046b780`. This now looks like the first grounded world-side owner above the shell preview pair armed by `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` rather than a generic hidden scanner.","objdump + RT3.lng strings + caller inspection + preview-overlay correlation + legend-branch correlation + adjacent-formatter boundary check"
0x00439140,1086,simulation_frame_accumulate_and_step_world,simulation,cdecl,inferred,objdump + analysis-context,4,"Frame-owned simulation cadence after world bring-up and still directly called from shell_service_pump_iteration at 0x00483f70 rather than a separately grounded outer gameplay loop. The routine samples elapsed time through 0x0051d890 mixes shell and mode scalars into a simulation quantum keeps leftover fractional time in [this+0x4c80] and when enough time has accumulated repeatedly calls simulation_advance_to_target_calendar_point at 0x0040ab50 using the current step quantum from 0x005f2b38. Around those simulation steps it refreshes shell-facing presentation helpers under 0x006d4024 and 0x006d0818 updates multiple world collections and transport or scenario side structures and services the recurring GameMessage.win branch through `game_message_window_service_if_present` `0x004e0720` before later follow-up work. The shell-owned cadence evidence is tighter here now too: one direct frame-side branch at `0x0043970f` opens or focuses `LoadScreen.win` through `shell_open_or_focus_load_screen_page` `0x004e4ee0`, and the post-step shell-window ladder then services several sibling shell windows by presence-probe plus dirty-latch pairs instead of any detached gameplay-only owner. Current grounded members of that ladder now include the shared custom modal through `shell_has_live_custom_modal_dialog` `0x004c8680` plus `shell_mark_custom_modal_dialog_dirty` `0x004c8670`, the file-options dialog through `shell_has_file_options_dialog` `0x004dc7d0` plus `shell_mark_file_options_dialog_dirty` `0x004dc7e0`, `LoadScreen.win` through `shell_has_live_load_screen_window` `0x004e1f50` plus `shell_mark_load_screen_window_dirty` `0x004e1f60`, `SettingsWindow.win` through `shell_has_settings_window` `0x004fe120` plus `shell_mark_settings_window_dirty` `0x004fe130`, `Overview.win` through `shell_has_live_overview_window` `0x004f2e80` plus `shell_mark_overview_window_dirty` `0x004f2e90`, `BuildingDetail.win` through `shell_has_live_building_detail_window` `0x004b9d70` plus `shell_mark_building_detail_window_dirty` `0x004b9d80`, and now `Trainbuy.win` through `shell_has_live_trainbuy_window` `0x0050f740` plus `shell_mark_trainbuy_window_dirty` `0x0050f750`. One deeper world-mode sidecar inside the same frame path now looks grounded too: after delegating to world_view_service_shell_input_pan_and_hover at 0x0043db00 the frame compares the active controller-view pointer at [0x006d4024+0x18]+0x366e against the latched world object at [this+0x66a2], releases the previous object through vtable slot +0x64, and when the new object passes its own availability test at slot +0x1c plus shell-detail control gate 0x07d6 on 0x006d0818 it latches the new object and calls slot +0x60. That makes the frame owner the first grounded non-camera world-input coordinator for hover or focus-target transitions beneath the shell-fed camera stack, even though click or command semantics are still unresolved. This is the strongest grounded owner so far for the recurring gameplay simulation cadence that follows world_entry_transition_and_runtime_bringup.","objdump + analysis-context + caller xrefs + callsite inspection + frame-disassembly correlation"
0x00433b00,117,shell_can_open_trainbuy_window_or_warn,shell,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Shared availability gate above the shell-side `Trainbuy.win` family. The helper first rejects scenario states where the train-buy action is globally disabled through `[0x006cec78+0x4aa3]`, surfacing localized id `334` `That action is not allowed in this scenario.` through the shared shell modal path when blocked. It then checks whether the active company or world object state supplied by the caller allows train purchase; if no company is active it raises id `337` `You can't buy a train without starting a company first!`, and if no track has been placed it raises id `338` `You can't buy a locomotive until some track has been placed!`. Only the success path returns nonzero to the callers at `0x004406d3` and `0x004de7d9`, both of which immediately enter `shell_open_or_focus_trainbuy_window` at `0x00512c50`.","objdump + caller inspection + RT3.lng strings + train-buy gate correlation"
0x0050f740,6,shell_has_live_trainbuy_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Tiny presence probe for the shell-side `Trainbuy.win` singleton rooted at `0x006d3ac8`. The helper returns the live-flag dword at `0x006d3ae4`, which is set during `shell_open_or_focus_trainbuy_window` at `0x00512c50` and cleared after that family tears the singleton down. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside the sibling overview, building-detail, load-screen, settings, custom-modal, and file-options probes.","objdump + caller inspection + strings correlation + singleton correlation"
0x0050f750,11,shell_mark_trainbuy_window_dirty,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Tiny dirty-latch setter paired with `shell_has_live_trainbuy_window`. The helper stores `1` into `0x006d3adc`, which current nearby call patterns treat as the `Trainbuy.win` refresh or service request latch once the live singleton family rooted at `0x006d3ac8` exists. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, and the same latch is consumed on the message-`0` service path inside the family handler at `0x00512202` through the `0x00512c09` branch.","objdump + caller inspection + nearby-family correlation + singleton correlation + service-path inspection"
0x0050f760,45,shell_trainbuy_window_query_selected_locomotive_id,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Returns the currently selected locomotive id or `0` when the shell-side `Trainbuy.win` family has no valid active selection. The helper first checks whether the live singleton at `0x006d3ac8` exists and whether control resource `0x2afe` exposes one nonnegative selected row through `0x0055fba0`; on success it returns that selected locomotive id. Current grounded callers include the route, upgrade-cost, and purchase-confirmation branches inside `shell_trainbuy_window_handle_message`, where this value is then resolved through the locomotive collection at `0x006ada84`.","objdump + caller inspection + strings correlation + selected-row correlation"
0x0050f790,241,shell_trainbuy_window_compute_selected_upgrade_total_and_count,shell,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Computes the current selected-train upgrade summary beneath the shell-side `Trainbuy.win` family. The helper counts all flagged train entries in the `0x2000`-byte selection array rooted at `0x006d1aa8`, resolves the currently selected locomotive choice through `shell_trainbuy_window_query_selected_locomotive_id` at `0x0050f760`, and then multiplies the resulting selected-train count by the per-train upgrade cost from `0x004619c0` after converting the current and target locomotive ids through `0x004337b0` and `0x004337a0`. It writes the total upgrade cost through the first out-parameter and the number of selected trains through the second. Current grounded callers are the summary formatter at `0x0050f890` and the purchase-or-upgrade confirmation path inside `shell_trainbuy_window_handle_message`.","objdump + caller inspection + RT3.lng strings + selection-array correlation + upgrade-cost correlation"
0x0050f890,368,shell_trainbuy_window_render_selected_train_upgrade_summary,shell,cdecl,inferred,objdump + caller inspection + RT3.lng strings,4,"Formats the selected-train upgrade summary text in the shell-side `Trainbuy.win` family. After resolving the currently selected locomotive id through `shell_trainbuy_window_query_selected_locomotive_id` at `0x0050f760`, the helper calls `shell_trainbuy_window_compute_selected_upgrade_total_and_count` at `0x0050f790` and then builds the player-facing status string from localized ids `1338` `No trains currently selected to upgrade.`, `1339` `Total Cost to Upgrade the %1 Selected Trains to %2 is %3.`, and `1340` `Total Cost to Upgrade the 1 Selected Train to %1 is %2.`. It publishes the resulting heap-backed text through the callback-driven shell control path rooted at control resource `0x275c`. Current grounded callers are the family refresh path at `0x00511500` and the row-selection branch at `0x00512ac7`.","objdump + caller inspection + RT3.lng strings + upgrade-summary correlation"
0x0050fc00,1003,shell_trainbuy_window_render_selected_train_route_and_state_panel,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Renders the richer selected-train detail panel beneath the shell-side `Trainbuy.win` family. The helper resolves the currently selected train and its linked locomotive definition, formats one header block through the shared shell text path at `0x005519f0`, and then builds the lower route or cargo state block through `0x0053de00`, `0x0041d540`, and `0x00552560`. When the runtime latch at `[0x006cec74+0x180]` is set it also appends up to three localized fragments through ids `1341..1343`, gated by bytes `[train+0x30..0x32]`, before laying the final text out. Current grounded callers are the per-row hover or selection refresh paths beneath `Trainbuy.win`; the evidence is strong enough to treat it as the selected-train route-and-state renderer even though the exact player-facing captions for the three optional fragments are still unrecovered.","objdump + caller inspection + nearby-family correlation + selected-train correlation"
0x00511500,2941,shell_trainbuy_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Constructs the shell-side `Trainbuy.win` singleton later published at `0x006d3ac8`. The constructor binds the window resource through `0x0053fa50`, caches three shell runtime handles in `0x006d3abc..0x006d3ac4`, seeds the live singleton pointer at `0x006d3ac8`, builds one filtered locomotive-choice list under `0x006d3ae8`, and then wires the family controls and callbacks through `0x00540120`. Current grounded control ownership is broad enough to treat this as the full `Trainbuy.win` family rather than a small helper: it binds the main action and selection controls under resources `0x2afa..0x2aff`, the selected-train summary path through `shell_trainbuy_window_render_selected_train_upgrade_summary` at `0x0050f890`, the per-row hover helpers at `0x0050fa00` and `0x0050fc00`, the selected-row refresh helper at `0x00511170`, and the selection-paging helper at `0x00512080`. Current grounded caller is `shell_open_or_focus_trainbuy_window` at `0x00512c50`.","objdump + caller inspection + strings correlation + control-wiring inspection + singleton correlation"
0x00512080,372,shell_trainbuy_window_refresh_controls,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Refreshes the visible control state for the shell-side `Trainbuy.win` family. The helper consumes and clears the temporary refresh gate at `0x006d3ae1`, clamps the current selected locomotive-row index from control resource `0x2aff` against the live filtered choice list length at `0x006d3aec`, rewrites the list-selection state across control `0x88`, updates the current mode-strip and list-state controls rooted at `0x00622b28`, and then tail-calls the selected-row detail refresher at `0x00511170`. Current grounded callers are the family constructor at `0x00511500`, the action path after row or mode changes inside `shell_trainbuy_window_handle_message`, and the initial open path in `shell_open_or_focus_trainbuy_window` at `0x00512dd5`.","objdump + caller inspection + strings correlation + list-state correlation"
0x00512c50,615,shell_open_or_focus_trainbuy_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation + RT3.lng strings,4,"Shared opener for the shell-side `Trainbuy.win` singleton rooted at `0x006d3ac8`. The helper first rejects duplicate opens through the live flag at `0x006d3ae4`, seeds the family globals `0x006d3ad0..0x006d3ad8`, `0x006d3acc`, `0x006d3aa8`, `0x006d1aa0`, `0x006d1aa4`, `0x006d3af0`, `0x006d3af4`, `0x00622b24`, and the filtered locomotive-choice list at `0x006d3ae8`, allocates an `0x80`-byte shell window object, constructs it through `shell_trainbuy_window_construct` at `0x00511500`, refreshes it through `shell_trainbuy_window_refresh_controls` at `0x00512080`, and publishes it to the shell runtime at `0x006d401c`. Current grounded callers are the direct train-buy shell command branches at `0x004406ee` and `0x004de7f4` after `shell_can_open_trainbuy_window_or_warn` at `0x00433b00`, plus the sibling train-side action family around `0x00514c97` and `0x00514d7e`. The current family semantics are broader than a bare locomotive picker: nearby message and summary paths show that the same window also stages selected-train upgrade state and train-route editing affordances, but the strongest resource-name anchor remains `Trainbuy.win`.","objdump + caller inspection + strings correlation + RT3.lng strings + singleton correlation + control-family correlation"
0x00512f80,193,shell_trainbuy_window_refresh_selection_side_toggle,shell,thiscall,inferred,objdump + caller inspection + control-flow inspection,4,"Refreshes the small side-toggle strip beneath `Trainbuy.win` and stores the chosen side in `0x006d3b28`. The helper converts the caller-supplied boolean into two opposing style states on controls `0x6593` and `0x6594`, rewrites one small layout block through `0x0053fe90`, and keeps the current side latched for the surrounding message paths that call it with `0` and `1` at `0x00514fed` and `0x00514fd8`. Current grounded caller is the neighboring train-side window family rooted at `0x006d3b20`, which reuses the same selected-train context but is not yet safely named.","objdump + caller inspection + control-flow inspection + side-toggle correlation"
0x005130f0,62,shell_trainbuy_window_query_selected_train_record,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Returns the currently selected train record or `0` when the active shell detail controller at `0x006d0818` does not hold one valid train id in `[this+0x90]`. The helper validates that selected id against the train collection at `0x006cfcbc` and then resolves the live record through `0x00518140`. Current grounded callers include the neighboring train-side shell window family around `0x005146d6`, `0x00514ce2`, and `0x00515176`, which repeatedly reuse the same selected-train pointer for route, upgrade, and warning flows.","objdump + caller inspection + nearby-family correlation + selected-train correlation"
0x00513130,51,shell_trainbuy_window_query_selected_train_id,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Returns the currently selected train id from the active shell detail controller at `0x006d0818` when that id is positive and still present in the train collection at `0x006cfcbc`; otherwise returns `-1`. Current grounded callers are the same neighboring train-side shell families that package selected-train requests for local and multiplayer follow-on work.","objdump + caller inspection + nearby-family correlation + selected-train-id correlation"
0x00513170,44,shell_trainbuy_window_has_valid_selected_train,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Boolean validity probe above `shell_trainbuy_window_query_selected_train_id`. The helper returns `1` only when the active shell detail controller at `0x006d0818` currently holds one positive train id in `[this+0x90]` and that id is still live in the train collection at `0x006cfcbc`. Current grounded callers include the train-side command family around `0x00514c66`, `0x00514cb5`, `0x00514d9c`, and `0x0051515c`, where it gates nearly every selected-train verb before deeper ownership or route checks run.","objdump + caller inspection + nearby-family correlation + selected-train-id correlation"
0x005131a0,125,shell_trainbuy_window_selected_train_belongs_to_selected_company,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Boolean ownership probe for the currently selected train. After resolving the selected train record through the same `0x006d0818` plus `0x006cfcbc` path as `shell_trainbuy_window_query_selected_train_record`, the helper compares that record's linked company id at `[train+0x51]` against the current scenario-selected company from `0x004337a0`. It returns `1` only when they match. Current grounded callers include the neighboring train-side command family, where failure falls into the explicit warning path at `0x00513220`.","objdump + caller inspection + nearby-family correlation + company-match correlation"
0x00513220,351,shell_trainbuy_window_warn_selected_train_not_owned_by_current_company,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Shared warning modal raised when a selected train does not belong to the current scenario-selected company. The helper resolves one player-facing label through `0x004a8bd0` when a live selected train exists, falls back to the static string block at `0x005c87a8` otherwise, formats localized id `0x250`, and then opens the standard callback-driven shell modal through `shell_open_custom_modal_dialog_with_callbacks` at `0x004c98a0`. Current grounded caller is the ownership-failure branch immediately after `shell_trainbuy_window_selected_train_belongs_to_selected_company` at `0x00514a35`.","objdump + caller inspection + nearby-family correlation + modal correlation"
0x00513720,168,shell_trainbuy_window_refresh_selection_column_empty_state_labels,shell,thiscall,inferred,objdump + caller inspection + control-flow inspection,4,"Refreshes the paired empty-state labels and styles on controls `0x65a1` and `0x65a2`. The helper inspects the currently active side resource `0x65a3/0x65a4`, checks whether its list selection at `[resource+0x1d6]` is negative, and then switches the two visible placeholder strings between localized ids `0x25b..0x25e` while also rewriting both controls' styles through `0x00540120`. Current grounded callers are the neighboring train-side shell window family constructor at `0x005145f3` and the row-selection action lane at `0x005148f3`.","objdump + caller inspection + control-flow inspection + placeholder-label correlation"
0x00514110,67,shell_train_detail_window_refresh_selected_train_name_label,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Small dynamic-label refresher beneath the shell-side `TrainDetail.win` family rooted at `0x006d3b20`. After validating the currently selected train id from the shell detail controller at `0x006d0818`, the helper resolves control `0x659d` inside the live `TrainDetail.win` singleton and forwards the caller-supplied subject string through `0x004bffc0`. Current grounded caller is the family constructor at `0x00514420`, which binds this helper as the dynamic-text callback for control `0x659d`.","objdump + caller inspection + strings correlation + callback binding"
0x00514160,704,shell_train_detail_window_refresh_controls,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Refreshes the visible control state for the shell-side `TrainDetail.win` family rooted at `0x006d3b20`. The helper rewrites the two top selection bands `0x65a3` and `0x65a4` from the current side latch at `0x006d3b24`, rebuilds the selected train's nested row state from the current train record resolved through the shell detail controller at `0x006d0818`, installs the per-row callbacks and renderers for the metric rows `0x65b6`, `0x65b9`, `0x65bc`, and `0x65bf`, updates the placeholder and summary text controls `0x659a`, `0x659b`, and `0x659d`, and then refreshes the current row selection plus the paired empty-state labels through `0x004bf320` and `shell_trainbuy_window_refresh_selection_column_empty_state_labels` at `0x00513720`. Current grounded callers are the family constructor at `0x00514420`, the opener at `0x00514620`, and several action paths inside the family message dispatcher at `0x00514690`.","objdump + caller inspection + strings correlation + callback binding + row-state correlation"
0x00514420,512,shell_train_detail_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Constructs the shell-side `TrainDetail.win` singleton later published at `0x006d3b20`. The constructor seeds the local vtable at `0x005d1990`, caches three shell runtime handles in `0x006d3b14..0x006d3b1c`, binds the `TrainDetail.win` resource directly through `0x0053fa50` using the embedded string at `0x005d19c0`, and then wires the family controls and callbacks through `0x00540120`. Current grounded bindings are broad enough to treat this as the full `TrainDetail.win` family: it installs row-click callbacks on `0x65a3` and `0x65a4`, metric renderers on `0x65ab` and `0x65ac`, the selected-train callback on `0x659c`, the dynamic-name label callback on `0x659d`, seeds the side-toggle state through `shell_trainbuy_window_refresh_selection_side_toggle` at `0x00512f80`, and then refreshes the full window through `shell_train_detail_window_refresh_controls` at `0x00514160`. Current grounded callers are the shell detail-panel transition manager at `0x004ddda1` and the direct opener at `0x00514620`.","objdump + caller inspection + strings correlation + callback binding + singleton correlation"
0x00514620,110,shell_open_or_focus_train_detail_window,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Shared opener or focus path for the shell-side `TrainDetail.win` singleton. When the caller supplies one valid train id present in the train collection at `0x006cfcbc`, the helper can seed the selected train subject through `0x004a7390`; when a live `TrainDetail.win` singleton already exists at `0x006d3b20` and the current shell runtime subject matches the incoming one, it simply refreshes that window and pings the shell runtime. Current grounded direct caller is the surrounding shell command path at `0x0046cbda`, and the existing constructor edge at `0x004ddda1` confirms that this opener sits above the same `TrainDetail.win` family rather than the neighboring `Trainbuy.win` singleton.","objdump + caller inspection + strings correlation + singleton correlation"
0x00514690,1920,shell_train_detail_window_handle_message,shell,thiscall,inferred,objdump + caller inspection + control-flow inspection + RT3.lng strings,4,"Primary message dispatcher for the shell-side `TrainDetail.win` family rooted at `0x006d3b20`. The handler processes shell messages `0`, `0xca`, `0xcb`, and the recurring service message `0x3e9`; routes the top-level side-toggle, list-selection, and metric-row controls through a dispatch table over resources `0x659c..0x6947`; repeatedly reuses the currently selected train via the helper family at `0x005130f0..0x00513220`; and fans out into several now-bounded train verbs. Current explicit branches include one selected-train engine-replacement or trainbuy handoff lane that checks scenario gate `[0x006cec78+0x4a97]`, raises localized ids `593` `That action is not allowed in this scenario.` and `594` `You can not replace the engine while the train is broken-down.` on failure, and otherwise re-enters `shell_open_or_focus_trainbuy_window` at `0x00512c50` or the neighboring local follow-on path at `0x00436820`; one selected-train retirement lane that checks `[0x006cec78+0x4a9b]`, rejects blocked states through ids `595` and `597`, confirms through id `596`, and then either tears the train down locally through the train collection plus `shell_detail_panel_transition_manager` mode `2` or packages multiplayer opcode `0x37`; plus one tighter route-edit lane over the shared `0x33`-stride route-entry family, where removal re-enters `train_route_list_remove_entry_and_compact` at `0x004b3000` and staged insertion re-enters `train_route_list_insert_staged_entry_at_index` at `0x004b3160`, then validates the resulting route through `train_route_list_validate_reachability_and_station_pair` at `0x004b2c10` and commits the follow-on train state through `train_set_route_operating_mode_and_scalar` at `0x004ab980`, with multiplayer opcode mirrors `0x3d`, `0x3f`, and `0x41`. It also consumes the family refresh path through `shell_train_detail_window_refresh_controls` at `0x00514160`. Current evidence is broad enough to treat this as the full `TrainDetail.win` message owner even though several deeper per-action verbs remain semantically open.","objdump + caller inspection + control-flow inspection + dispatch-table inspection + selected-train helper correlation + RT3.lng strings"
0x004a01a0,789,route_entry_collection_try_build_path_between_optional_endpoint_entries,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy route-entry collection method over the global route store at `0x006cfca8`. The helper accepts up to two optional endpoint-entry pointers or ids, two endpoint coordinate pairs, a route-policy or mode byte, and optional output slots for the chosen endpoint-entry ids. It first resolves any supplied route-entry ids through `0x00518140` and projects them back to compact coordinate pairs through `0x0048a170`, rejects early when either endpoint lands on an invalid world tile through `0x00449980`, and computes one span scalar through `0x004952f0`. When the leading endpoint entry is absent it can synthesize one fresh route entry from the supplied coordinates and policy arguments through `0x00493cf0`; after that it resolves the chosen entry, copies four `3*dword` route-shape or bounding blocks from that entry into the collection-owned builder-state area at `[this+0x139]..[this+0x167]` through `0x005394b0`, stores the chosen endpoint coordinates at `[this+0x11d]` and `[this+0x121]`, latches one active-builder flag at `[this+0x118]`, and stages one linked entry field from `[entry+0x202]` into `[this+0x125]`. On one newly synthesized-entry path and policy bytes `1/2` it also touches the auxiliary route-entry family at `0x006cfcb4` through `0x004a42b0`, `0x00494f00`, and `0x004a4340`. Current caller evidence now narrows one more policy case: both the later world-side caller at `0x00480cd0` and the linked-site refresh helper `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0` enter this helper with both optional endpoint-entry ids unset and literal policy byte `2`, so the strongest current read for that byte is a full linked-site route-anchor rebuild between optional endpoint entries rather than the narrower direct endpoint-anchor creation or replacement lane carried by literal byte `1` in `0x00493cf0`. The helper then resets the collection's transient path-search state through `0x00495480`, re-enters the deeper route-search core at `0x0049d380`, optionally writes the chosen endpoint-entry ids back through the caller-supplied output pointers on success, and finally tears down the transient search state through `0x00495540` and `0x0049ad90`. Current grounded callers are the early route-search lane inside `city_connection_try_build_route_with_optional_direct_site_placement` `0x00402cb0`, two neighboring retry branches at `0x004030d0` and `0x00403330`, a paired startup-connection branch at `0x00403ac0`, that later world-side caller at `0x00480cd0`, and the linked-site refresh helper at `0x00480bb0`. This now looks like the shared route-entry search or synthesis owner above the deeper path-search core rather than a generic route-store mutator.","objdump + caller xrefs + callsite inspection + route-entry search correlation + builder-state correlation + partial-mode-byte correlation + linked-site refresh correlation + linked-site policy-byte split correlation"
0x00489f80,11,route_entry_assign_aux_tracker_group_id,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,3,"Tiny route-entry helper that writes the caller-supplied auxiliary tracker id into route-entry field `+0x212`. Current grounded callers include the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0`, the route-search core `0x0049d380`, the broader regrouping pass `0x004a45f0`, and neighboring tracker-update branches at `0x004996e0`, `0x004a4380`, `0x004a4ce0`, and `0x004a4ff0`. This now looks like the direct route-entry aux-tracker group-id assignment helper rather than a generic field store.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
0x00493cf0,456,route_entry_collection_create_endpoint_entry_from_coords_and_policy,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Creates one fresh route-entry endpoint record from caller-supplied coordinates and a small policy tuple. The helper rejects when either coordinate pair falls outside the live world bounds in `0x0062c120`, optionally validates the supplied company id through `0x0062be10` and `company_query_available_track_laying_capacity_or_unlimited` `0x004240a0`, allocates a new route-entry-like record from the current collection through `0x00518900` with type `0x257`, applies one company-side setup branch through `company_adjust_available_track_laying_capacity_with_floor_zero` `0x00423ec0` when the company id is nonzero, and then commits the detailed endpoint payload through `0x00490ac0`. It can also re-enter `0x00491e60` when the created record or the owning collection keeps one follow-on latch set, and if the collection field `[this+0x88]` is still unset it seeds that field from the created record's word at `+0x240`. Current mode-byte evidence is still partial but tighter now. Literal policy byte `1` is the strongest current match for direct linked-site endpoint-anchor creation or replacement, because the linked-site constructor and its nearby repair branches at `0x00480463`, `0x00480a77`, and `0x00480b69` all pass that byte before rebinding one chosen anchor through `0x0048abc0`. The TrackLay-side callers at `0x0050df1e` and `0x0050eec6` are tighter now too: they derive the passed policy byte from the shared TrackLay mode `0x00622b0c` through `route_entry_collection_map_track_lay_mode_to_endpoint_policy_byte` `0x004955b0`, which currently gives the strongest read `policy 1 = single-track endpoint synthesis` and `policy 4 = double-track endpoint synthesis`. Bytes `1/2` are also the ones later reused by `0x004a01a0` to enable the auxiliary tracker lane, while the company-side charge split is no longer vague: when a company id is present, ordinary company-bound synthesis passes `-1` into `0x00423ec0`, while byte `4` instead passes `-2`, so the current strongest read is that policy byte `4` consumes a larger company-side available-track-laying-capacity unit rather than skipping the company setup branch outright. The older builder-state path at `0x0046f2d1` still passes a dynamic byte from `[esi+0x05]`. The function returns the newly created route-entry id or `-1` on failure. Current grounded callers include `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0`, those neighboring route-building branches, and the TrackLay-side callers at `0x0050df1e` and `0x0050eec6`, so this now looks like the shared endpoint-entry synthesis helper rather than a generic collection allocator.","objdump + caller xrefs + callsite inspection + route-entry creation correlation + partial-mode-byte correlation + caller-pattern correlation + route-build-capacity correlation + linked-site policy-byte split correlation + TrackLay mode correlation"
0x00494e40,61,aux_route_entry_tracker_reset,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Zeroes or reinitializes one small auxiliary route-entry tracker record. The helper seeds the two endpoint-entry ids at `+0x04` and `+0x08` to `-1`, clears the small refcount at `+0x10`, clears the cached route-key and class-signature words at `+0x18` and `+0x1e`, resets the boolean latch at `+0x1c` to `0`, and clears the trailing payload band through `+0x42`. Current grounded callers are the tracker allocator paths at `0x004a42b0` and several neighboring `0x006cfcb4` setup sites, so this is the clearest current initializer for the auxiliary route-entry tracker family.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
0x00494e90,15,aux_route_entry_tracker_seed_owner_entry_id,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Seeds one auxiliary route-entry tracker with its owner or primary route-entry id. The helper writes the caller-supplied id into tracker field `+0x00` and clears the small accumulator fields at `+0x42` and `+0x46`. Current grounded callers are the tracker allocator paths at `0x004a42b0`, which use it immediately after allocating one `0x006cfcb4` record keyed by a route-entry id.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
0x00494eb0,15,aux_route_entry_tracker_adjust_refcount,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Adds the caller-supplied delta into the small refcount field at tracker offset `+0x10` and returns the updated total. Current grounded callers are the collection-side tracker updater `0x004a4340`, where a zero result triggers the tracker's destruction path.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
0x00494ed0,26,aux_route_entry_tracker_contains_endpoint_entry_id,map,thiscall,inferred,objdump + caller xrefs + field-layout inspection,2,"Small membership probe over one auxiliary route-entry tracker. The helper returns `1` when the caller-supplied route-entry id matches either tracker endpoint slot `+0x04` or `+0x08`, and `0` otherwise. Current grounded callers include several tracker-regroup and repair branches around `0x00490d62`, `0x0049a9ed`, `0x0049f162`, and `0x004a4ce0`, where it acts as the cheap endpoint-membership test beneath adjacent-chain transfer and duplicate-split logic.","objdump + caller xrefs + field-layout inspection + tracker-family correlation"
0x00494f00,176,aux_route_entry_tracker_merge_or_bind_endpoint_entry,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Binds one route-entry id into the two-endpoint auxiliary tracker record. The helper resolves the supplied route-entry through `0x006cfca8`, derives one route-key-like value through `0x0048aa70`, reads the route-entry signature fields at `+0x22e` and byte `+0x44`, and then either seeds both endpoint slots `+0x04/+0x08` on the first bind or merges the new entry into one side when the signature, route-key, and boolean class latch match the tracker's existing state. On failure it returns `0`; on success it returns `1`. Current grounded callers are the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring `0x006cfcb4` tracker update branches around `0x0049f1ce`, `0x0049f38d`, `0x0049f90b`, `0x004a4685`, `0x004a4830`, `0x004a4982`, `0x004a5175`, and `0x004a5189`. This now looks like the tracker-side endpoint bind or merge helper rather than a generic route-entry accessor.","objdump + caller xrefs + callsite inspection + tracker-family correlation"
0x00494fb0,97,aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Refreshes the small boolean class latch at tracker offset `+0x1c` and notifies the owning route-entry group when that latch changes. When the route-store latch `[0x006cfca8+0xf1]` is clear, the helper resolves the current endpoint-entry ids from `+0x04` and `+0x08`, recomputes whether the bound endpoint pair carries the nonzero route-entry byte `+0x44` on both sides, writes the resulting boolean back into `+0x1c`, compares it against the previous latch value, and on change calls `0x004a6360` on the auxiliary tracker collection `0x006cfcb4` with the owner entry id at `+0x00`. Current grounded callers are the neighboring route-state branch at `0x004915e0` and the compatible endpoint-slot rewrite helper `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0`. This now looks like the tracker-side boolean class-latch refresh plus owner-notify path rather than a generic predicate helper.","objdump + caller xrefs + callsite inspection + tracker-family correlation + owner-notify correlation"
0x00495020,188,aux_route_entry_tracker_refresh_cached_match_fields_and_maybe_split_duplicate_pair,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + field-layout inspection,3,"Refreshes one auxiliary tracker's cached match metadata and clears its trailing relationship payload band. Under two scenario-threshold branches keyed by `[0x006cec78+0x46c34]`, the helper seeds or refreshes tracker cache fields from the currently bound endpoint pair: it derives one route-key-like value through `0x0048aa30`, reuses one endpoint signature word from route-entry field `+0x22e`, and falls back to constant `1` when no endpoint slot is available on the active branch. After that it zeroes the trailing payload band at `+0x24..+0x46`. When both endpoint slots `+0x04` and `+0x08` still point to the same route-entry id and the tracker refcount `+0x10` is greater than `1`, it tail-calls the deeper split or reseed path at `0x004a51a0` with the owner route-entry id at `+0x00`. Current grounded caller is the broader tracker-side branch at `0x004a41b0`. The current objdump shape keeps the exact `+0x18/+0x1e` destination split slightly irregular on the second threshold path, so this row stays conservative about the final field assignment while still grounding the helper as cached-match refresh plus duplicate-pair split prep.","objdump + caller xrefs + callsite inspection + field-layout inspection + tracker-family correlation"
0x004950f0,128,aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Rewrites one matching endpoint slot in an auxiliary tracker after compatibility checks. The helper validates the replacement route-entry id, derives its route-key-like value through `0x0048aa70`, requires that value plus the route-entry signature word `+0x22e` to match the tracker's cached comparison fields, and then only replaces endpoint slot `+0x04` or `+0x08` when the caller-supplied old endpoint id currently occupies that slot. After any replacement it re-enters `aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner` `0x00494fb0` so the boolean class latch at `+0x1c` stays in sync. It returns `1` when a slot was replaced and `0` otherwise. Current grounded callers include the route-search core `0x0049d380`, the broader regrouping pass `0x004a45f0`, the neighboring route-state helpers at `0x00490bf0` and `0x004996e0`, and the tracker-side link-rewrite family at `0x004a4ce0`. This now looks like the compatibility-checked endpoint-slot rewrite helper beneath the auxiliary tracker family rather than a generic record mutator.","objdump + caller xrefs + callsite inspection + tracker-family correlation + endpoint-slot rewrite correlation"
0x004955b0,43,route_entry_collection_map_track_lay_mode_to_endpoint_policy_byte,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Small mapper from the live TrackLay primary mode into one of the endpoint-synthesis policy bytes consumed by `route_entry_collection_create_endpoint_entry_from_coords_and_policy` `0x00493cf0`. The helper returns `1` immediately when the caller-supplied mode dword is `1`; otherwise it inspects two route-store state fields at `[this+0x1e1]` and `[this+0x1fd]` before either keeping that same `1` fallback or returning `4`. Current grounded callers are the TrackLay-side branches at `0x0050df00` and `0x0050eea8`, where the input mode comes directly from the shared TrackLay state at `0x00622b0c` already bounded as `Lay single track.` `0x1`, `Lay double track.` `0x4`, and `Bulldoze` `0x40`. That makes the strongest current read `policy 1 = single-track endpoint synthesis` and `policy 4 = double-track endpoint synthesis`, with one route-store-state-dependent fallback still preventing a fully closed user-facing name.","objdump + caller xrefs + callsite inspection + TrackLay mode correlation + partial-policy-byte correlation"
0x004952f0,208,math_compute_quadrant_adjusted_heading_angle_from_xy_pair,map,cdecl,inferred,objdump + caller xrefs + arithmetic inspection,4,"Computes one quadrant-adjusted heading angle from two float XY point pairs. The helper handles the vertical-line degeneracy explicitly by returning `pi/2` or `3*pi/2`, otherwise computes one arctangent ratio through the CRT helper at `0x005a1270` and then adds either `pi` or `2*pi` when the caller's delta pair lands in the corresponding quadrant. The result is a normalized heading-like angle in the `0 .. 2*pi` range. Current grounded callers include the route-entry search family at `0x004a01a0`, `0x0049d380`, and `0x0049c900`, plus several neighboring route and world-side geometry branches.","objdump + caller xrefs + arithmetic inspection + constant correlation"
0x004953c0,95,math_normalize_subtracted_angle_delta_and_report_wrap,map,thiscall,inferred,objdump + caller xrefs + arithmetic inspection,4,"Subtracts one angle from another and normalizes the resulting delta back into the principal `[-pi, pi]` range. When the optional pointer in `ECX` is nonnull the helper clears it to `0`, then sets it to `1` only when the delta had to be wrapped by adding or subtracting `2*pi`. Current grounded callers include the route-entry search family at `0x0049d380` and `0x0049c900`, several route-node or waypoint geometry branches, and neighboring world-side angle tests. This now grounds `0x004953c0` as a reusable wrapped-angle-delta helper rather than another anonymous quality check.","objdump + caller xrefs + arithmetic inspection + constant correlation"
0x0049d380,1134,route_entry_collection_search_path_between_entry_or_coord_endpoints,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy internal route-search core beneath the route-entry synthesis family. The helper accepts a leading route-entry id, one company id, two endpoint coordinate pairs, a route-policy tuple, one optional external target entry id, and several scratch or output buffers. It begins by validating the company id through `0x0062be10` and `company_query_available_track_laying_capacity_or_unlimited` `0x004240a0` when present, then packages the current search context into the collection-owned builder state, including one current-search latch at `[this+0x1d5]` and one distance-like scalar at `[this+0x1d1]`. From there it runs three bounded internal stages. First, it enters the deeper candidate path sweep at `0x0049bd40`; this can return a direct matching route-entry id or leave the search unresolved. Second, when that first stage does not settle the search, it rehydrates the returned route entry through `0x0048a170`, evaluates point-to-point distance, span, and angle-like quality terms through `math_measure_float_xy_pair_distance` `0x0051db80`, `0x004952f0`, `0x004953c0`, and `0x005a152e`, and only accepts the result when those quality gates pass. Third, when the quality gates or initial sweep fail, it can fall back to route-entry extension helpers `0x00494cb0` and `0x0049c900`, plus route-state propagation through `0x0048e600`, while rewriting several collection-side path blocks rooted at `[this+0x169]`, `[this+0x175]`, `[this+0x181]`, `[this+0x18d]`, `[this+0x199]`, `[this+0x1a5]`, `[this+0x1b1]`, and `[this+0x1bd]`. The function returns one resolved route-entry id or `-1`, and current direct callers are only internal route-entry family wrappers at `0x004a0470`, `0x004a0870`, `0x004a0b2a`, and `0x004a0cef`. In current evidence this is the search core that the higher wrapper `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` hands off to after endpoint reuse or synthesis, rather than a user-facing route mutator by itself.","objdump + caller xrefs + callsite inspection + path-search correlation + builder-state correlation + distance-helper correlation + track-laying-capacity correlation"
0x0049bd40,982,route_entry_collection_run_initial_candidate_path_sweep,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Runs the first candidate route sweep beneath `route_entry_collection_search_path_between_entry_or_coord_endpoints` `0x0049d380`. The helper clears any prior temporary path list through `0x0049ad90`, seeds two caller-owned status dwords, resolves the starting route-entry id through the collection, rejects one trivial or degenerate local-delta case, and then seeds an initial extension attempt through `0x00494cb0`. From there it builds one temporary candidate chain in `[this+0x1cd]`, derives route quality terms from point-to-point distance through `math_measure_float_xy_pair_distance` `0x0051db80`, re-enters the route-node search against the auxiliary tracker collection `0x006cfcb4` through `0x004a6630`, and on a passing result publishes one follow-on route-entry id through the caller-supplied output slot. Current evidence now narrows the internal quality policy too: when the route-state gate at `[this+0xe9]` stays clear the helper selects a larger quality multiplier of `1.8` on route-policy byte `4` or field `[0x006cec78+0x4c74]`, and otherwise uses `1.4`; the same branch also folds in one signed angle-bias term `+/-0.181000038854627` before the later acceptance checks. That field is still the same player-facing TrackLay preference slot grounded elsewhere as `Auto-Show Grade During Track Lay`, but on this route-search lane it now reads more concretely as a temporary search-quality override: the shared city-connection builder `0x00402cb0` and the broader company periodic pass `0x004019e0` both mirror electric-locomotive context into it specifically to force this same larger initial-sweep multiplier branch. Current grounded direct caller is the search core `0x0049d380`, where this helper is the first stage before the later quality-gate and extension fallbacks. This now looks like the initial candidate path sweep rather than a generic collection iterator.","objdump + caller xrefs + callsite inspection + candidate-sweep correlation + tracker-family correlation + quality-threshold constant correlation + distance-helper correlation + temporary-override correlation"
0x0049c900,829,route_entry_collection_try_extend_search_frontier_toward_target_coords,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Tries to extend the current route-search frontier toward one target coordinate pair. The helper starts from two endpoint coordinate pairs plus one caller-owned result slot, initializes that result slot to `-1`, computes span and angle-like quality terms through `0x004952f0`, `0x005a152e`, and the same constant families used by the search core, and then repeatedly advances the search sample window until one candidate route extension passes the quality thresholds. Current evidence now narrows those thresholds too: this helper reuses the same signed angle-bias family `+/-0.181000038854627` seen in the initial candidate sweep before deciding whether to probe a covering entry. On successful passes it re-enters `route_entry_collection_try_find_route_entry_covering_point_window` `0x00494cb0`, verifies the returned entry through `0x0048ba40`, `0x004953c0`, and neighboring state bytes, and publishes the accepted route-entry id through the caller-owned result pointer. On failure it leaves that pointer at `-1`. Current grounded direct callers are the search core `0x0049d380` and the neighboring route wrapper at `0x004a0740`, which together make this the clearest current extension or frontier-advance helper beneath the route-entry search family rather than a free-standing world query.","objdump + caller xrefs + callsite inspection + frontier-extension correlation + quality-threshold constant correlation"
0x00494cb0,398,route_entry_collection_try_find_route_entry_covering_point_window,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Searches the current route-entry collection for one entry whose sampled span covers the caller's point window. The helper rejects immediately when the supplied window radius is nonpositive, quantizes the caller's center coordinates into world-grid bounds, iterates the resulting rectangular tile window inside `0x0062c120`, and repeatedly re-enters `0x004921a0` on each candidate tile or route bucket until it finds one acceptable route-entry id. Current grounded callers include the station-attachment validation lane at `0x00403d30`, the placement validator at `0x00417ba1` and `0x0041a2c9`, the world-side route mutation lane at `0x00480d88`, the initial candidate sweep `0x0049bd40`, the search core `0x0049d724`, and several neighboring route-search branches. This now looks like the shared route-entry point-window coverage query beneath both placement-side track attachment and the heavier route-entry search family rather than a generic tile scan.","objdump + caller xrefs + callsite inspection + world-grid correlation + route-window correlation"
0x004a42b0,79,aux_route_entry_tracker_collection_allocate_entry,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Allocates one new tracker record in the auxiliary route-entry collection at `0x006cfcb4` and seeds it for one owner route-entry id. The helper resets a small local tracker template through `aux_route_entry_tracker_reset` `0x00494e40`, allocates one live record from the collection through `0x00518900`, resolves that record, seeds its owner entry id through `aux_route_entry_tracker_seed_owner_entry_id` `0x00494e90`, and returns the new tracker id. Current grounded callers include `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring route-state branches at `0x0049e174`, `0x0049e3d8`, `0x0049e427`, `0x0049e45c`, `0x0049f1b0`, `0x0049f3b5`, `0x0049f91a`, `0x004a466d`, `0x004a4814`, `0x004a4966`, and `0x004a5054`, so this is now the clearest current allocator for the auxiliary route-entry tracker family.","objdump + caller xrefs + callsite inspection + tracker-family correlation"
0x004a4340,55,aux_route_entry_tracker_collection_adjust_refcount_or_destroy,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Looks up one tracker record in the auxiliary route-entry collection at `0x006cfcb4`, adjusts its small refcount through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`, and destroys the record through the collection vtable when the resulting count reaches zero. Current grounded callers include the synthesis-side lane in `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` and several neighboring route-state branches at `0x00490da5`, `0x0049a9b8`, `0x0049abca`, `0x0049f178`, `0x0049f1a2`, `0x0049f1e0`, `0x0049f37e`, `0x0049f3a7`, `0x004a4f9c`, `0x004a4fb0`, and `0x004a5161`. This now looks like the shared refcount or destroy path for the auxiliary route-entry tracker family rather than another anonymous collection helper.","objdump + caller xrefs + callsite inspection + tracker-family correlation"
0x004a4380,619,aux_route_entry_tracker_collection_try_split_route_entry_chain_into_fresh_group,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Broader prepass beneath the auxiliary route-entry tracker regrouping family at `0x006cfcb4`. Starting from one existing tracker id, the helper snapshots the source tracker's cached match tuple at `+0x18/+0x1c/+0x1e` plus its endpoint slots `+0x04/+0x08`, walks the adjacent route-entry chain through the `+0x206/+0x20a/+0x20e` family, and watches for a subchain whose route-key-like value from `0x0048aa70`, signature word `+0x22e`, or boolean class byte `+0x44` no longer matches the source tracker. When that mismatch survives the surrounding guards, it allocates one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, seeds or binds the moved entries through `aux_route_entry_tracker_seed_owner_entry_id` `0x00494e90` and `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, reassigns the traversed route entries through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, and rebalances the two trackers' counts through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`. Current grounded direct caller is `aux_route_entry_tracker_collection_refresh_route_entry_group_membership` `0x004a45f0`, where this helper runs as the early split prepass keyed by the current route entry's tracker id. This now looks like the chain-splitting helper that carves a mismatching adjacent subchain into one fresh tracker group rather than a generic collection walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + regrouping prepass correlation"
0x004a45f0,1420,aux_route_entry_tracker_collection_refresh_route_entry_group_membership,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavy regrouping pass over the auxiliary route-entry tracker collection at `0x006cfcb4`. The helper starts from one route-entry record, rejects the trivial case where both adjacent route-entry fields `[entry+0x206]` and `[entry+0x20a]` are unset, optionally runs `aux_route_entry_tracker_collection_try_split_route_entry_chain_into_fresh_group` `0x004a4380` keyed by the route entry's current tracker id in `[entry+0x212]`, and then refreshes ownership around that id. On the simpler branch it can allocate one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, bind one or more route-entry ids into it through `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, assign the resulting tracker id back into route-entry field `+0x212` through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, and rebalance tracker refcounts through `aux_route_entry_tracker_adjust_refcount` `0x00494eb0`. The current endpoint-bind semantics are tighter now too: the bind helper groups entries only when their route-key-like value from `0x0048aa70`, route-entry signature word `+0x22e`, and boolean class latch derived from byte `+0x44` all agree. On the larger branch this pass walks adjacent route-entry links through the `+0x206/+0x20a/+0x20e` family, can re-enter `aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups` `0x004a4ce0` to migrate compatible neighboring subchains between tracker groups, uses `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0` to rewrite compatible endpoint slots, and can re-enter the nearby cached-match refresh path `0x00495020` before dropping empty tracker records through the collection vtable. Current grounded caller is `placed_structure_refresh_linked_site_display_name_and_route_anchor` `0x00480bb0`, where this pass runs immediately after literal-policy-`2` route-anchor rebuild and bind. This now looks like the auxiliary tracker regrouping pass beneath the broader linked-site route-anchor rebuild lane rather than a generic collection sweep.","objdump + caller xrefs + callsite inspection + tracker-family correlation + linked-site refresh correlation + endpoint-match-tuple correlation + chain-transfer correlation"
0x004a4c00,224,aux_route_entry_tracker_route_entry_pair_pass_adjacent_chain_transfer_gate,map,thiscall,inferred,objdump + callsite inspection + field-layout inspection,3,"Compatibility gate used before adjacent tracker-chain transfers. Given two route-entry records, the helper validates both current tracker ids in the auxiliary tracker collection at `0x006cfcb4`, resolves the two tracker records, and then requires a matching cached comparison tuple across both trackers: byte `+0x1d` must be nonzero on both sides, dwords `+0x18` and `+0x1e` must match, and boolean latch byte `+0x1c` must match. It also requires both candidate route entries to keep their special side fields at `+0x20e` and `+0x222` unset at `-1`. Only when all of those checks pass does it return `1`; otherwise it returns `0`. Current grounded direct caller is `aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links` `0x004a6360`, where this gate sits directly above the adjacent-chain transfer helper `0x004a4ce0`. This now looks like the reusable adjacent-chain transfer compatibility gate rather than a generic pairwise predicate.","objdump + callsite inspection + field-layout inspection + tracker-family correlation + transfer-gate correlation"
0x004a4ce0,777,aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Reusable cross-group migration helper beneath the auxiliary route-entry tracker collection at `0x006cfcb4`. Given two tracker ids plus one cached match tuple, the helper first verifies that collection-busy latches are clear, validates the destination tracker's cached fields at `+0x18/+0x1c/+0x1d/+0x1e`, then walks one adjacent route-entry chain through the `+0x206/+0x20a/+0x20e` family while using `aux_route_entry_tracker_contains_endpoint_entry_id` `0x00494ed0` to avoid trampling the destination tracker's existing endpoint entries. Compatible traversed entries are reassigned into the destination group through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, source and destination tracker populations are rebalanced through `aux_route_entry_tracker_collection_adjust_refcount_or_destroy` `0x004a4340` and the raw `+0x14` count field, and the destination endpoint slots can be rewritten through `aux_route_entry_tracker_replace_matching_endpoint_entry_and_refresh_latch` `0x004950f0` before any emptied source tracker is destroyed. Current grounded callers include the owner-refresh family at `0x004a6360` plus neighboring route-state branches at `0x0049ac78`, `0x0049ff6e`, and `0x004a645a..0x004a65a3`. This now looks like the adjacent-chain transfer helper between compatible tracker groups rather than a generic collection mutator.","objdump + caller xrefs + callsite inspection + tracker-family correlation + adjacent-chain transfer correlation"
0x004a4ff0,454,aux_route_entry_tracker_collection_reseed_group_from_route_entry_component,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Repair or reseed helper over the auxiliary route-entry tracker collection at `0x006cfcb4`. Starting from one route-entry id whose current tracker membership is missing or invalid, the helper allocates one fresh tracker through `aux_route_entry_tracker_collection_allocate_entry` `0x004a42b0`, assigns that tracker id into the starting entry through `route_entry_assign_aux_tracker_group_id` `0x00489f80`, walks the connected route-entry component through `0x0048e140` and `0x0048e160`, and migrates each adjacent member that still carries the stale tracker id into the new group while counting the moved entries. It then updates the involved tracker populations, binds the new component's endpoint entries back into the fresh tracker through two calls to `aux_route_entry_tracker_merge_or_bind_endpoint_entry` `0x00494f00`, and returns. Current grounded callers include the route-state repair branch at `0x0048b896` and the broader tracker traversal pass at `0x004a6244`. This now looks like the component-level tracker-group reseed helper used when a route-entry component has lost valid tracker ownership rather than a generic regrouping walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + reseed correlation"
0x004a5fc0,928,aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Collection-wide traversal refresh for the auxiliary route-entry tracker family at `0x006cfcb4`. The helper clears the collection dirty latch at `[this+0x8c]`, allocates one temporary queue array at `[this+0x94]`, resets every live tracker's traversal label field at `+0x0c` to `-1`, and then repeatedly walks connected tracker groups until every live record has one stable component label. While traversing, it destroys dead tracker records whose active count has fallen nonpositive, follows adjacent route-entry links outward from each tracker endpoint through the `+0x206/+0x20a/+0x20e` route-entry family, and when one neighboring route entry carries an invalid tracker id it repairs that side immediately through `aux_route_entry_tracker_collection_reseed_group_from_route_entry_component` `0x004a4ff0` before continuing the walk. The refreshed component labels are stored back into tracker field `+0x0c`, and neighboring collection-side queries reuse them after the dirty latch has been cleared. Current grounded callers are the adjacent tracker-query helper at `0x004a6320` and neighboring owner-refresh branches that first test `[this+0x8c]` before trusting cached component labels. This now looks like the collection-wide connected-component refresh and invalid-group reseed pass rather than a generic sweep.","objdump + caller xrefs + callsite inspection + tracker-family correlation + traversal-label correlation + reseed correlation"
0x004a6360,592,aux_route_entry_tracker_collection_refresh_owner_adjacent_compatible_group_links,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Owner-side adjacent-group refresh beneath the auxiliary route-entry tracker family at `0x006cfcb4`. Starting from one owner route-entry id, the helper validates the current tracker, requires its tracker-side enable byte `+0x1d` to be nonzero, resolves the two bound endpoint entries from tracker slots `+0x04` and `+0x08`, and first requires those endpoint entries to agree on the boolean class state derived from route-entry byte `+0x44`. It then inspects adjacent route-entry links hanging off both endpoint sides through the `+0x206/+0x20a` family and, whenever a neighboring route entry belongs to a different tracker group, runs `aux_route_entry_tracker_route_entry_pair_pass_adjacent_chain_transfer_gate` `0x004a4c00` before re-entering `aux_route_entry_tracker_collection_try_transfer_adjacent_chain_between_groups` `0x004a4ce0` to migrate that compatible adjacent chain into the owner's tracker group. Current grounded caller is `aux_route_entry_tracker_refresh_boolean_class_latch_and_notify_owner` `0x00494fb0`, which invokes this helper only when the tracker's boolean class latch at `+0x1c` changes. This now looks like the owner-adjacent compatible-group refresh path triggered by latch changes rather than a generic tracker walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + owner-refresh correlation + compatibility-gate correlation"
0x004a62c0,79,aux_route_entry_tracker_query_tracker_component_labels_match,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Small dirty-aware equality test over tracker component labels in the auxiliary route-entry tracker collection at `0x006cfcb4`. Given two tracker ids, the helper first refreshes stale labels through `aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups` `0x004a5fc0` when collection dirty latch `[this+0x8c]` is set, resolves both tracker records, and returns `1` only when both ids are live and tracker field `+0x0c` matches across the pair. Invalid tracker ids return `0`. Current grounded callers include the alternate recursive pair-metric branch at `0x004a5900`, where this helper gates same-component recursion before adjacent-neighbor expansion.","objdump + caller xrefs + callsite inspection + tracker-family correlation + component-label equality correlation"
0x004a6320,64,aux_route_entry_tracker_collection_query_component_label_by_tracker_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Dirty-aware query helper over the auxiliary route-entry tracker collection at `0x006cfcb4`. The helper first checks collection dirty latch `[this+0x8c]` and re-enters `aux_route_entry_tracker_collection_refresh_component_labels_and_reseed_invalid_groups` `0x004a5fc0` when the cached component labels are stale. It then validates the caller-supplied tracker id through the collection, resolves the live tracker record, and returns the connected-component label stored in tracker field `+0x0c`; invalid tracker ids return `-1`. Current grounded callers are the heavier pair-selection family around `0x004a6630`, where this helper is the reusable query side of the component-label sweep rather than another traversal owner.","objdump + caller xrefs + callsite inspection + tracker-family correlation + component-label query correlation"
0x004a65b0,128,aux_route_entry_tracker_dispatch_route_entry_pair_metric_query,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Build-compatibility-switched lower metric query beneath the auxiliary route-entry tracker pair-selection family. The helper forwards one fixed route-entry pair, one companion output pair, and the surrounding score or scratch arguments into one of two heavier internal algorithms: it dispatches to `0x004a5280` when the shared build-version query at `runtime_query_hundredths_scaled_build_version` `0x00482e00(0x006cec74)` reports at least `0x67`, and otherwise dispatches to `0x004a5900`. The recovered cutovers now line up with executable build values `0x67/0x68/0x69/0x6a == 1.03/1.04/1.05/1.06`, and the version source itself can come from either the local `RT3.EXE` version resource or the multiplayer session-side companion path at `0x0046a4b0`, so this branch now reads most safely as a pre-`1.03` versus `1.03+` route-metric compatibility dispatcher rather than any gameplay time or era gate. Current grounded caller is the broader chooser at `0x004a6630`, which can invoke this helper repeatedly across multiple endpoint combinations, keep the smallest non-`-1` returned score, and publish the chosen route-entry pair through out pointers. Current evidence is therefore tight enough to treat this as the reusable route-entry-pair metric dispatcher beneath that chooser, while the deeper user-facing meaning of the returned metric still lives mostly in the linked-transit and route-validation consumers rather than inside this switch itself.","objdump + caller xrefs + callsite inspection + tracker-family correlation + pair-metric correlation + version-gate correlation + multiplayer-session-version correlation"
0x004a5280,1664,aux_route_entry_tracker_query_route_entry_pair_metric_via_weighted_recursive_search,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavier weighted search branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates tracker membership, can require endpoint-capable entry type byte `[entry+0x216] == 2` when the caller's looser gate is clear, and on top-level entry initializes one global prune threshold at `0x006cfcb0` plus one per-tracker best-cost cache at `0x006cfcac`. It then evaluates up to four candidate continuations: one direct paired-side route entry plus adjacent links `+0x206`, `+0x20a`, and `+0x20e`. For each surviving candidate it resolves route-entry coordinates through `0x0048a170`, computes one float heuristic through `0x0051dbb0`, orders the candidates by that heuristic, accumulates integer step and mismatch penalties, and recursively re-enters itself while pruning against the current best threshold and the per-tracker cache. On success it writes the best integer metric back through one out pointer, the paired companion metric through another, and returns one chosen downstream route-entry id; top-level calls free the temporary cache block before returning. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the weighted recursive route-entry-pair metric search rather than a generic tracker walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + weighted-search correlation + heuristic-ordering correlation + recursive-search correlation"
0x004a5900,1728,aux_route_entry_tracker_query_route_entry_pair_metric_via_recursive_neighbor_walk,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Alternate recursive neighbor-walk metric branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates top-level endpoint eligibility in the same broad way as `0x004a5280`, initializes the same global prune threshold and per-tracker cache on top-level entry, and then recursively explores neighboring route entries through the `+0x206`, `+0x20a`, and `+0x20e` link family. The search stays within compatible tracker-component context through `aux_route_entry_tracker_query_tracker_component_labels_match` `0x004a62c0`, applies optional boolean-class and company gates through tracker latch byte `+0x1c` and `0x00424010`, and accumulates one integer route-step count plus one mismatch penalty count, adding extra cost when route-entry signature word `+0x22e` differs from the caller-supplied filter. The best surviving branch writes the minimal metric and companion penalty back through out pointers, and top-level calls free the temporary per-tracker cache block before returning one chosen downstream route-entry id or one adjacent fallback entry when no recursive hit survives. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the simpler recursive neighbor-walk metric query beneath the weighted branch rather than a generic collection scan.","objdump + caller xrefs + callsite inspection + tracker-family correlation + recursive-neighbor-walk correlation + component-label correlation"
0x004a6630,892,aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavier chooser above the auxiliary route-entry tracker pair-metric dispatcher. Given two route-entry ids plus several out slots and optional gates, the helper validates both route entries and their tracker ids, rejects one caller-requested boolean-class mismatch when the source route-entry byte `+0x44` stays clear, and then has two bounded modes. When both entries pass `0x0048b870`, it directly re-enters `aux_route_entry_tracker_dispatch_route_entry_pair_metric_query` `0x004a65b0` for that fixed pair. Otherwise it resolves the current tracker endpoint slots `+0x04/+0x08` for both sides, derives up to four endpoint-pair combinations from those two tracker groups, and invokes `0x004a65b0` on each surviving combination while keeping the smallest non-`-1` returned metric. The winning route-entry id and companion peer id are written back through out pointers, and current grounded callers reuse the chooser beneath the initial candidate route sweep `0x0049bd40`, the company linked-transit peer-cache builder `0x004093d0`, and the train route validator `0x004b2c10`. This now looks like the best route-entry-pair metric chooser with tracker-endpoint fallbacks rather than a generic sweep.","objdump + caller xrefs + callsite inspection + tracker-family correlation + endpoint-fallback correlation + pair-chooser correlation"
0x004a9460,65,train_current_route_context_uses_strict_reachability_mode,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small boolean gate keyed off the train's current linked route object at `[this+0x41]`. The helper resolves that route object through `0x0062ba84`, follows its class or profile reference through `0x0041adb0`, uses the resulting id at `[profile+0x126]` to query the small class table rooted at `0x006ada84`, and returns `1` only when the final type field at `[entry+0x10]` equals `2`. Current grounded callers include the local and multiplayer route-entry insertion success paths at `0x00515430` and `0x004718fe`, where a true result triggers the stricter second `train_route_list_validate_reachability_and_station_pair` pass before mode `0x13` is selected, and several neighboring simulation branches such as `0x004ad5e2` and `0x004b1ec5` that use the same gate before re-entering the stronger route-state path. Current evidence is therefore tight enough to treat this as a shared current-route-context gate for the stricter reachability or operating-mode family even though the player-facing meaning of class type `2` remains open.","objdump + caller xrefs + callsite inspection + route-context correlation"
0x004a94b0,381,train_finalize_aux_route_entry_buffer_preserving_subflags,simulation,thiscall,inferred,objdump + caller xrefs + route-entry inspection,3,"One train-side cleanup or finalize helper over the auxiliary route-entry wrapper at `[this+0x1c6]`. When that wrapper is present, the helper walks the embedded `0x33`-stride route-entry list rooted at `[aux+0x0c]`, rewrites one bounded payload band back into the selected entries, and explicitly preserves route-entry flag bits `0x40`, `0x20`, and `0x10` in byte `+0x28` across the rewrite. It then frees the auxiliary wrapper through `0x005a1145` and clears `[this+0x1c6]`. Current grounded caller is the larger train-side route-state branch at `0x004b0cf0`, where this helper sits behind the scenario-state gate at `0x00434050` and ahead of the later current-route-entry resolution path. Current evidence is therefore strong enough to treat this as an auxiliary route-entry buffer finalize step that preserves the lower route-entry subflags even though the exact player-facing meaning of those bits remains open.","objdump + caller xrefs + route-entry inspection + auxiliary-buffer correlation"
0x004ab980,760,train_set_route_operating_mode_and_scalar,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Shared train-side mode setter beneath route editing and adjacent operating-state transitions. The helper clears several transient route-state fields at `[this+0x55]`, `[this+0x59]`, `[this+0x5d]`, and `[this+0x1a7]`, optionally rounds the caller-supplied scalar argument to an integer when the scenario-state gate at `0x00434050` is active, dispatches over mode ids `0..0x13`, and in several branches toggles the train byte at `[this+0xf4]` across the linked route-object chain rooted at `[this+0x41]` before notifying follow-on state refresh helpers `0x004a8100` or `0x004a81b0`. Every successful path writes the chosen mode id to `[this+0xe8]` and the final scalar to `[this+0xec]`. Current grounded callers include the local and multiplayer route-entry insertion success path at `0x004718a0` and `0x00515450`, which select mode `0x13` after the stricter post-insertion validation succeeds and mode `0x0a` after the looser fallback path. Current evidence is therefore tight enough to treat this as the shared train route operating-mode and scalar setter even though the player-facing names of the individual mode ids remain open.","objdump + caller xrefs + callsite inspection + mode-write correlation + route-edit correlation"
0x004b2b80,29,train_route_list_count_live_site_reference_entries,simulation,thiscall,inferred,objdump + caller xrefs + route-entry inspection,4,"Counts the subset of entries in the same train-owned `0x33`-stride route-entry list whose flag byte at `+0x28` is nonnegative. Current grounded callsites make that sign-bit split meaningful: sign bit clear entries are the live placed-structure-backed family, while sign bit set entries use the direct route-node payload side instead. Current callers include the shell-side formatter branches at `0x004be50c` and `0x004be53c`, plus the train purchase or readiness path at `0x005126c2`, where the count must reach at least `2` before the deeper route validation lane is allowed to continue. Current evidence is therefore tight enough to treat this as the shared count of live site-reference route entries rather than a generic row counter.","objdump + caller xrefs + route-entry inspection + callsite inspection"
0x004b2c10,656,train_route_list_validate_reachability_and_station_pair,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,4,"Shared route validator above the train route-entry insertion and edit family. The helper walks the same train-owned `0x33`-stride route-entry list and splits on route-entry flag byte `+0x28`: sign bit clear entries resolve live placed-structure ids from field `+0x29` through the placed-structure collection at `0x006cec20` before mapping those structures into the route-node collection at `0x006cfca8`, while sign bit set entries take one direct route-node payload from field `+0x2b`. It then re-enters `0x004a6630` for each successive route step and one optional caller-supplied external target. While scanning, it also tracks up to two distinct station-like placed-structure ids through `0x0047fd50`; the final result fails when any placed structure or route node cannot be resolved, when any `0x004a6630` sweep leaves the output marker at `-1`, or when the scan never accumulates both ends of that station pair. Current grounded callers include the local and multiplayer insertion paths at `0x004718a0` and `0x00515450`, where failure leads to localized route warnings `3089` `At least one station on the route is not connected to the others.`, `3090` `This train cannot reach the station you've selected.`, and `3091` `This train cannot reach the track waypoint you've selected.`. Current evidence is therefore tight enough to treat this as the shared route reachability and terminal-station-pair validator rather than a generic list scan.","objdump + caller xrefs + callsite inspection + RT3.lng strings + placed-structure correlation + route-warning correlation + route-entry flag split"
0x004b2f00,250,train_route_list_select_entry_and_refresh_linked_site_state,simulation,thiscall,inferred,objdump + caller xrefs + state-layout inspection,4,"Shared selector helper for one train-owned route-entry list whose records are `0x33` bytes wide. The helper clamps the requested selected index against the current count at `[this+0x4]`, stores the new selection in `[this+0x8]`, and only when route-entry flag byte `+0x28` has its sign bit clear does it extract the previous and new placed-structure ids from field `+0x29` and forward that old/new site pair into `0x004819b0`; sign bit set entries skip that placed-structure extraction path. It then refreshes the linked train-side state through `0x004abca0`, `0x004ad260`, and `0x004b2ea0`. When the caller requests it, it also marks the owning train record's byte `[train+0x1b9]`. Current grounded callers include the local `TrainDetail.win` route-entry branch at `0x00514a96`, the multiplayer-side route-entry handlers at `0x00471730` and `0x004097f9`, and the removal helper `train_route_list_remove_entry_and_compact` at `0x004b3000`. The same route family is now also tied to localized reachability warnings `3089..3091`, so this reads as a train route-stop or waypoint selection helper rather than a generic row selector.","objdump + caller xrefs + state-layout inspection + placed-structure-id correlation + route-warning correlation + route-entry flag split"
0x004b3000,341,train_route_list_remove_entry_and_compact,simulation,thiscall,inferred,objdump + caller xrefs + state-layout inspection,4,"Removes one entry from the same `0x33`-stride train-owned route list and compacts the remaining records. The helper validates the caller-supplied index against current count `[this+0x4]`, repairs the selected index `[this+0x8]`, re-enters `train_route_list_select_entry_and_refresh_linked_site_state` at `0x004b2f00` when the removed row was the selected one, allocates a shorter replacement buffer, copies the prefix and suffix segments around the removed row, decrements the list count, frees the old buffer, and then refreshes the linked train-side state through `0x004abca0`, `0x004ad260`, and `0x004b2ea0`. Current grounded callers include the local `TrainDetail.win` route-entry removal branch at `0x00515211` and the multiplayer-side handler at `0x00471823`.","objdump + caller xrefs + state-layout inspection + compacting-buffer correlation + route-list correlation"
0x004b3160,530,train_route_list_insert_staged_entry_at_index,simulation,thiscall,inferred,objdump + caller xrefs + state-layout inspection + RT3.lng strings,4,"Inserts one staged `0x33`-byte route-entry record into the same train-owned route list at one caller-selected index. Before insertion the helper seeds parts of the staged record from the prior terminal route entry and preserves the currently grounded lower route-entry subflags `0x40`, `0x20`, and `0x10` in field `+0x28`. That same flag byte also carries the top-level entry split: sign bit clear entries use one live placed-structure id in field `+0x29`, while sign bit set entries use one direct route-node payload in field `+0x2b`. Only the live site-reference branch can re-enter the narrower tutorial gate `tutorial_validate_train_route_station_indicator_step` at `0x00516d00`, and only when the staged placed-structure id is station-or-transit-like and the shell tutorial family rooted at `0x006d3b4c` is active. The helper then allocates a `(count+1)` replacement buffer, copies the prefix rows, writes the staged record at the requested insertion index, copies the suffix rows, frees the old buffer, bumps the count, repairs the selected index, and refreshes the linked train-side state. Current grounded callers include the local `TrainDetail.win` insertion or staging branch at `0x00515417`, the multiplayer-side handlers at `0x004718e5` and `0x004097eb`, and the nearby validation path that surfaces localized reachability warnings `3090` `This train cannot reach the station you've selected.` and `3091` `This train cannot reach the track waypoint you've selected.`. Current evidence is therefore tight enough to treat this as the route-stop or waypoint insertion helper above that validation family rather than as a generic record copier.","objdump + caller xrefs + state-layout inspection + RT3.lng strings + insertion-buffer correlation + route-warning correlation + route-entry flag split + subflag preservation"
0x00516be0,284,tutorial_advance_step_and_refresh_expected_control_ids,shell,cdecl,inferred,objdump + caller xrefs + local disassembly + tutorial-table inspection,4,"Advances one active shell tutorial step and refreshes the small expected-control cache under `0x00622b34..0x00622b3c`. The helper first returns immediately when the tutorial-active flag at `0x006d3b4c` is zero; otherwise it increments the current tutorial step index at `0x006d3b50`, consults the `0x40`-byte descriptor table rooted at `0x00622b48`, and skips several currently grounded step codes when their extra world or shell-state predicates fail. After choosing the next live step it copies the previous expected control id from `0x00622b34` into `0x00622b38`, then loads the new expected control id and one current alternate-accepted control id from descriptor offsets `+0x34` and `+0x38` into `0x00622b34` and `0x00622b3c`. Current shell-command correlation is now tight enough to support that narrower reading: the generic shell control path around `0x004de199` and `0x004de724` compares incoming control ids directly against `0x00622b3c` and suppresses the tutorial-only `3587` rejection when they match, which makes `0x00622b3c` look like a current companion control id rather than a page or mode selector. The helper also rate-limits one small shell-side nudge through `0x0045ea20` while the tutorial runs. Current grounded callers are the generic shell control path at `0x00540cca` and the train-route tutorial validator at `0x00516d93`, which makes this the current best owner for the tutorial step-advance and expected-control cache instead of leaving `0x00622b34/38/3c` as anonymous globals.","objdump + caller xrefs + local disassembly + tutorial-table inspection + control-cache correlation + shell-command correlation"
0x00516d00,143,tutorial_validate_train_route_station_indicator_step,shell,thiscall,inferred,objdump + caller xrefs + callsite inspection + nearby-state inspection + RT3.lng strings,4,"Small shell-side tutorial gate used before one live station-or-transit site id is committed into the train route-entry list. The helper only matters while the tutorial state family rooted at `0x006d3b4c` is active: it consults the current tutorial step index at `0x006d3b50`, reads that step's code from the `0x40`-byte tutorial descriptor table rooted at `0x00622b48`, and accepts only the currently grounded step codes `0x172` and `0x17c`, which align with localized tutorial prompts `3777` `Click on the yellow station indicator for Milan.` and `3778` `Now click on the station indicator for Turin`. For accepted steps it stages the caller-supplied site id into `0x006d3b5c` and, in the second step, advances the surrounding tutorial state through `0x00516be0` only when the incoming site differs from the currently staged one. For incompatible tutorial steps it opens one callback-driven shell modal through `0x004c98a0` and returns `0`, which causes `train_route_list_insert_staged_entry_at_index` at `0x004b3160` to abort before the record is inserted. Current evidence is therefore tight enough to treat this as the tutorial-side train-route station-indicator validator rather than a general `TrainDetail.win` row-kind gate.","objdump + caller xrefs + callsite inspection + nearby-state inspection + RT3.lng strings + modal correlation"
0x00517d40,66,indexed_collection_entry_id_is_live,simulation,thiscall,inferred,objdump + caller inspection + collection-bitset inspection,4,"Shared indexed-collection presence test over the common collection layout that uses `[this+0x14]` as the upper id bound and `[this+0x34]` as the tombstone or disabled-bitset. The helper rejects nonpositive or out-of-range ids and otherwise returns `1` only when the bit for the requested id is clear, i.e. when the entry is currently live. Current grounded callers include `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0`, where it guards ordinary candidate ids before `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and neighboring collection walkers that treat the same ids as positive live-record selectors rather than zero-based dense ordinals.","objdump + caller inspection + collection-bitset inspection + callsite correlation"
0x00517cf0,3,indexed_collection_slot_count,simulation,thiscall,inferred,objdump + caller inspection + collection-layout inspection,4,"Tiny shared accessor that returns the current slot-count field `[this+0x18]` from the common indexed-collection layout. Current grounded callers use it as the upper bound for zero-based slot walks before resolving one nth live entry id through `indexed_collection_get_nth_live_entry_id` `0x00518380`.","objdump + caller inspection + collection-layout inspection + slot-walk correlation"
0x00518140,89,indexed_collection_resolve_live_entry_by_id,simulation,thiscall,inferred,objdump + caller inspection + collection-layout inspection,4,"Shared indexed-collection record resolver over the same common collection layout. The helper rejects nonpositive, out-of-range, or tombstoned ids through the `[this+0x14]` bound and `[this+0x34]` bitset, then returns one live record pointer from the payload rooted at `[this+0x30]`. When collection flag dword `[this+0x04]` is nonzero it treats that payload as a flat `stride=[this+0x08]` record array and returns `base + stride*id`; otherwise it treats the payload as an array of record pointers stored in `stride=[this+0x08]` slots and returns the pointer loaded from `base + stride*id`. Current grounded callers include the company, profile, train, and structure-candidate families, where it is the common bridge from one positive collection id to one concrete live record pointer.","objdump + caller inspection + collection-layout inspection + direct-vs-indirect payload correlation"
0x00518380,364,indexed_collection_get_nth_live_entry_id,simulation,thiscall,inferred,objdump + caller inspection + collection-layout inspection,4,"Shared nth-live-entry selector over the same indexed-collection layout. With traversal mode `0` it walks slot ids in forward order, skipping tombstoned ids through the bitset at `[this+0x34]`, and returns the positive entry id whose zero-based live ordinal matches the caller-supplied index; recent results are memoized in the small cache bands rooted at `[this+0x68]` and `[this+0x78]`. With nonzero traversal mode it reuses the auxiliary link banks rooted at `[this+0x38]`, `[this+0x48]`, and `[this+0x58]` to step through one alternate live-order chain before returning the resulting id. Current grounded callers across company, profile, structure-candidate, and placed-structure families mostly use traversal mode `0`, where this is the shared bridge from one zero-based live ordinal to one positive collection entry id.","objdump + caller inspection + collection-layout inspection + cache-band inspection + alternate-chain correlation"
0x0051c920,223,localization_lookup_display_label_by_stem_or_fallback,shell,thiscall,inferred,objdump + caller inspection + language-table correlation + static-table inspection,4,"Shared shell-side label helper that turns one ASCII stem string into one player-facing display label. The helper case-folds the first letter, scans the static `(stem, string-id)` table rooted at `0x006243c8`, compares candidate stems case-insensitively, and returns the localized text for the first matching string id through `0x005193f0` when that localized entry is nonempty. The current table correlation already grounds entries such as `Alcohol`, `Aluminum Mill`, `Automobiles`, `Bauxite`, and `Big Boy` against RT3.lng ids `3202..3220`. When no table entry matches, the helper falls back to localized id `3866` `Could not find a translation table entry for '%1'`. Current grounded callers include `shell_building_detail_refresh_subject_cargo_and_service_rows` `0x004ba3d0`, where it sits directly above candidate field `[record+0x04]`, and several neighboring list and detail renderers that need one display label from the same stem family.","objdump + caller inspection + language-table correlation + static-table inspection + RT3.lng correlation"
0x004f2e80,14,shell_has_live_overview_window,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Tiny presence probe for the shell-side `Overview.win` singleton rooted at `0x006d12bc`. The helper returns `1` when that live overview object pointer is nonnull and `0` otherwise. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside other shell-window probes, and the overview family itself around `0x004f3a10`, which uses the same singleton to suppress duplicate opens.","objdump + caller inspection + nearby-family correlation + singleton correlation"
0x004f2e90,11,shell_mark_overview_window_dirty,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Tiny dirty-latch setter paired with `shell_has_live_overview_window`. The helper stores `1` into `0x006d12cc`, which current nearby call patterns treat as the `Overview.win` refresh or service request latch once the live overview singleton at `0x006d12bc` exists. Current grounded caller is the same post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + caller inspection + nearby-family correlation + singleton correlation"
0x004f38a0,67,shell_overview_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Constructs the shell-side `Overview.win` object later published at `0x006d12bc`. The constructor seeds the local vtable at `0x005d1368`, binds the shell window resource through `0x0053fa50`, clears the selected subject field at `[this+0x7c]`, and installs the shared control callback `0x004f3880` on control `0x88bf`. Current grounded caller is `shell_open_or_focus_overview_window` at `0x004f3a10`, and current string-table correlation leaves `Overview.win` as the strongest owner name for this singleton family.","objdump + caller inspection + strings correlation + singleton correlation"
0x004f38f0,562,shell_overview_window_handle_message,shell,thiscall,inferred,objdump + caller inspection + control-flow inspection,4,"Primary message dispatcher for the shell-side `Overview.win` family rooted at `0x006d12bc`. The handler processes the usual shell message ids `0`, `0xca`, and `0xcb`; uses the current subject object at `[this+0x78]`; opens follow-on detail lanes through `0x004f2ea0`; and raises simple shell modals through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` when the requested drill-down path is currently invalid. It also consumes the family dirty latch at `0x006d12cc` on the recurring service path. Current grounded caller is the shell runtime after construction through `shell_open_or_focus_overview_window`.","objdump + caller inspection + control-flow inspection + dirty-latch correlation"
0x004f3a10,272,shell_open_or_focus_overview_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Shared opener for the shell-side `Overview.win` singleton. When a valid overview subject exists under the live world-side owner at `0x006cea4c` and no current overview window is open, the helper allocates an `0x80`-byte shell object, constructs it through `shell_overview_window_construct` at `0x004f38a0`, publishes it through the shell runtime at `0x006d401c`, and stages the selected subject pointer into the live singleton at `0x006d12bc` before routing it into the family message path at `0x004f2ea0`. When an overview window already exists it leaves the current singleton in place. Current grounded callers include the world-side action branches at `0x004396ae` and `0x004414c6`, both of which pass one subject object resolved from `0x006cea4c` before opening the overview path.","objdump + caller inspection + strings correlation + singleton correlation + publish-path inspection"
0x004b99c0,88,structure_candidate_collection_get_nth_active_candidate_id,map,cdecl,inferred,objdump + caller inspection + collection iteration,4,"Returns the zero-based nth active candidate id from the structure-candidate collection at `0x0062ba8c`. The helper iterates the collection through `0x517cf0` and `0x518380`, skips candidates whose active byte in the returned record is clear, decrements the caller-supplied ordinal only across the surviving entries, and finally returns the matching candidate id or `0` when the requested active slot does not exist. Current grounded callers are the shell-side building-detail branches at `0x004ba01f`, `0x004bbcfd`, and `0x004bbd56`, where ordinals `page-3` are translated back into live candidate ids before the selected-building service and capability rows are refreshed.","objdump + caller inspection + collection iteration + active-candidate correlation"
0x004b9a20,833,shell_building_detail_refresh_flagged_service_capability_rows,shell,thiscall,inferred,objdump + caller inspection + control-range inspection,3,"Shared `BuildingDetail.win` refresh helper for the flagged service or capability row bands driven from the currently selected building subject at `0x006cfe04`. The helper repeatedly restyles controls in the `0x7d07..0x7d1c` range through `0x540120`, using route-entry flag byte `+0x28` from the selected building subject as the decision source. Current local control correlation now bounds that mask family more tightly than a generic bit consumer: `0x7d07/0x7d08` split the zero-versus-nonzero `0x30` mask, `0x7d11/0x7d12` split the bit-`0x20`-only case, `0x7d13/0x7d14` split the exclusive-or `0x20^0x10` case, `0x7d17/0x7d1a` track bit `0x20`, `0x7d18/0x7d1b` track bit-`0x10`-only, and `0x7d19/0x7d1c` track the combined `0x30` case. The later repeated row family rooted at `0x7f58..0x801f` also consults bit `0x40` together with the currently selected candidate or service id in subject field `+0x24`, but current evidence now narrows that lane too: it is a selected-ordinal highlight band rather than a generic restyle loop. The special express-side triplet at `0x7f58..0x7f5a` is the fixed table-driven branch; after that the helper falls through into the ordinary active-candidate/service rows. When the selected id is below `0x384`, the helper translates it through `structure_candidate_collection_get_nth_active_candidate_id` at `0x004b99c0` and highlights ordinal `3 + active-candidate-rank` for the current subject id; otherwise it treats `0x384..` as the parallel express-side family directly. Current grounded callers include the broader building-detail refresh path at `0x004bae97`, the constructor-adjacent refreshes at `0x004bbcf3` and `0x004bbd0d`, and neighboring handler branches at `0x004bb8e3`, `0x004bbe5c`, and `0x004bc039`. Current evidence is therefore strong enough to treat this as the shared shell-side consumer of route-entry subflags `0x10`, `0x20`, and `0x40` even though the ordinary candidate-row captions still remain open.","objdump + caller inspection + control-range inspection + route-entry flag correlation + active-candidate correlation + control-family triplet correlation + row-mask partition correlation + selected-ordinal highlight correlation"
0x004ba3d0,2380,shell_building_detail_refresh_subject_cargo_and_service_rows,shell,thiscall,inferred,objdump + caller inspection + strings correlation,3,"Large `BuildingDetail.win` refresh helper for the selected subject row families centered on controls `0x7d06`, `0x7d96..`, `0x7d0e`, and the adjacent `0x7d6a/0x7d6b` and `0x7d9d` visual lanes. The helper walks the selected building subject at `0x006cfe04`, iterates the per-subject id list rooted at `[subject+0x01]`, validates ordinary ids through the structure-candidate collection at `0x0062ba8c` with `indexed_collection_entry_id_is_live` `0x00517d40`, resolves them into concrete live candidate records through `indexed_collection_resolve_live_entry_by_id` `0x00518140`, and then uses candidate field `[record+0x04]` as the shared stem for both the ordinary row asset path `%s.imb` and the neighboring display-label lookup through `localization_lookup_display_label_by_stem_or_fallback` `0x0051c920`. Only when that ordinary candidate branch fails does it fall back to the fixed express-side special ids `0x384..0x386`. Current table correlation now bounds that fixed branch more sharply: `0x00621df8` seeds the short-label controls `0x7dc8..0x7dca` with localized ids `494..496` `Any Cargo`, `Any Freight`, and `Any Express`, while `0x00621e10` seeds the adjacent asset-name controls `0x7e90..0x7e92` with `AnyCargo`, `AnyFreight`, and `PassMail` before `%1.imb` formatting. The helper also uses `Cargo.imb`, `Caboose.imb`, and the adjacent asset string `Dining.imb` while rebuilding the visible row payloads; current RT3.lng alignment now ties the longer descriptive popup/help side to `497/498` for freight/express and the two special service rows to localized labels `911` `Dining Car` and `912` `Caboose`. One resource-side boundary is tighter now too: the extracted `BuildingDetail.win` blob currently exposes only a sparse embedded text table with the help line `0xbb8`, the asset-name string `0xbb9`, and one standalone caption entry `0xbba` `Cargo`, which is the strongest current resource-side anchor for the row header around `0x7d06` and simultaneously reinforces that the deeper ordinary rows are being labeled from live candidate-record stems rather than from a larger hidden caption table. Current subflag correlation is tighter too: the extra visual lanes `0x7d6a`, `0x7d6b`, and `0x7d9d` are driven from the same selected-subject flag byte at `+0x28`, with `0x7d9d` on the bit-`0x20` branch using `Caboose.imb` and the sibling bit-`0x10` special lane using `Dining.imb`. The helper then re-enters both `shell_building_detail_refresh_subject_pair_value_rows` at `0x004bad20` and the flagged-row helper `shell_building_detail_refresh_flagged_service_capability_rows` at `0x004b9a20`. Current grounded callers include the main building-detail refresh at `0x004baedd`, constructor-adjacent and handler-side refreshes at `0x004bb8dc`, `0x004bbc89`, `0x004bbd6a`, and `0x004bc02b`. Current evidence is therefore strong enough to treat this as the selected-building cargo or service row owner even though several ordinary candidate-row captions remain unrecovered.","objdump + caller inspection + strings correlation + control-range inspection + candidate-id correlation + collection-helper correlation + stem-label correlation + subflag-row correlation + asset-string block correlation + RT3.lng correlation + table-entry correlation + win-resource extraction"
0x004ba270,311,shell_building_detail_handle_subject_value_row_band_action,shell,cdecl,inferred,objdump + callsite inspection + local disassembly,3,"Small `BuildingDetail.win` row-band action callback over the control-id family `0x7d07..0x7d14`. The helper switches on the clicked control id minus `0x7d07`, updates the selected building subject rooted at `0x006cfe04`, and treats subject bytes `+0x21`, `+0x22`, and `+0x23` as one current selection plus one bounded low/high pair. On change it increments the family dirty latch at `0x006cfe0c`, writes the refreshed current or bound value back through the shared shell control helper on code `0x66`, and when the side list helper at `0x006cfe08` is active it re-enters the neighboring follow-up refresh path at `0x004b9ec0`. Current direct installation site is the `0x7d0e` widget branch inside `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004bacc9`, which keeps this bounded as the live action owner for the paired value rows rather than another passive formatter.","objdump + callsite inspection + local disassembly + selected-subject field correlation"
0x004bad20,461,shell_building_detail_refresh_subject_pair_value_rows,shell,thiscall,inferred,objdump + caller inspection + control-range inspection,3,"Shared `BuildingDetail.win` helper for the mutually exclusive subject-value row pairs around controls `0x7d05..0x7d14`. The helper first styles the leading pair `0x7d05/0x7d06`, then chooses between the value-row pairs `0x7d07/0x7d08`, `0x7d11/0x7d12`, and `0x7d13/0x7d14` from the selected building subject at `0x006cfe04`, using the same flag byte at `+0x28` that drives the neighboring cargo or service rows. On the nonzero selector branch it instead refreshes the current-selection status around `0x7d0d/0x7d0e` from the subject count byte and the subject field at `+0x21`, then tails back into `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004ba3d0`. Current payload values for the mutually exclusive pairs come from subject fields `+0x22` and `+0x23`, and current grounded caller correlation keeps this bounded as one shared pair-value row owner rather than a separate top-level widget family.","objdump + caller inspection + control-range inspection + subject-field correlation + flag-branch correlation"
0x004b9d70,14,shell_has_live_building_detail_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Tiny presence probe for the shell-side `BuildingDetail.win` singleton rooted at `0x006cfe00`. The helper returns `1` when that live detail object pointer is nonnull and `0` otherwise. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside the sibling overview, load-screen, settings, custom-modal, and file-options probes.","objdump + caller inspection + strings correlation + singleton correlation"
0x004b9d80,11,shell_mark_building_detail_window_dirty,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Tiny dirty-latch setter paired with `shell_has_live_building_detail_window`. The helper stores `1` into `0x006cfe10`, which current nearby call patterns treat as the `BuildingDetail.win` refresh or service request latch once the live singleton at `0x006cfe00` exists. Current grounded caller is the same post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + caller inspection + nearby-family correlation + singleton correlation"
0x004b9e10,166,shell_building_detail_submit_aux_owner_subject_sync_request,shell,cdecl,inferred,objdump + caller inspection + state-block inspection,3,"Small side-owner sync helper for `BuildingDetail.win`. When the auxiliary owner at `0x006cd8d8` is present and the local dirty counter `0x006cfe0c` is nonzero, the helper allocates a `0x3f`-byte request block, stamps a small header through `0x005216c0` and `0x00513130`, stores one mirrored-subject mode bit in request word `+0x08`, stores the current building-detail ordinal from `0x00621df4`, then copies the full staged building subject record from `0x006cfe04` into the request body before queueing it through `0x00469d30` on the owner-local request list at `[0x006cd8d8+0x8f48]`. Current direct callers are the `0x7d01` and `0x7d09/0x7d0a` branches inside `shell_building_detail_window_handle_message` `0x004bb9e0`, and both now clearly source that mode bit from the side-list mirror latch at `[0x006cfe08+0x0c]`, which keeps this bounded as an auxiliary-owner subject-sync path that preserves local mirror-state rather than a generic widget refresh. The helper also currently suppresses submission when the neighboring live-flag dword at `0x006d3ae4` is nonzero.","objdump + caller inspection + state-block inspection + side-owner queue correlation + mirror-latch correlation"
0x004b9ec0,272,shell_building_detail_propagate_selected_subject_state_into_side_list,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Shared follow-up helper for `BuildingDetail.win` when the sibling side-list owner at `0x006cfe08` is active and its mirror latch at `+0x0c` is nonzero. The helper walks every indexed side-list subject through `0x004b2b60`, copies the currently selected subject state from `0x006cfe04` into each sibling record, mirrors the current service or capability id at `[subject+0x24]`, and propagates the mutable subflag family in byte `+0x28` with bits `0x40`, `0x20`, and `0x10` preserved from the active subject. It also copies the current-selection fields `+0x21/+0x22/+0x23` and the live id list rooted at `+0x01`, which is why the paired value-row action helper at `0x004ba270` and several handler-side selector branches re-enter this path after mutating the active subject. Current grounded callers are `shell_building_detail_handle_subject_value_row_band_action` at `0x004ba270` and the handler-side refresh branches at `0x004bbc9d`, `0x004bbd81`, and `0x004bbe55`.","objdump + caller inspection + local disassembly + selected-subject field correlation + side-list iteration correlation + mirror-latch correlation"
0x004b9fd0,672,shell_building_detail_present_flagged_service_capability_popup,shell,cdecl,inferred,objdump + caller inspection + local disassembly,3,"Popup callback installed on the larger `BuildingDetail.win` flagged-row band. The helper takes one clicked control id in the `0x7f58..0x801f` family, resolves either one fixed express-side descriptor from table `0x00621e04` for the first three rows or one active candidate/service id from the selected subject at `0x006cfe04+0x24`, and then formats an explanatory shell popup before returning through `0x538c70`. Current table correlation now closes that first triplet more cleanly: `0x00621e04` supplies localized ids `494`, `497`, and `498`, so the fixed popup/help branch is specifically `Any Cargo`, `Any Freight\\n(Freight is everything but Passengers, Mail, and Troops)`, and `Any Express\\n(Express is Passengers, Mail, and Troops)` for controls `0x7f58..0x7f5a`. Current language-table correlation also tightens the ordinary popup split: one single-line availability popup uses localized id `3922` `%1\\nLoads available at %2: %3`, while the ordinary candidate branch uses localized id `2981` `%1\\nLoads available at %2: %3 Current Price: %4` and can append localized id `2982` `Price at next station, %1: %2 (%3%4)`. On that ordinary branch it resolves the current candidate through `structure_candidate_collection_get_nth_active_candidate_id` at `0x004b99c0`, compares the selected site against the current subject site at `+0x29`, queries local service metrics through `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`, and conditionally computes the nearby-site delta line before presenting the final text. Current direct installation sites are the callback-registration branches at `0x004bb43f` and `0x004bb8a6`, which keeps this bounded as the live explanatory popup owner for the `0x7f58..0x801f` selector rows rather than another passive formatter.","objdump + caller inspection + local disassembly + callback-registration correlation + popup-path correlation + candidate-metric correlation + RT3.lng correlation + table-entry correlation"
0x004bb9e0,2183,shell_building_detail_window_handle_message,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Primary message dispatcher for the shell-side `BuildingDetail.win` family rooted at `0x006cfe00`. The handler switches over shell messages `0`, `0xca`, and `0xcb`; updates the staged building subject in `0x006cfe04` and its list helper at `0x006cfe08`; refreshes the visible control ranges `0x7d..0x8051`; and consumes the dirty latch at `0x006cfe10` on the recurring service path. Its action cases are now tighter than a generic navigation bucket. The `0x7d01` branch is no longer just an isolated oddball either: extracted `BuildingDetail.win` text now makes `Set the initial cargo amount for 'Disable Cargo Economy' scenarios.` the strongest current caption candidate for that control, the message path can mirror that action through `shell_building_detail_submit_aux_owner_subject_sync_request` `0x004b9e10` when `shell_has_auxiliary_preview_owner` `0x00434050` reports the side owner live, and one later rejection path now clearly raises localized id `3587` `This option is only available by following the tutorial.` behind the active tutorial flag at `0x006d3b4c` plus the cached previous expected-control id at `0x00622b38`. The `0x7d02/0x7d03` pair flips selected-subject bit `0x40` and re-enters `shell_building_detail_refresh_subject_pair_value_rows` `0x004bad20`, which makes that pair the real top-level mode switch between the bounded pair-value branch and the current-selection/status branch around `0x7d0d/0x7d0e`. The `0x7d09/0x7d0a` pair steps neighboring building subjects through `0x004b2b60`, skipping disallowed subjects on the local iteration path, and the same branch can also mirror the new selected subject through `0x004b9e10` when that auxiliary owner is present. The `0x7d0f/0x7d10` pair flips selected-subject bits `0x20` and `0x10`, i.e. the same special-service subflags later rendered as `Caboose` and `Dining Car`, and then re-clamps the paired value widgets through the same shared refresh path. The `0x7f58..0x801f` selector band changes the current service or capability id at `[subject+0x24]` before re-entering `shell_building_detail_refresh_flagged_service_capability_rows` `0x004b9a20`; current refresh-side correlation now shows that band as one selected-ordinal picker over three fixed express rows plus the ordinary active-candidate rows rather than an undifferentiated list. The `0x8020..0x8051` action band is now tighter too: it is primarily a per-row removal family over the selected subject's live id list rooted at `+0x01`, zeroing one indexed entry, compacting the remaining dword ids, decrementing count byte `+0x00`, clamping the current-selection byte `+0x21`, and then refreshing the visible row bands. Two special row indices inside that same band re-route into the adjacent `0x7d0f/0x7d10` subflag-clearing path instead of ordinary list compaction when the current `0x20/0x10` service-bit state requires it. The handler can also open simple shell modals through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` when one building-side action is disallowed. Current grounded callers are the shell runtime after construction and the explicit dirty-latch service path.","objdump + caller inspection + strings correlation + control-range inspection + dirty-latch correlation + selected-subject mutation correlation + RT3.lng correlation + selected-ordinal correlation + remove-entry compaction correlation + auxiliary-owner sync correlation + tutorial-rejection correlation + expected-control-cache correlation"
0x004baef0,2793,shell_building_detail_window_refresh_controls,shell,thiscall,inferred,objdump + caller inspection + control-range inspection,4,"Primary refresh path for the shell-side `BuildingDetail.win` family. The helper rebuilds the top-level control bands under `0x7d02..0x8051`, including the paired mode switch `0x7d02/0x7d03` from subject flag `0x40`, the smaller special-service toggles `0x7d0f/0x7d10` from subject bits `0x20` and `0x10`, the current-selection status widget around `0x7d0d/0x7d0e`, the selected-building cargo or service rows through `shell_building_detail_refresh_subject_cargo_and_service_rows` at `0x004ba3d0`, the paired subject-value rows through `shell_building_detail_refresh_subject_pair_value_rows` at `0x004bad20`, and the flagged service or capability rows through `shell_building_detail_refresh_flagged_service_capability_rows` at `0x004b9a20`. Current control-building correlation now makes the leading special-row bands explicit too: the short-label triplet `0x7dc8..0x7dca`, its adjacent asset/icon triplet `0x7e90..0x7e92`, and the popup/selectable triplet `0x7f58..0x7f5a` are the fixed express-side branch before the broader ordinary candidate rows. Current branch structure is tighter too: when subject bit `0x40` is set the refresh ends on the selected-subject cargo/service family rooted at `0x004ba3d0`, while the clear branch instead ends on the flagged capability-selector family rooted at `0x004b9a20`. It also hides or shows the larger control ranges `0x7dc8..0x7f57`, `0x7f58..0x801f`, and `0x8020..0x8051` through the shared shell control toggles at `0x53fe00`. Current grounded callers are the main constructor-side and focus refreshes at `0x004bbace`, `0x004bc0cc`, and `0x004bc0de`, and the message dispatcher at `0x004bb9e0`.","objdump + caller inspection + control-range inspection + subject-flag correlation + helper-family correlation + branch-end correlation + control-family triplet correlation"
0x004bc0a0,71,shell_building_detail_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings correlation,4,"Constructs the shell-side `BuildingDetail.win` object later published at `0x006cfe00`. The constructor seeds the local vtable at `0x005d05e0`, binds the window resource through `0x0053fa50`, and immediately refreshes the visible subject and control bands through `0x004baef0`. Current grounded caller is `shell_open_or_focus_building_detail_window` at `0x004bc100`, and current string-table correlation leaves `BuildingDetail.win` as the strongest owner name for this singleton family.","objdump + caller inspection + strings correlation + singleton correlation"
0x004bc100,203,shell_open_or_focus_building_detail_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Shared opener for the shell-side `BuildingDetail.win` singleton. The caller supplies the building-detail list helper in `ECX`, one current building subject in `EDX`, and one selected ordinal on the stack. The helper seeds the shared family globals at `0x006cfe04`, `0x006cfe08`, and `0x00621df4`, validates that the supplied building subject resolves to one live world object through the placed-structure collection at `0x006cec20`, allocates a `0x78`-byte shell object when no detail window is live, constructs it through `shell_building_detail_window_construct` at `0x004bc0a0`, publishes it through the shell runtime at `0x006d401c`, and tears it back down on return while clearing `0x006cfe00`. Current grounded callers include the world-side branch around `0x004bbace`, which updates the current building subject before opening this detail family. Current string-table correlation leaves `BuildingDetail.win` as the strongest owner name for this singleton family.","objdump + caller inspection + strings correlation + publish-path inspection + singleton correlation"
0x004384d0,570,world_run_post_load_generation_pipeline,map,cdecl,inferred,objdump + strings + caller xrefs,4,"Large post-load world-generation pipeline reached after world entry and shell-side file-load success paths. It increments the world-root generation counter at `[0x0062c120+0x2205]`, can run one preliminary branch through `0x00437743`, and then advances through a more bounded staged setup sequence with shell progress updates through `0x004834e0`. The visible banner order is now grounded from the direct string ids in the function body: id `318` `Computing Transportation and Pricing...` is posted first and remains active while the pipeline runs world_compute_transport_and_pricing_grid at `0x0044fb70`, the early collection pass world_setup_building_collection_phase at `0x0041ea50`, and the conditional region pair world_region_collection_seed_default_regions at `0x00421b60` plus world_region_border_overlay_rebuild at `0x004882e0`; only after those complete does the pipeline post id `319` `Setting up Players and Companies...`. That `319` lane is no longer just gate plumbing: the primary grounded work there is still the chairman-profile pair world_seed_default_chairman_profile_slots at `0x004377a0` plus world_build_chairman_profile_slot_records at `0x00437220`, and current neighboring setup flow also exposes one conditional company-side helper at `0x0047d440` under sandbox or non-editor shell-state conditions. The later interior ordering of the same `319` lane is tighter now too: after the route-entry collection refresh on `0x006cfca8` through `0x00493be0`, the pipeline refreshes the auxiliary route-entry tracker collection `0x006cfcb4` through `0x004a41b0`, then re-enters `placed_structure_collection_refresh_local_runtime_records_and_position_scalars` `0x004133b0`, runs a flagged world-grid cleanup sweep through `0x00448af0/0x00533fe0`, and only after that re-enters the route-entry post-pass `0x00491c20` before continuing into later persona, route-style, region, and world-manager setup families. Current evidence is tighter on the remaining gates too: `[0x006cec74+0x68]` now aligns with the editor-map `.gmp` mode in the shell file coordinators and acts as the broader master editor-mode flag that suppresses both later world-generation branches and diverts region-side calculations into alternate paths; `[0x006cec74+0x174]` is the direct building-population gate above id `320` `Setting Up Buildings...` and world_region_collection_run_building_population_pass at `0x00421c20`; `[0x006cec74+0x178]` is the direct seeding-burst gate above id `321` `Seeding Economy...` and simulation_run_chunked_fast_forward_burst at `0x00437b20`; and id `322` `Calculating Heights...` finishes through `0x0044d410`. The body fans into the live world root at `0x0062c120`, manager collections `0x0062ba8c`, `0x0062bae0`, `0x006cfca8`, `0x006cfcb4`, and `0x006cfc9c`. Current grounded callers are the world-entry side around `0x004390ea` and the shell file-load side around `0x004dccfc`.","objdump + RT3.lng strings + caller xrefs + callsite inspection + file-flow correlation + post-load-stage-order correlation"
0x00435630,648,scenario_state_rebuild_port_warehouse_cargo_recipe_runtime_tables,map,thiscall,inferred,objdump + caller xrefs + state-layout inspection,4,"Rebuilds the runtime port-or-warehouse cargo-line tables from the scenario-side recipe-book state rooted at `[this+0x0fe7]`. The helper first biases into the recipe-book payload at `[this+0x13d4]`, then iterates all `12` recipe-book blocks in `0x4e1`-byte steps. For each book it clamps the shared maximum annual production float that precedes the first line, counts active lines across five repeated `0x30`-byte line records, and then imports those five lines into one parallel runtime array of `0xbc`-byte descriptors. The importer treats every line slot symmetrically rather than special-casing any row index: each slot reads one mode dword, one annual amount, and two cargo-token strings, resolves nonempty cargo strings through the global cargo collection at `0x0062ba8c`, and builds paired runtime halves for the mode families `2/3` and `1/3`. Current mode gating is now tight enough to treat the polarity as grounded rather than provisional: the source token at `line+0x08` is the supplied-cargo field because it is the branch activated for `Supply Only` and `Production Demand->Supply`, while the source token at `line+0x1c` is the demanded-cargo field because it is the branch activated for `Demand Only` and `Production Demand->Supply`. The constructor and handler now tighten the amount semantics too: `line+0x04` is the per-line annual-demand field only in mode `1`, but it becomes the annual-supply field in modes `2/3`. The importer matches that split by copying `line+0x04` directly into the supply-side runtime half for modes `2/3`, while the production-mode demand half is normalized to `1.0` rather than reusing the entered amount. That makes the five editor-side row entries look like generic cargo-line slots rather than five fixed named production roles. Current grounded callers include the scenario-state initializer at `0x00436ee0`, world-load or map-entry side branches at `0x00443ebc`, `0x00444ac1`, and `0x00448126`, plus the live editor page constructor at `0x004cf935`.","objdump + caller xrefs + state-layout inspection + cargo-collection correlation + mode-table correlation + constructor correlation"
0x00437b20,218,simulation_run_chunked_fast_forward_burst,simulation,thiscall,inferred,objdump,3,"Shell-mediated burst advance helper above simulation_advance_to_target_calendar_point. It marks a local fast-forward latch at `[this+0x46c38]`, derives one loop count from shell-state `0x006cec74+0x178` and active-mode flag `[0x006cec78+0x4af7]`, then repeatedly advances the world toward fixed target `0x05a0` through simulation_advance_to_target_calendar_point while pumping the shell-side service helper at `0x004834e0` between chunks. After the burst it clears the latch, sweeps the world collection at `0x0062bae0`, and tails into the neighboring cleanup path at `0x00434d40`. The current grounded owner is world_run_post_load_generation_pipeline at `0x004384d0`, where the helper sits behind shell-state gate `[0x006cec74+0x178]` under the localized `Seeding Economy...` phase after the earlier transportation-pricing and building-setup work has already run. This keeps the helper on the map or scenario setup side rather than the ordinary player-facing speed-control path.","objdump + caller context + RT3.lng strings + phase ordering"
0x00434680,435,world_set_game_speed_mode,simulation,thiscall,inferred,objdump + strings,3,"Primary game-speed setter for the live world object. It clamps the requested mode against the normal `0..5` range or the wider `0..9` range when shell-state gate `[0x006cec74+0x2c8]` is active, stores the current mode at `[this+0x19]`, preserves the nonzero resume mode at `[this+0x1d]`, updates the shell detail control `0x74` when `0x006d0818` is live, and can format the localized status line `Game Speed: %1` using speed labels `Paused` through `Very Fast` and the hidden `Ultra Fast 6..9` strings. When the caller requests propagation and the multiplayer preview path is active it also routes the new speed through the multiplayer-side handoff around `0x00407870`, which matches the localized restriction `Only the host may change the game speed.`","objdump + RT3.lng strings + multiplayer handoff"
0x00434850,19,world_adjust_game_speed_mode_delta,simulation,thiscall,inferred,objdump,3,"Small relative front end over world_set_game_speed_mode. It adds the signed caller delta to the current mode at `[this+0x19]` and then re-enters world_set_game_speed_mode with both notification and propagation flags enabled.","objdump + callee inspection"
0x00437220,279,world_build_chairman_profile_slot_records,map,thiscall,inferred,objdump + strings + caller xrefs,4,"Post-load chairman-profile materialization pass reached under banner id `319` `Setting up Players and Companies...`. The helper first refreshes one local occupancy map through `0x0047bc80`, optionally waits on the multiplayer preview owner at `0x006cd8d8`, then walks the 16 selector bytes at `[0x006cec7c+0x87]` together with the per-slot staging table rooted at `[this+0x69d8]`. Current slot-field semantics are tighter now: `[slot+0x00]` is the staged chairman profile id, `[slot+0x01]` is the Optional-versus-Mandatory byte with nonzero=`Optional` and zero=`Mandatory`, `[slot+0x02]` is the ordinary seat-enable byte that combines with the separate per-slot gate at `[this+0x0bc3+slot*9]` to surface `Human`, `Computer`, and `Human or Computer`, `[slot+0x03]` is the special occupied-seat byte, and `[slot+0x04]` is the numeric tuning field copied into the resolved profile. Zero selectors take the random unused-profile path; nonzero selectors map directly onto one persona index; and campaign mode at `[0x006cec7c+0xc5]` can override back through the scenario slot table. Each resolved profile record is pulled from the global persona collection at `0x006ceb9c`, formatted through `0x0050a16f`, and seeded from the static persona table at `0x005f2d28`, whose localized ids include `2730` `Unassigned`, the named-chairman range `2731+`, and the adjacent biography range `2495+`. Both this helper and the neighboring selector seeder treat either `[slot+0x02]` or `[slot+0x03]` as enough to keep a slot live, but current grounded writes only seed `[slot+0x03]` on slot zero and later move it solely by whole-record compaction. That makes `[slot+0x03]` the strongest current anchor for the distinguished primary-human-seat marker rather than a generic role byte. The helper leaves one per-slot record family live in the resolved persona objects, stores per-profile numeric tuning from `[slot+0x04]` into `[profile+0x154]` and `[profile+0x158]`, and finishes by writing the selected profile id to `[this+0x25]` plus the linked owner-company id from `[profile+0x1dd]` to `[this+0x21]`. Current grounded callers are the main post-load generation pipeline at `0x004384d0` and the saved-runtime restore side around `0x00444b79`.","objdump + RT3.lng strings + caller xrefs + table inspection + shell editor cross-check"
0x004377a0,693,world_seed_default_chairman_profile_slots,map,thiscall,inferred,objdump + caller xrefs + strings,4,"Seeds the 16 scenario-side chairman selector bytes at `[0x006cec7c+0x87]` from the local chairman-slot table rooted at `[this+0x69d8]` before the later profile-record materialization pass runs. In editor-map mode the helper first compacts the 16 local 9-byte slot records so occupied slots bubble forward whenever a later slot has either the ordinary seat-enable byte `[slot+0x02]` or the special occupied-seat byte `[slot+0x03]` set and an earlier slot has neither; it then clears selectors for empty slots and assigns deterministic defaults for occupied ones, using selector `1` for the first occupied slot and selector `0x64+n` for later occupied slots. The same slot layout is now bounded more tightly by the editor window family around `0x004cc2d0`: `[slot+0x00]` is the staged chairman profile id, `[slot+0x01]` is the Optional-versus-Mandatory flag with nonzero=`Optional` and zero=`Mandatory`, `[slot+0x02]` is the ordinary seat-enable byte, `[slot+0x03]` is the special occupied-seat byte, and `[slot+0x04]` is the numeric tuning field. Current grounded writes seed `[slot+0x03]` on slot zero and the compaction pass moves it only by swapping whole 9-byte records, which matches the selector policy: one distinguished first slot gets selector `1`, and the remaining occupied slots get the `0x64+n` opponent range. After the selector seeding pass it walks the selector array, resolves each chosen persona through the global collection at `0x006ceb9c`, constructs or refreshes the per-profile record through `0x00476140`, copies the numeric tuning field from `[slot+0x04]` into `[profile+0x154]` and `[profile+0x158]`, and finally seeds the scenario-state summary pair from the first persona entry: `[this+0x25]` becomes the selected profile id while `[this+0x21]` becomes the linked owner-company id through `[profile+0x1dd]`. Current grounded caller is the neighboring world bring-up path around `0x00438692`, where this helper runs after the setup-side burst branch and immediately before the localized `Calculating Heights...` progress update.","objdump + caller xrefs + RT3.lng strings + slot-table inspection + shell editor cross-check"
0x00434870,23,scenario_state_get_selected_chairman_company_record,map,thiscall,inferred,objdump + global-state inspection,4,"Returns the currently selected company record for the shell-side scenario state object at `0x006cec78`. The helper reads `[this+0x21]` as a company id and resolves that id through the live company collection at `0x0062be10`; zero or negative ids return null. This is the clearest direct accessor yet for the summary field written by the post-load chairman-profile lane.","objdump + global-state inspection + caller correlation"
0x00434890,35,scenario_state_set_selected_chairman_profile,map,thiscall,inferred,objdump + global-state inspection,4,"Sets the currently selected chairman profile on the shell-side scenario state object at `0x006cec78`. The helper stores the incoming persona id into `[this+0x25]`, resolves that persona through the global profile collection at `0x006ceb9c`, and then copies the linked owner-company id from `[profile+0x1dd]` into `[this+0x21]`. This grounds the summary pair used by the post-load chairman-profile setup lane: `[state+0x25]` is the selected chairman profile id and `[state+0x21]` is the corresponding owning company id.","objdump + global-state inspection + caller correlation"
0x004348c0,23,scenario_state_get_selected_chairman_profile_record,map,thiscall,inferred,objdump + global-state inspection,4,"Returns the currently selected chairman profile record for the shell-side scenario state object at `0x006cec78`. The helper reads `[this+0x25]` as a profile id and resolves it through the global persona collection at `0x006ceb9c`; zero or negative ids return null. This pairs directly with scenario_state_set_selected_chairman_profile at `0x00434890`.","objdump + global-state inspection + caller correlation"
0x00436590,372,scenario_state_compute_issue_opinion_multiplier,simulation,thiscall,inferred,objdump + caller inspection,4,"Computes one bounded opinion multiplier for a caller-selected issue slot on the active scenario or shell state rooted at `0x006cec78`. The helper starts from the base issue term at `[this + issue*4 + 0x8a]`, clamps that raw value to a floor of `-99`, normalizes it into a multiplier around `1.0`, and then optionally folds in up to three issue-specific override tables: a company-side term from `[company + issue*4 + 0x35b]`, a chairman-profile term from `[profile + issue*4 + 0x2ab]`, and a territory-side term from `[territory + issue*4 + 0x3b5]`. When the profile argument is omitted but a valid company is supplied, it implicitly reuses that company's linked chairman id from `[company+0x3b]`. The final multiplier is clamped to a small positive floor near `0.01` before return. Current grounded callers include the broader support-adjusted share-price helper at `0x00424fd0`, the merger vote resolver at `0x004ebd10` with issue id `0x3a`, and several other company-policy and shell-side opinion branches. The merger-side `0x3a` use now lines up directly with `RT3.lng` id `726`, which says public merger votes depend on their attitude toward the management of the two companies, so this issue slot is now best read as the merger-management-attitude multiplier.","objdump + caller inspection + issue-table correlation + merger-text correlation"
0x004768c0,53,chairman_profile_owns_all_company_shares,simulation,thiscall,inferred,objdump + caller inspection,4,"Boolean ownership predicate over one chairman profile and company id. The helper resolves the requested company through the live company collection at `0x0062be10`, reads the company's full outstanding-share count from `[company+0x47]`, and compares it against the current profile's holding slot for that same company at `[profile + company_id*4 + 0x15d]`. It returns `1` only when the profile holds the full outstanding-share band and `0` otherwise. Current grounded caller is the CompanyDetail section-0 overview formatter at `0x004e5cf0`, where this is the decision point between the wholly-owned text family `3046/3047` and the investor-attitude text family `3048/3049`.","objdump + caller inspection + ownership-predicate correlation"
0x00436710,163,scenario_state_sum_issue_opinion_terms_raw,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Raw additive companion to `scenario_state_compute_issue_opinion_multiplier` on the active scenario or shell state rooted at `0x006cec78`. The helper starts from the base issue term at `[this + issue*4 + 0x8a]`, then optionally adds the company override term at `[company + issue*4 + 0x35b]`, the chairman-profile override term at `[profile + issue*4 + 0x2ab]`, and the territory override term at `[territory + issue*4 + 0x3b5]` without normalizing or clamping the result into a multiplier. When the profile argument is omitted but a valid company is supplied, it implicitly reuses that company's linked chairman id from `[company+0x3b]`. Current grounded callers include the city-connection bonus lane through `company_compute_issue39_opinion_bias_scalar` at `0x00424580` and several neighboring policy or setup branches that treat the returned integer as one raw issue-opinion total rather than a finished probability or vote scalar.","objdump + caller xrefs + callsite inspection + issue-table correlation + raw-sum correlation"
0x00437a60,41,world_toggle_pause_or_restore_game_speed,simulation,thiscall,inferred,objdump + strings,3,"Pause or resume toggle over the world game-speed fields. When the current mode at `[this+0x19]` is above zero it re-enters world_set_game_speed_mode with target `0` to pause; otherwise it restores the saved nonzero resume mode from `[this+0x1d]`. This matches the player-facing speed-control family rooted in `Paused` through `Very Fast` and their tooltips in `RT3.lng` ids `1795..1800`.","objdump + RT3.lng strings"
0x00443a50,1073,world_entry_transition_and_runtime_bringup,map,cdecl,inferred,objdump + analysis-context,4,First grounded gameplay-world entry coordinator reached from shell_map_file_entry_coordinator. It stages the selected file path into 0x0062bee0 dismisses the shell detail-panel controller at 0x006d0818 drives shell_transition_mode through 0x00482ec0 and shell_state_service_active_mode_frame then marks shell state for the transition and resets the previous world bundle through world_runtime_release_global_services and the neighboring allocator branch at 0x00438890. After the transition wait it builds temporary bundle payloads from %1\\%2 and %1.tmp allocates or serializes several world-entry records through 0x00530c80 0x00531150 and 0x00531360 allocates the new world root at 0x0062c120 from the staged filename through 0x0044e910 notifies the shell owner at 0x0062be68 and then initializes multiple world-facing global managers including 0x0062ba8c 0x0062b2fc 0x0062b26c and 0x006ada90. This now looks like the first real shell-to-gameplay world-entry bring-up path rather than shell-only staging.,objdump + analysis-context + caller xrefs + strings
0x00444dd0,3301,map_bundle_open_reference_databases,map,cdecl,inferred,ghidra-headless,3,Opens and registers a broad reference-database bundle for the active map path. The routine formats %1\\%2 paths allocates bundle state through 0x00530c80 and wires many global datasets including gpdLabelDB gpdCityDB and related city geographic and map reference tables before later shell and map loaders continue.,ghidra + rizin + llvm-objdump + strings
0x00445ac0,790,shell_map_file_entry_coordinator,map,cdecl,inferred,objdump + analysis-context,4,"Broad shell-side file-open and restore coordinator reached from tutorial launch shell UI editor-panel flows and scenario batch processing. It accepts either an incoming filename seed or a generated Quicksave base name and then chooses between the heavier world-entry branch at 0x00443a50 and the sibling saved-runtime restore branch at 0x00446d40. Bit 0x1 in its flag argument now grounds the Quicksave path from the shared string table at 0x005ca9cc. The non-Quicksave interactive path is tighter now too: it routes through shell_file_request_dialog_collect_target_path at 0x004dd010 using load mode 4=.gmp when EditorPanel.win is live and the paired non-editor open modes 8=.gms 9=.gmc and 10=.gmx. The shell-state master flag `[0x006cec74+0x68]` now reinforces that same mapping on the direct Quicksave branch too: when it is nonzero the coordinator appends the `.gmp` token immediately instead of choosing among the scenario families, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic post-load toggle. Current surrounding shell evidence now makes the non-editor trio much less anonymous: `.gmx` aligns with sandbox mode because the sibling shell branch at 0x004dc923 gates on 0x006cec7c+0x82 and surfaces string 3898 `The briefing is not available in sandbox games`; `.gmc` aligns with campaign scenarios because 0x004dc9cd gates on 0x006cec7c+0xc5 and surfaces string 3018 about resigning back to the campaign screen; the remaining default `.gms` branch is therefore the standalone scenario family. When a live runtime world is already active the helper appends .smp instead of the non-runtime extensions before the restore branch continues.",objdump + analysis-context + caller xrefs + strings + mode-table inspection + string correlation + Quicksave branch inspection
0x00445de0,1115,shell_map_file_world_bundle_coordinator,map,cdecl,inferred,objdump + analysis-context,4,"Broad shell-side file-save and package coordinator used by direct shell commands scenario batch processing and neighboring shell-editor callers. It accepts either an incoming filename seed a generated Quicksave base name from flag bit 0x1 or the localized `Autosave` seed from flag bit 0x2 string id 387. Its non-Quicksave interactive path is now tighter: it routes through shell_file_request_dialog_collect_target_path at 0x004dd010 using save mode 3=.gmp for the editor-map package path 0=.gms for standalone scenarios 1=.gmc for campaign-scenario saves and 2=.gmx for sandbox saves plus one auxiliary 11=.gmt branch reached only through the separate 0x00434050 check on the side owner at 0x006cd8d8. The shell-state master flag `[0x006cec74+0x68]` now reinforces that editor mapping on the direct save and Quicksave side too: when it is nonzero the coordinator chooses the `.gmp` package mode immediately before the scenario-family checks, which makes the flag the strongest current shell-side anchor for editor-map mode rather than a generic setup toggle. That `.gmt` path no longer looks like another scenario family: when the auxiliary owner is present the coordinator packages the chosen path into the owner-local request block near 0x006cd8d8+0x8f48 and submits it through 0x00469d30; only when that owner is absent does it fall back to map_bundle_open_reference_databases at 0x00444dd0. The campaign mapping is now backed by the numbered `%s%02d.gmc` helper at 0x00517c70 which formats one campaign-progress slot from 0x006cec7c+0xc4 before re-entering this coordinator, while the sandbox mapping is backed by the neighboring shell restriction string 3898 on 0x006cec7c+0x82. When a live runtime world is active the mainline branch still appends .smp and invokes world_runtime_serialize_smp_bundle at 0x00446240. This makes the helper the save-side sibling of shell_map_file_entry_coordinator rather than another restore dispatcher, with `.gmt` now bounded as an auxiliary preview-surface side path instead of a fourth gameplay save family.",objdump + analysis-context + caller xrefs + strings + mode-table inspection + string correlation + side-owner branch inspection + direct save branch inspection
0x00446240,2807,world_runtime_serialize_smp_bundle,map,cdecl,inferred,objdump + analysis-context,3,Serializes the current live world state into the `.smp` branch used by shell_map_file_world_bundle_coordinator. After dismissing the shell detail controller and running one shell-state service step it allocates a bundle through 0x00530c80 seeds many typed records through repeated 0x00531030 and 0x00531340 calls walks world collections under 0x0062c120 and 0x006ada80 and emits runtime-state payloads through helpers such as 0x00534e50 0x00534ec0 0x00534f00 and 0x00534f40 before finalizing through 0x00530a00. Current grounded caller is 0x00445de0 on the `.smp` path so this looks like the live-world save or package serializer rather than the restore path.,objdump + analysis-context + caller xrefs + strings
0x00446d40,5401,world_load_saved_runtime_state_bundle,map,cdecl,inferred,objdump + analysis-context,4,Loads one saved runtime world-state bundle from the `.smp` branch selected by shell_map_file_entry_coordinator. The helper dismisses the shell detail controller releases the prior world runtime drives shell mode and status transitions builds a bundle through 0x00530c80 and repeated 0x00531150 reads allocates a new world root at 0x0062c120 through 0x0044cf70 and then fills that root through repeated grid and object writes including 0x0044dca0 0x00448c20 0x00448cb0 0x00448d90 0x00448e60 0x00448e90 and 0x0044de30. This is the first grounded gameplay save-load restore dispatcher for `.smp` content rather than the broader reference-database map-entry flow.,objdump + analysis-context + caller xrefs + strings
0x0044fb70,1117,world_compute_transport_and_pricing_grid,map,cdecl,inferred,objdump + strings + callsite inspection,3,"Post-load world-generation subphase inside world_run_post_load_generation_pipeline. Reached directly under the localized progress update `Computing Transportation and Pricing...`, the helper iterates the active world grid through dimensions and bounds rooted at `[0x0062c120+0x2145]`, `[+0x2149]`, `[+0x2155]`, `[+0x2159]`, and `[+0x2129]`, samples neighborhood offsets from `0x00624b28` and `0x00624b48`, combines local terrain or transport values through repeated calls to `0x00534e50` and `0x00448aa0`, and writes bounded 16-bit results back into the grid cells. This now looks like the map-wide transportation-cost or pricing-field computation pass rather than a recurring simulation-step loop.",objdump + caller context + RT3.lng strings
0x004882e0,199,world_region_border_overlay_rebuild,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Rebuilds the border-overlay companion for the numbered region set owned by `0x0062bae0`. After pumping shell progress through `0x004834e0` the helper seeds a companion record family on `0x006cfc9c`, counts active region entries, scans the active world grid at `0x0062c120`, compares neighboring cell-region ids, and emits border-segment geometry through `0x00536ea0` whenever adjacent cells belong to different mapped regions. Current grounded callsites are the post-load generation pipeline at `0x004384d0` and the broader world-build path around `0x00447560`, which makes this look like a region-border overlay rebuild rather than another generic player or company manager pass.","objdump + caller xrefs + RT3.lng strings + grid-neighbor inspection"
0x004c9da0,496,map_editor_chairman_slot_panel_format_slot_card,map,cdecl,inferred,objdump + RT3.lng strings + control-flow inspection,4,"Formats one selected chairman-slot card for the shell editor panel rooted under control group `0x5a6e`. The helper reads the 9-byte local slot record rooted at `[0x006cec78+slot*9+0x69d8]`, formats the staged chairman profile label from the static persona table at `0x005f2d28`, appends the localized `Optional` versus `Mandatory` suffix from ids `2997` and `2998` based on `[slot+0x01]` with nonzero=`Optional` and zero=`Mandatory`, then appends one of `Human` `Computer` or `Human or Computer` from ids `3001` `3000` and `2999` based on `[slot+0x02]` plus the separate per-slot gate at `[0x006cec78+slot*9+0x0bc3]`. It also formats the numeric tuning field from `[slot+0x04]` into the same card. Current grounded caller is the selection callback rooted at `0x004cc230`.","objdump + RT3.lng strings + UI callback inspection"
0x004ca010,432,map_editor_chairman_slot_panel_refresh_selected_slot,map,thiscall,inferred,objdump + RT3.lng strings + UI control inspection,4,"Refreshes the active detail controls for one selected chairman slot in the shell editor panel. It stores the selected slot index at `[this+0x80]`, publishes the staged profile id from `[slot+0x00]`, the persona icon byte from `0x005f2d29`, and the localized profile label from `0x005f2d47`, then updates the role and policy controls from the same local record. `[slot+0x01]` drives the Optional-versus-Mandatory control pair with nonzero=`Optional` and zero=`Mandatory`; `[slot+0x02]` plus the separate per-slot gate at `[0x006cec78+slot*9+0x0bc3]` drive the `Human`, `Computer`, and `Human or Computer` controls; and `[slot+0x04]` is surfaced through the numeric field editor. Current grounded caller is the list-selection callback at `0x004cc230`.","objdump + RT3.lng strings + UI control inspection"
0x004ca1c0,514,map_editor_chairman_slot_panel_refresh_slot_counters,map,thiscall,inferred,objdump + UI control inspection,3,"Recomputes the aggregate slot counters displayed by the chairman-slot editor panel. The helper walks the 16 local slot records rooted at `[0x006cec78+0x69d8]`, splits them by the Optional-versus-Mandatory byte `[slot+0x01]`, and separately counts slots whose live-seat markers come from the ordinary seat byte `[slot+0x02]` versus the special occupied-seat byte `[slot+0x03]`. It then formats the resulting `%1/%2` summaries through the shared pattern block at `0x005cfda8`, republishes those summaries to the panel controls under groups `0x5a6f`, `0x5a70`, and `0x5a71`, and stores the aggregate counts at `0x006cec78+0x6a68..0x6a7c` for neighboring shell validation. Current grounded callers are the panel constructor at `0x004cc2d0` and the role-policy update handlers in `0x004cecc0`.","objdump + UI control inspection + format-string inspection"
0x004ca540,304,map_editor_available_chairman_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + static-table inspection,4,"Constructs the shell-side `Player Pool` page in the map-editor control panel. The helper binds the row formatter `0x004ca450` and range callback `0x004ca430` on the shared panel root `0x5aa0`, walks the 40-entry persona table slice at `0x005f2d6e` in `0x27`-byte steps, publishes one localized chairman-name row for each persona, counts enabled scenario-side availability bytes in `[0x006cec78+0x6987..]`, and then republishes the `%1 out of %2 are selected.` summary from localized id `1035` through control `0x5aa4`. The neighboring localized page text `996` `Player Pool` plus help text `1016` `Control of which specific players (i.e. Jay Cooke) allowed in the scenario.` now make this the strongest current shell owner for the scenario's available-chairman pool rather than another generic persona browser.","objdump + RT3.lng strings + static-table inspection + UI callback inspection"
0x004ca670,280,map_editor_scenario_metadata_panel_refresh_briefing_mode,map,thiscall,inferred,objdump + RT3.lng strings + UI control inspection,4,"Refreshes the briefing-mode controls inside one shell-side map-editor scenario metadata panel. The helper uses the global selector `0x621f50` to choose whether the visible long-text editor is the ordinary scenario briefing or the multiplayer briefing, publishes the corresponding heading from localized ids `1491` `Briefing (dialog appears when scenario starts):` and `3586` `Multi-Player Briefing (dialog appears when scenario starts):` onto control `0x5b73`, flips the paired selector controls around `0x5b71` and `0x5b72`, and republishes the stored single-player and multiplayer briefing texts from `[0x006cec78+0x4f30]` and `[+0x5ae9]` into the paired edit controls `0x5b6d` and `0x5b6f`. Current grounded caller is the broader scenario metadata refresh at `0x004ca790`.","objdump + RT3.lng strings + UI control inspection + state-field correlation"
0x004ca790,384,map_editor_scenario_metadata_panel_refresh_controls,map,thiscall,inferred,objdump + RT3.lng strings + UI control inspection,4,"Refreshes the shell-side map-editor scenario metadata controls under the shared control band `0x5b69..0x5b74`. The helper first re-enters `map_editor_scenario_metadata_panel_refresh_briefing_mode` at `0x004ca670`, then republishes the scenario description from `[0x006cec78+0x672e]` to control `0x5b69`, the start-year trio from `[+0x66ca]`, `[+0x66d2]`, and `[+0x66ce]` into `0x5b6a`, `0x5b6c`, and `0x5b6b`, and the two boolean flags `[+0x66de]` and inverse `[+0x66f3]` into controls `0x5b6e` and `0x5b74`. The neighboring message dispatcher at `0x004cb4a0` clamps the three year fields to `1829..2100` and maintains `minimum <= default <= maximum`, which aligns this panel with the localized editor strings `Description:` `Minimum Start Year:` `Default Start Year:` `Maximum Start Year:` and the paired briefing labels in `RT3.lng` ids `1483..1492` and `3586`.","objdump + RT3.lng strings + UI control inspection + state-field correlation"
0x004ca910,474,map_editor_building_density_panel_refresh_controls,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + UI control inspection,4,"Refreshes the shell-side `Building Density` page in the map-editor control panel. The helper reads two scenario-state bytes at `[0x006cec78+0x4c78]` and `[+0x4c7c]` and reflects them into two separate three-choice control bands `0x5c3a..0x5c3c` and `0x5c44..0x5c46`, with both fields seeded to the middle state `1` by constructor-time defaults and persisted through the ordinary map-state bundle path. The localized field captions now make the page materially tighter: `[state+0x4c78]` is the `Starting Building Density Level:` selector from ids `1642` and `1643`, where the default middle state `1` corresponds to the documented `100%` baseline and the lower world-building branches later treat the stored ordinal as a real three-state numeric mode; `[state+0x4c7c]` is the paired `Building Density Growth:` selector from id `1644`, which combines with city or region-specific density changes as described by `1641` and is likewise consumed later as a three-state growth-mode byte rather than a pure UI label. Related localized report text such as `1037`, `1048`, and `1070` points back to this same pair as the map-wide starting-density and later growth controls.","objdump + RT3.lng strings + caller inspection + UI control inspection + save-load correlation"
0x004ca980,315,map_editor_economic_cost_slider_dispatch,map,thiscall,inferred,objdump + RT3.lng strings + .data descriptor table inspection,3,"Slider-update dispatcher for one shell-side map-editor economic tuning family. The helper handles the bounded slider event range `0xa433..0xa43d`, converts the incoming integer slider delta or position into normalized floats, writes six tuned values into the adjacent scenario-state block at `[0x006cec78+0x0be2]`, `[+0x0be6]`, `[+0x0bea]`, `[+0x0bee]`, `[+0x0bf2]`, and `[+0x0bf6]`, mirrors the first value into `[state+0x0bde]`, and then re-enters the live panel owner through `0x004cadf0` when `0x006cff84` is present. Current neighboring constructor evidence binds this callback to six visible controls under `0x5bcd..0x5bd7`, while the surrounding `.data` descriptor run at `0x00611c70..0x00612220` now bounds the wider editor lane as the live owner for `Prime Rate`, `Merger Premium`, and the construction and maintenance cost labels `Build Stations Cost` through `Steam Engine Cost` with help texts `2433..2437`, rather than leaving that help-text family orphaned.","objdump + slider jump-table inspection + state-field correlation + RT3.lng strings + .data descriptor table inspection"
0x004cadf0,751,map_editor_economic_cost_slider_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + .data descriptor table inspection,4,"Constructs one shell-side map-editor economic cost tuning panel. The helper registers `map_editor_economic_cost_slider_dispatch` at `0x004ca980` on the six slider controls `0x5bcd`, `0x5bcf`, `0x5bd1`, `0x5bd3`, `0x5bd5`, and `0x5bd7`, attaches the neighboring preview or formatter callback `0x004caaf0` on control `0x5be1`, and then republishes the current scenario-state tuning values from `[0x006cec78+0x0be2..0x0bf6]` back into those controls through the shared slider formatting helpers. Current surrounding evidence now grounds this as the live editor-side economic tuning subsystem that was previously only visible through the orphaned help-text family: the adjacent descriptor block at `0x00611c70..0x00612220` pairs the wider lane with localized fields `Prime Rate`, `Merger Premium`, and `Build Stations Cost` through `Steam Engine Cost`, plus help texts `2433..2437`. Current grounded caller is the larger editor-panel dispatcher at `0x004ce244`.","objdump + caller inspection + slider registration + state-field correlation + RT3.lng strings + .data descriptor table inspection"
0x004cb2b0,485,map_editor_scenario_special_conditions_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + static-table inspection,4,"Constructs the special-conditions side of the shell map-editor scenario setup page. The helper binds the row formatter `0x004cb1c0` and range callback `0x004cb1a0` on list control `0xa7fa` through `Setup_Options_Buttons.imb`, walks the 36-entry static toggle table at `0x005f3ab0`, counts enabled dword flags in `[0x006cec78+0x4a7f]`, formats each row from paired label/help ids such as `2535/2564` `Disable Stock Buying and Selling`, `2874/2875` `Use Bio-Accelerator Cars`, `3722/3723` `Disable Cargo Economy`, `3850/3851` `Disable Train Crashes`, `3852/3853` `Disable Train Crashes AND Breakdowns`, and `3920/3921` `AI Ignore Territories At Startup`, and republishes the `Special Conditions In Effect` summary from localized id `1053` through control `0xa7f8`. It then re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`, which makes this a bounded scenario special-conditions panel rather than a generic option list. Current grounded caller is the larger editor-panel dispatcher at `0x004ce28e`.","objdump + RT3.lng strings + static-table inspection + UI callback inspection"
0x004cb4a0,468,map_editor_scenario_metadata_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the adjacent map-editor scenario metadata controls. The helper handles the bounded event band `0xa497..0xa4a2`, writing the scenario description from the edit-control payload into `[0x006cec78+0x672e]`, the single-player and multiplayer briefing texts into `[+0x4f30]` and `[+0x5ae9]`, flipping the briefing selector at `0x621f50` between the single-player and multiplayer views, toggling the two boolean bytes `[+0x66de]` and `[+0x66f3]`, and committing the three start-year fields `[+0x66ca]`, `[+0x66ce]`, and `[+0x66d2]` after clamping each incoming value to `1829..2100`. Before returning it also normalizes the year trio so `minimum <= default <= maximum` and then re-enters `map_editor_scenario_metadata_panel_refresh_controls` at `0x004ca790`, which confirms that the shared control band `0x5b69..0x5b74` is the live scenario description, briefing, and start-year editor rather than another generic editor options block. Current grounded caller is the panel callback installation rooted at `0x004ce28e`.","objdump + RT3.lng strings + UI dispatch inspection + state-field correlation"
0x004cb6f0,496,map_editor_available_chairman_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + static-table inspection + UI dispatch inspection,4,"Message dispatcher for the shell-side `Player Pool` editor page. The helper handles the three bulk-selection buttons `0x5aa1..0x5aa3` by rewriting the scenario-side availability bytes rooted at `[0x006cec78+0x6987]` from preset-selection bytes embedded in the same `0x005f2d28` persona table family, and it also commits direct per-row toggle changes from the control range `0x5aaa..0x5b03` back into that byte array. After either path it re-enters `map_editor_available_chairman_panel_construct` at `0x004ca540`, which keeps the visible chairman-name list and the `selected out of total` summary in sync. The localized page text `996` `Player Pool` and help text `1016` now make this the live owner for the scenario's chairman-availability mask rather than a passive list callback block.","objdump + RT3.lng strings + static-table inspection + UI dispatch inspection + state-field correlation"
0x004cb8e0,271,map_editor_scenario_special_conditions_panel_handle_message,map,thiscall,inferred,objdump + static-table inspection + UI dispatch inspection,4,"Message dispatcher for the special-conditions side of the shell map-editor scenario setup page. The helper handles the bulk selection controls `0xa7fb` and `0xa7fc` by writing the whole special-condition dword array rooted at `[0x006cec78+0x4a7f]`, commits direct per-row state changes from the callback band `0xabe0..0xafc7` into that same array, and then re-enters `map_editor_scenario_special_conditions_panel_construct` at `0x004cb2b0` to refresh the visible list and the `Special Conditions In Effect` summary. Two row ids are also special-cased through immediate helper calls after commit, which marks this as the live state owner for the scenario rule-toggle matrix rather than only a passive list callback block.","objdump + static-table inspection + UI dispatch inspection + state-field correlation"
0x004cb9f0,134,map_editor_building_density_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + caller inspection + UI dispatch inspection,4,"Message dispatcher for the shell-side `Building Density` page. The helper handles the two three-choice control bands `0x5c3a..0x5c3c` and `0x5c44..0x5c46`, committing ordinal values `0`, `1`, or `2` into the scenario-state bytes `[0x006cec78+0x4c78]` and `[+0x4c7c]` respectively before re-entering the same page refresh path at `0x004ca910`. The localized captions now pin the semantics more directly: `[state+0x4c78]` is the map-wide `Starting Building Density Level:` selector whose default middle state is the documented `100%` baseline, while `[state+0x4c7c]` is the paired `Building Density Growth:` selector. Current downstream xrefs also show both stored bytes steering later world-generation and growth math as concrete three-state mode selectors rather than only UI summaries.","objdump + RT3.lng strings + caller inspection + UI dispatch inspection + state-field correlation"
0x004cc980,943,map_editor_city_region_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Cities/Regions` editor page. The helper uses the current selected city-or-region id in `0x006cff74`, falls back to the first live entry in the region collection at `0x0062bae0`, and shows the empty-page warning from localized id `1045` `You currently have no cities or regions to edit.` when the collection is empty. In the live path it binds the list-row formatter `0x004cc340` and selection callback `0x004cc930`, populates the visible city-or-region list from `0x0062bae0`, publishes detail fields through controls `0x50dc..0x50e2`, and formats the page summary from localized ids including `3002`, all of which makes this the main owner for the `Cities/Regions` editor section rather than a subordinate helper.","objdump + RT3.lng strings + UI callback inspection + region-collection correlation"
0x004cc250,112,map_editor_chairman_slot_panel_refresh_slot_list,map,thiscall,inferred,objdump + UI control inspection,4,"Rebuilds the visible slot list in the chairman-slot editor panel. It clears the list control under group `0x5a6e`, then walks the 16 local slot records rooted at `[0x006cec78+0x69d8]` and appends one row for each slot whose active-seat bytes `[slot+0x02]` or `[slot+0x03]` are set. After repopulating the list it re-enters `map_editor_chairman_slot_panel_refresh_slot_counters` at `0x004ca1c0`. Current grounded callers are the panel constructor at `0x004cc2d0` and several message-handler update paths in `0x004cecc0`.","objdump + UI control inspection"
0x004cc2d0,99,map_editor_chairman_slot_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Players` editor panel under control group `0x5a6e`. The helper attaches the selected-slot formatter at `0x004c9da0`, the profile-cycle button at `0x004c9fa0`, and the list-selection callback at `0x004cc230`, then populates the current slot list through `map_editor_chairman_slot_panel_refresh_slot_list` and publishes one top-level panel control. The localized page text `995` `Players` plus help text `1015` `Control of how many players, human and/or A.I., allowed in the scenario.` now make this the clearest current shell owner for the local chairman-slot record family rooted at `0x006cec78+0x69d8`.","objdump + RT3.lng strings + UI callback inspection"
0x004ceb90,291,map_editor_chairman_slot_panel_cycle_selected_slot_profile,map,thiscall,inferred,objdump + static-table inspection,4,"Cycles the staged chairman profile assigned to the currently selected local slot. Starting from the slot-local profile id at `[slot+0x00]`, the helper wraps through the bounded persona id range `0..40`, skips any profile already marked busy in the static persona table byte at `0x005f2d28`, writes the chosen id back to `[slot+0x00]`, and mirrors the same choice into any already-materialized persona object in `0x006ceb9c`, including its display name, biography text, and icon byte. Current grounded callers are the profile-cycle control in `map_editor_chairman_slot_panel_handle_message` and the neighboring shell callback block around `0x004c9fa0`.","objdump + static-table inspection + UI callback inspection"
0x004cecc0,1049,map_editor_chairman_slot_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell chairman-slot editor panel rooted at `0x5a6e`. The helper handles add and remove slot actions, profile cycling, the Optional-versus-Mandatory toggle, the three-way `Human` `Computer` `Human or Computer` role group, and numeric tuning edits for the selected slot. The current slot-record semantics are bounded directly from these branches: control id `0x5a77` writes `[slot+0x01]=1` for `Optional`, `0x5a78` writes `[slot+0x01]=0` for `Mandatory`, and `0x5a79`, `0x5a7a`, plus `0x5a7b` select `Human`, `Computer`, and `Human or Computer` by combining the ordinary seat byte `[slot+0x02]` with the separate per-slot gate at `[0x006cec78+slot*9+0x0bc3]`; `0x5a7c` commits the numeric tuning field back to `[slot+0x04]`. The add-slot path allocates a new live slot, seeds `[slot+0x00]` to one persona id, `[slot+0x01]` to `Optional`, `[slot+0x02]` to the broad `Human or Computer` state, mirrors that same broad state into the external gate at `+0x0bc3`, and seeds `[slot+0x04]` to the default `100000` tuning value. The remove path clears the whole 9-byte record rooted at `[slot+0x00]`, resets `[slot+0x04]` back to `100000`, and clears any already-materialized persona object, but it does not directly write the special occupied-seat byte `[slot+0x03]`, which remains seeded elsewhere in the currently grounded code. Current grounded caller is the shell panel callback attachment in `map_editor_chairman_slot_panel_construct` at `0x004cc2d0`.","objdump + RT3.lng strings + UI dispatch inspection"
0x004ce070,1549,map_editor_panel_select_active_section,map,thiscall,inferred,objdump + caller inspection + UI dispatch inspection,4,"Top-level map-editor control-panel section selector. The helper switches over the active page byte at `[this+0x78]`, tears down or replaces the current page owner at `[this+0x7c]`, and then constructs the bounded editor pages reached so far including the scenario metadata panel `0x004ca790`, city-or-region page `0x004cc980`, territory page `0x004cd070`, available-chairman panel `0x004ca540`, economic tuning panel `0x004cadf0`, locomotives-availability page `0x004cd680`, industry-availability page `0x004cdbd0`, special-conditions panel `0x004cb2b0`, the bounded dual tri-state policy panel rooted at `0x004ca910`, the now-grounded `Port/Warehouse Cargos` page `0x004cf910`, and the resolved report pages at `0x004d3000`, `0x004d3020`, `0x004d3060`, `0x004d3080`, `0x004d30a0`, `0x004d4110`, and `0x004d4130`. Current neighboring shell evidence is enough to treat this as the broad editor-side page owner rather than another local panel helper.","objdump + caller inspection + UI dispatch inspection + page-constructor correlation"
0x004ce380,1174,map_editor_city_region_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Cities/Regions` editor page. The helper routes list-selection and navigation traffic through the city-or-region controls around `0x507e..0x5088`, opens the rename prompt from localized id `1054` `Enter the new name:` for the currently selected city-or-region, and also owns the copy-industry-data flow anchored by localized id `1055` `Choose the city to copy industry data from`. One bounded branch walks the candidate pool at `0x0062b268` and reapplies per-candidate enable or weighting state against the selected city-or-region through `0x004206b0` before re-entering `map_editor_city_region_panel_construct`. Current grounded globals `0x006cff74`, `0x006cff78`, and the region collection `0x0062bae0` make this the live handler for the `Cities/Regions` editor section rather than a generic shell callback block.","objdump + RT3.lng strings + UI dispatch inspection + region and candidate correlation"
0x004ce820,1221,map_editor_territory_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Territories` editor page. The handler uses the selected territory ids in `0x00621f48` and `0x00621f4c`, routes selection and navigation through controls around `0x50dc..0x50df`, opens the territory rename prompt from localized id `1054`, and owns the border-remap or hide-border policy path that warns through localized ids `1056` and `1057` when a territory's borders cannot be hidden because other territories already remap to it. After committing the selected territory's border and remap fields it re-enters `map_editor_territory_panel_construct`, which makes this the live `Territories` page handler rather than another local modal callback.","objdump + RT3.lng strings + UI dispatch inspection + territory-state correlation"
0x004cd070,1280,map_editor_territory_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Territories` editor page. The helper uses `0x00621f48` and `0x00621f4c` as the selected-territory latches, falls back to the first live territory in the territory collection at `0x006cfc9c`, and shows the empty-page warning from localized id `1046` `You currently have no territories to edit.` when no territories exist. In the live path it populates the visible territory list from `0x006cfc9c`, publishes the selected territory's id, name, border mode, remap target, and numeric tuning fields through controls `0x50dc..0x50e5`, and builds the secondary remap list from other territories that reference the currently selected one. Current grounded neighbors make this the main owner for the `Territories` editor section.","objdump + RT3.lng strings + UI callback inspection + territory-collection correlation"
0x004cd680,1168,map_editor_locomotive_availability_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Locomotives` availability page in the map-editor control panel. The helper reflects three scenario-state policy bytes from `[0x006cec78+0x4c97]`, `[+0x4c98]`, and `[+0x4c99]` into controls `0x5b09..0x5b0b`, binds the row formatter `0x004cd570` and the neighboring callback `0x004ca960` on root control `0x5b05`, and iterates the collection at `0x006ada84` to build the visible locomotive list plus the localized title from id `1050` `Locomotives Available\n\n%1 of %2 available`. The detail path formats each selected locomotive through `EditorDetail.win` and counts live world usage by resolving the record through `0x00461c80` and the world-side lookup at `0x00435030`. Current grounded evidence is therefore strong enough to treat this as the main locomotives-available page rather than a generic detail widget.","objdump + RT3.lng strings + UI callback inspection + locomotive-usage correlation"
0x004cf0d0,861,map_editor_locomotive_availability_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Locomotives` availability page. The helper routes selection and bulk-toggle traffic through controls `0x5b06..0x5b0c`, rewrites the three scenario-state policy bytes at `[0x006cec78+0x4c97]`, `[+0x4c98]`, and `[+0x4c99]`, and walks the locomotive collection at `0x006ada84` to commit per-row availability changes through the same record family used by the constructor. Bulk branches apply enable or disable policy across the visible locomotive set before the handler re-enters `map_editor_locomotive_availability_panel_construct` at `0x004cd680`, which makes this the live availability-policy owner rather than a local detail callback.","objdump + RT3.lng strings + UI dispatch inspection + locomotive-policy correlation"
0x004cdbd0,1357,map_editor_industry_availability_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Industry (Overall)` availability page in the map-editor control panel. The helper binds the detail-row callback `0x004cc130` and the neighboring callback `0x004c9d80` on root control `0x9c42`, then walks the global candidate pool at `0x0062b268`, skipping the category-1 family and sorting the remaining candidates by label before building the visible industry list. The detail side formats the selected industry through `EditorDetail.win`, appends up to eight compatible city-or-region names from the region collection at `0x0062bae0`, and publishes the localized summary from id `1051` `There are %1 Cities and/or Regions using %2 right now`, while the page title uses id `1052` `Industries Available\n\nIndustries: %1 of %2 available`. Current grounded evidence therefore treats this as the main industry-availability page rather than an unnamed detail browser.","objdump + RT3.lng strings + UI callback inspection + candidate-pool correlation"
0x004cf430,714,map_editor_industry_availability_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Industry (Overall)` availability page. The handler routes navigation and toggle traffic through the control band `0x9c43..0xa40f`, updates candidate-availability state through `0x00434f20` for the currently selected industry rows, and then re-enters `map_editor_industry_availability_panel_construct` at `0x004cdbd0` so the visible count and compatible-city summary refresh against the candidate pool at `0x0062b268`. Current grounded control usage and localized strings now make this the live industry-availability handler rather than another shared editor callback block.","objdump + RT3.lng strings + UI dispatch inspection + candidate-state correlation"
0x004cf910,1770,map_editor_port_warehouse_cargo_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Port/Warehouse Cargos` page in the map-editor control panel. The helper uses the selected recipe-book index latches at `0x006cffa0` and `0x006cffa4`, falls back across the per-book state blocks rooted at `[0x006cec78+0x0fe7+index*0x4e1]`, and populates the visible cargo-page controls under `0x59d8`, `0x5a0a`, and `0x5b74`. Current page-state work now bounds the structure more concretely too: the selected recipe-book index wraps modulo `12`, each recipe-book block stores the shared maximum annual production float at `book+0x3ed`, and the constructor then walks five fixed cargo-line entries starting at `book+0x3f1` with stride `0x30`. Each line now grounds as one row-owned mode dword at `+0x00`, one annual amount float at `+0x04`, one supplied-cargo token at `+0x08`, and one demanded-cargo token at `+0x1c`; the constructor resolves the two token strings against the global cargo collection and then reflects the resulting selector indices back into the page controls. The row-control mapping is now bounded too: the selector and label pair at `+0x14/+0x1e` is the supplied-cargo side because it is the pair enabled in modes `2/3`, while the pair at `+0x28/+0x0a` is the demanded-cargo side because it is the pair enabled in modes `1/3`. The same gating also tightens the single numeric field at `+0x46/+0x32`: it is labeled `Annual Demand:` only for mode `1`, but `Annual Supply:` for modes `2/3`. The localized page-title and help-text cluster now bounds the page much more tightly: `1001` `Port/Warehouse Cargos`, `1021` `Control over what ports and warehouses demand and supply.`, `1499` `Port/Warehouse Cargo Recipe Book:`, `1671` `Rename this cargo recipe book`, `1672` and `1673` for previous or next recipe-book cycling, `1674` and `1675` for the shared maximum annual production field, `1676` `Demanded:`, `1677` `Supplied:`, and `1678` for the per-cargo annual amount field. The same constructor also surfaces the four per-cargo mode labels `501` `<Disabled>`, `502` `Demand Only`, `503` `Supply Only`, and `504` `Production Demand->Supply`, publishes the annual demand or supply captions from `510` and `511`, formats rename and usage summaries through localized ids `507`, `508`, and `509`, and exposes the sandbox toggle text from id `3901` `Sandbox Allowed`. Current mode gating now makes the fourth mode tighter too: `Production Demand->Supply` is the only line state that clearly keeps both supplied-cargo and demanded-cargo branches active, while the shared numeric field stays on the supply side in that mode. That matches the wording around `1674`, `1675`, and `504` that ties it to one shared production-capacity pool and raw-material conversion into supplied output. It also emits the bounded high-production and high-load warnings from ids `505` and `506`, both of which explicitly reference ports or warehouses, which makes this the strongest current owner for the recipe-book or port-cargo editor lane rather than another generic detail page.","objdump + RT3.lng strings + UI callback inspection + recipe-book state correlation + mode-table correlation + control-gating correlation"
0x004d0040,1643,map_editor_port_warehouse_cargo_panel_handle_message,map,thiscall,inferred,objdump + RT3.lng strings + UI dispatch inspection,4,"Message dispatcher for the shell-side `Port/Warehouse Cargos` editor page. The helper routes selection and navigation traffic through the same recipe-book control bands rooted at `0x59d8`, `0x5a0a`, and `0x5b74`, opens the rename prompt from localized id `507`, and commits per-book cargo policy, sandbox-allowed state, and recipe-book text changes back into the scenario-state blocks at `[0x006cec78+0x0fe7+index*0x4e1]`. The edit-side dispatch is now tighter than before: the recipe-book selector wraps modulo `12`; the dedicated top-level numeric field under `0x59de` writes the shared maximum annual production float at `book+0x3ed`; and the per-line edit groups commit into five fixed cargo-line records beginning at `book+0x3f1` with stride `0x30`. Those line groups now ground as one mode dword at `+0x00`, one annual amount float at `+0x04`, one supplied-cargo token string at `+0x08`, and one demanded-cargo token string at `+0x1c`. The concrete control writes are now bounded too: the mode-`2/3` selector pair writes the supplied token through the `+0x14` control into `+0x08`, while the mode-`1/3` selector pair writes the demanded token through the `+0x28` control into `+0x1c`. The same handler keeps the single amount field on the demand side only for mode `1`; in modes `2/3` it writes that same `+0x04` field as annual supply, which matches the constructor captions `510` `Annual Demand:` versus `511` `Annual Supply:`. Current localized row text now makes the bounded edit surface much clearer: the page cycles among recipe books through `1672` and `1673`, renames them through `1671`, updates the shared maximum annual production field under `1674` and `1675`, and edits five fixed per-book line entries whose mode labels are `501` `<Disabled>`, `502` `Demand Only`, `503` `Supply Only`, and `504` `Production Demand->Supply` with annual amount captions `510` `Annual Demand:` and `511` `Annual Supply:` plus row labels `1676` `Demanded:` and `1677` `Supplied:`. The wording on `1675` also tightens the fourth mode specifically: `Production Demand->Supply` is the branch where the shared production-cap field is relevant and raw materials on hand are converted through production lines into supplied output, rather than only free-standing demand or free-standing supply. One bounded branch walks the city-or-region collection at `0x0062bae0` while rebuilding the usage summaries from localized ids `508` and `509`, and the warning branches re-use ids `505` and `506` when production-rate or supply-demand settings become too high for ports or warehouses. Before returning it re-enters `map_editor_port_warehouse_cargo_panel_construct` at `0x004cf910`, which makes this the live handler for the port or warehouse recipe-book page rather than a shared page-table callback.","objdump + RT3.lng strings + UI dispatch inspection + recipe-book state correlation + mode-table correlation + control-write correlation"
0x004cf700,370,map_editor_panel_dispatch_active_section_message,map,thiscall,inferred,objdump + caller inspection + UI dispatch inspection,4,"Top-level message dispatcher for the active map-editor control-panel section. The helper reuses the same page selector byte at `[this+0x78]` and routes incoming shell messages to the current page-local handlers, including the grounded city-or-region handler `0x004ce380`, territory handler `0x004ce820`, scenario metadata handler `0x004cb4a0`, available-chairman handler `0x004cb6f0`, special-conditions handler `0x004cb8e0`, the bounded dual tri-state handler `0x004cb9f0`, the grounded port-or-warehouse cargo handler `0x004d0040`, and the resolved report-page handlers rooted at `0x004d38c0`, `0x004d3d90`, and the neighboring editor report family. Current grounded caller and page-table evidence now make this the broad editor-side active-page dispatcher rather than another page-local callback block.","objdump + caller inspection + UI dispatch inspection + page-handler correlation"
0x004d0420,1618,map_editor_city_count_stats_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `City Count Stats` editor report. The helper aggregates land-cell and city counts from the active world and region collections, derives per-10K density ratios, and formats the visible summary through localized ids `1059..1070`, including `Total Land Cells`, `Total Cities`, `Average City Building Density`, `Average Region Building Density`, and the projected starting-industry and non-industry building counts. Current grounded caller is the neighboring report-page constructor at `0x004d30a0`.","objdump + RT3.lng strings + caller inspection + world and region count correlation"
0x004d0a90,3416,map_editor_general_validation_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `General Validation` editor report. The helper walks the current scenario and world state looking for high-level validation failures, including missing industry in a city or region, mismatches between available player slots and the current player-pool setup, missing briefing text, and missing scenario description, then emits the matching warning lines through localized ids such as `1071`, `1073`, `1074`, and `1075`. Current grounded caller is the page constructor at `0x004d3080`, which makes this the actual general-validation report rather than the tree-stats page previously grouped under that label.","objdump + RT3.lng strings + caller inspection + validation-string correlation"
0x004d1b80,536,map_editor_tree_stats_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `Tree Stats` editor report. The helper scans the active world grid through dimensions rooted at `0x0062c120`, accumulates total-tree and density counts into the neighboring global scratch slots at `0x006cffa8` and `0x006cffb8`, and then formats the visible report through localized id `1086`, which includes `Total Trees`, `Trees per any cell`, `Trees per land cell`, and the adjacent performance guidance text. Current grounded caller is the tree-stats page constructor at `0x004d3060`.","objdump + RT3.lng strings + caller inspection + world-grid scan correlation"
0x004d1d60,1679,map_editor_city_region_growth_stats_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `Stats - City/Region` growth report. The helper walks the city or region collection at `0x0062bae0`, reads display names from each entry, and formats the multi-column growth summary through localized ids `1087..1096`, including `Industry Bldg Count`, `Industry Revenue`, `Industry Profit`, `Modified Rail Revenue`, `Weighted Profit Margin`, `Annual Density Adjust`, `Start Density`, `Current Density`, `Start Bldg Count`, and `Current Bldg Count`. The neighboring constructor also publishes localized id `1114`, whose explanatory text says cities grow from industry profit margins plus modified rail revenue, so this now looks like the main city-region growth analytics page rather than a generic validation helper. Current grounded caller is `0x004d3020`.","objdump + RT3.lng strings + caller inspection + city-region stat correlation"
0x004d2430,1597,map_editor_cargo_stats_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `Stats - Cargo` editor report. The helper iterates the cargo or building candidate pool at `0x0062b268`, groups entries by category, and emits the report columns from localized ids `1097..1113`, including `Category`, `Raw Producers`, `Factories`, `Total`, and the adjacent supply-demand and weighted-price summary fields. Current grounded caller is the neighboring page constructor at `0x004d3000`.","objdump + RT3.lng strings + caller inspection + cargo-pool correlation"
0x004d3000,32,map_editor_cargo_stats_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Stats - Cargo` page in the map-editor control panel. The helper binds the report callback `0x004d2430` and attaches the resulting page into the broader editor section owner. Current grounded neighboring labels and report fields align this page with the cargo analytics family rather than with general validation.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d3020,32,map_editor_city_region_growth_stats_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Stats - City/Region` page in the map-editor control panel. The helper binds the report callback `0x004d1d60`, and the surrounding page text includes localized id `1114`, whose explanatory note about city growth from industry profit margins and modified rail revenue matches the same report callback. Current grounded evidence therefore treats this as the city-region growth analytics page.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d3060,100,map_editor_tree_stats_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Stats - Trees` page in the map-editor control panel. The helper binds the report callback `0x004d1b80` and attaches it into the broader editor page owner. This corrects the earlier overbroad validation naming: current grounded evidence says this constructor owns the dedicated tree-stats page rather than the whole general-validation lane.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d3080,32,map_editor_general_validation_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `General Validation` page in the map-editor control panel. The helper binds the report callback `0x004d0a90` and sits alongside the neighboring stats and event-report pages in the same page table. Current grounded warning strings and validation checks make this the actual general-validation page rather than the adjacent tree-stats constructor.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d30a0,32,map_editor_city_count_stats_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Stats - City Count` page in the map-editor control panel. The helper binds the report callback `0x004d0420` and sits alongside the other editor report constructors in the active-section page table. Current grounded labels and report fields align it with the city-count and projected-density summary page.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d38c0,1228,map_editor_event_variable_values_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the localized `Event Variable Values` editor tracking report. The helper walks the active scenario issue-state arrays across the game, company, player-profile, and territory slices and emits the visible rows through localized ids `1118..1125`, including `Game : %1`, `Comp. : %1 : %2`, `Player : %1 : %2`, `Terr. : %1 : %2`, and the page title `Event Variable Values`. Current grounded caller is the event-variable page constructor at `0x004d4110`.","objdump + RT3.lng strings + caller inspection + scenario-issue-array correlation"
0x004d3d90,878,map_editor_event_validation_report,map,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the editor event-validation report over the live event collection at `0x0062be18`. The helper checks for missing required outcome events and per-event validation failures, then emits the bounded result strings `No Status event.`, `No Lose event.`, `No Win - Gold event.`, `No Win - Silver event.`, `No Win - Bronze event.`, `Error with event %1.`, and `No event errors detected.` from localized ids `1127..1133`. Current grounded caller is the neighboring page constructor at `0x004d4130`.","objdump + RT3.lng strings + caller inspection + event-collection correlation"
0x004d4110,32,map_editor_event_variable_values_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side `Event Variable Values` tracking page in the map-editor control panel. The helper binds the report callback `0x004d38c0` and sits beside the neighboring event-validation page in the active-section page table.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x004d4130,32,map_editor_event_validation_panel_construct,map,thiscall,inferred,objdump + RT3.lng strings + UI callback inspection,4,"Constructs the shell-side event-validation page in the map-editor control panel. The helper binds the report callback `0x004d3d90`, which checks for missing status or win-lose events and other per-event errors before formatting the result list.","objdump + RT3.lng strings + UI callback inspection + page-constructor correlation"
0x00456920,3247,unit_visual_init_weapon_airframe_and_exhaust_effects,bootstrap,thiscall,inferred,ghidra-headless,4,Initializes one armed-unit visual bundle spanning turret and cannon hardware exhaust emitters and aircraft airframe attachments. The routine creates static Turret Mantlet Cannon and MuzzleFlash assets at [this+0x31a] through [this+0x326] direct JetExhaust and PropExhaust sprite emitters at [this+0x2f6] and [this+0x2fa] a cannon-audio attachment at [this+0x32a] indexed WingL and WingR assets plus plane-audio state at [this+0x32e] through [this+0x346] and cached Aileron Elevator Rudder and Thrust vectors at [this+0x2d1] [this+0x2c5] [this+0x2b9] and [this+0x2dd].,ghidra + rizin + llvm-objdump + strings
0x00461650,120,map_load_geographic_label_database,map,cdecl,inferred,ghidra-headless,3,Loads the geographic-label database branch inside the broader reference-bundle setup. It stages resource ids 0x5209 through 0x520b binds the selected bundle through 0x517d90 iterates the loaded collection with 0x517cf0 0x518380 and 0x518140 and dispatches each record through vtable slot +0x44 using the current map path context.,ghidra + rizin + llvm-objdump + strings
0x00461cd0,298,locomotive_collection_select_best_era_matched_non_electric_fallback_id,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + engine-type correlation,2,"Fallback locomotive chooser beneath `company_select_preferred_available_locomotive_id` `0x004078a0`. The helper walks the live locomotive collection, explicitly skips records whose engine-type dword `[record+0x10]` is `2`, and then scores the remaining records from the linked era record at `[record+0x72]`: the current grounded score uses the absolute distance from the current scenario year to the era start field `[era+0x105]`, adds `500` when the era has not started yet, adds `50` when the current year has passed the era-end field `[era+0x109]`, and adds `2000` when the linked approval helper `0x0041d550` rejects the era or engine family for the current context. The lowest-penalty locomotive id wins, so the current best read is an era-matched non-electric fallback rather than a general preferred-locomotive chooser. Current grounded caller is `company_select_preferred_available_locomotive_id` `0x004078a0`.","objdump + caller xrefs + callsite inspection + engine-type correlation + fallback-choice correlation"
0x00464410,12679,shell_dispatch_ui_command,shell,cdecl,inferred,ghidra-headless,4,Large shell UI command dispatcher reached from shell-side event callbacks and direct command pushes. It switches over many command ids including 0x7530 through 0x7532 graphics-preset commands that route into 0x0051ebc0 0x00484590 and 0x004853c0; 0x7533 through 0x7534 TigerTank viewer actions; and 0x7540 through 0x7543 scenario-text report build and batch-processing commands that route into 0x00489830 0x004886e0 and 0x00489a20.,ghidra + rizin + llvm-objdump + strings
0x00474610,120,map_load_city_database,map,cdecl,inferred,ghidra-headless,3,Loads the city database branch in the same pattern as the geographic-label loader. It stages resource ids 0x61a9 through 0x61ab binds the selected bundle through 0x517d90 iterates the collection with 0x517cf0 0x518380 and 0x518140 and dispatches each record through vtable slot +0x44.,ghidra + rizin + llvm-objdump + strings
0x00474e20,336,effect_slot_create_attached_sprite_emitter,bootstrap,thiscall,inferred,ghidra-headless,3,Creates or clones one attached sprite emitter for an effect slot on the owning object. Depending on flag bit 0x400 it either clones through 0x00556ce0 or allocates a fresh 0x1fd template through 0x00556920 then attaches the emitter to the owner at [emitter+0x60] and optionally sets persistent flag [emitter+0xbc].,ghidra + rizin + llvm-objdump
0x00474f70,97,effect_slot_update_attached_sprite_emitters,bootstrap,thiscall,inferred,ghidra-headless,3,Advances every sprite emitter stored in one effect-slot container by iterating its pointer list and calling 0x00555e50 with update mode zero. When the caller passes null it instead walks the global linked slot list rooted at 0x006cea74.,ghidra + rizin + llvm-objdump
0x00477820,59,profile_collection_count_active_chairman_records,map,thiscall,inferred,objdump + callsite inspection,4,"Counts active chairman-profile records in the global persona collection at `0x006ceb9c`. The helper iterates the collection and increments the result only for entries whose live flag at `[profile+0x4]` is nonzero. Current grounded caller is `world_conditionally_seed_named_starting_railroad_companies` at `0x0047d440`, where count `>= 2` gates whether the second seeded railroad can be bound to another active chairman profile.","objdump + callsite inspection + caller correlation"
0x00477860,90,profile_collection_get_nth_active_chairman_record,map,thiscall,inferred,objdump + callsite inspection,4,"Returns one zero-based active chairman-profile record from the global persona collection at `0x006ceb9c`. The helper skips any entry whose live flag `[profile+0x4]` is zero and decrements the requested ordinal across the remaining active entries until it resolves one record or returns null. Current grounded caller is `world_conditionally_seed_named_starting_railroad_companies` at `0x0047d440`, which requests ordinal `1` to bind the second seeded railroad to the second active chairman profile when present.","objdump + callsite inspection + caller correlation"
0x00478200,291,shell_queue_single_world_anchor_overlay,shell,cdecl,inferred,ghidra-headless,3,Builds one world-anchor overlay packet for the current owner object. It samples the owner transform through 0x00455800 and 0x00455810 derives projected half-height and half-width through 0x00477a10 world_anchor_measure_projected_half_height and world_anchor_measure_projected_half_width and then enqueues the finished marker through shell_queue_world_anchor_marker.,ghidra + rizin + llvm-objdump
0x00478330,2432,shell_queue_world_anchor_overlay_list,shell,cdecl,inferred,ghidra-headless,3,Builds and queues a repeated world-anchor overlay list for one owner-managed collection. The routine iterates several owner sublists and state branches repeatedly derives projected extents through 0x00477a10 0x004779c0 world_anchor_measure_projected_half_height and world_anchor_measure_projected_half_width and emits one shell_queue_world_anchor_marker packet per accepted overlay entry.,ghidra + rizin + llvm-objdump
0x0047d080,186,start_new_company_dialog_open,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Opens the shell-side `Start New Company...` dialog rooted at localized id `574`. The helper rolls one persona-dependent shell color or portrait token through a small static table, allocates the modal shell window through the constructor/callback pair `0x0047c590` and `0x0047c3a0`, increments the scenario-side start-company generation counter at `[0x006cec78+0x41]`, and enters the shared callback-driven modal path through `shell_open_custom_modal_dialog_with_callbacks` at `0x004c98a0`. Current grounded caller is the company-list window handler at `0x004c6f30`, which reaches this helper from the synthetic company-row id `0x7fff` after optional resignation confirmation through localized string `272` `You're currently chairman of the %1... Proceed?`. The older claim that this helper stored one live dialog owner at `0x006d3b4c` is no longer supported by direct disassembly; current stronger evidence treats `0x006d3b4c` as part of the broader shell tutorial state family instead.","objdump + RT3.lng strings + caller inspection + modal-path inspection + tutorial-state correction"
0x0047d120,509,start_new_company_dialog_commit_create_company,shell,cdecl,inferred,objdump + caller inspection + company-constructor inspection,4,"Commits the shell-side `Start New Company...` dialog and creates one fresh live company record rather than claiming one of the pre-seeded named railroads. After validating the dialog state it resolves the selected chairman-profile summary from `0x006cec78`, unlinks any existing company from that chairman through `0x00427c70`, allocates a new company id from the live company collection at `0x0062be10`, formats the dialog-owned company-name buffer at `0x006cebd8`, and initializes the new company through `0x00428420`. It then clamps one startup-funding lane against the new company's local limit fields, writes the chosen funding back to `0x006cec14`, updates one per-profile financing slot at `[profile+company_id*4+0x15d]`, applies the resulting debt through `0x00476050`, publishes the new selected company id through `0x00433790`, and triggers one shell refresh through `0x00432f40`. When the dialog instead diverts into the `0x3f2` side path, it packages the same staged company payload into the Multiplayer preview request owner at `0x006cd8d8` through `0x00469d30`.","objdump + caller inspection + company-constructor inspection + global-state correlation"
0x0047d320,280,start_new_company_request_create_company,map,thiscall,inferred,objdump + caller inspection + company-constructor inspection,4,"Creates one fresh company record from a compact startup-company request block. The request layout is now partly grounded: `[this+0x0]` is the chairman profile id in `0x006ceb9c`, `[this+0x4]` is the localized railroad-name id or equivalent name token, `[this+0x8]` plus `[this+0xc]` form the startup-funding total later divided by the new company rate lane, and `[this+0x10]` is the staged company-name buffer. The helper unlinks any existing company from the referenced chairman through `0x00427c70`, allocates a fresh company id from the live company collection at `0x0062be10`, initializes that company through `0x00428420`, and updates one per-profile financing slot at `[profile+company_id*4+0x15d]`. If the request chairman matches the current selected chairman summary from `0x006cec78`, it also publishes the new selected company id through `0x00433790`. Current grounded caller is the neighboring startup-company branch at `0x00470e48`, which reaches this helper when the request cannot be resolved to an existing company record.","objdump + caller inspection + company-constructor inspection + global-state correlation"
0x0047e240,240,placed_structure_query_candidate_local_service_metrics,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Queries one candidate-specific local service metric pair for the current placed-structure or site context. The helper first resolves the requested candidate index through the live structure collection at `0x0062ba8c` and rejects entries that fail `structure_candidate_is_enabled_for_current_year` at `0x0041e220`; on rejection it returns `0`, writes count `0` to the optional first out-pointer, and writes fallback float `1.0` to the optional second out-pointer. For live candidates it resolves the optional linked placed instance at `[this+0x04]`, passes that context through `0x00455f60`, and queries the base integer metric through `0x0042c960`; when the caller has a nonzero local sample list at `[this+0x38]` and `[this+0x34]`, it then accumulates matching per-cell float contributions from the world-grid table rooted at `[0x0062c120+0x2129]` into the second out-value. Current grounded callers include the shell or world-side branches at `0x0043f72e`, `0x0043f936`, `0x0047e365`, `0x0047ecd3`, `0x0047faff`, `0x004ba072`, `0x004bb51c`, and `0x00504d0f`, so this now looks like the first higher-level site query above the cargo-service bitset lane rather than another raw editor-runtime helper.","objdump + caller xrefs + callsite inspection + world-grid correlation"
0x0047e330,96,placed_structure_count_candidates_with_local_service_metrics,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Counts how many live structure candidates currently produce a valid local service-metric result for the current placed-structure or site context. The helper walks the full candidate collection at `0x0062ba8c`, resolves each entry id through `0x00518380`, and reuses `placed_structure_query_candidate_local_service_metrics` at `0x0047e240` with null out-pointers; it increments the return value only when that lower query succeeds. Current grounded callers keep this in the same site-query family as `0x0047e240`, so it now looks like the bounded count wrapper above the candidate-local service-metric lane.","objdump + caller xrefs + callsite inspection"
0x0047e390,656,placed_structure_query_cached_express_service_class_score,map,thiscall,inferred,objdump + caller xrefs + string correlation + callsite inspection,3,"Cached site-side query for one express-service class score. The helper special-cases request ids `0x384`, `0x385`, and `0x386` through three cached float-plus-timestamp pairs at `[this+0x14]/[+0x20]`, `[this+0x10]/[+0x1c]`, and `[this+0x0c]/[+0x18]`; when a cached value is younger than `0x0b40` ticks it returns immediately. On a cold path it scans all `0x35` live structure candidates, uses `0x0041e260` to keep only candidates that match the requested class, and then accumulates local per-cell contributions from the repeated sample list at `[this+0x34]` and the same world-grid tables under `[0x0062c120+0x2129]`. Nearby strings now strongly align the three class ids with the express cargo family `Passengers`, `Mail`, and `Troops`, but current grounded callers still treat this as a generic class-score query rather than a fully named UI lane. Current grounded callers include the shell or world-side branches at `0x00506c2d`, `0x00506c3d`, `0x00506e97`, and `0x00506ebf`.","objdump + caller xrefs + string correlation + callsite inspection + express-family correlation"
0x0047e690,784,placed_structure_query_candidate_directional_route_overlay_summary,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Builds the heavier directional route-summary channel used by the station-detail candidate-service overlay when the active candidate carries a nonzero route-style byte at `[candidate+0x46]`. The helper converts one caller-supplied distance or bucket limit into a capped step count up to `0x28`, resolves the requested candidate's grouped routing class from `0x0062ba8c+0x9a`, then walks the current placed structure's linked route list at `[this+0x466]` and follows each route-linked placed structure through the live instance collections at `0x0062b26c` and the route-link collection `0x006ada90`. For matching class entries it re-enters `0x004676a0` to measure one directional route value against the peer placed-structure argument, keeps the strongest bounded values in a sorted local lane, and finally accumulates those kept route values into the caller-owned out-pointers. Current grounded overlay callers at `0x0043f89a` and `0x0043f8ee` invoke it in both directions between the preview station and each scanned placed structure before `world_render_station_candidate_service_map_overlay` turns those two returned channels into the `Coming To` and `Going From` legend rows.","objdump + caller xrefs + callsite inspection + overlay-caller correlation + legend-correlation + route-link-collection correlation"
0x0047d440,845,world_conditionally_seed_named_starting_railroad_companies,map,cdecl,inferred,objdump + caller xrefs + global-state inspection,4,"Conditional company-side setup helper adjacent to the `Setting up Players and Companies...` lane. Current grounded callers are the neighboring bring-up flow after world_seed_default_chairman_profile_slots at `0x004377a0` and a second setup-side branch around `0x00438300`, both under the same sandbox or non-editor shell-state conditions: it runs only when the Multiplayer preview dataset owner at `0x006cd8d8` is absent and either sandbox flag `[0x006cec7c+0x82]` is set or shell-state flag `[0x006cec74+0x14c]` is set while editor-map mode `[0x006cec74+0x68]` is clear. The helper first realigns the selected company from the chosen chairman profile when the current summary pair points at a missing company, then iterates exactly three fixed localized railroad-name ids through `0x00428420`: `0x23f` `Missouri Pacific`, `0x240` `New York Central`, and `0x241` `Grand Trunk Railroad` from `RT3.lng` ids `575..577`. That makes the branch look like a seeded trio of named starting railroad companies rather than a generic company refresh. The first seeded company is tied to the selected chairman-profile summary from `0x006cec78`, tuned from that selected chairman's per-profile fields `[profile+0x154]` and `[profile+0x158]`, and then written back as the selected company id through `0x00433790`. The second company is narrower now too: it only binds when `profile_collection_count_active_chairman_records` at `0x00477820` reports at least two live chairman records, and it then links through `profile_collection_get_nth_active_chairman_record` at `0x00477860` with ordinal `1`, so the second railroad is specifically the second active chairman-owned company rather than an arbitrary extra bind. The third railroad currently gets no matching chairman-link branch in the grounded code and therefore remains an unchaired named company in the live roster. All three records are constructed or refreshed from the live company collection at `0x0062be10` through `0x00428420`, while chairman-to-company ownership links are applied through `0x00427c70` and neighboring writes to `[profile+0x1dd]`.","objdump + caller xrefs + global-state inspection + state-accessor correlation + RT3.lng strings + company-constructor inspection + profile-helper inspection"
0x0047efe0,28,placed_structure_query_linked_company_id,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Returns the owning company id for one placed structure when a linked placed-instance record is present. The helper resolves `[this+0x04]` through the live placed-instance collection at `0x0062b26c` and then returns the company-like field at `[instance+0x276]`; when no linked instance is present it falls back to `0`. Current grounded callers include the station candidate-service overlay at `0x0043fff7`, where the returned company id is compared against the active company selector before the overlay chooses whether a scanned site should carry the `Already Connected by Another Company` note.","objdump + caller xrefs + callsite inspection + overlay-owner correlation"
0x0047f010,195,placed_structure_append_unique_route_entry,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Appends one unique six-byte route-entry record onto the placed-structure route list rooted at `[this+0x462]` and `[this+0x466]`. The helper first scans the existing list for the incoming leading `u16` key and returns early on duplicates; otherwise it allocates a new `(count*6)+6` byte buffer, copies the existing records, writes the new `u16` key at offset `+0x0` and the caller-supplied `u32` payload at `+0x2`, frees the previous buffer, and increments the route-entry count. Current grounded callers include the placed-structure side at `0x0042c554`, which walks the linked instance chain through `[site+0x0d6]` and `[instance+0x2a2]` while appending entries, and the world-side branch at `0x0040db7d`, which appends one selected placed-structure id plus a companion payload from a route-like table. This is therefore the current reusable append-if-missing helper above the route-entry list later consumed by `placed_structure_query_candidate_directional_route_overlay_summary` at `0x0047e690`.","objdump + caller xrefs + callsite inspection + buffer-layout correlation"
0x00483f70,352,shell_service_pump_iteration,shell,thiscall,inferred,objdump + analysis-context,4,Executes one outer shell-service iteration on the shell state rooted at 0x006cec74. The helper can queue service event 0xcc through the shell bundle at 0x006d4018 polls that bundle through 0x00483ea0 refreshes active-mode or shell-state flags ensures the controller work pointer [0x006d4024+0x28] defaults to 0x0062be68 runs several global maintenance helpers and auxiliary cleanup then dispatches shell_state_service_active_mode_frame; when shell-state flag [this+0x501] is set it also marks the controller layout dirty through 0x0051f070 before returning the loop-continue result. bootstrap_init_shell_window_services calls it in the repeating shell loop that appears to own the observed shell lifetime before teardown.,objdump + analysis-context + caller xrefs
0x00485750,14,shell_has_tiger_tank_viewer,shell,cdecl,inferred,ghidra-headless,4,Returns whether the dedicated TigerTank shell viewer object at 0x006cfc8c is currently active. The 0x7533 open and 0x7534 close commands both gate on this global before showing status text or mutating viewer state.,ghidra + rizin + llvm-objdump + strings
0x004840e0,863,bootstrap_init_shell_window_services,bootstrap,cdecl,inferred,ghidra-headless,4,Consumes the early bootstrap object then allocates and installs the shell service bundle rooted at 0x006d4024 seeds a 640x480 fallback and enters the bootstrap-owned shell loop around shell_service_pump_iteration at 0x00483f70 until shell state [this+0x10] changes; after each break it drives the next shell mode transition through 0x00482ec0 and when the shell lifetime finally ends it tears the shell bundle back down through 0x00521390 before returning to app_bootstrap_main.,ghidra + rizin + llvm-objdump
0x00484440,323,app_bootstrap_main,bootstrap,cdecl,inferred,ghidra-headless,4,Primary post-CRT bootstrap coordinator; initializes COM and branding strings probes host state allocates the shell state at 0x006cec74 and then hands shell execution into bootstrap_init_shell_window_services. After that helper returns it releases the shell globals and finishes the remaining process-tail cleanup before exiting back through the CRT.,ghidra + rizin + llvm-objdump
0x00484590,887,shell_init_graphics_preset_state,shell,cdecl,inferred,ghidra-headless,3,Initializes the shell graphics-preset state block rooted at [this+0x70]. It clears a large option buffer seeds many default fields and applies one of three coarse mode layouts from its integer argument before later preset application or config-save helpers continue.,ghidra + rizin + llvm-objdump
0x00484910,105,shell_save_graphics_config,shell,cdecl,inferred,ghidra-headless,4,Persistently writes the current shell graphics configuration to data\\configuration\\game.cfg. It optionally syncs the global display runtime through 0x0051eea0 then writes config keys 0x429 and 0x48d from the shell state block before closing the file.,ghidra + rizin + llvm-objdump + strings
0x00484980,212,shell_load_graphics_config_or_init_defaults,shell,cdecl,inferred,ghidra-headless,4,Loads the shell graphics configuration from data\\configuration\\game.cfg during early shell setup. It optionally pulls the larger display-runtime blob through 0x0051ef20 validates key 0x429 reads key 0x48d into the shell state block at [this+0x70] and falls back to 0x00484590 plus 0x00484910 when the file is missing or invalid.,ghidra + rizin + llvm-objdump + strings
0x00484a60,125,shell_match_legacy_gpu_profile_token,shell,cdecl,inferred,ghidra-headless,4,Collects the current display-adapter descriptor string then scans the legacy GPU-profile table at 0x0062142c for the first matching token. The table contains vendor and chipset strings such as geforce radeon Voodoo matrox i810 sis savage and 3dfx; the returned index or -1 then drives the preset-tier tables in 0x004853c0.,ghidra + rizin + llvm-objdump + strings
0x00484d70,700,shell_apply_graphics_option_runtime_effects,shell,thiscall,inferred,ghidra-headless,3,Walks the pending graphics-option array rooted at [this+0x1c] and applies runtime side effects for the dirty entries selected by the caller mask. The cases fan into the active engine object at 0x0062c120 and shell globals under 0x006d4024 and 0x006d4030 updating several float scaled thresholds integer quality values and display capability bytes before clearing the dirty array and notifying the active shell object at 0x0062be68.,ghidra + rizin + llvm-objdump
0x004852e0,210,shell_apply_default_graphics_master_profile,shell,thiscall,inferred,ghidra-headless,4,Reads the default master graphics profile value from 0x006211dc currently 6 and broadcasts it across option ids 1 through 16 in the shell settings block. Special option ids 10 11 12 and 13 are remapped through the preset tables at 0x00621250 through 0x00621358 before the function refreshes runtime side effects through 0x00484d70 updates shell display-profile flags under 0x006d4024 and persists game.cfg through 0x00484910.,ghidra + rizin + llvm-objdump
0x004853c0,740,shell_apply_graphics_preset_bundle,shell,cdecl,inferred,ghidra-headless,4,Applies one table-driven graphics preset bundle to the shell settings object. It derives a preset tier from shell state and runtime capability probes then writes per-setting values through repeated 0x00485060 calls refreshes dependent runtime state through 0x00484d70 optionally saves game.cfg through 0x00484910 and updates several display capability flags under 0x006d4024.,ghidra + rizin + llvm-objdump
0x00485060,635,shell_set_graphics_option_with_fanout,shell,thiscall,inferred,ghidra-headless,4,Writes one graphics option value into the shell settings arrays at [this+0xac] and coordinates grouped fanout updates. Primary preset selectors recursively expand into dependent option ids 1 through 16 using preset remap tables at 0x00621250 through 0x00621358. The function compares the new normalized value against the previous setting invokes 0x00484d70 when a runtime refresh is needed and persists game.cfg through 0x00484910 once the update batch completes.,ghidra + rizin + llvm-objdump
0x00485760,2746,vehicle_visual_init_running_gear_and_smoke_effects,bootstrap,thiscall,inferred,ghidra-headless,4,Builds a larger vehicle visual bundle covering running-gear assets smoke effects and attachment-audio objects. The routine fills indexed road-wheel visual arrays from RoadWheelR and RoadWheelL asset strings creates direct MuzzleSmoke and ExhaustSmoke sprite emitters at [this+0x216] and [this+0x21a] and then creates five fixed attachment objects at [this+0x3cc] through [this+0x3dc] for diesel1 tracks german88 turret and mantlet audio assets before registering them on the owner.,ghidra + rizin + llvm-objdump + strings
0x004883f0,325,scenario_text_export_append_numbered_entry,scenario,cdecl,inferred,ghidra-headless,4,Formats and appends one numbered translation entry into the scenario-text export buffer. It duplicates the source text applies the export wrapper template through helper formatters and appends the finished block through 0x531030 while updating the running non-comment word count at 0x006cfca0.,ghidra + rizin + llvm-objdump + strings
0x004886e0,3796,scenario_text_export_build_language_file,scenario,cdecl,inferred,ghidra-headless,4,Builds one MAPS\\%s.lng scenario-text export for the active map and returns the non-comment word count. It writes translator guidance and section headers then walks map briefing territory city geographic-label station company and event collections appending numbered entries through 0x004883f0 before finalizing the output buffer.,ghidra + rizin + llvm-objdump + strings
0x00487450,153,shell_open_tiger_tank_viewer,shell,cdecl,inferred,ghidra-headless,3,Allocates and shows the dedicated TigerTank shell viewer object when no viewer is active. It samples shell-owned placement data allocates a 0x434-byte object initializes it through 0x00485760 with the TigerTank title and stores the resulting viewer pointer in 0x006cfc8c.,ghidra + rizin + llvm-objdump + strings
0x004874f0,70,shell_close_tiger_tank_viewer,shell,cdecl,inferred,ghidra-headless,4,Closes and frees the dedicated TigerTank shell viewer rooted at 0x006cfc8c. It detaches the viewer if currently selected in the shell owner at 0x0062be68 destroys its internal resources through 0x00530680 frees the object and clears the global viewer slot.,ghidra + rizin + llvm-objdump + strings
0x00489830,496,scenario_text_export_report_language_file,scenario,cdecl,inferred,ghidra-headless,3,Opens one existing MAPS\\%s.lng file for the selected map and reports on its parsed contents without rebuilding it. The routine loads the file into memory iterates numbered entries through 0x00488540 formats summary strings through 0x004895c0 and presents success or failure dialogs when interactive mode is enabled.,ghidra + rizin + llvm-objdump + strings
0x00489a20,1085,scenario_text_export_batch_process_maps,scenario,cdecl,inferred,ghidra-headless,4,Enumerates maps\\*.gmp and batch-processes every scenario through the scenario-text export branch. Command 0x7542 runs the build path through 0x004886e0 while command 0x7543 runs the report path through 0x00489830; the wrapper tracks progress formats per-map status strings and emits a final summary dialog.,ghidra + rizin + llvm-objdump + strings
0x004bfb30,956,shell_format_company_financial_summary_card,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Reusable shell company financial-summary formatter shared by `CompanyDetail.win` and the company-list row lane. The helper resolves the linked chairman and current selected profile through `0x006cec78` and `0x006ceb9c`, highlights the card when the company belongs to the selected chairman, formats the visible company header text, and then renders a compact three-row finance block under localized ids `633` `Cash:`, `607` `Revenue:`, and `925` `Profits:`. The grounded metric mapping is now tighter too: `Cash:` comes from `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0` with slot `0x0d` and stat-family selector `0x2329`, `Revenue:` comes from the same reader with slot `0x2c`, and `Profits:` comes from slot `0x2b`; the revenue and profit rows also switch color when the readback is negative. Grounded callers are `shell_company_detail_render_company_summary_card` at `0x004c1ab0` and `shell_company_list_format_company_or_start_row` at `0x004c6b40`.","objdump + RT3.lng strings + caller inspection + shared shell formatter correlation + compact-metric-row correlation"
0x004c0160,2214,shell_format_company_stock_data_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Shared shell stock-data formatter used by `LoadScreen.win` page `6`. The helper resolves the selected company through the live collection at `0x0062be10`, builds the section headers `928` `Largest Shareholders`, `929` `Shares`, and `930` `Per Share Data`, ranks the top positive active-chairman holdings for that company through the profile collection at `0x006ceb9c`, and renders up to four shareholder rows with the current share counts from `[profile + company_id*4 + 0x15d]`. It then formats the full six-row per-share block: help texts `931..936` and labels `937..942`, with `Share Price` from stat-family `0x2329/0x1c`, `Book Value Per Share` from `0x2329/0x1d`, `Revenue Per Share` from `0x2329/0x1e`, `Earnings Per Share` from `0x2329/0x1f`, `Dividend Per Share` from `0x2329/0x20`, and `5 Year Weighted Return` from `0x2329/0x21` via `company_compute_five_year_weighted_shareholder_return` `0x004246b0`. Current grounded caller is `shell_load_screen_render_company_stock_data_panel` at `0x004e5130`.","objdump + RT3.lng strings + caller inspection + shareholder-ranking correlation + stock-data-label correlation + per-share-metric correlation + weighted-return correlation"
0x004c1610,48,shell_company_detail_bind_bond_row_band_for_active_panel,shell,cdecl,inferred,objdump + caller inspection,4,"Tiny CompanyDetail helper that binds one contiguous debt-row control band to whichever bond panel is active. When the source control id is `0x947e` it enables the upper row band `0x94e8..0x950f`; otherwise it enables the sibling row band `0x9510..0x9537`. Current grounded owner is the CompanyDetail refresh path at `0x004c2ca0`, where this helper sits beside the shared bond readout callback for controls `0x947d` and `0x947e` and makes those two controls read as twin bond-slot list owners rather than as one-off buttons.","objdump + caller inspection + bond-row-band correlation"
0x004c16b0,35,shell_company_detail_copy_selected_company_debt_slot_triplet,shell,cdecl,inferred,objdump + caller inspection,3,"Small CompanyDetail helper that copies one 12-byte triplet from the currently selected company's debt-record band near `[company+0x5f + slot*0xc]` into a caller-supplied output buffer. Current grounded callers use it while building the bond maturity and repay readout lane and the adjacent action-message debt checks.","objdump + caller inspection + debt-slot correlation"
0x004c16f0,59,shell_company_detail_resolve_selected_company,shell,cdecl,inferred,objdump + caller inspection,4,"Resolves the current `CompanyDetail.win` company into the live company collection and returns the validated company record pointer or null. The helper reads the selected company id from shell detail owner `0x006d0818+0x90`, rejects nonpositive ids, verifies existence through company collection `0x0062be10`, and then returns the concrete record through `0x00518140`. It is the common shared accessor beneath the CompanyDetail read-side panels, finance actions, territory-access lane, and company-governance flows.","objdump + caller inspection + shared CompanyDetail accessor correlation"
0x004c1730,546,shell_company_detail_render_financial_history_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"CompanyDetail-specific widget callback for control `0x9470`. The helper resolves the currently selected company through the shell detail owner at `0x006d0818`, lays out a five-step history strip, and renders localized labels `607` `Revenue:`, `944` `Expenses:`, `945` `Interest:`, `610` `Profit:`, and `611` `Lifetime`. Current grounded metric reads come from the same wider company history family through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0`, notably slots `0x2c`, `0x2e`, `0x2f`, and `0x2b`. Current grounded owner is the CompanyDetail constructor `0x004c5540`, which binds this callback onto the finance-history panel rather than onto a generic company-list row.","objdump + RT3.lng strings + caller inspection + CompanyDetail panel correlation"
0x004c1ab0,169,shell_company_detail_render_company_summary_card,shell,cdecl,inferred,objdump + caller inspection + shared formatter correlation,4,"Thin `CompanyDetail.win` widget callback for control `0x9471`. The helper resolves the current selected company through the shell detail owner at `0x006d0818` and forwards the draw to `shell_format_company_financial_summary_card` at `0x004bfb30` using the widget rectangle supplied by the current control tree. Current grounded owner is the CompanyDetail constructor `0x004c5540`, which binds this callback beside the separate financial-history panel callback at `0x004c1730`.","objdump + caller inspection + shared formatter correlation"
0x004c1d30,48,shell_company_detail_select_territory_access_row,shell,cdecl,inferred,objdump + caller inspection,4,"Small `CompanyDetail.win` territory-picker selection callback bound to the adjacent control pair `0x948d` and `0x948e`. When the incoming row ordinal is nonnegative, the helper resolves the current picker widget under `0x948c`, reads the chosen territory id from the row field at `[widget+0x117]`, and then forwards that territory id into `shell_company_detail_refresh_selected_territory_access_summary` at `0x004c1b60`. A negative row ordinal falls back to territory id zero before the same summary refresh.","objdump + caller inspection + picker-field correlation"
0x004c1d70,323,shell_company_detail_render_territory_access_row,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Territory-row renderer for the `CompanyDetail.win` access-rights lane. The callback resolves the currently selected company through `0x006d0818`, resolves the supplied territory id through the territory collection at `0x006cfc9c`, and then renders the territory row through the shell text widgets rooted at `0x006cfe50` and `0x006cfe58`. Current grounded logic also checks access rights through `company_has_territory_access_rights` at `0x00424010`, varies the row styling accordingly, and triggers the focused-row highlight path through `0x0054f710` when the rendered territory matches the globally selected territory id at `0x006cfe5c`. The CompanyDetail constructor binds this callback onto the paired territory-row controls `0x948d` and `0x948e`.","objdump + RT3.lng strings + caller inspection + territory-row correlation"
0x004c1b60,462,shell_company_detail_refresh_selected_territory_access_summary,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Refreshes the selected-territory status summary in `CompanyDetail.win`. The helper caches the active territory id in `0x006cfe5c`, resolves the territory through `0x006cfc9c`, and formats one of three localized status texts for the current selected company: id `946` when the company already has access rights, id `947` when rights are unavailable but purchasable, or id `948` when the company cannot purchase rights at all. It also republishes the selected-territory control rooted at `0x948c`. Current grounded callers are the territory-summary callbacks at `0x004c1d30`, `0x004c1d70`, and `0x004c22e0`.","objdump + RT3.lng strings + caller inspection + territory-status correlation"
0x004c1ec0,587,shell_company_detail_render_bond_maturity_and_repay_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"CompanyDetail-specific bond readout callback bound to controls `0x947d` and `0x947e`. The helper resolves the currently selected company through `0x006d0818`, indexes one 12-byte debt-record slot from the selected company near `[company+0x5f + slot*0xc]`, formats the maturity caption through localized id `949` `Due %1`, formats the current bond amount or value through the shared numeric formatter family at `0x0051c000`, and then renders the repay affordance through localized id `950` `Repay this bond.`. In the surrounding refresh path this panel is paired with `shell_company_detail_bind_bond_row_band_for_active_panel` at `0x004c1610`, so the two controls now read as the owners of twin repayable bond-slot row bands `0x94e8..0x950f` and `0x9510..0x9537` rather than as isolated text widgets. Current grounded owner is the CompanyDetail constructor `0x004c5540`, which binds this callback onto the adjacent debt-panel controls rather than onto the territory or finance-history lanes.","objdump + RT3.lng strings + caller inspection + debt-panel correlation + bond-row-band correlation"
0x004c22e0,56,shell_company_detail_sync_selected_territory_from_picker,shell,cdecl,inferred,objdump + caller inspection,4,"Small `CompanyDetail.win` territory-sync callback for control `0x948c`. The helper resolves the current territory-picker widget through the live CompanyDetail window at `0x006cfe4c`, reads the currently focused territory id from `[widget+0x117]` when a picker row is present, and then forwards that territory id into `shell_company_detail_refresh_selected_territory_access_summary` at `0x004c1b60`. When no picker row is active it falls back to territory id zero before refreshing the same summary.","objdump + caller inspection + picker-sync correlation"
0x004c23a0,1259,shell_company_detail_render_debt_credit_and_rate_summary_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"CompanyDetail-specific summary callback bound to control `0x9488`. The helper resolves the currently selected company through `0x006d0818` and renders the player-facing debt and rate block under localized ids `951` `Total Debt:`, `952` `Credit Rating:`, `953` `Average Interest Rate:`, and `954` `Prime Rate:`. Current grounded logic now has concrete helper ownership for the rate rows: `company_compute_weighted_average_bond_interest_rate` `0x00423e40` feeds `Average Interest Rate`, `company_compute_prime_rate_from_issue39_scenario_baseline` `0x00424580` feeds `Prime Rate`, the credit-rating text table at `0x00620d00..0x00620d14` is chosen from the rounded city-connection bonus ladder at `0x00425320`, and the leading debt total comes from the current metric family through `company_read_year_or_control_transfer_metric_value` `0x0042a5d0` using stat-family `0x2329` and slot `0x12`. The CompanyDetail refresh path wires this callback onto the same read-side tab family as the bond and stock-summary panels.","objdump + RT3.lng strings + caller inspection + finance-summary correlation + average-interest correlation + prime-rate correlation + debt-total correlation"
0x004c2720,1394,shell_company_detail_render_share_value_and_dividend_summary_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"CompanyDetail-specific stock-summary callback bound to control `0x948a`. The helper resolves the currently selected company through `0x006d0818` and renders the player-facing share-value and payout block under localized ids `937` `Share Price:`, `724` `Shares Outstanding:`, `955` `Market Cap:`, `956` `Annual Dividend:`, and `957` `Annual Dividend Payments:`. Current grounded helper ownership is tighter now too: `company_query_cached_share_price_scalar` `0x00423eb0` feeds `Share Price`, the outstanding-share count comes from `[company+0x47]`, `Market Cap` multiplies those two lanes together, `Annual Dividend` comes from the current-year stat-family read `0x2329/0x20`, and `Annual Dividend Payments` multiplies that dividend-per-share lane by the outstanding-share count. The broader six-row per-share data family `938..942` instead sits in the shared stock-data formatter `shell_format_company_stock_data_panel` at `0x004c0160`. Current grounded owner is the CompanyDetail refresh path, which binds this panel beside the debt or credit or rate summary block rather than inside the action-message dispatcher.","objdump + RT3.lng strings + caller inspection + stock-summary correlation + share-price correlation + dividend-payout correlation"
0x004c3470,621,shell_company_detail_step_selected_active_company_delta,shell,cdecl,inferred,objdump + caller inspection,4,"CompanyDetail-specific company-navigation helper. The routine resolves the currently selected company id through the detail owner at `0x006d0818`, converts it to an active-company ordinal through `company_collection_count_active_companies_before_company_id` `0x004299f0`, wraps `ordinal + delta` modulo the active-company count from `company_collection_count_active_companies` `0x00429a50`, resolves the replacement company id through `company_collection_get_nth_active_company_id` `0x00429990`, writes it back through detail-manager setter `0x004dd8a0`, refreshes the visible panel through `shell_company_detail_window_refresh_controls` `0x004c2ca0`, notifies the detail manager through `0x004dd410`, and resets territory picker control `0x948c` through `0x00538e00`. Current grounded wrappers are the next and previous company selectors at `0x004c3540` and `0x004c3550`.","objdump + caller inspection + CompanyDetail navigation correlation"
0x004c3540,5,shell_company_detail_select_next_active_company,shell,cdecl,inferred,objdump + caller inspection,4,"Trivial CompanyDetail wrapper that seeds delta `+1` in `ecx` and tail-calls `shell_company_detail_step_selected_active_company_delta` `0x004c3470`. Current grounded callers include shell-side world and company-detail navigation paths.","objdump + caller inspection + wrapper correlation"
0x004c3550,5,shell_company_detail_select_previous_active_company,shell,cdecl,inferred,objdump + caller inspection,4,"Trivial CompanyDetail wrapper that seeds delta `-1` in `ecx` and tail-calls `shell_company_detail_step_selected_active_company_delta` `0x004c3470`. Current grounded callers include shell-side world and company-detail navigation paths.","objdump + caller inspection + wrapper correlation"
0x004c3560,816,shell_company_detail_render_issue_bond_offer_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Dedicated shell renderer for the `CompanyDetail.win` bond-offer dialog. The helper resolves the currently selected company from the live collection at `0x0062be10`, derives the staged offer terms from the same local bond-offer state later committed by `shell_company_detail_issue_bond_offer_flow`, and then lays out the localized underwriter lines `968..972`: `Underwriters offer to issue bonds as follows:`, `Amount:`, `Interest Rate:`, `Underwriting Fees:`, and `Go ahead and issue the bond?`. Current grounded caller is the issue-bond flow at `0x004c3890`, which passes this helper as the custom dialog renderer into the shared shell finance modal path at `0x004c98a0`.","objdump + RT3.lng strings + caller inspection + finance-dialog correlation"
0x004c3890,693,shell_company_detail_issue_bond_offer_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` bond-issue action flow. The helper resolves the currently selected company through the shell detail owner at `0x006d0818`, rejects requests when the company already has too many outstanding bonds through localized id `973`, rejects weak credit through localized id `974` plus the credit-rating tables at `0x00620d00..0x00620d14`, and otherwise opens the underwriter offer dialog for localized ids `968` through `972` using the dedicated renderer `shell_company_detail_render_issue_bond_offer_dialog` at `0x004c3560`. On acceptance it issues the bond through the selected-company method at `0x004275c0`; when the multiplayer-side shell owner is active it instead packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded caller is `shell_company_detail_window_handle_message` at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + bond-dialog correlation"
0x004c3b50,992,shell_company_detail_render_issue_stock_offer_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Dedicated shell renderer for the `CompanyDetail.win` stock-issue offer dialog. The helper resolves the currently selected company from the live collection at `0x0062be10`, reads the staged offer state from `0x006cfe64` and `0x006cfe68`, and lays out the localized stock-offer lines `975..978`: `Underwriters offer to issue stock as follows:`, `Shares:`, `Total Proceeds:`, and `Go ahead and issue the stock?`. Current grounded caller is `shell_company_detail_issue_stock_offer_flow` at `0x004c3f30`, which passes this helper as the custom dialog renderer into the shared shell finance modal path at `0x004c98a0`.","objdump + RT3.lng strings + caller inspection + finance-dialog correlation"
0x004c3f30,968,shell_company_detail_issue_stock_offer_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` stock-issue action flow. The helper derives a proposed share count and proceeds from the selected company into the local globals `0x006cfe64` and `0x006cfe68`, rejects weak offerings through localized id `979`, rejects oversaturated issuance through localized id `980`, and otherwise opens the underwriter offer dialog for localized ids `975` through `978`. On acceptance it issues the stock through the selected-company method at `0x00427450`; when the multiplayer-side shell owner is active it routes the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded caller is `shell_company_detail_window_handle_message` at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + stock-issue correlation"
0x004c4300,976,shell_company_detail_render_stock_buyback_offer_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Dedicated shell renderer for the `CompanyDetail.win` stock-buyback offer dialog. The helper resolves the currently selected company from the live collection at `0x0062be10`, reads the staged buyback state from `0x006cfe64` and `0x006cfe68`, and lays out the localized broker-offer lines `981..984`: `Brokers are able to locate the following shares on the market:`, `Brokerage Fees:`, `Total Cost:`, and `Go ahead and buy back the stock?`. Current grounded caller is `shell_company_detail_buyback_stock_flow` at `0x004c46d0`, which passes this helper as the custom dialog renderer into the shared shell finance modal path at `0x004c98a0`.","objdump + RT3.lng strings + caller inspection + finance-dialog correlation"
0x004c46d0,1420,shell_company_detail_buyback_stock_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` stock-buyback action flow. The helper computes a proposed repurchase quantity and total cash cost into `0x006cfe64` and `0x006cfe68`, rejects cases with no public float through localized id `985`, rejects requests that would retire the final protected share band through id `986`, rejects insufficient company cash through id `987`, and otherwise opens the broker buyback dialog for localized ids `981` through `984` using the dedicated renderer `shell_company_detail_render_stock_buyback_offer_dialog` at `0x004c4300`. On acceptance it repurchases the shares through the selected-company method at `0x004273c0`; when the multiplayer-side shell owner is active it routes the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded caller is `shell_company_detail_window_handle_message` at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + stock-buyback correlation"
0x004c4c70,448,shell_company_detail_setup_dividend_rate_adjust_controls,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Custom setup callback for the `CompanyDetail.win` dividend-rate dialog opened by `shell_company_detail_change_dividend_rate_flow` at `0x004c5360`. The helper resolves the currently selected company, stages two small shell control descriptors, and binds the paired dividend-adjust controls with ids `0x99e8` and `0xc0f9` back into the shared finance modal through the shell control-registration path rooted at `0x0053f9c0`. Current grounded behavior makes this the control-setup half of the dividend modal beside the text renderer at `0x004c4e30` and the message handler at `0x004c5140`.","objdump + RT3.lng strings + caller inspection + dividend-dialog control-setup correlation"
0x004c4e30,784,shell_company_detail_render_change_dividend_rate_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Dedicated shell renderer for the `CompanyDetail.win` change-dividend dialog. The helper resolves the currently selected company from the live collection at `0x0062be10`, renders the localized prompt and value lines `988..990`: `Change Dividend Rate`, `Dividend Rate:`, and `Total Annual Dividends:`, formats the staged per-share dividend from `0x006cfe48`, and derives the annual total from that same staged rate times the current outstanding-share count at `[company+0x47]`. Current grounded caller is `shell_company_detail_change_dividend_rate_flow` at `0x004c5360`, which passes this helper into the shared shell finance modal path at `0x004c98a0`.","objdump + RT3.lng strings + caller inspection + dividend-dialog renderer correlation"
0x004c5140,544,shell_company_detail_handle_change_dividend_rate_dialog_message,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Custom message callback for the `CompanyDetail.win` change-dividend dialog. The helper handles shell message `0xcb` from the paired adjust controls `0x99e8` and `0xc0f9`, raises or lowers the staged dividend-per-share value in `0x006cfe48`, clamps decrements at zero, and clamps increments against the board-approved per-share ceiling from `company_compute_board_approved_dividend_rate_ceiling` at `0x00426260`. When the player tries to raise the dividend beyond that ceiling it opens localized id `991` `Your board of directors feels that the company is not financially strong enough for a higher dividend...` through the shared modal path instead of accepting the increase. Current grounded caller is `shell_company_detail_change_dividend_rate_flow` at `0x004c5360`, which passes this helper as the dialog message owner into `0x004c98a0`.","objdump + RT3.lng strings + caller inspection + dividend-dialog message correlation + dividend-ceiling correlation"
0x004c5360,472,shell_company_detail_change_dividend_rate_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` dividend-rate action flow. The helper seeds the current dividend-per-share value from `[company+0x4b]` into `0x006cfe48`, opens the shared finance dialog rooted at callbacks `0x004c4c70`, `0x004c4e30`, and `0x004c5140` under localized ids `988` through `990`, and then commits the accepted new dividend rate through the selected-company method at `0x00423fb0`. When the multiplayer-side shell owner is active the same request is packaged through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded caller is `shell_company_detail_window_handle_message` at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + dividend-dialog correlation"
0x004c2ca0,1964,shell_company_detail_window_refresh_controls,shell,thiscall,inferred,objdump + strings + caller inspection,4,"Shared refresh pass for the shell-side `CompanyDetail.win` family rooted at `0x006cfe4c`. The helper first requires a live shell detail-panel owner at `0x006d0818` with a selected company id in `[detail+0x90]`, resolves that company through the live collection at `0x0062be10`, and then repopulates the section strip and section-specific control bands rooted at `0x9472..0x9490`. Current grounded state is keyed by section index `0x006cfe60`: section `0` is the chairman/governance slice around `0x9480` and the dynamic multi-line overview widget `0x947f`, section `1` is the debt-and-capital slice around `0x947d`, `0x947e`, and `0x9488`, section `2` is the per-share slice around `0x948a`, and section `3` is the territory-access slice around `0x948c`, `0x948d`, and `0x948e`. The same refresh now cleanly splits the four visible section selectors `0x9472..0x9475` from their companion visual controls `0x9476..0x9479`, keeps the adjacent section-navigation or decoration bands around `0x947b..0x947c` and `0x948f..0x9490` synchronized with the current section, and formats the current chairman summary through localized ids `958` `Chairman: %1` and `959` `Chairman: None` together with the portrait-backed chairman band on `0x9480`. The section-0-only bind for `0x947f` is tighter now too: the refresh passes a dedicated stack-built dynamic-text payload through the special `0x6f` control path instead of using the normal callback-widget lane, and the shared helpers `shell_control_refresh_matching_dynamic_text_payload` at `0x00540a47` plus `shell_control_release_dynamic_text_payload` at `0x005639d2` now show that type `0x6f` frees or swaps one heap-backed text payload and then short-circuits as a special case. That keeps `shell_format_company_governance_and_economy_status_panel` at `0x004e5cf0` as the strongest current semantic match for `0x947f` while making the widget itself look more clearly like a display-only dynamic-text control rather than a normal callback widget. One wider action-row split is tighter now that the range loops are explicit: the helper walks `0x94d4..0x9537` as the selected-company-owned governance/action band and applies style `0x65` when the selected company matches the scenario-selected company at `0x00434870`, otherwise `0x87`; it then walks `0x9538..0x959b` as the linked-chairman-owned band and applies style `0x87` when the selected company's linked chairman id `[company+0x3b]` matches the scenario-selected chairman at `0x004337b0`, otherwise `0x65`. The selected-company side is no longer one vague gated block either: scenario-state toggle `[0x006cec78+0x4a8f]` re-enables bankruptcy row `0x94d6` together with passive companion row `0x94d4`, `[0x006cec78+0x4a8b]` re-enables issue-bond row `0x94d7` together with passive companion row `0x94d5`, `[0x006cec78+0x4a87]` re-enables stock issue and stock buyback rows `0x94d8..0x94d9`, `[0x006cec78+0x4a93]` re-enables dividend row `0x94da` together with the same passive companion row `0x94d5`, `[0x006cec78+0x4adb]` re-enables merger row `0x94db`, `[0x006cec78+0x4acb]` re-enables resign row `0x94dc`, and `[0x006cec78+0x4acf]` re-enables takeover row `0x9538`; `0x9493` only re-enables when editor-map mode `[0x006cec74+0x68]` is clear. That makes `0x94d4/0x94d5` read more like passive companion or heading widgets than hidden verbs. The constructor at `0x004c5540` and many message-side branches at `0x004c56a0` converge back into this helper, which makes it the current owner-side refresh pass for the CompanyDetail window rather than a generic company-list helper.","objdump + strings + caller inspection + section-switch correlation + chairman-band correlation + governance-band gating correlation + selected-company styling correlation + dynamic-overview-widget correlation + passive-companion-row gating correlation + scenario-toggle correlation + explicit-row-loop correlation + type-0x6f control correlation"
0x004c5540,347,shell_company_detail_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `CompanyDetail.win` panel later published at `0x006cfe4c`. The constructor installs vtable `0x005d0858`, binds `CompanyDetail.imb` and `CompanyDetail.win` through `0x0053d110` and `0x0053fa50`, seeds the primary action controls `0x9470`, `0x9471`, `0x947d`, `0x947e`, `0x948c`, `0x948d`, and `0x948e` through callbacks `0x004c1730`, `0x004c1ab0`, `0x004c1ec0`, `0x004c22e0`, `0x004c1d70`, and `0x004c1d30`, stores the singleton resources at `0x006cfe50..0x006cfe58`, and then immediately repopulates the visible state through `shell_company_detail_window_refresh_controls` at `0x004c2ca0`. One negative boundary is useful too: current constructor-time binding still does not install dedicated per-row callbacks for the broader section-0 governance bands `0x94d4..0x9537` and `0x9538..0x959b`, which keeps those rows looking more like resource-defined display bands gated and restyled by the refresh pass than like individually code-rendered widgets. A grounded shell detail-manager caller reaches this constructor at `0x004dde24`, which corrects the earlier assumption that the post-roster company branch still had no recovered detail-window owner.","objdump + strings + detail-manager correlation + caller inspection + constructor-binding absence correlation"
0x004c56a0,4228,shell_company_detail_window_handle_message,shell,thiscall,inferred,objdump + strings + caller inspection,4,"Primary message dispatcher for the shell-side `CompanyDetail.win` family rooted at vtable `0x005d0858`. The helper switches on the incoming shell message id and now has a grounded section-selector lane too: message `0xca` on controls `0x9472..0x9475` writes `control-0x9472` into section index `0x006cfe60` before re-entering `shell_company_detail_window_refresh_controls` `0x004c2ca0`. Its broader action band is now tighter as well. Under message `0xcb`, control `0x94b5` routes into `shell_company_detail_buy_territory_access_rights_flow` `0x004c5fc9`, `0x94b6` routes into `shell_company_detail_bankruptcy_flow` `0x004c5b99`, `0x94cf` routes into `shell_company_detail_issue_bond_offer_flow` `0x004c3890`, `0x94d0` routes into `shell_company_detail_issue_stock_offer_flow` `0x004c3f30`, `0x94d1` routes into `shell_company_detail_buyback_stock_flow` `0x004c46d0`, `0x94d2` routes into `shell_company_detail_change_dividend_rate_flow` `0x004c5360`, `0x9493` routes into the destructive company-clear helper `company_deactivate_and_clear_chairman_share_links` `0x00426d60`, `0x94d6` routes into `shell_company_detail_bankruptcy_flow` `0x004c5b99`, `0x94d7` routes into `shell_company_detail_issue_bond_offer_flow` `0x004c3890`, `0x94d8` routes into `shell_company_detail_issue_stock_offer_flow` `0x004c3f30`, `0x94d9` routes into `shell_company_detail_buyback_stock_flow` `0x004c46d0`, `0x94da` routes into `shell_company_detail_change_dividend_rate_flow` `0x004c5360`, `0x94db` routes into `shell_company_detail_attempt_merger_flow` `0x004ec640`, `0x94dc` routes into `shell_company_detail_resign_chairmanship_flow` `0x004c5a0e`, and `0x9538` routes into `shell_company_detail_attempt_chairmanship_takeover_flow` `0x0050ccc0`. The same `0xcb` jump table now makes the passive/action split explicit rather than inferred: in the dispatch byte map rooted at `0x004c6640`, offsets `0x4b..0x51` for controls `0x94d6..0x94dc` map to cases `0x06..0x0c`, offset `0xad` for control `0x9538` maps to case `0x0d`, and the neighboring companion rows `0x94d4` and `0x94d5` stay on the default `0x0e` path. The debt-side row bands are narrower now too: under the same `0xcb` path, controls `0x94e8..0x950f` and `0x9510..0x9537` resolve a selected debt-slot index beneath the two bond panels `0x947d` and `0x947e`, reject repayment when the selected slot's principal exceeds the current cash-side metric through localized id `2990`, otherwise open the localized early-repayment confirmation rooted at id `2991`, and on acceptance either commit through `company_repay_bond_slot_and_compact_debt_table` `0x00423d70` or package the same request through the multiplayer shell transport. The same dispatcher also now bounds most of the section-0 control cluster: control `0x948b` is a tutorial-guarded escape or back control that either shows localized id `3724` `This option is disabled in the tutorial.` or falls back to `0x004ddbd0`, controls `0x9491` and `0x9492` only restyle the paired visual controls `0x948f` and `0x9490`, and control `0x9494` opens localized id `3635` `Enter the amount that your company's cash should be` through the shell numeric-entry dialog family and then writes the accepted value into the selected company cash pair at `[company+0x11f7]` and `[company+0x11fb]`. Current `0xcb` dispatch does not treat `0x948f`, `0x9490`, `0x94d4`, or `0x94d5` as standalone action cases, and the refresh-side gates now sharpen that split further: `0x94d4` is the passive companion row that comes back beside bankruptcy `0x94d6`, while `0x94d5` is the passive companion row that comes back with the issue-bond/dividend side of the finance cluster `0x94d7` and `0x94da`. The remaining open section-0 control is therefore mainly `0x947f`, plus the still-unsplit render-side text rows inside the broader governance bands `0x94d4..0x9537` and `0x9538..0x959b`. It repeatedly converges back into `shell_company_detail_window_refresh_controls` after state changes. Current ground
0x004c5a0e,268,shell_company_detail_resign_chairmanship_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` resignation confirmation flow. The branch opens localized confirmation id `964` `Are you sure you want to resign the chairman's position?` and on acceptance commits the change through `company_clear_selected_chairman_if_current_profile` at `0x00428a10`. When the multiplayer-side shell owner is active it packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8` instead of mutating the company immediately. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + dialog correlation"
0x004c5b99,428,shell_company_detail_bankruptcy_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` bankruptcy action flow. The branch checks the localized cooldown and eligibility strings `965` through `967`, rejects requests when the selected company is not yet bankruptable, and on acceptance commits the change through `company_declare_bankruptcy_and_halve_bond_debt` at `0x00425a90`. When the multiplayer-side shell owner is active it packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8` instead of mutating the company immediately. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + bankruptcy-dialog correlation"
0x004c5fc9,659,shell_company_detail_buy_territory_access_rights_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` territory-access purchase flow for the currently selected territory. The branch first resolves the selected territory from the territory-summary controls rooted at `0x948c..0x948e`, requires that the detail panel is still showing the current chairman-owned company, then splits cleanly by access state. When the company lacks rights but the territory is purchasable, it computes the access-rights price through `0x004879f0`, shows localized id `961` when purchase is possible, id `962` when cash is insufficient, and id `963` when rights cannot be purchased at all. Accepting id `961` commits the change through `company_set_territory_access_rights_byte` at `0x00424030` and the cash-side mutation at `0x0042a040`; when the multiplayer-side shell owner is active it instead packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + territory-access branch correlation"
0x004c98a0,880,shell_open_custom_modal_dialog_with_callbacks,shell,cdecl,inferred,objdump + caller inspection,4,"Generic shell modal opener for callback-driven custom dialogs. The helper snapshots the current detail-owner context, stores one caller-supplied mode or prompt token at `0x00621f40`, stores one optional custom control callback or row-owner token at `0x006cfeb0`, allocates a shared `0xa0`-byte modal object with vtable `0x005d0a04`, and seeds it through the lower constructor at `0x004c86c0` using the caller's custom message, setup, and render callbacks plus the surrounding button or style parameters. When the optional callback slot is present it also binds that callback onto control `0x03ed`. The same helper temporarily pushes shell modal state through `0x0053f000`, enters the visible modal loop through `0x00538f10`, and then tears the object back down while restoring the surrounding shell or world presentation state. Current grounded callers include the CompanyDetail finance dialogs for bond issue, stock issue, stock buyback, and dividend changes, plus `multiplayer_open_staged_text_entry_dialog` at `0x004ee0e0`.","objdump + caller inspection + modal-lifecycle correlation"
0x004d57c0,540,shell_event_conditions_window_construct,shell,thiscall,inferred,objdump + EventConditions.win string xref + control-binding inspection,3,"Constructs the shell-side `EventConditions.win` window. The constructor installs vtable `0x005d0cd4`, binds `EventConditions.win` through `0x0053fa50`, stores the incoming live event record pointer at `[this+0x84]`, seeds the selected condition row id at `[this+0x78]` plus the adjacent subselector at `[this+0x7c]`, binds the condition-row action callbacks at `0x004d5790` and `0x004d57b0`, and then populates the visible controls and status rows through the same window-local refresh path. Current grounded string xref is direct at `0x004d5803`, which makes this the clean owner for the conditions window rather than just another anonymous scenario dialog.","objdump + EventConditions.win string xref + control-binding inspection + state-field correlation"
0x004d59e0,166,shell_event_conditions_window_handle_message,shell,thiscall,inferred,objdump + EventConditions.win vtable slot + local disassembly,3,"Primary shell-message dispatcher bound in vtable slot `0x005d0cd8` for `EventConditions.win`. The handler switches on incoming shell messages `0xc9`, `0xca`, and the callback-style `0x04` path, remaps the constructor-bound callback controls at `0x4f73` and `0x4fd1` into the `0xc9` branch after validation through `0x004d54d0`, and dispatches the window-local command strip rooted at ids such as `0x4fb4..0x509c` through helpers like `0x004d4560`, `0x004d4838`, and `0x004d4d10`. Current direct evidence is the `EventConditions.win` vtable at `0x005d0cd4`, whose second slot points to `0x004d59e0`, so this is the clean message owner for the conditions window rather than just another small callback helper.","objdump + EventConditions.win vtable slot + local disassembly + callback-remap correlation"
0x004d5d00,605,shell_event_effects_window_refresh_effect_type_selector,shell,thiscall,inferred,objdump + EventEffects.win constructor and handler correlation + local disassembly,3,"Selector refresh beneath `EventEffects.win`. The helper rebuilds the effect-type list control rooted at `0x4fb2` from the static descriptor family starting near `0x006103e7`, filters entries by the current availability or permission state from control `0x5033`, selects the best current row by the descriptor float lane, and republishes the chosen effect-type index through `[this+0x7c]` plus the visible selector control state. Current grounded callers are the effects-window constructor `0x004d6d60`, the message dispatcher `0x004d7060`, and the selected-editor refresh family under `0x004d6090`, so this is now the safest current owner for the effect-type selector rather than an anonymous table walk.","objdump + EventEffects.win constructor and handler correlation + local disassembly + selector-table correlation"
0x004d5f50,320,shell_event_effects_window_refresh_selected_effect_parameter_rows,shell,thiscall,inferred,objdump + EventEffects.win constructor and handler correlation + local disassembly,3,"Parameter-row refresh beneath `EventEffects.win`. The helper reads the current effect-type index at `[this+0x7c]`, consults the compact descriptor tables rooted at `0x004d5fde` and `0x004d600a`, and then repaints the grouped parameter-label or parameter-enable rows through the generic control path under control family `0x4ff6` plus the smaller row-style helper `0x004d5f83`. Current grounded callers are the effects-window constructor `0x004d6d60`, the message dispatcher `0x004d7060`, and the heavier editor refresh at `0x004d6090`, so this is the safest current read for the selected-effect parameter-row repaint rather than another anonymous row helper.","objdump + EventEffects.win constructor and handler correlation + local disassembly + parameter-table correlation"
0x004d6090,1752,shell_event_effects_window_refresh_selected_staged_effect_editor_panels,shell,thiscall,inferred,objdump + EventEffects.win constructor and handler correlation + local disassembly,3,"Heavier editor refresh beneath `EventEffects.win`. The helper first resets the smaller grouped parameter rows through `0x004d5f83`, then interprets the currently staged effect row at `[this+0x78]` by reading opcode byte `+0x08`, scalar dword `+0x04`, grouped value lanes `+0x09` and `+0x0d`, and the bounded numeric fields `+0x11`, `+0x12`, `+0x14`, and `+0x16`. It uses that staged row plus the current effect-type descriptor state at `[this+0x7c]` to repaint the main effect-editor controls rooted at ids such as `0x4fc7`, `0x4fce`, `0x4ff6`, `0x4ff9`, `0x4ffc`, `0x5041`, `0x5044`, `0x5046`, and `0x5047`, including the numeric-entry affordances, sign or comparator toggles, and the type-specific parameter bands. Current grounded callers are the effects-window constructor `0x004d6d60` and message dispatcher `0x004d7060`, which keeps this as the clearest current owner for staged effect-editor repaint rather than a generic event formatter.","objdump + EventEffects.win constructor and handler correlation + local disassembly + staged-row-field correlation"
0x004d77b0,251,shell_event_conditions_window_refresh_grouped_effect_summary_band_affordances,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Refreshes the grouped-effect summary band affordances beneath `EventConditions.win`. The helper checks whether selected-event mode control `0x4e8f` is active and whether the current selector rooted at `0x5000` resolves to control `0x5002`; only on that branch does it enable the grouped summary-band controls `0x4fed..0x4ff0`, otherwise it disables that four-control band with style `0x87`. Current grounded callers include the mode-dependent detail-row switch `0x004d9390` and nearby condition-window refresh tails around `0x004d9970` and `0x004daf40`, so this is the safest current read for grouped summary-band affordance refresh rather than another anonymous style helper.","objdump + caller xrefs + local disassembly + grouped-band-control correlation + selector-gate correlation"
0x004d7ef0,301,shell_event_effects_window_refresh_event_selector_list_and_selected_event_id,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Event-selector refresh beneath the broader event editor family. The helper clears the current selected event id at `[this+0x84]`, the visible row count at `[this+0x90]`, and the adjacent selection latches at `[this+0x88]` and `[this+0x8c]`, then iterates the live event collection `0x0062be18` to populate the visible selector control rooted at `0x4e84` with each event name from `+0x18` plus the paired count field at `+0x14`. When at least one live event exists it republishes the chosen event id through `[this+0x84]` and enables the list-selection affordance on control `0x4e84`. Current grounded caller is the effects-side command family near `0x004dbb35`, which makes this the safest current owner for event-list selector refresh rather than a generic event walk.","objdump + caller correlation + local disassembly + event-collection iteration correlation"
0x004d8120,1968,shell_event_conditions_window_refresh_condition_row_list_panel,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Heavier row-list refresh beneath `EventConditions.win`. The helper resolves the currently selected live event through `[this+0x84]`, walks the standalone condition-row list rooted at `[event+0x00]`, and repaints the condition-row panel rooted at `0x4eaf` by formatting special sentinel rows `-1` and `-2` through fixed localized ids `0x47e` and `0x47f` while ordinary rows derive their caption and comparator text from the condition tables rooted near `0x005f3de3` and `0x004d88cc`. The same pass also rebuilds the current selected-row index at `[this+0x94]`, maintains the per-row seen bitmap on the stack, and republishes the current selection row list through the generic control path before the surrounding condition-window refresh continues. Current grounded callers are the add, edit, and remove condition-row verbs `0x004da640`, `0x004da700`, and `0x004d9ed0`, so this is the safest current owner for condition-row list repaint rather than a generic formatter.","objdump + caller correlation + local disassembly + condition-row-list correlation"
0x004d88f0,1115,shell_event_conditions_window_refresh_selected_grouped_effect_row_list_panel,shell,thiscall,inferred,objdump + local disassembly + RT3.lng correlation + grouped-effect-descriptor correlation,3,"Grouped effect-row list refresh beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, uses current grouped selector `[this+0x9c]` to walk the grouped `0x28`-byte row list anchored at `[event + group*4 + 0x04]`, clears list control `0x4ed5`, and resets selected grouped row index `[this+0x98] = -1` before rebuilding the visible row band. Formatting is now tighter than a generic list repaint: ordinary grouped rows flow through the effect descriptor table at `0x006103a0` and RT3.lng `1154..1159` to build `Set %1 to FALSE/TRUE`, timed `for %1 months/years`, and scalar assignment lines, while opcode byte `+0x08 == 8` takes the wider multivalue path over fields `+0x11/+0x12/+0x14/+0x16` before publishing the finished text into `0x4ed5`. The helper finishes by re-enabling `0x4ed5` with active style when the selected grouped list is nonempty. Current grounded callers are the selected-event refresh family `0x004db120/0x004d9390/0x004dbf93` plus grouped effect add, edit, and remove verbs `0x004da7c0/0x004da860/0x004da920`, so this is the safest current read for selected grouped-effect row-list repaint rather than an anonymous formatter.","objdump + local disassembly + RT3.lng correlation + grouped-effect-descriptor correlation + grouped-list-anchor correlation"
0x004d8d50,320,shell_event_conditions_window_commit_current_grouped_effect_summary_state_before_group_switch,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation,3,"Small commit helper beneath `EventConditions.win` that snapshots the current grouped-effect summary editor state back into the selected live event before the grouped selector changes. The helper resolves the selected event through `[this+0x84]`, uses current grouped index `[this+0x9c]`, samples control `0x500a` into event byte lane `[event + group*4 + 0x7ff]`, maps the hidden mutually exclusive selector family rooted at `0x5006` into ordinal byte `[event + group + 0x7fb] = 0..8`, and stores current local selector state `[this+0x8c]` into event dword lane `[event + group*4 + 0x80f]`. The ordinal mapping is now explicit in the commit-side jump table: controls `0x5006..0x500e` store values `0..8`, and the refresh side later maps those same ordinals one-to-one onto visible controls `0x5014..0x501c`. Current evidence therefore reads `0x5006..0x500e` as the hidden canonical selector family and `0x5014..0x501c` as its visible display mirror, not as two distinct semantic families. The strongest current RT3.lng fit for the stored scope family is `object being evaluated`, `whole game`, `all/human/AI companies`, `specified territories`, and `all/human/AI players`. Current grounded caller is the grouped-band dispatcher case at `0x004dbf93`, so this is the safest current read for grouped-effect summary-state commit before group switch rather than a generic editor helper.","objdump + caller xrefs + local disassembly + grouped-selector-state correlation + ordinal-mapping correlation + RT3.lng correlation"
0x004d8ea0,1165,shell_event_conditions_window_commit_current_selected_event_text_panels_before_selection_change,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Selected-event commit helper beneath `EventConditions.win` that snapshots the currently visible mode-strip text panels back into the live event record before selection, grouped-action, or grouped-band changes. The helper resolves the selected live event through `[this+0x84]`, samples active controls `0x4e8e`, `0x4e8f`, `0x4ed9`, `0x4edb`, `0x4edd`, and `0x4e91`, and uses those active-state checks to rewrite event mode byte `[event+0x7ee]` plus the fixed text bands at `[event+0x0e0]`, `[event+0x401]`, `[event+0x4ca]`, `[event+0x593]`, `[event+0x65c]`, and `[event+0x725]` from the current shell control payloads. Current grounded callers are selected-event previous and next navigation `0x004db520/0x004db5e0`, the selected-event id setter `0x004db6a0`, and the grouped-action selector case at `0x004dbfca`, so this is the safest current read for committing current selected-event text panels before selection change rather than another repaint helper.","objdump + caller xrefs + local disassembly + event-text-band correlation + selection-change correlation"
0x004d91e0,343,shell_event_conditions_window_commit_selected_event_summary_headers_and_group_mode,shell,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Selected-event summary-header and grouped-mode commit helper beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, snapshots the active modifier bands rooted at `0x4fd7` and `0x4fd8` into event bytes `[event+0x7f9]` and `[event+0x7fa]`, stores the inverted toggle state of control `0x4e93` into event byte `[event+0x800]`, writes summary header control `0x4ead` into event dword `[event+0x7f5]`, mirrors window field `[this+0x88]` into event dword `[event+0x7f0]`, re-enters `shell_event_conditions_window_commit_current_grouped_effect_summary_state_before_group_switch` `0x004d8d50`, and then commits one grouped-mode choice from controls `0x4eca/0x4ecb/0x4ecc` into event byte `[event+0x7f4]`. Current grounded caller is the broader selected-event strip refresh at `0x004db120`, so this is the safest current read for committing selected-event summary headers and grouped mode rather than another grouped-action helper.","objdump + local disassembly + caller correlation + control-band correlation + event-record-field correlation"
0x004d9360,43,shell_event_conditions_window_remove_selected_event_and_refresh_selector,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Delete verb for the selected live event beneath `EventConditions.win`. When `[this+0x84]` holds a valid event id, the helper resolves collection `0x0062be18`, removes that live event through the collection vtable delete slot, and then immediately rebuilds the visible event selector through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`. Current grounded dispatcher caller is control `0x4e8a` through `0x004dbc48`, so this is the safest current read for selected-event deletion and selector refresh rather than a generic collection wrapper.","objdump + local disassembly + dispatcher correlation + collection-delete correlation"
0x004d9390,1504,shell_event_conditions_window_refresh_selected_event_mode_dependent_detail_rows,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Mode-dependent detail-row switch beneath `EventConditions.win`. The helper samples which selected-event mode button is active across controls `0x4e8f`, `0x4e90`, `0x4e91`, and `0x4e92`, then shows or hides the corresponding detail-row families rooted at `0x4ed7..0x4edd` and `0x4fdb..0x4fe6` through the generic shell control path. The same pass also re-enters `shell_event_conditions_window_refresh_grouped_effect_summary_band_affordances` `0x004d77b0`, resets grouped selection field `[this+0x9c]` when the chosen mode does not keep it, refreshes the grouped row list through `0x004d88f0`, and toggles the trailing affordance at `0x4fed`. Current grounded callers are the selected-event strip refresh `0x004d9f50`, the broader condition-window dispatcher `0x004dbb80`, and one nearby secondary dispatcher at `0x004daf40`, so this is the safest current read for selected-event mode-dependent detail rows rather than a generic control-style helper.","objdump + caller xrefs + local disassembly + mode-button correlation + detail-row-band correlation + grouped-band-affordance correlation"
0x004d9970,925,shell_event_conditions_window_refresh_condition_class_summary_and_group_rows,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation,3,"Refreshes the condition-class summary and grouped-row affordance bands beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, queries the standalone condition-row aggregate flags through `scenario_event_query_standalone_condition_row_list_class_and_modifier_flags` `0x0042d700`, and then restyles the summary header or status rows rooted at `0x4eae`, `0x4eb4`, `0x4fd9`, `0x4fda`, `0x4ec0..0x4ec4`, and `0x4eb6..0x4eba`. Current local bit correlation is tighter than a generic status repaint: aggregate bit `0x01` drives the `0x4fd9` / `0x4ec0..0x4ec4` band, aggregate bit `0x02` drives the `0x4fda` / `0x4eb6..0x4eba` band, aggregate bit `0x04` drives the header pair `0x4eae` and `0x4eb4`, and the higher modifier bits `0x10` and `0x20` refine the style of `0x4ec1` and `0x4eb6`. Current RT3.lng adjacency now gives the strongest current player-facing fit for this whole branch too: selector `0x5001` above it reads as the `1573` `Test against...` side, with the grouped company and player target-family rows under `0x4ec0..0x4ec4` and `0x4eb6..0x4eba` aligning to the adjacent `1574..1592` company/player test-scope text family. Event byte `[event+0x7f4]` also gates one special affordance in each grouped band. Current grounded callers include the add, edit, and remove condition-row verbs `0x004da640`, `0x004da700`, and `0x004d9ed0`, plus several surrounding condition-window refresh tails, so this is the safest current owner for the condition-summary and grouped-row repaint rather than a generic style loop.","objdump + caller xrefs + local disassembly + condition-aggregate correlation + grouped-band correlation + RT3.lng correlation"
0x004d9d10,53,shell_event_conditions_window_refresh_selected_grouped_effect_territory_target_affordance,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation,3,"Small territory-target affordance refresh beneath `EventConditions.win` for the current grouped effect selection. The helper resolves the selected live event at `[this+0x84]`, queries grouped effect-row type flags for the current grouped selector `[this+0x9c]` through `scenario_event_query_grouped_effect_row_list_type_flags` `0x0042d740`, and enables control `0x500b` only when the returned flags include bit `0x04` and the neighboring controls `0x5019` plus `0x5002` are already active. Otherwise it disables the same affordance with style `0x87`. The strongest current label fit is that `0x5019/0x500b` are the RT3.lng `1619/1620` `to territories` lane, with `0x500b` carrying the stored territory-target parameter from `[event + group*4 + 0x80f]`. Current grounded callers are the broader condition-window refresh `0x004da0f0` and the main dispatcher `0x004dbb80`, so this is the safest current read for the selected grouped-effect territory-target affordance rather than a generic control-style toggle.","objdump + caller xrefs + local disassembly + grouped-flag correlation + control-enable correlation + RT3.lng correlation"
0x004d67f0,456,shell_event_effects_window_commit_current_editor_state_into_staged_row,shell,thiscall,inferred,objdump + EventEffects.win constructor and handler correlation + local disassembly,3,"Commit helper beneath `EventEffects.win` that normalizes the current editor controls back into the staged effect row at `[this+0x78]`. The helper stores the selected effect-type index from `[this+0x7c]` into row dword `+0x00`, rewrites opcode byte `+0x08` and scalar dword `+0x04` through the descriptor-driven mapper at `0x004d64a0`, preserves or clears the sign bit on the opcode byte as needed, and then refreshes the smaller boolean or numeric side fields before the staged row is ready for the higher-level window logic. Current grounded callers are the constructor `0x004d6d60`, the vtable-bound message dispatcher `0x004d7060`, and the smaller callback remap path around `0x004d70a2`, so this is the safest current read for editor-state commit into the staged effect row rather than another formatter.","objdump + EventEffects.win constructor and handler correlation + local disassembly + staged-row-commit correlation"
0x004d6d60,763,shell_event_effects_window_construct,shell,thiscall,inferred,objdump + EventEffects.win string xref + control-binding inspection,3,"Constructs the shell-side `EventEffects.win` window. The constructor installs vtable `0x005d0cf4`, binds `EventEffects.win` through `0x0053fa50`, stores the incoming staged effect-row record at `[this+0x78]`, mirrors its key fields into the local window state at `[this+0x7c]` and the stack-built numeric caches used by the row editors, binds the grouped effect-row callbacks at `0x004d6d30`, and then repaints the visible controls through the same window-local refresh family. Current grounded string xref is direct at `0x004d6da5`, which makes this the clean owner for the effects window rather than a generic event editor child.","objdump + EventEffects.win string xref + control-binding inspection + staged-row-field correlation"
0x004d7060,166,shell_event_effects_window_handle_message,shell,thiscall,inferred,objdump + EventEffects.win vtable slot + local disassembly,3,"Primary shell-message dispatcher bound in vtable slot `0x005d0cf8` for `EventEffects.win`. The handler switches on incoming shell messages `0xc9`, `0xca`, and the callback-style `0x04` path, remaps the constructor-bound callback controls at `0x4fb1` and `0x4fd4` into the `0xc9` branch, validates staged effect-row state through `0x004d67f0`, and dispatches the effect-window command strip rooted at ids such as `0x4fb3..0x5047` through the grouped-row and detail refresh helpers `0x004d5d00`, `0x004d5f50`, and `0x004d6090`. Current direct evidence is the `EventEffects.win` vtable at `0x005d0cf4`, whose second slot points to `0x004d7060`, so this is the clean message owner for the effects window rather than just the smaller callback lane.","objdump + EventEffects.win vtable slot + local disassembly + callback-remap correlation"
0x004d9dc0,123,shell_open_event_conditions_modal_and_return_result,shell,cdecl,inferred,objdump + constructor call correlation + local disassembly,3,"Shared modal opener for `EventConditions.win`. The helper allocates an `0x88`-byte window object, constructs it through `shell_event_conditions_window_construct` `0x004d57c0` with the caller-supplied live condition row pointer plus the extra boolean argument, enters the common shell modal loop through `0x538f10`, then destroys and frees the modal object before returning the dialog result code. Current grounded callers are the add and edit condition-row verbs around `0x004da640` and `0x004da700`, which makes this the clean owner for condition-row modal launch rather than an anonymous allocator wrapper.","objdump + constructor call correlation + local disassembly + modal-loop correlation"
0x004d9e40,120,shell_open_event_effects_modal_and_return_result,shell,cdecl,inferred,objdump + constructor call correlation + local disassembly,3,"Shared modal opener for `EventEffects.win`. The helper allocates an `0x80`-byte window object, constructs it through `shell_event_effects_window_construct` `0x004d6d60` with the caller-supplied staged effect-row pointer, enters the common shell modal loop through `0x538f10`, then runs the effect-window close tail at `0x004d5b90`, destroys the modal object, and returns the dialog result code. Current grounded callers are the add and edit grouped-effect verbs around `0x004da7c0` and `0x004da860`, which makes this the clean owner for the effect-row modal launch rather than another small wrapper.","objdump + constructor call correlation + local disassembly + modal-loop correlation"
0x004d9ed0,116,shell_event_conditions_window_remove_selected_condition_row,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Remove verb beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, uses the current selected condition-row index at `[this+0x94]` to unlink one node from the standalone condition-row list rooted at `[event+0x00]`, frees the removed `0x1e`-row allocation through `0x53b080`, then refreshes the visible row list through `shell_event_conditions_window_refresh_condition_row_list_panel` `0x004d8120` and re-enters the surrounding condition-window repaint tail at `0x004d9970`. Current grounded caller is the conditions-side command family under `0x004dbcc3`, so this is the safest current read for selected condition-row deletion rather than a generic list unlink helper.","objdump + caller correlation + local disassembly + linked-list-unlink correlation"
0x004d9f50,546,shell_event_conditions_window_refresh_selected_event_mode_strip_and_summary_panels,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Refreshes the selected-event mode strip and summary text panels beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, republishes the boolean toggle on control `0x4e93` from event byte `[event+0x800]`, selects one mode button across `0x4e8f/0x4e90/0x4e91` from event byte `[event+0x7ee]`, and restyles the whole mode strip `0x4e8e..0x4e92` with the current active choice. It then re-enters `shell_event_conditions_window_refresh_selected_event_mode_dependent_detail_rows` `0x004d9390` and republishes several dynamic-text controls from the current event record, including the main summary text at `[event+0x0e0]` into `0x4eac` and the later fixed text bands rooted at offsets `+0x4ca`, `+0x593`, and `+0x65c` into controls such as `0x4fdf`, `0x4fe0`, and `0x4fe1`. Current grounded callers are the broader conditions refresh family `0x004db120` and the main conditions-window dispatcher `0x004dbb80`, so this is the safest current read for the selected-event mode strip and summary-panel refresh rather than a generic text repaint.","objdump + caller xrefs + local disassembly + mode-strip correlation + dynamic-text-panel correlation"
0x004da640,185,shell_event_conditions_window_append_default_condition_row_via_modal,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Add verb beneath `EventConditions.win`. The helper allocates and zero-initializes one default `0x1e`-byte condition row, seeds row dword `+0x00` with default id `0x0e` plus row byte `+0x04` with subtype `4`, then opens the condition-row modal through `shell_open_event_conditions_modal_and_return_result` `0x004d9dc0`. When the modal returns accept code `0x4f73`, the helper either appends the resulting row at the end of the current condition-row list or installs it as the first row on an empty event, then refreshes the visible list through `0x004d8120` and the surrounding condition-window repaint through `0x004d9970`. Current grounded caller is the conditions-side command family at `0x004dbca8`, which makes this the clean current owner for default condition-row creation rather than an anonymous allocator branch.","objdump + caller correlation + local disassembly + modal-return correlation"
0x004da700,182,shell_event_conditions_window_edit_selected_condition_row_via_modal,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Edit verb beneath `EventConditions.win`. The helper resolves the selected live event and selected condition-row index `[this+0x94]`, walks the standalone condition-row list to the chosen row, and opens the current row in the condition modal through `shell_open_event_conditions_modal_and_return_result` `0x004d9dc0`. On accept code `0x4f73`, it writes the edited row back in place; one negative-id branch also duplicates the selected row into a fresh `0x1e` allocation before reinserting it at the head. The helper then refreshes the row list through `0x004d8120` and the surrounding condition-window repaint through `0x004d9970`. Current grounded caller is the conditions-side command family at `0x004dbcb1`, so this is the safest current read for selected condition-row edit rather than another raw list walk.","objdump + caller correlation + local disassembly + modal-return correlation"
0x004da7c0,155,shell_event_effects_window_append_grouped_effect_row_via_modal,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Add verb beneath `EventEffects.win`. The helper allocates and zero-initializes one default `0x28`-byte grouped effect row, seeds row dword `+0x00` with default opcode `2`, opens the effects modal through `shell_open_event_effects_modal_and_return_result` `0x004d9e40`, and on accept code `0x4fb1` appends the resulting row to the currently selected effect-group list anchor `[event + group*4 + 0x04]` using the active group index at `[this+0x9c]`. It then refreshes the grouped effect rows through `0x004d88f0` and re-enters the broader effects-window repaint through `0x004da0f0`. Current grounded caller is the effects-side command family at `0x004dbc84`, which makes this the clean current owner for grouped effect-row creation rather than another allocator stub.","objdump + caller correlation + local disassembly + grouped-list-append correlation"
0x004da860,179,shell_event_effects_window_edit_selected_grouped_effect_row_via_modal,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Edit verb beneath `EventEffects.win`. The helper resolves the selected live event, selected effect group `[this+0x9c]`, and selected row index `[this+0x98]`, copies the chosen `0x28`-byte grouped effect row into a stack staging buffer, and opens the effects modal through `shell_open_event_effects_modal_and_return_result` `0x004d9e40`. On accept code `0x4fb1` it writes the edited row back in place, then refreshes the grouped effect rows through `0x004d88f0` and the broader effects-window repaint through `0x004da0f0`. Current grounded caller is the effects-side command family at `0x004dbd02`, so this is the safest current read for selected grouped effect-row edit rather than another modal wrapper.","objdump + caller correlation + local disassembly + grouped-row-staging correlation"
0x004da920,126,shell_event_effects_window_remove_selected_grouped_effect_row,shell,thiscall,inferred,objdump + caller correlation + local disassembly,3,"Remove verb beneath `EventEffects.win`. The helper resolves the selected live event, selected effect group `[this+0x9c]`, and selected row index `[this+0x98]`, unlinks one node from the chosen grouped effect-row list anchored at `[event + group*4 + 0x04]`, frees the removed `0x28`-byte allocation through `0x53b080`, then refreshes the grouped effect rows through `0x004d88f0` and the broader effects-window repaint through `0x004da0f0`. Current grounded caller is the effects-side command family at `0x004dbd1d`, so this is the safest current read for selected grouped effect-row deletion rather than a generic list helper.","objdump + caller correlation + local disassembly + grouped-list-unlink correlation"
0x004da9a0,400,shell_event_conditions_window_refresh_current_grouped_effect_summary_state_from_selected_event,shell,thiscall,inferred,objdump + local disassembly + RT3.lng correlation,3,"Selected grouped-summary state refresh beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, uses current grouped selector `[this+0x9c]`, republishes checkbox control `0x500a` from event byte lane `[event + group*4 + 0x7ff]`, mirrors event dword lane `[event + group*4 + 0x80f]` into local selector field `[this+0x8c]` and control `0x500b` when that stored value is nonnegative, and then republishes grouped target-scope ordinal byte `[event + group + 0x7fb] = 0..8` through the visible target-scope display family `0x5014..0x501c`. The jump table is now explicit here too: ordinal `0..8` activates visible controls `0x5014..0x501c` one-to-one, which is the strongest current evidence that those visible rows are a display mirror over the hidden canonical selector family `0x5006..0x500e` rather than a second label-distinct mode family. Current strongest label fit for those stored ordinals is `object being evaluated`, `whole game`, `all/human/AI companies`, `specified territories`, and `all/human/AI players`; each ordinal case then tails directly into the broader grouped-effect target-scope refresh at `0x004da0f0`. Current grounded callers are the selected-event strip refresh `0x004db120` and grouped-band selection tail `0x004dbf93`, so this is the safest current read for republishing the currently selected grouped summary state from stored event data rather than a generic control write loop.","objdump + local disassembly + grouped-summary-state correlation + ordinal-mapping correlation + RT3.lng correlation"
0x004dab60,212,shell_event_conditions_window_refresh_selected_grouped_effect_target_scope_strip,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng correlation + grouped-band dispatch-table decode,3,"Refreshes the selected grouped-effect target-scope strip beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, reads current grouped selector `[this+0x9c]`, republishes checkbox control `0x500a` from event byte lane `[event + group*4 + 0x7ff]`, and then republishes grouped target-scope ordinal byte `[event + group + 0x7fb] = 0..8` through the visible display family `0x5014..0x501c`. The surrounding enable logic is tighter too: grouped effect-row type mask bit `0x08` gates `0x5015` (`whole game`), bit `0x01` gates the company-target trio `0x5016..0x5018`, bit `0x02` gates the player-target trio `0x501a..0x501c`, and bit `0x04` gates the paired territory-target lane `0x500b/0x5019`. When the territory lane is absent the helper falls back to local selector state `[this+0x8c]` for `0x500b`; and when any target-scope lane is active it first tries to re-enable one hidden selector from `0x5006..0x500e`, falling back to the persisted control id in `0x00622074` only when no current visible target-scope display row is already active. Current code now makes the hidden/display split firmer too: `0x5006..0x500e` are the canonical hidden selectors stored by `0x004d8d50`, while `0x5014..0x501c` are the visible one-to-one mirror rows republished by `0x004da9a0` and styled here. The grouped-band `0x4dc09c` table keeps the remaining boundary explicit: visible rows `0x5014..0x501c` do not dispatch to the target-scope selector case directly; they only re-enter the smaller `0x004d9d10` territory-target affordance path on the `0xcf` side, so this helper remains the safest current owner for the actual stored target-scope refresh rather than a generic control-style helper.","objdump + caller xrefs + local disassembly + ordinal-mapping correlation + persisted-selection correlation + RT3.lng correlation + grouped-band dispatch-table decode"
0x004daf40,367,shell_event_conditions_window_reset_selected_event_summary_placeholders,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Selection-bootstrap helper beneath `EventConditions.win` that clears and republishes the dynamic-text placeholder band when the selected event changes or no live event is currently active. The helper writes the same fixed placeholder text block rooted at `0x005c87a8` back into controls `0x4eaf`, `0x4eac`, `0x4ed9`, `0x4edb`, and `0x4fdf..0x4fe2`, then repaints those controls through the generic shell path before the broader selected-event refresh continues. Current grounded callers are `shell_event_conditions_window_set_selected_event_id_and_refresh_if_open` `0x004db6a0` and the callback-binding bootstrap `0x004db6f0`, so this is the safest current read for selected-event summary placeholder reset rather than another local dispatcher fragment.","objdump + caller xrefs + local disassembly + placeholder-control correlation"
0x004da0f0,1350,shell_event_conditions_window_refresh_controls,shell,thiscall,inferred,objdump + caller xrefs + EventConditions.win correlation + RT3.lng correlation + grouped-band dispatch-table decode,3,"Shared refresh pass for `EventConditions.win`. The helper resolves the currently selected live event record from collection `0x0062be18`, samples grouped effect-row type flags for the current grouped selector `[this+0x9c]` through `scenario_event_query_grouped_effect_row_list_type_flags` `0x0042d740`, then consults the adjacent runtime-condition helpers `0x0042dff0`, `0x0042df30`, `0x0042df70`, and `0x0042dfb0` to decide which condition rows should be enabled, disabled, or summarized through the condition-side controls rooted at ids such as `0x5005..0x501c`. The selector pair `0x5001/0x5002` now has a tighter split here: `0x5001` gates the standalone condition test-scope side consumed by `0x004d9970`, with RT3.lng `1573` `Test against...` now the strongest current label fit, while `0x5002` gates the grouped-effect target-scope side, with RT3.lng `1606` `Apply effects...` now the strongest current label fit. On that `0x5002` branch, when control `0x4ed5` is active and the current condition aggregates permit it, the helper builds dynamic-text control `0x5014` from RT3.lng `1160..1164`, yielding `to the company/player/player (i.e. chairman)/territory for which the condition is TRUE`; current RT3.lng correlation then gives the strongest current label fit for the remaining visible target-scope display rows as `0x5015 = to the whole game`, `0x5016..0x5018 = to all/human/AI companies`, `0x5019 + 0x500b = to territories` with a stored target parameter, and `0x501a..0x501c = to all/human/AI players`. The same pass now has a tighter mask split too: grouped effect-row type flag bit `0x08` gates `0x5015`, bit `0x01` gates the company-target trio `0x5016..0x5018`, bit `0x04` gates the territory-target lane `0x500b/0x5019`, and bit `0x02` gates the player-target trio `0x501a..0x501c`. The grouped-band `0x4dc09c` table now keeps the interaction boundary honest too: controls `0x5001/0x5002` are the only `0x4fed..0x501c` entries that route into the grouped target-scope selector case `0x004dbfca` on the `0xcf` side, while visible rows `0x5014..0x501c` route only to the smaller `0x004d9d10` affordance path. The same pass also re-enters `shell_event_conditions_window_refresh_condition_class_summary_and_group_rows` `0x004d9970`, `shell_event_conditions_window_refresh_selected_event_mode_strip_and_summary_panels` `0x004d9f50`, and the smaller territory-target affordance helper `0x004d9d10` before finishing the common window-side repaint tail. Current grounded callers sit in the surrounding event-condition message family near `0x004dbce0`, which makes this the safest current owner for condition-window refresh rather than only a one-off formatter.","objdump + caller xrefs + EventConditions.win correlation + condition-helper correlation + grouped-effect-flag correlation + RT3.lng correlation + grouped-band dispatch-table decode"
0x004db120,1024,shell_event_conditions_window_refresh_selected_event_strip_and_navigation,shell,thiscall,inferred,objdump + local disassembly + caller xrefs + event-selector correlation,3,"Broad selected-event repaint beneath `EventConditions.win`. The helper first enables or disables the selected-event strip rooted at `0x4e84..0x5077` depending on whether `[this+0x84]` holds a live event id, seeds grouped selector `[this+0x9c]` to `0`, re-enables the first grouped summary band `0x4fed`, republishes the persisted grouped target-scope selector id from `0x00622074`, and then resolves the selected live event through collection `0x0062be18` before re-entering `0x004dab60`, `shell_event_conditions_window_refresh_selected_event_mode_strip_and_summary_panels` `0x004d9f50`, `shell_event_conditions_window_refresh_condition_class_summary_and_group_rows` `0x004d9970`, `shell_event_conditions_window_refresh_condition_row_list_panel` `0x004d8120`, and the grouped-row refresh tail `0x004d88f0`. The same pass also republishes the fixed selected-event selector band `0x4e98..0x4ea2` from event byte `[event+0x7ef]`, the summary headers `0x4ead/0x4eae` from `[event+0x7f5]` and `[event+0x7f0]`, the modifier bands `0x4ec0..0x4ec4` and `0x4eb6..0x4eb9` from `[event+0x7f9]` and `[event+0x7fa]`, and the grouped-mode trio `0x4eca..0x4ecc` from `[event+0x7f4]`. The closing count check against `0x0062be18` also gates navigation controls `0x4e85` and `0x4e86`, so this is the safest current owner for selected-event strip and navigation refresh rather than a generic repaint tail.","objdump + local disassembly + caller xrefs + event-record-field correlation + grouped-selection-bootstrap correlation + navigation-control correlation"
0x004db520,192,shell_event_conditions_window_select_previous_event_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Backward selected-event stepping verb beneath `EventConditions.win`. When `[this+0x84]` holds a live event id, the helper resolves the current event record, queries the neighboring live event id through collection helper `0x005184f0(..., 2)`, and when a valid predecessor exists it clears staged condition selection through `0x004d8ea0`, copies the stepped event id into `[this+0x84]`, rebuilds the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, and re-enters the broader selected-event repaint `0x004db120`. It finally republishes control `0x4e84` with the new selected row. Current grounded dispatcher caller is the first event-strip navigation case at `0x004dbc5c`, so this is the safest current read for selected-event previous-step and refresh rather than a generic collection walk.","objdump + local disassembly + dispatcher correlation + event-selector-list correlation"
0x004db5e0,192,shell_event_conditions_window_select_next_event_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Forward selected-event stepping verb beneath `EventConditions.win`. The helper mirrors `0x004db520`, but after querying the stepped event id through `0x005184f0(..., 2)` it rejects the end-of-strip sentinel when the returned ordinal reaches current field `[this+0x90]`, then commits the next live event into `[this+0x84]`, rebuilds the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, re-enters `shell_event_conditions_window_refresh_selected_event_strip_and_navigation` `0x004db120`, and republishes control `0x4e84` with the new selected row. Current grounded dispatcher caller is the sibling event-strip navigation case at `0x004dbc70`, so this is the safest current read for selected-event next-step and refresh rather than another generic list walk.","objdump + local disassembly + dispatcher correlation + end-of-strip-sentinel correlation"
0x004db6a0,80,shell_event_conditions_window_set_selected_event_id_and_refresh_if_open,shell,cdecl,inferred,objdump + local disassembly + callback-binder correlation,3,"Shared selected-event setter beneath `EventConditions.win`. The helper accepts one live event id in `edx`, checks whether the global conditions-window singleton at `0x006cff84` is either inactive or ready for refresh through `0x004d8ea0`, and then writes the requested event id into `[window+0x84]`, re-enters `0x004daf40` plus the broader selected-event repaint `0x004db120`, and mirrors the same id into pending field `0x00622070`. Current grounded caller is the event-selector callback bound on control `0x4e84` from `0x004db6f0`, so this is the safest current owner for selected-event id publish and refresh rather than a generic global setter.","objdump + local disassembly + callback-binder correlation + pending-selection-field correlation"
0x004db6f0,1168,shell_event_conditions_window_bind_event_selector_callbacks_and_seed_pending_selection,shell,thiscall,inferred,rizin + local disassembly + callback-binding correlation,3,"Post-construction callback binder and pending-selection bootstrap for `EventConditions.win`. The helper installs callback-style bindings across the selected-event and summary controls, including the event selector `0x4e84` through `shell_event_conditions_window_set_selected_event_id_and_refresh_if_open` `0x004db6a0` and several summary bands through the window-local callback family rooted at `0x004d71b0`, `0x004d78d0`, `0x004d7950`, `0x004d7960`, `0x004d7970`, and `0x004d7980`. It then seeds the current event selection from pending id `0x00622070`, resets grouped selection `[this+0x9c]`, refreshes the smaller summary side through `0x004d7fe0`, rebuilds the event selector list through `0x004d7ef0`, re-enters `0x004daf40`, and finishes with the broader selected-event repaint `0x004db120`. Current grounded caller is the neighboring conditions-window bring-up branch at `0x004ce204`, so this is the safest current read for event-selector callback binding and pending-selection bootstrap rather than a generic constructor fragment.","rizin + local disassembly + callback-binding correlation + pending-selection-bootstrap correlation"
0x004db8b0,718,shell_event_conditions_window_append_blank_or_clone_selected_event_via_name_modal,shell,thiscall,inferred,objdump + caller xrefs + local disassembly + dispatcher correlation,3,"Selected-event add or clone helper beneath `EventConditions.win`. One caller-controlled boolean selects between a blank event path and a clone-selected-event path: boolean `0` seeds the modal text from localized ids `0x47a` and `0x47c`, while boolean `1` uses the current selected event name plus localized ids `0x47b` and `0x47c`. On accept the helper opens the shared custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0`, creates and selects a new live event through `0x00432ea0`, optionally deep-copies the currently selected live event into that new record through `scenario_event_clone_runtime_record_deep_copy` `0x0042e050`, then rebuilds the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, re-enters the broader selected-event repaint `0x004db120`, and republishes control `0x4e84`. Current grounded dispatcher callers are controls `0x4e87` and `0x4e88` through `0x004dbbfd` and `0x004dbc1e`, so this is the safest current read for blank-event append or selected-event clone via name modal rather than an effects-window refresh.","objdump + caller xrefs + local disassembly + dispatcher correlation + modal-name-flow correlation"
0x004dba90,236,shell_event_conditions_window_rename_selected_event_via_name_modal,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Rename verb for the selected live event beneath `EventConditions.win`. The helper resolves the selected live event through `[this+0x84]`, copies the current name field `[event+0x18]`, opens the shared custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` with localized id `0x47d`, and on accept writes the edited name back into the live event record before rebuilding the selector list through `shell_event_effects_window_refresh_event_selector_list_and_selected_event_id` `0x004d7ef0`, restoring the selected id, re-entering `shell_event_conditions_window_refresh_selected_event_strip_and_navigation` `0x004db120`, and republishing control `0x4e84`. Current grounded dispatcher caller is control `0x4e89` through `0x004dbd6e`, so this is the safest current read for selected-event rename via name modal rather than another selector refresh tail.","objdump + local disassembly + dispatcher correlation + modal-rename correlation"
0x004dbe7a,100,shell_event_conditions_window_open_choice_event_single_player_only_warning_modal,shell,thiscall,inferred,objdump + local disassembly + switch-table decode + RT3.lng string correlation,3,"Small warning-modal branch beneath `EventConditions.win` reached from the `0x4ec6/0x4ec7` control pair. The helper first checks whether selected-event mode control `0x4e8f` is active, and only on that branch forces grouped-mode control `0x4eca` active before opening the shared custom modal through `shell_open_custom_modal_dialog_with_callbacks` `0x004c98a0` with localized id `0x0f2f` `3887`, whose grounded RT3.lng text warns that `Choice` events are single-player only and not allowed in multiplayer games. The branch does not otherwise mutate persistent event state, so this is the safest current read for a choice-event single-player-only warning modal rather than a grouped-action commit path.","objdump + local disassembly + switch-table decode + RT3.lng string correlation + mode-control correlation"
0x004dbeeb,116,shell_event_conditions_window_publish_pending_shared_summary_text_triplet,shell,thiscall,inferred,objdump + local disassembly + switch-table decode,3,"Pending dynamic-text publish helper beneath `EventConditions.win` reached from control `0x4ed9` when global latch `0x006d07d8` is clear. The helper copies one current shell text payload into a local `0x7d0` buffer, republishes that same text into controls `0x4eac`, `0x4ed9`, and `0x4edb` through the generic type-`0x6f` dynamic-text path, and then clears `0x006d07d8`. This is therefore the safest current read for publishing one pending shared summary-text triplet rather than a generic selection refresh.","objdump + local disassembly + switch-table decode + dynamic-text-control correlation"
0x004dbb80,1074,shell_event_conditions_window_dispatch_selected_event_strip_and_grouped_band_actions,shell,thiscall,inferred,objdump + local disassembly + switch-table decode + control-id correlation + grouped-band dispatch-table decode,3,"Broader `EventConditions.win` command dispatcher above the selected-event strip and grouped-band controls. The helper switches on shell messages `0xca`, `0xcb`, and `0xcf`, then uses the decoded `0x4dc000`, `0x4dc018`, `0x4dc050`, and `0x4dc08c` tables to route control families rooted at `0x4e84..0x4ea1`, `0x4eac..0x4ed9`, and `0x4fed..0x501c`. The selected-event strip is now explicit on the `0xcb` side: controls `0x4e85/0x4e86` step previous or next events through `0x004db520/0x004db5e0`, `0x4e87/0x4e88` add a blank event or clone the selected event through `0x004db8b0(0/1)`, `0x4e89` renames the selected event through `0x004dba90`, and `0x4e8a` deletes it through `0x004d9360`. The `0xca` side also owns the selected-event mode strip rooted at `0x4e98..0x4ea1`, where the baseline band writes event byte `[event+0x7ee] = 0` before re-entering `0x004d9f50`, while control `0x4ea1` writes special mode `4` and then refreshes the same strip. The later grouped-band `0xcf` cases are now bounded more tightly by the `0x4dc09c` byte map: grouped summary controls `0x4fed..0x4ff0` route to `0x004dbf93`, selector pair `0x5001/0x5002` route to `0x004dbfca`, visible target-scope display rows `0x5014..0x501c` route only to `0x004dbf7f -> 0x004d9d10`, and the remaining `0x4ff1..0x5013` span falls through the default no-op case. This is therefore the safest current owner for selected-event strip and grouped-band action dispatch rather than leaving those bands distributed across unnamed case blocks.","objdump + local disassembly + switch-table decode + control-id correlation + grouped-band correlation + grouped-band dispatch-table decode"
0x004dbfca,32,shell_event_conditions_window_select_grouped_effect_target_scope_mode_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation + grouped-band dispatch-table decode + RT3.lng correlation,3,"Grouped target-scope mode selector case beneath `EventConditions.win` on the `0xcf` grouped-band path. The helper first commits the currently visible selected-event text panels through `shell_event_conditions_window_commit_current_selected_event_text_panels_before_selection_change` `0x004d8ea0`, then refreshes the grouped-effect target-scope strip through `shell_event_conditions_window_refresh_selected_grouped_effect_target_scope_strip` `0x004dab60`, and finally stores the clicked control id into global `0x00622074` so the same target-scope selector can be re-enabled during later selected-event bring-up at `0x004db120`. The `0x4dc09c` dispatch table now keeps the control family honest: this case is only reached by controls `0x5001` and `0x5002`, not by visible rows `0x5014..0x501c`. Current RT3.lng adjacency gives those two controls their strongest current player-facing fit too: `0x5001` is the condition-side `Test against...` mode and `0x5002` is the grouped-effect-side `Apply effects...` mode. This is therefore the safest current read for grouped target-scope mode selection and refresh rather than for the whole visible target-scope display family.","objdump + local disassembly + dispatcher correlation + grouped-band dispatch-table decode + persisted-selection correlation + RT3.lng correlation"
0x004dbf93,55,shell_event_conditions_window_select_grouped_effect_summary_band_and_refresh,shell,thiscall,inferred,objdump + local disassembly + dispatcher correlation,3,"Grouped-band selector verb beneath `EventConditions.win`. The helper first commits the current grouped-effect summary editor state through `shell_event_conditions_window_commit_current_grouped_effect_summary_state_before_group_switch` `0x004d8d50`, stores the newly chosen grouped selector ordinal `control_id - 0x4fed` into `[this+0x9c]`, refreshes the visible grouped rows through `0x004d88f0`, re-enters the surrounding condition-window repaint through `0x004da0f0`, and then finishes with the smaller grouped summary tail at `0x004da9a0`. Current grounded dispatcher caller is the `0x4fed..0x4ff0` case family under `0x004dbb80`, so this is the safest current read for grouped-effect summary band selection and refresh rather than a generic selector write.","objdump + local disassembly + dispatcher correlation + grouped-band-selector correlation"
0x004c8670,11,shell_mark_custom_modal_dialog_dirty,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny dirty-latch setter paired with the shared callback-driven custom modal family rooted at `0x006cfeb4`. The helper stores `1` into `0x006cfeac`, which current nearby call patterns treat as the custom-modal refresh or service request latch after the lower constructor at `0x004c86c0` and opener `shell_open_custom_modal_dialog_with_callbacks` have published a live modal object. Current grounded caller is the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + nearby-constructor correlation + frame-caller inspection + custom-modal correlation"
0x004c8680,14,shell_has_live_custom_modal_dialog,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny presence probe for the shared callback-driven custom modal family. The helper reads the live modal singleton at `0x006cfeb4`, returns `1` when that pointer is positive or nonnull, and returns `0` otherwise. Current grounded caller is the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where this branch now sits beside the `LoadScreen`, file-options, and other shell-window probes rather than any detached gameplay-only UI owner.","objdump + nearby-constructor correlation + frame-caller inspection + custom-modal correlation"
0x004e1d60,1169,shell_load_screen_refresh_page_strip_and_page_kind_controls,shell,thiscall,inferred,objdump + descriptor-table decode + caller inspection,4,"Shared refresh helper beneath the shell-side `LoadScreen.win` family. The helper reads the active 13-byte page descriptor record at `0x006220a0 + page*0x0d` using current page id `[this+0x78]`, where the record now grounds as `{ page_kind_dword, title_string_id, back_link_page_dword, selected_company_header_flag_byte }`. It copies the descriptor kind into `[this+0x80]`, refreshes the page-strip and companion controls `0x3e80`, `0x3e81`, `0x3eee..0x3ef7`, `0x3ef8`, `0x3efb`, `0x3efc`, `0x3f0a`, `0x3f0b`, and `0x3f0e` through the generic shell control path at `0x00540120`, and applies page-specific row-band styling from current page-local row state `[this+0x7c]`, row count `[this+0x84]`, and stacked selection history `[this+0x0a0..0x118]`. The descriptor decode now also bounds control `0x3ef8` as the table-driven backlink affordance: page `0` keeps backlink `0`, page `1` backlinks to page `2`, page `8` backlinks to page `7`, page `0x0b` backlinks to page `0x0a`, and page `0x0d` backlinks to page `0x0c`. Current descriptor decode therefore keeps page `0` as kind `0`, title id `1200` `XXX`, backlink `0`, and header flag `0`; page `1` as company-overview kind `1` with backlink page `2`; page `8` as player-detail kind `3` with backlink page `7`; page `0x0b` as dormant train-detail title with backlink page `0x0a`; and page `0x0d` as dormant station-detail title with backlink page `0x0c`. Current grounded caller is `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10`, which uses this helper after storing a new page or subject selection.","objdump + descriptor-table decode + caller inspection + control-style correlation + backlink-control correlation"
0x004e2c10,3472,shell_load_screen_select_page_subject_and_refresh,shell,thiscall,inferred,objdump + caller inspection + state-flow correlation,4,"Shared page or subject selector beneath the shell-side `LoadScreen.win` family rooted at `0x006d10b0`. The helper accepts a page id, a page-local subselector, and an optional subject id; defaults of `-1` reuse the current fields at `[this+0x78]`, `[this+0x7c]`, and caller-selected company or profile state. It stores the chosen page in `[this+0x78]`, the subselector in `[this+0x7c]`, resets several page-local fields including `[this+0x84]` and the report-row latch at `[this+0x75c]`, updates the current company id `[this+0x88]` or profile id `[this+0x8c]` depending on page ownership, and then repaints the active page controls through `0x00563250` and `0x0053fe00`. Several page-specific branches also recompute bounded row-count state for the report lists on pages `0x0a`, `0x0c`, `0x0f`, and `0x0e`, including row styling over control band `0x3f48..`. The surrounding descriptor table now makes one narrower part of this family explicit too: when control `0x3ef8` is used as a backlink affordance, the selected page target comes from the current descriptor backlink dword rather than from a separate hardcoded detail-page branch. Current grounded callers include the broad `LoadScreen.win` dispatcher at `0x004e3a80`, the page-specific stock-holdings branch at `0x004e45d0`, and the selected-company or selected-profile step helpers at `0x004e3a00` plus `0x004e45d0`, so this now reads as the family-wide page or subject refresh owner rather than a CompanyDetail helper.","objdump + caller inspection + state-flow correlation + page-refresh correlation + backlink-target correlation"
0x004e3a00,112,shell_load_screen_step_selected_company_delta,shell,thiscall,inferred,objdump + caller inspection + company-collection correlation,4,"Steps the current `LoadScreen.win` selected company forward or backward across the active company roster. The helper wraps `selected_company + delta` through `company_collection_count_active_companies` at `0x00429a50`, resolves the replacement id through `company_collection_get_nth_active_company_id` at `0x00429990`, stores it into `[this+0x88]`, and then re-enters `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10` with the current page id in `[this+0x78]`. Current grounded callers are the `0x3efd/0x3efe` year or company navigation lane inside `LoadScreen.win`.","objdump + caller inspection + company-collection correlation + page-refresh correlation"
0x004e3a80,2900,shell_load_screen_window_handle_message,shell,thiscall,inferred,objdump + caller inspection + resource correlation,4,"Primary message dispatcher for the shell-side `LoadScreen.win` family rooted at singleton `0x006d10b0`. The handler switches on the incoming shell message id and owns page state `[this+0x78]`, page-local substate `[this+0x7c]`, page-kind byte `[this+0x80]`, current company `[this+0x88]`, current chairman profile `[this+0x8c]`, display year `[this+0x9c]`, and the page-local report-row latch `[this+0x118]`. Message `0xcb` on the page-strip controls routes through the page-kind dispatch rooted at `[this+0x80]`, where several cases re-enter `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10`, the company-step helper at `0x004e3a00`, or narrower page handlers such as `0x004e45d0`. One separate control band `0x3fd4..0x4073` selects report or list pages by updating `[this+0x75c]` and a boolean accent latch `[this+0x760]` before refreshing control `0x3fac`. The row band `0x3f48..0x3f51` is tighter now too: on page `7` it promotes one selected player row into page `8` through `shell_load_screen_select_page_subject_and_refresh`; on page `0x0a` it routes the chosen train through the shell detail-panel manager `0x004ddbd0` in mode `2` and then centers via `0x00437a90`; on page `0x0c` it routes the chosen station through the same manager in mode `5` and then centers via `0x00437a90`; and on page `0x0f` it routes the chosen industry or building through the same manager in mode `0x0a` before the same centering path. Current grounded ownership therefore includes the company or profile page routes for ids `0`, `2`, `7`, `8`, `9`, `0x0a`, `0x0c`, `0x0e`, and `0x0f`, while the title-table detail ids `0x0b` and `0x0d` still do not appear on the live row-click path or any recovered page-strip action lane. This makes `0x004e3a80` the real outer `LoadScreen.win` message owner above the sibling renderers at `0x004e5300`, `0x004e5a80`, and `0x004e5cf0` rather than a loose shared helper.","objdump + caller inspection + resource correlation + page-dispatch correlation + report-tab correlation + row-click-route correlation"
0x004e39e0,19,company_query_display_year_or_current_year,simulation,thiscall,inferred,objdump + caller inspection,4,"Tiny company-side helper that returns the optional display year cached at `[this+0x9c]` when nonzero, otherwise falls back to the current scenario year at `[0x006cec78+0x0d]`. Current grounded callers include the shared governance or economy shell formatter at `0x004e5cf0` and several nearby company-readout helpers in the same shell display family.","objdump + caller inspection + year-fallback correlation"
0x004e1f50,14,shell_has_live_load_screen_window,shell,cdecl,inferred,objdump + global-state inspection + frame-caller inspection,4,"Tiny shell-side presence probe for `LoadScreen.win`. The helper reads the live ledger singleton at `0x006d10a8`, returns `1` when that pointer is nonnull, and returns `0` otherwise. Current grounded callers include the frame-owned cadence at `simulation_frame_accumulate_and_step_world` `0x00439140`, where this branch now sits beside other shell-window service probes rather than any detached gameplay-only input owner.","objdump + global-state inspection + frame-caller inspection + LoadScreen singleton correlation"
0x004e1f60,11,shell_mark_load_screen_window_dirty,shell,cdecl,inferred,objdump + global-state inspection + frame-caller inspection,4,"Tiny shell-side dirty-flag setter paired with `shell_has_live_load_screen_window`. The helper stores `1` into `0x006d10a4`, which current nearby call patterns treat as the `LoadScreen.win` refresh or service request latch once the live ledger singleton at `0x006d10a8` exists. Current grounded caller is the post-step shell-window service ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + global-state inspection + frame-caller inspection + LoadScreen singleton correlation"
0x004e45d0,757,shell_load_screen_profile_stock_holdings_page_handle_message,shell,thiscall,inferred,objdump + RT3.lng strings + control-id inspection,4,"Page-specific message handler for the `LoadScreen.win` stock-holdings slice. The handler owns controls `0x3ef6..0x3f1d` while page-kind `[this+0x80]` selects this branch from the outer dispatcher at `0x004e3a80`. Current grounded state includes the selected profile id `[this+0x8c]`, selected company id `[this+0x88]`, optional display year `[this+0x9c]`, and a local row index `[this+0x118]`. Controls `0x3ef6` and `0x3ef7` step `[this+0x118]` backward or forward within a bounded `0..10` band before re-entering `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10`; `0x3ef8`, `0x3efb`, and `0x3efc` reuse that same helper to activate or step the current company row and page-local selector state. The later jump-table lane rooted at `0x3f07` also cycles the selected profile through the active-chairman collection at `0x006ceb9c` using `profile_collection_count_active_chairman_records` at `0x00477820`, `0x005184f0`, and `0x00518380`, then refreshes the current page through `0x004e2c10`. The same page branch adjusts the display year `[this+0x9c]` through the company-step helper `0x004e3a00` and the fallback reader `company_query_display_year_or_current_year` at `0x004e39e0`. Current grounded meaning is the stock-holdings page handler beneath `LoadScreen.win`, not the outer window dispatcher.","objdump + RT3.lng strings + control-id inspection + active-profile-cycle correlation + year-step correlation + row-selection correlation"
0x004e4b10,720,shell_load_screen_reset_runtime_state_and_seed_selection,shell,thiscall,inferred,objdump + caller inspection + state-flow correlation,3,"Lower reset or seed helper used by the `LoadScreen.win` opener before the visible ledger loop begins. The helper clears page state `[this+0x78]`, page-local substate `[this+0x7c]`, display year `[this+0x9c]`, selected company `[this+0x88]`, selected chairman profile `[this+0x8c]`, the page-kind cache `[this+0x80]`, the page-strip history stack rooted at `[this+0x0a0]`, and several presentation-side pointers including `[this+0x0b2d]` and `[this+0x0b31]`. It then seeds the selected company and chairman from the current scenario state through `0x004337a0` and `0x004337b0`, allocates the main text surface at `[this+0x0e55]`, builds several descriptor or name caches under `[this+0x0b25]`, `[this+0x0b29]`, `[this+0x0761..]`, `[this+0x0995..]`, and `[this+0x0b35..]`, binds three callback-style controls `0x3ee4`, `0x3ef4`, and `0x3ee5` through the generic shell control path at `0x00540120`, and stores the caller-selected display year into `[this+0x9c]`. Current grounded caller is the higher `LoadScreen` opener at `0x004e4ee0`, which later enters the page-selection refresh path. This now reads as the runtime reset and cache-seed helper beneath ledger opening rather than as a page renderer.","objdump + caller inspection + state-flow correlation + cache-seed correlation"
0x004e4ee0,406,shell_open_or_focus_load_screen_page,shell,thiscall,inferred,objdump + caller inspection + RT3.lng strings + launch-flow correlation,4,"Shared higher-level opener for the shell-side `LoadScreen.win` ledger family. The caller supplies one requested page id in `ECX`. When sandbox flag byte `[0x006cec7c+0x82]` is set the helper does not open the ledger; instead it raises a simple shell modal through `shell_open_custom_modal_dialog_with_callbacks` using localized id `3899` `The ledger is not available in sandbox mode.`. Outside sandbox it first checks for an existing live ledger runtime at `0x006d10a8`: when one is already open and the requested page id is nonzero it simply re-enters `shell_load_screen_select_page_subject_and_refresh` at `0x004e2c10` with that page; when the live runtime exists and the requested page id is zero it leaves the current page unchanged. When no live runtime exists it allocates the transient ledger object into `0x006d10a8`, resets and seeds it through `shell_load_screen_reset_runtime_state_and_seed_selection` at `0x004e4b10`, enters the visible shell modal loop through `0x00538f10`, and then tears the object back down while restoring the surrounding shell presentation state. Current grounded callers include the world-frame command path at `0x0043970f`, the grouped shell command stubs at `0x0044070e..0x0044086e` for pages `1`, `2`, `3`, `4`, `5`, `6`, `7`, `9`, `0x0a`, `0x0c`, `0x0e`, and `0x0f`, and the shell detail-side launcher at `0x004de82b`; no current recovered opener in that family requests page `0x0b` or `0x0d`. This now reads as the shared open-or-focus ledger-page owner rather than an unnamed helper beside the page family.","objdump + caller inspection + RT3.lng strings + launch-flow correlation + sandbox-guard correlation"
0x004e5130,186,shell_load_screen_render_company_stock_data_panel,shell,thiscall,inferred,objdump + RT3.lng strings + helper correlation,4,"Selected-company stock-data page renderer inside `LoadScreen.win`. The helper first validates the current company id at `[this+0x88]` through the live company collection at `0x0062be10`. When no company is active it emits localized id `1299` `No stocks to view at this time...` through the shell text presenter and restyles control `0x3efd` inactive. On the populated path it falls through into the shared stock-data builder at `0x004c0160` using the temporary holdings buffer at `[this+0x995]`, current row or subselector state at `[this+0x0b25]` and `[this+0x0b29]`, and the stock-data descriptor table rooted at `0x00622098`. That lower helper iterates the active chairman roster, ranks the largest positive holders for the selected company, and formats the `Largest Shareholders`, `Shares`, and `Per Share Data` family under localized ids `928..930`, with the first three per-share rows now bounded as `Share Price`, `Book Value Per Share`, and `Revenue Per Share` from stat-family slots `0x1c..0x1e`. Current grounded caller is page `7` of `shell_load_screen_render_active_page_panel` at `0x004ea060`, so current best page meaning is the `Stock Data` slice rather than another generic company list.","objdump + RT3.lng strings + helper correlation + shareholder-ranking correlation + stock-data fallback correlation + per-share-label correlation"
0x004e51ea,246,shell_load_screen_render_game_status_briefing_panel,shell,thiscall,inferred,objdump + RT3.lng strings + helper correlation,4,"Game-status-side briefing renderer inside `LoadScreen.win`. The helper uses page-local subselector `[this+0x7c]` to build one packed key and then queries the live scenario text store at `0x0062be18` through `0x00432f40` with kind `9`, writing the returned briefing text into a stack buffer before presenting it through the shell text surface rooted at `[this+0x0e55]`. It then appends the localized title or help pair `1772` `Briefing` and `1773` `View the scenario briefing.` through the smaller shell text-widget writer at `0x00563290`. Current grounded caller is page `3` of `shell_load_screen_render_active_page_panel` at `0x004ea060`, so current best meaning is the `Game Status` briefing page or panel rather than a company-owned report list.","objdump + RT3.lng strings + helper correlation + scenario-text-store correlation + briefing-string correlation"
0x004e5300,1899,shell_load_screen_render_player_detail_stock_holdings_panel,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection + page-title-table decode,4,"Renders the selected-profile stock-holdings summary panel inside the shell-side `LoadScreen.win` family. The helper resolves the selected profile id at `[this+0x8c]` through the live chairman collection at `0x006ceb9c`, builds the top summary rows under localized ids `1204` `Stock Value:`, `1205` `Total Assets:`, and `1206` `Stock Holdings:`, then walks the active company roster through `company_collection_count_active_companies` at `0x00429a50` plus `company_collection_get_nth_active_company_id` at `0x00429a90`. For each active company with positive profile holdings in `[profile + company_id*4 + 0x15d]`, it formats one company row under ids `1201` `Click to view details on %1.`, `1207` `%1 Shares`, and `1208` `%1 Value`; when no positive holdings survive the sweep it emits fallback id `1209` `None`. The panel also checks the scenario-selected chairman through `0x004348c0`, and only for that currently selected profile does it append localized id `3029` `Click to change player name and portrait.` together with the adjacent `1941` `Change` affordance through the shell text-widget writer at `0x00563290`. The `LoadScreen.win` page-title descriptor table rooted at `0x006220a4` now ties current grounded caller page `8` to localized title id `1192` `PLAYER DETAIL`, so this renderer is no longer just a generic holdings page.","objdump + RT3.lng strings + caller inspection + active-company-iteration correlation + holdings-slot correlation + selected-profile affordance correlation + page-title-table decode"
0x004e5a80,2368,shell_render_company_overview_panel_header_and_optional_change_affordance,shell,thiscall,inferred,objdump + RT3.lng strings + helper correlation,4,"Broader company-side overview-panel renderer above the shared text-formatting entry later mapped at `0x004e5cf0`. The wrapper first checks the selected company id at `[this+0x88]`. When that id is absent or no longer resolves through the live company collection at `0x0062be10`, it chooses one of three fallback text families `1210` `You haven't started a company yet...`, `3043` `You don't control a company at the moment...`, or `3888` `You don't control a company at the moment.` from current chairman/company state, paints that fallback into the current shell text surface, and styles controls `0x3f06` and `0x3f07` inactive through the generic control path at `0x00540120`. When a valid company is present, it styles those same controls active, falls through into the shared metric/governance body later labeled at `0x004e5cf0`, and on the narrower branch where the selected company matches the scenario-selected company at `0x00434870` it also appends localized id `3044` `Click to change company name and logo.` and publishes the adjacent `1941` `Change` affordance through the shell text-widget writer at `0x00563290`. Current evidence therefore keeps the name/logo affordance outside the normal `CompanyDetail.win` callback dispatcher and makes `0x004e5cf0` read more like the shared text-formatting subentry within this wider overview-panel renderer than like a full standalone owner by itself.","objdump + RT3.lng strings + helper correlation + fallback-text correlation + overview-wrapper correlation"
0x004e5cf0,1844,shell_format_company_governance_and_economy_status_panel,shell,cdecl,inferred,objdump + RT3.lng strings + helper correlation,4,"Shared shell text formatter for one company-side overview panel. The helper first renders a five-line company-metric preamble from the generic stat reader `0x0042a5d0` using display-year-aware company slots `0x2c`, `0x2b`, `0x17`, and `0x26` plus one derived ratio branch. That preamble is now grounded through localized ids `1211..1215`: `Revenues` from slot `0x2c`, `Profits` from slot `0x2b`, `Load miles hauled` from slot `0x17`, `Revenue per load mile` from the derived `slot 0x2c / slot 0x17` branch with a safe `1.0` fallback when the load-mile value is nonpositive, and `Average speed` from slot `0x26` rendered through localized value formatter `1216` `%1 m.p.h.`. Its governance branch is now tighter too: when the selected company has no linked chairman it emits localized id `3045` `This company is controlled by the shareholder's committee...`; when the company is wholly owned it emits `3046` `You have complete ownership...` for the scenario-selected chairman or `3047` `This company is wholly owned by %1` for another linked chairman; otherwise it emits the investor-attitude lines `3048` `Investors are %1 your performance.` or `3049` `Investors are %1 the chairman's performance.` using the adjective table at `0x00622170`. The salary branch is bounded now too: it computes a signed salary delta from the company fields at `[company+0x14f]` and `[company+0x0d59]`, formats the absolute change and current salary value through the numeric helpers at `0x0051bfe0`, and then chooses `3050..3052` when the linked chairman is the scenario-selected chairman or `3053..3055` for another linked chairman depending on whether the delta is negative, positive, or zero. The bonus branch is narrower as well: only when the display year from `company_query_display_year_or_current_year` `0x004e39e0` matches the recorded bonus year at `[company+0x34f]` does it append `3056` `You have been awarded a bonus of %1.` or `3057` `The chairman has been awarded a bonus of %1.` using the bonus amount at `[company+0x353]`. The same formatter then appends the localized economy tail caption `1218` `Economy status - %1.` from the current scenario economy state at `[0x006cec78+0x2d]` and continues by staging the adjacent selected-company report or list help-title pairs `1219/1220` `Income Statement`, `1221/1222` `Balance Sheet`, `1223/1224` `Haulage Report`, `1225/1226` `Stock Report`, `1227/1228` `Train List`, `1229/1230` `Station List`, `1231/1232` `Industry List`, and `1233/1234` `Cargo List`. Current evidence still does not recover separate `CompanyDetail.win` action controls for those report or list labels under `shell_company_detail_window_handle_message` at `0x004c56a0`, so this strip currently reads as staged overview text or help content rather than as a closed dispatcher-owned launcher family. It uses the linked-chairman accessor `0x00426ef0`, the company-ownership test at `0x004768c0`, the display-year bucket helper `0x004240c0`, and the economy-status table at `0x00620cc0`. Current direct shell binding is still open, but the section-0 refresh for `CompanyDetail.win` now routes control `0x947f` through a dedicated stack-built dynamic text path, so this remains the strongest current shared formatter family aligned with that overview widget.","objdump + RT3.lng strings + helper correlation + governance-status string correlation + CompanyDetail overview correlation + metric-preamble correlation + report-launch-strip correlation + ownership-branch correlation + salary-bonus branch correlation + negative-dispatch-boundary correlation + preamble-label-table correlation"
0x004e68e0,1521,shell_load_screen_render_company_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection + page-title-table decode,4,"Renders the active-company comparison page inside `LoadScreen.win`. The helper first rejects the empty-company case with one fallback text branch rooted at localized ids `1210`, `3043`, or `3888`, then clears the shared row buffer at `[this+0x11c]`, stages the visible company-comparison column family `1235..1242`, and iterates the active company roster through `company_collection_count_active_companies` at `0x00429a50` plus `company_collection_get_nth_active_company_id` at `0x00429a90`. The caller-supplied page-local selector chooses which company metric to rank on: revenue through slot `0x2c`, profit through slot `0x2b`, cash through slot `0x0d`, or track mileage through slot `0x25`, all read through the generic company stat reader at `0x0042a5d0`. The emitted row lane also stages the adjacent company-report affordances `1243` `Click to view %1's income statement.`, `1244` `Click to view %1's balance sheet.`, and `1245` `Click to view %1's haulage reports.` on top of the ranked company rows, while applying the stronger highlight path when the row company matches the scenario-selected chairman's current company. The `LoadScreen.win` page-title descriptor table rooted at `0x006220a4` now ties current grounded caller page `2` to localized title id `1186` `COMPANY LIST`, so this renderer is now bounded as the company-list page rather than only a generic financial ranking helper.","objdump + RT3.lng strings + caller inspection + active-company-iteration correlation + company-stat-slot correlation + report-affordance correlation + page-title-table decode"
0x004e6ef0,1879,shell_load_screen_render_player_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection + page-title-table decode,4,"Renders the active-chairman comparison page inside `LoadScreen.win`. The helper clears the shared row buffer at `[this+0x11c]`, stages the visible chairman-comparison headers from the localized family `1237`, `1241`, `1246`, `1247`, `1248`, `1249`, and `1250`, then iterates the active chairman profile collection at `0x006ceb9c` through `profile_collection_count_active_chairman_records` and the `nth active` accessors rooted at `0x00477820`, `0x00477860`, and `0x004778c0`. The caller-supplied selector chooses which chairman-side metric drives the ranking: cash or one direct profile-held total, stock value, one broader total or net-worth lane, and a purchasing-power lane read through the profile helpers at `0x00476320`, `0x00476780`, `0x00476bb0`, and `0x004778c0`. The row builder also uses the profile-side name and portrait-family tables around `0x00622192..0x006221a4`, with special-cased current-player text on the zero-th row and the stronger highlight path when one ranked profile matches the scenario-selected chairman. The `LoadScreen.win` page-title descriptor table rooted at `0x006220a4` now ties current grounded caller page `7` to localized title id `1191` `PLAYER LIST`, so this renderer is now bounded as the player-list page rather than only a chairman-wealth ranking helper.","objdump + RT3.lng strings + caller inspection + active-profile-iteration correlation + profile-metric correlation + wealth-ranking-string correlation + page-title-table decode"
0x004e7670,3033,shell_load_screen_render_company_train_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Renders the company-owned train list page inside `LoadScreen.win`. The helper first rejects missing selected-company state through localized id `1210` and then rejects companies with no trains through id `1251` `This company does not have any trains.` after querying the current company through the live company collection at `0x0062be10` and the train-count helper at `0x004264c0`. On the populated path it clears the `0x190`-dword row buffer at `[this+0x11c]`, reads the optional display year through `company_query_display_year_or_current_year` at `0x004e39e0`, stages the visible column headers and sort-help family `1235..1242`, and then iterates the selected company's live train roster through the company-side train accessors around `0x004264c0`, `0x00426520`, `0x004a7270`, `0x004a77b0`, and `0x0041adb0`. The emitted row family matches the player-facing train-list strip: revenue, profit, cash, track mileage, engine type, age, oil, water, sand, speed, and profit rows from `1252..1266`, plus the per-row camera-centering affordance `1267` `Click to center the camera on %1`. Current grounded caller is the wider `LoadScreen.win` render family around `0x004ea499`, which keeps this as one company-list page sibling beside the holdings, building, station, and cargo pages rather than a `CompanyDetail.win` subpanel.","objdump + RT3.lng strings + caller inspection + company-train-roster correlation + train-list-string correlation"
0x004e8270,2336,shell_load_screen_render_company_industry_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection + page-title-table decode,4,"Renders the selected-company industry list page inside `LoadScreen.win`. The helper rejects missing selected-company state through localized id `1210` and rejects companies with no owned buildings through id `1268` `This company does not own any buildings.` after resolving the current company through `0x0062be10` and the building-count helper at `0x004266c0`. On the populated path it clears the shared row buffer at `[this+0x11c]`, stages the visible header and sort-help family `1269..1278`, and then walks the selected company's owned placed-structure set through the building-side accessors around `0x004266c0`, `0x004267f0`, `0x0062b26c`, `0x0047de00`, `0x0040cac0`, `0x0040ca70`, `0x0040ca80`, and `0x0040d360`. The rendered rows align with the player-facing industry list strip: industry or building type, year built, profitability, loads consumed, loads generated, and the surrounding sort hints. The `LoadScreen.win` page-title descriptor table rooted at `0x006220a4` now ties current grounded caller page `15` to localized title id `1199` `INDUSTRY LIST`, which makes this the industry-list page rather than a generic building-list sibling.","objdump + RT3.lng strings + caller inspection + company-building iteration correlation + building-list-string correlation + page-title-table decode"
0x004e8bb0,2198,shell_load_screen_render_company_station_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Renders the company-owned station list page inside `LoadScreen.win`. The helper rejects missing selected-company state through localized id `1210` and rejects companies with no stations through id `1279` `This company does not have any stations.` after resolving the selected company and probing the company-owned station count through `0x00426590`. On the populated path it clears the shared row buffer at `[this+0x11c]`, stages the station-list header and sort-help family `1280..1288`, and then walks the selected company's owned station or placed-structure set through the station-side accessors around `0x00426620`, `0x006cec20`, `0x0047d7d0`, `0x0047d7c0`, `0x0047d7f0`, `0x0047d7e0`, and `0x0047de00`. The emitted rows match the visible station-list strip: cargo out, cargo in, revenue out, revenue in, and the adjacent sort affordances. Current grounded caller is the wider `LoadScreen.win` render family around `0x004ea499`, which keeps this as the company-station page sibling beside the train, building, and cargo pages.","objdump + RT3.lng strings + caller inspection + company-station iteration correlation + station-list-string correlation"
0x004e9460,1694,shell_load_screen_render_map_cargo_list_panel,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Renders the map-wide cargo list page inside `LoadScreen.win`. The helper clears the shared row buffer at `[this+0x11c]`, stages the cargo-list header and sort-help family `1289..1298`, and then iterates the live structure-candidate collection at `0x0062ba8c` rather than one selected company roster. It filters candidates through `structure_candidate_is_enabled_for_current_year` at `0x0041e220`, then derives one sortable per-cargo metric from `structure_candidate_query_route_style_or_local_availability_metric` at `0x0041e650` plus the direct candidate fields at `+0x5e`, `+0x62`, `+0x6a`, and route-style flag `+0x46`. That keeps the same candidate split visible on this page too: route-style rows use the normalized route-side availability metric from `0x0041e650`, while ordinary rows can still surface the direct local float at `[candidate+0x5a]`. The resulting rows align with the player-facing cargo page: cargo name, number of loads, new loads, loads used, price, and the surrounding sort hints. Current grounded caller is the wider `LoadScreen.win` render family around `0x004ea499`, which keeps this as the cargo-list page sibling beside the selected-profile holdings page and the selected-company train, building, and station lists.","objdump + RT3.lng strings + caller inspection + cargo-candidate iteration correlation + cargo-list-string correlation + route-style-metric correlation"
0x004e9b20,1330,shell_load_screen_render_company_report_history_panel,shell,cdecl,inferred,objdump + caller inspection + page-jump-table correlation + RT3.lng correlation,4,"Shared multi-year company report-table renderer inside `LoadScreen.win`. The helper validates the selected company through the live company collection at `0x0062be10`, derives a bounded display-year window from current display year `[this+0x9c]` and company founding year `[company+0x157]`, clears and repopulates the shared row buffer at `[this+0x11c]`, and then renders one of three page-local report modes selected by its caller-supplied mode argument. The descriptor table rooted at `0x00622192..0x006221a4` now grounds those modes as page `4` `Income Statement`, page `5` `Balance Sheet`, and page `6` `Haulage Report`: mode `0` walks the revenue and expense family `1301..1315`, mode `1` walks the asset and liability family `2816`, `1317..1322`, and mode `2` walks the haulage and operating-stat family `1323..1335`. Ordinary rows read yearly values through `company_read_year_or_control_transfer_metric_value` at `0x0042a5d0`. The two special row families are tighter now too: they feed the `%1/%2` rate inserts for localized strings `2815` and `2816` through `company_compute_negative_cash_balance_interest_rate` at `0x00425880` and `company_compute_positive_cash_balance_interest_rate` at `0x004258c0`. Current grounded callers are the page `4`, `5`, and `6` arms of `shell_load_screen_render_active_page_panel` at `0x004ea060`, so ownership and page semantics are now both bounded.","objdump + caller inspection + page-jump-table correlation + selected-company validation correlation + report-table mode correlation + RT3.lng row-family correlation + descriptor-table decode + special-rate-row correlation"
0x004ea060,1403,shell_load_screen_render_active_page_panel,shell,thiscall,inferred,objdump + caller inspection + page-jump-table correlation + page-title-table decode,4,"Family-wide render dispatcher beneath the shell-side `LoadScreen.win` singleton `0x006d10b0`. The helper first formats the active page heading from the 13-byte page descriptor table rooted at `0x006220a0` using current page id `[this+0x78]`, specifically the title-string dword at record offset `+0x04`. It then lays out the common panel containers through the shell control family rooted at `[this+0x0b31]`, and conditionally exposes the selected-company header affordance on control `0x3f13` when the descriptor header-flag byte at record offset `+0x0c` is set and the current company `[this+0x88]` still resolves through the live company collection at `0x0062be10`. It then switches on the same page id `[this+0x78]` and dispatches into the active page body. Current grounded routes include page `0` through the localized fallback `1203` `Unable to display page`, page `1` through the broader company-overview wrapper around `0x004e5a70/0x004e5a80`, page `2` through `shell_load_screen_render_company_list_panel` at `0x004e68e0`, page `3` through `shell_load_screen_render_company_report_history_panel` at `0x004e9b20` in `Income Statement` mode, page `4` through the same renderer in `Balance Sheet` mode, page `5` through the same renderer in `Haulage Report` mode, page `6` through `shell_load_screen_render_company_stock_data_panel` at `0x004e5130`, page `7` through `shell_load_screen_render_player_list_panel` at `0x004e6ef0`, page `8` through `shell_load_screen_render_player_detail_stock_holdings_panel` at `0x004e5300`, page `9` through `shell_load_screen_render_game_status_briefing_panel` at `0x004e51ea`, page `0x0a` through `shell_load_screen_render_company_train_list_panel` at `0x004e7670`, page `0x0b` through the same localized `1203` fallback, page `0x0c` through `shell_load_screen_render_company_station_list_panel` at `0x004e8bb0`, page `0x0d` through the same localized `1203` fallback, page `0x0e` through `shell_load_screen_render_map_cargo_list_panel` at `0x004e9460`, and page `0x0f` through `shell_load_screen_render_company_industry_list_panel` at `0x004e8270`. That now makes the rendered title order concrete too: `XXX`, `COMPANY OVERVIEW`, `COMPANY LIST`, `INCOME STATEMENT`, `BALANCE SHEET`, `HAULAGE REPORT`, `STOCK DATA`, `PLAYER LIST`, `PLAYER DETAIL`, `GAME STATUS`, `TRAIN LIST`, `TRAIN DETAIL`, `STATION LIST`, `STATION DETAIL`, `CARGO LIST`, and `INDUSTRY LIST`. Current grounded click flow is narrower than that title table: list-page row activation now re-enters page `8` for player detail, but train, station, and industry rows jump out through the shell detail-panel manager instead of switching to page `0x0b` or `0x0d`; no current recovered opener targets `0x0b` or `0x0d`; and no current post-constructor selector path has been recovered for page `0`, whose descriptor remains kind `0`, title `1200` `XXX`, backlink `0`, and header flag `0`. The outer ownership is now clear: this is the shared active-page body renderer above the individual `LoadScreen.win` pages rather than just one more page-local helper.","objdump + caller inspection + page-jump-table correlation + page-table correlation + selected-company header correlation + page-mode decode + page-title-table decode + row-click-route correlation"
0x004ea620,219,shell_load_screen_window_construct,shell,thiscall,inferred,objdump + resource strings + constructor inspection,4,"Constructs the shell-side `LoadScreen.win` family later stored at singleton `0x006d10b0`. The constructor installs vtable `0x005d1194`, binds the random background image `LoadScreen%d.imb` through the format string at `0x005d1180`, binds `LoadScreen.win` through `0x0053fa50`, initializes current page `[this+0x78]` to `0`, stores the singleton at `0x006d10b0`, and seeds the first three visible page-strip controls starting at `0x84d3` through the generic control path at `0x00540120`. It also randomizes one background index into shell state byte `[0x006cec74+0x2c7]` while avoiding the immediately previous choice. Current neighboring helpers at `0x004ea720` and `0x004ea730` provide the live-singleton query and destructor for the same family, which makes this the broad owner-side constructor above the page dispatcher at `0x004e3a80` and the sibling renderers at `0x004e5300`, `0x004e5a80`, and `0x004e5cf0`.","objdump + resource strings + constructor inspection + singleton-state correlation + page-strip correlation"
0x004eb890,381,shell_present_merger_vote_outcome_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Single-player merger-vote outcome presenter used by the merger result path. The helper resolves the two merger companies from `0x006d10dc` and `0x006d10de`, chooses localized title id `729` `Merger Succeeds!!!` or `730` `Merger Fails!!!`, formats the vote tally labels `731` `Votes In Favor:` and `732` `Votes Against:`, and renders the final result dialog through the shell presentation callback rooted at `0x006d111c`. Current grounded caller is `shell_resolve_merger_vote_and_commit_outcome` at `0x004ebd10` on the single-player branch.","objdump + RT3.lng strings + caller inspection + merger-result dialog correlation"
0x004ebd10,1202,shell_resolve_merger_vote_and_commit_outcome,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Resolves the single merger vote, commits the outcome, and records cooldown state. The helper walks the active chairman profile collection at `0x006ceb9c`, computes weighted votes for and against the proposed merger between companies `0x006d10dc` and `0x006d10de`, accumulates the affirmative share count into `0x006d110c`, compares that total against half the target-company value, and then splits by single-player versus multiplayer. In single-player it presents the result through `shell_present_merger_vote_outcome_dialog` at `0x004eb890`; in multiplayer it formats localized id `3059` `Merger between '%1' and '%2' has %3.` with result strings `3060` or `3061` and routes the payload through the shell transport. On success it commits the merger through `0x00427e20`; on failure it stamps the current year into `[company+0x15f]` as the grounded merger-cooldown field.","objdump + RT3.lng strings + caller inspection + merger-vote resolution correlation"
0x004ec640,732,shell_company_detail_attempt_merger_flow,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` merger-attempt flow. The helper rejects empty worlds through localized id `727`, rejects recent failed merger cooldown cases through id `728`, and then opens the merger offer or vote dialog family rooted at the local globals `0x006d10cc..0x006d1120`. The grounded single-player path checks the proposed premium against company cash through localized id `3889`, can open a premium-confirmation prompt through id `4067`, and on acceptance commits through the company merger helper at `0x00427e20` or the broader vote-resolution path at `0x004ebd10`. When the multiplayer-side shell owner is active it packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8` instead of mutating company state immediately. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + merger-dialog correlation"
0x00504770,786,shell_station_detail_present_to_from_haul_stats_popup,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats and presents the `StationDetail.win` hauled-traffic popup for one of the two `To` or `From` summary widgets. The helper validates the current station from detail-manager state `0x006d0818+0x90`, resolves the selected station record through `0x006cec20`, and then chooses the localized direction strings `676` `...hauled TO this station.` or `679` `...hauled FROM this station.` plus the singular or plural `load` and `loads` labels `677/678` based on the triggering control id `0xb3f6` versus `0xb3f7`. It formats the current-year and lifetime load and value totals through the station haul-stat helpers at `0x0047d7e0` or `0x0047d7f0`, then presents the final popup text through the shell message-box path at `0x00538c70`. Current grounded owner is the neighboring `To` or `From` summary-widget builder at `0x00505150`.","objdump + RT3.lng strings + caller inspection + hauled-traffic popup correlation"
0x00504a90,70,shell_station_detail_clear_active_candidate_service_preview,shell,thiscall,inferred,objdump + caller inspection + state correlation,4,"Clears the active candidate-service preview owned by `StationDetail.win`. The helper first resets the shared `(placed-structure id, candidate id)` pair at `0x005ee4fc` and `0x005ee500` through `0x0043f610`, then tears down the local station-detail preview latch at `[this+0x7c]` and decrements the sibling global refcount `0x0062be84` when that preview was armed. When the live world owner at `0x0062c120` is in the matching preview-capable mode gate rooted at `[+0x2171]` and `[+0x2175]`, it tails into the neighboring world-side clear path at `0x00452d30`. Current grounded callers are the station-detail selection reset branches around `0x00504bca`, `0x00504bda`, and the later cleanup family at `0x00505bff` and `0x00505c0a`.","objdump + caller inspection + world-preview correlation"
0x00504ae0,174,shell_station_detail_set_active_candidate_service_preview,shell,thiscall,inferred,objdump + caller inspection + state correlation,4,"Arms the active candidate-service preview for `StationDetail.win`. The helper begins by clearing the old preview through `shell_station_detail_clear_active_candidate_service_preview` at `0x00504a90`, then when the supplied candidate id is nonzero and the live world owner at `0x0062c120` is in the matching preview-capable mode gate it routes the current detail-panel station id through the world-side preview family at `0x00452f60`, `0x00452d80`, `0x00452db0`, and `0x00452ca0`. On success it latches the preview-active bit at `[this+0x7c]`, increments the sibling global refcount `0x0062be84`, and stores the active `(station id, candidate id)` pair into `0x005ee4fc` and `0x005ee500` through `0x0043f620`. This is the shell-side owner that feeds the broader world scanner rooted at `0x0043f640` with the currently inspected station-detail candidate pair.","objdump + caller inspection + world-preview correlation + global-pair correlation"
0x00504ba0,796,shell_station_detail_update_candidate_service_entry,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Updates one candidate-service entry inside `StationDetail.win`. With zero in the first stack slot the helper either re-arms the globally remembered candidate through `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` or clears the current preview through `shell_station_detail_clear_active_candidate_service_preview` at `0x00504a90`. On the ordinary nonzero path it validates the current station from detail-manager state `0x006d0818+0x90`, rejects disallowed modifier combinations from `0x006d4018+0xa8c`, resolves the candidate from `0x0062ba8c`, and then either updates the hover anchor at `0x006d16fc/0x006d1700` or re-enters `placed_structure_query_candidate_local_service_metrics` at `0x0047e240` to format the visible entry text. Current grounded text lanes use localized ids `681`, `682`, and `2813` for the loads-available, current-price, and average-profit explanation strings, plus ids `688` and `689` for the nearby-structure jump text. This is the clearest shell-side owner above the active candidate-service preview pair and the station-detail candidate service readout.","objdump + RT3.lng strings + caller inspection + service-preview correlation"
0x00504bea,722,shell_station_detail_format_candidate_local_service_summary,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the candidate-local-service summary lane inside `StationDetail.win`. The helper validates the current station id from the detail manager through collection `0x006cec20`, resolves the candidate record through `0x0062ba8c`, and when the ordinary station-detail path is active it re-enters `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` before querying `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`. It then formats the visible candidate text using localized ids `681` `%1: Loads available: %2`, `682` `Current Price: %1`, and the explanatory text `2813` `Prices shown are the average profit per load for delivering %1 from %2 to that station...`; neighboring branches also use localized ids `688` and `689` for the nearby-structure jump affordance. This now looks like the shell-side candidate-service readout above the same local service metric lane used by the station freight and express summaries.","objdump + RT3.lng strings + caller inspection + service-query correlation"
0x00505150,796,shell_station_detail_build_to_from_haul_summary_widget,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Builds one of the two `To` or `From` hauled-traffic summary widgets inside `StationDetail.win`. The helper chooses the localized heading `686` `To` or `687` `From` from its first argument, paints a bounded 10-step summary strip from the supplied float lane and the paired station haul-stat queries at `0x0047d7e0` or `0x0047d7f0`, and formats the one-line direction-specific labels and totals through the same `load` or `loads` family later used by the popup callback. On first build it also registers the matching control id `0xb3f6` or `0xb3f7` through callback `shell_station_detail_present_to_from_haul_stats_popup` at `0x00504770`, so the same widget owns both the visible `To` or `From` strip and the click-through stats popup. Current grounded caller is the larger station-detail refresh pass at `0x00506610`, which constructs the `To` and `From` widgets back to back.","objdump + RT3.lng strings + caller inspection + control registration correlation"
0x00505470,738,shell_station_detail_refresh_nearby_structure_jump_rows,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,3,"Refreshes the five-row nearby-structure jump lane inside `StationDetail.win`. The helper validates the current station, iterates the fixed five nearby-structure categories, counts matching nearby entries through `0x0047dc90`, and formats the player-facing jump text from localized ids `688` `This station has %1 %2(s) nearby...` and `689` `first ` together with the per-category name table rooted at `0x00620dc4`. It then builds the paired per-row controls and descriptive text blocks under the `0xb400..0xb413` control band that the later station-detail message handler uses to center the map or jump into the matching nearby structure detail. This currently looks like the shell-side owner of the nearby-structure lane that sits beside the later candidate-service preview rows.","objdump + RT3.lng strings + caller inspection + nearby-structure correlation"
0x00505760,1159,shell_station_detail_refresh_candidate_service_rows,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Refreshes the visible candidate-service row lane inside `StationDetail.win`. The helper counts currently active candidate-service entries through `placed_structure_count_candidates_with_local_service_metrics` at `0x0047e330`, resolves each visible row candidate through the neighboring ordinal helper at `0x0047e620`, and then colors and formats the row from the candidate-local-service metrics, the candidate display name, and the same localized strings `681`, `682`, and `2813` used by `shell_station_detail_update_candidate_service_entry`. It registers the per-row click path through callback `shell_station_detail_update_candidate_service_entry` at `0x00504ba0`, keeps the selected and hovered candidate ids in the globals `0x006d16f8` and `0x006d16f4`, and toggles the current preview highlight as rows are rebuilt. Current grounded caller is the broader station-detail refresh pass at `0x00506610`.","objdump + RT3.lng strings + caller inspection + candidate-service row correlation"
0x0050c500,426,shell_present_chairmanship_takeover_vote_outcome_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Single-player chairmanship-takeover outcome presenter used by the special election path. The helper resolves the target company from `0x006d1a0c`, chooses localized title id `626` `New Chairman Takes Over!!!` or `627` `Chairmanship Takeover Fails!!!`, formats the tally labels `628` `Votes in favor` and `629` `Votes Against`, and renders the final result dialog through the shell presentation callback rooted at `0x006d1a34`. Current grounded caller is `shell_resolve_chairmanship_takeover_vote_and_commit_outcome` at `0x0050c940` on the single-player branch.","objdump + RT3.lng strings + caller inspection + takeover-result dialog correlation"
0x0050c940,880,shell_resolve_chairmanship_takeover_vote_and_commit_outcome,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Resolves the special chairman's election, commits the outcome, and records cooldown state. The helper walks the active chairman profile collection at `0x006ceb9c`, computes weighted votes for and against the takeover of company `0x006d1a0c` by chairman profile `0x006d1a0e`, accumulates the affirmative share count into `0x006d1a30`, compares that total against half the target-company value, and then splits by single-player versus multiplayer. In single-player it presents the result through `shell_present_chairmanship_takeover_vote_outcome_dialog` at `0x0050c500`; in multiplayer it formats localized id `3082` `Takeover attempt of '%1' by '%2' has %3.` with result strings `3060` or `3061` and routes the payload through the shell transport. On success it transfers chairmanship through `0x00428a30`; on failure it stamps the current year into `[company+0x289]` as the grounded takeover-cooldown field.","objdump + RT3.lng strings + caller inspection + takeover-vote resolution correlation"
0x0050ccc0,709,shell_company_detail_attempt_chairmanship_takeover_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` chairmanship-takeover flow against the currently selected company. The helper reads the caller's current share ownership in the target company, rejects insufficient holdings through localized id `623`, rejects recent failed takeover cooldown cases through id `624`, and otherwise opens the special chairman's election confirmation under id `625`. The grounded single-player path seeds the local takeover-election state at `0x006d1a08..0x006d1a38` and launches the follow-on election helper at `0x0050c940`; when the multiplayer-side shell owner is active it instead packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + takeover-election correlation"
0x004c6b40,105,shell_company_list_format_company_or_start_row,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats one row in the shell-side company list. When the incoming row id is the synthetic sentinel `0x7fff`, the helper formats localized id `266` `<<Start New Company>>` and stores it through the current row widget at `0x006cfe78`. Otherwise it resolves the live company id through the company collection at `0x0062be10` and delegates the richer row text to `0x004bfb30`. Current grounded caller is `shell_company_list_window_refresh_rows` at `0x004c6c30`.","objdump + RT3.lng strings + caller inspection"
0x004c6bb0,123,shell_company_list_activate_or_shift_center_company,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Handles activation on one live company row in the shell company list. The helper first verifies that the company id exists in the live company collection at `0x0062be10`, then notifies the shell detail-panel family at `0x006d0818`. If Shift is held through shell-input bits `[0x006d4018+0xa8c]&0x3` and the row is not the currently selected chairman company, it resolves the company's primary station or anchor through `0x00427260`, translates that station into a world-view target through `0x0047de00`, and centers the active world view through `0x0043c9a0`. That matches localized help string `2992` `Shift-Click to center on this company's primary station.`","objdump + RT3.lng strings + caller inspection + shell-input correlation"
0x004c6c30,765,shell_company_list_window_refresh_rows,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Rebuilds the shell company-list window rows. The helper clears the two mirrored list controls under ids `0x2ee1` and `0x2ee2`, iterates the live company collection at `0x0062be10`, and formats each company row with one of three localized status strings: id `267` `You are the chairman of the %1!` for the currently selected chairman company from `0x00434870`, id `268` `The %1 has no chairman at the moment.` when `[company+0x3b]` is zero, or id `269` `%1 is the chairman of the %2.` plus suffix id `270` `Double-click for details.` when another chairman profile is attached. When the row also has a primary station, the helper appends localized help id `2992` `Shift-Click to center on this company's primary station.` After the live-company rows are rebuilt, it conditionally appends the synthetic row id `0x7fff` through `shell_company_list_format_company_or_start_row` so `<<Start New Company>>` appears as a separate affordance rather than as part of the seeded trio itself. It also refreshes the currently selected list index at `[this+0x78]`.","objdump + RT3.lng strings + caller inspection + company-list iteration"
0x004c6f30,704,shell_company_list_window_handle_message,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Message dispatcher for the shell company-list window. Selection changes on controls `0x2ee1` and `0x2ee2` toggle the mirrored list selection state and the local start-company affordance latch at `0x006cfe7c`. Activating one live company row routes through `shell_company_list_activate_or_shift_center_company` at `0x004c6bb0` or opens its detail path through the shell detail-panel manager `0x004ddbd0`. Activating the synthetic row id `0x7fff` instead checks whether the current chairman can start a new company, optionally shows localized confirmation id `272` `You're currently chairman of the %1... Proceed?`, and then opens the dedicated `Start New Company...` dialog through `start_new_company_dialog_open` at `0x0047d080`. When that dialog closes while the company-list window remains active, the handler rebuilds the rows through `shell_company_list_window_refresh_rows` at `0x004c6c30`.","objdump + RT3.lng strings + caller inspection + dialog correlation"
0x004c7200,212,shell_company_list_window_construct,shell,thiscall,inferred,objdump + caller inspection + strings,4,"Constructs the shell company-list window rooted at globals `0x006cfe70..0x006cfe7c`. The helper allocates two mirrored list widgets under ids `0x2ee1` and `0x2ee2`, attaches the row formatter `shell_company_list_format_company_or_start_row` at `0x004c6b40`, the live-row activation handler `shell_company_list_activate_or_shift_center_company` at `0x004c6bb0`, publishes the current selected-index storage at `[this+0x78]`, and then calls `shell_company_list_window_refresh_rows` at `0x004c6c30`. It also toggles the start-company affordance controls `0x2ee3` and `0x2ee4` from the global latch `0x006cfe7c`, which matches the handler-side selection logic for the synthetic `<<Start New Company>>` row.","objdump + caller inspection + control wiring"
0x005068c0,443,shell_station_detail_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `StationDetail.win` panel owned by detail-manager mode `8`. The constructor installs the singleton at `0x006d16d8`, binds `StationDetail.imb` and `StationDetail.win` through `0x0053d110` and `0x0053fa50`, seeds the paired action controls `0xb3b7` and `0xb3b8` through callback `0x00506610`, toggles the adjacent navigation controls `0xb3b3` and `0xb3b4`, and conditionally refreshes the gated action control `0xb3f8` through `0x005044b0`. This corrects the older company-browser reading: current grounded resource names and control wiring put mode `8` on a station-detail lane rather than on a company-detail browser.","objdump + strings + detail-manager correlation + caller inspection"
0x00506be0,360,shell_station_detail_format_freight_and_express_summary,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Formats the visible freight and express summary lines on the shell-side `StationDetail.win` panel. The helper resolves the selected placed-structure record, builds the weighted freight total through the neighboring cargo-summary helper at `0x005519f0`, queries the cached express-side service totals through `placed_structure_query_cached_express_service_class_score` at `0x0047e390` for class ids `0x0385` and `0x0386`, and then writes the localized lines `Freight: %1` and `Express: %1` through string ids `239` and `240`. This is the first grounded shell-detail consumer of the local service bundle rebuilt beneath `0x0042d580`.","objdump + strings + caller inspection + service-query correlation"
0x00506d50,252,shell_station_list_handle_center_or_rename_action,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Handles the station-list row modifier actions after the active station row is resolved from collection `0x006cec20`. The helper reads the packed shell input modifier bits from `0x006d4018+0xa8c`; with Shift it recenters the world view on the selected station through `0x0047de00` and `0x00433900`, and with Control it opens the station rename prompt through localized id `3732` `Enter station name:`. This helper is the modifier-aware side-action lane paired with the visible freight or express station-row summaries.","objdump + strings + caller inspection + input-state correlation"
0x00506e50,221,shell_station_list_format_freight_and_express_availability_summary,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Formats the visible `StationList.win` row summary for one selected station. The helper resolves the placed-structure record from collection `0x006cec20`, queries the cached express-side service totals through `placed_structure_query_cached_express_service_class_score` at `0x0047e390` for class ids `0x0385` and `0x0386`, and then emits the localized composite summary `3890` `%1 has %2 freight loads and %3 express loads available for hauling...`. This is the first grounded shell-list consumer of the same service-score lane used by `shell_station_detail_format_freight_and_express_summary`.","objdump + strings + caller inspection + service-query correlation"
0x005071e0,494,shell_station_list_window_handle_message,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Primary message dispatcher for the shell-side `StationList.win` family rooted at vtable `0x005d177c`. The helper owns the paired station-row controls `0x61a9` and `0x61aa`, the side selector controls `0x61ab` and `0x61ac`, and the two status labels `0x61af` and `0x61b0`. It periodically updates the currently highlighted station id through `0x00622ae4`, mirrors row selections into `0x006cec78+0x4cba`, and on activation resolves the selected station object through collection `0x006cec20`, optionally recenters the world view through `0x00433900`, then re-enters the shell detail-panel manager with mode `5` and that same station id. The `0x61ab` and `0x61ac` controls toggle the active side bit at `0x006d1710` and reopen the station-pick helper rooted at `0x00507620`.","objdump + strings + detail-manager correlation + UI dispatch inspection"
0x005074c0,235,shell_station_list_window_construct,shell,thiscall,inferred,objdump + strings + detail-manager correlation,4,"Constructs the shell-side `StationList.win` panel later published at `0x006d1708`. The constructor binds the paired station-row controls `0x61a9` and `0x61aa`, seeds the side-selector controls `0x61ab` and `0x61ac` from the current active-side bit at `0x006d1710`, stores the selected-entry latch at `[this+0x78]`, and then calls the row-refresh helper at `0x00506f30`. Current grounded evidence places this panel on a station-oriented shell lane below the company roster rather than on a direct company-detail or chairmanship-claim path.","objdump + strings + detail-manager correlation + caller inspection"
0x00507620,656,shell_station_pick_window_construct,shell,thiscall,inferred,objdump + strings + caller inspection,4,"Constructs the shell-side `StationPick.win` helper window. The constructor binds the list control `0x80ea`, the scroll or selector controls `0x80e8` and `0x80e9`, publishes the helper at `0x006d1718`, and then populates the visible station rows from collection `0x006cec20`. The same family feeds the selected station id through `0x00622ae8` and returns it to the caller when the helper closes. Current grounded callers put this helper under the `StationList.win` selector branch rather than under the startup-company flow.","objdump + strings + caller inspection + helper correlation"
0x005076c0,501,shell_station_pick_window_populate_station_rows,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Populates the visible row set for the shell-side `StationPick.win` helper. The helper iterates collection `0x006cec20`, filters entries through `0x0047fd50`, sorts them by the display-name field at `[entry+0x46b]`, and publishes the resulting station names through the helper list control `0x80ea`. It also mirrors the chosen station ids back into the helper-local scratch arrays, updates one status lane through control event `0xaf`, and refreshes the visible row count through control event `0x66`. Current grounded caller is `shell_station_pick_window_construct` at `0x00507620`.","objdump + strings + caller inspection + collection iteration"
0x004d4500,88,shell_ensure_editor_panel_window,shell,cdecl,inferred,objdump + analysis-context,4,Ensures the shell-side EditorPanel.win helper window rooted at 0x006d07b4 exists. When the panel is absent it allocates a 0x7c-byte window object seeds the vtable at 0x005d0cb8 binds the EditorPanel.win resource through 0x0053fa50 publishes the object to the shell runtime through 0x00538e50 event 0x1e and then runs the shared panel-open helper at 0x004d4160.,objdump + analysis-context + strings
0x004dc670,368,shell_file_options_dialog_construct,shell,thiscall,inferred,objdump + strings,4,Constructs the shared shell file-options dialog rooted at fileopt.win. The helper clears the three downstream branch flags at 0x006d07f8 0x006d07ec and 0x006d07f0 binds the fileopt.win resource through 0x0053fa50 publishes the object to the shell runtime and populates several mode-dependent labels and status text before user input is handled.,objdump + strings
0x004dc7d0,14,shell_has_file_options_dialog,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny presence probe for the shared shell file-options dialog rooted at `0x006d0800`. The helper returns `1` when the live `fileopt.win` object is present and `0` otherwise. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where this check now sits beside the `LoadScreen` and custom-modal probes.","objdump + nearby-constructor correlation + frame-caller inspection + fileopt correlation"
0x004dc7e0,11,shell_mark_file_options_dialog_dirty,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny dirty-latch setter paired with `shell_has_file_options_dialog`. The helper stores `1` into `0x006d07fc`, which current nearby call patterns treat as the `fileopt.win` refresh or service request latch once the shared file-options dialog exists. Current grounded caller is the same post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`.","objdump + nearby-constructor correlation + frame-caller inspection + fileopt correlation"
0x004dc7f0,477,shell_file_options_dialog_handle_message,shell,thiscall,inferred,objdump + strings,4,Handles the fileopt.win command flow and selects exactly one downstream branch before the shared detail-panel completion dispatcher runs. Successful commands dismiss the dialog then set 0x006d07f8 for the load or restore side 0x006d07ec for the save or package side or 0x006d07f0 for the sibling settings-window escape. The settings branch gates on shell_has_settings_window at 0x004fe120 and lazily opens the shared SettingsWindow.win object through 0x00501e50 while sibling branches show prerequisite dialogs when the requested file operation is not currently allowed.,objdump + strings + caller xrefs
0x004dd010,890,shell_file_request_dialog_collect_target_path,shell,cdecl,inferred,objdump + strings,4,"Builds the modal filerqst.win request dialog and resolves one chosen target path back into the caller buffer. The helper treats dialog modes 0 1 2 3 and 11 as save-side requests and the paired modes 4 8 9 and 10 as load-side requests then swaps the button and prompt text between localized ids 249 250 and 251 252. On success it appends one extension from the static mode table at 0x005f3d58 where 0 or 8=.gms 1 or 9=.gmc 2 or 10=.gmx 3 or 4=.gmp and 11=.gmt. Current neighboring callers tighten that last mode too: the normal shell map coordinators use the `.gms/.gmc/.gmx/.gmp` families for scenario and editor flows, while save mode 11 is only consumed by the auxiliary `.gmt` preview-surface branch shared with the side owner at 0x006cd8d8. When a live runtime world is already active through 0x004839b0 the helper overrides that non-runtime table and appends .smp instead, which makes it the shared bridge between the broad shell coordinators and the runtime-state serializer or restore path rather than only a generic filename prompt.",objdump + strings + mode-table inspection + caller correlation
0x004ddbd0,1096,shell_detail_panel_transition_manager,shell,thiscall,inferred,objdump + analysis-context,3,Transitions the shell detail-panel controller rooted at 0x006d0818 between many window or panel states tracked in [this+0x8c] with optional selection ids cached at [this+0x78] through [this+0x90]. The manager tears down the prior child panel at [this+0x88] through 0x004dd950 updates selector or status UI through 0x004dd410 conditionally opens helper windows such as EditorPanel.win through 0x004d4500 and then allocates one of many shell-facing detail windows including TrainDetail.win TrainList.win and neighboring panel objects before publishing the new child through the shell runtime at 0x006d401c. shell_transition_mode reaches this manager on one branch but the current evidence keeps it on the shell-detail path rather than the first gameplay-world-entry coordinator.,objdump + analysis-context + strings
0x004dfdf0,84,shell_ensure_game_message_window,shell,cdecl,inferred,objdump + strings,4,Ensures the standalone GameMessage.win shell object rooted at 0x006d081c exists. When absent it allocates a 0x94-byte window object seeds the vtable at 0x005d0ed0 binds the GameMessage.win resource through 0x0053fa50 stores the result in 0x006d081c and publishes the object to the shell runtime through 0x00538e50.,objdump + strings + caller xrefs
0x004e0210,1217,game_message_window_service_frame,shell,thiscall,inferred,objdump + strings,4,Per-frame service pass for the GameMessage.win object rooted at 0x006d081c. It walks up to seven active message or notification records from the collection at 0x006acd34 populates the window slots around ids 0x8ca8 and neighboring controls chooses icon and portrait assets such as Portrait.imb note.imb smiley.imb and smalleye.imb maps selected message records into shell and world collections including 0x006ceb9c 0x0062be10 0x0062b26c and 0x0062bae0 and updates the visible action entries through repeated 0x00540120 calls. Current grounded caller is the simulation frame path through 0x004e0720.,objdump + strings + caller xrefs
0x004e0720,15,game_message_window_service_if_present,shell,cdecl,inferred,objdump + caller xrefs,4,Services the GameMessage.win branch only when the global object at 0x006d081c is live by tail-calling game_message_window_service_frame. The current grounded caller is simulation_frame_accumulate_and_step_world which keeps this world-facing message overlay inside the shell-owned recurring frame cadence.,objdump + caller xrefs
0x004e0780,468,game_uppermost_window_service_world_hotspot_band,shell,thiscall,inferred,objdump + strings + caller xrefs,4,Per-frame world-facing hotspot service for the GameUppermost.win overlay rooted at 0x006d0820. The helper clears the previously latched hotspot id at [this+0x78] when the shell runtime selection changes then requires an active world-mode branch at [0x006cec74+0x114] a live shell runtime node at [0x006d401c+0xc6d] an unobscured controller view through 0x00543e20 and 0x00543e40 and one selected control id in the narrow band 0x7918 through 0x7921. It rate-limits repeats through the runtime timestamp at [selected+0xd2] remaps the two rightmost ids onto the sibling left-side base actions 0x791c and 0x791e rechecks shell_input_cursor_inside_active_view at 0x0054f540 scales one table-driven coordinate pair from 0x006066c8 and 0x006066e8 and finally pushes that world-relative offset into the live world owner at 0x0062be68 through 0x0043d130. Current grounded caller is game_uppermost_window_handle_message at 0x004e0ba0.,objdump + strings + caller xrefs
0x004e0960,432,game_uppermost_window_refresh_controls,shell,thiscall,inferred,objdump + strings + caller xrefs,4,Refreshes the visible control state for the GameUppermost.win overlay at 0x006d0820. The helper repopulates the hotspot control band 0x7918 through 0x7921 through repeated 0x00540120 calls chooses one of two layout or visibility selectors based on the active world-mode state under 0x006cec74 and resolves the localized label `Hide Bottom Interface (Toggle)` for control 0x7923 before publishing it back into the window tree. Grounded callers include the overlay constructor at 0x004e0b20 the overlay message handler at 0x004e0ba0 and a later world-mode state-change branch at 0x004ff3f5.,objdump + strings + caller xrefs
0x004e0b20,118,game_uppermost_window_construct,shell,thiscall,inferred,objdump + strings + caller xrefs,4,Constructs the GameUppermost.win overlay object later stored at 0x006d0820. The helper seeds the vtable at 0x005d0f3c binds the GameUppermost.win resource through 0x0053fa50 registers the shared control callback at 0x004e0a70 for ids 0x7918 through 0x7921 refreshes the initial control state through game_uppermost_window_refresh_controls and initializes sibling control 0x7922 before returning the live overlay object. The ensure helper at 0x004e0e40 is the current grounded caller.,objdump + strings + caller xrefs
0x004e0ba0,95,game_uppermost_window_handle_message,shell,thiscall,inferred,objdump + strings + caller xrefs,4,Message dispatcher for the GameUppermost.win overlay object. It seeds one visual-speed field on the command object returned by 0x0053f830 then switches on the incoming message id through the local jump table at 0x004e0d04. The current grounded cases call game_uppermost_window_service_world_hotspot_band during the recurring service path refresh the overlay controls through game_uppermost_window_refresh_controls on a sibling state-change path and route control 0x7922 into the world-mode toggle helper at 0x004349f0 which also updates the same overlay object at 0x006d0820.,objdump + strings + caller xrefs
0x004e0e40,75,shell_ensure_game_uppermost_window,shell,cdecl,inferred,objdump + strings + caller xrefs,4,Ensures the world-facing GameUppermost.win overlay rooted at 0x006d0820 exists. When absent it allocates a 0xae-byte window object constructs it through game_uppermost_window_construct at 0x004e0b20 stores the result globally and publishes it through the shell runtime at 0x006d401c via 0x00538e50. A grounded caller sits in the shell_transition_mode path near 0x004831c0 immediately after the GameMessage.win bring-up branch which ties this overlay to world-mode entry rather than generic shell UI.,objdump + strings + caller xrefs
0x004fe120,14,shell_has_settings_window,shell,cdecl,inferred,objdump,4,Returns whether the shared settings window object rooted at 0x006d1350 is currently live. The fileopt settings escape branch and direct shell command wrappers both gate on this before opening SettingsWindow.win again.,objdump + caller xrefs
0x004fe130,11,shell_mark_settings_window_dirty,shell,cdecl,inferred,objdump + global-state inspection + frame-caller inspection,4,"Tiny dirty-latch setter paired with `shell_has_settings_window`. The helper stores `1` into `0x006d1360`, which current nearby call patterns treat as the `SettingsWindow.win` refresh or service request latch once the live settings singleton at `0x006d1350` exists. Current grounded callers include the post-step shell-window service ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, and the same latch is also cleared during settings-window open or rebuild paths near `0x00501e50`.","objdump + global-state inspection + frame-caller inspection + settings-window open-path correlation"
0x00500640,487,shell_settings_window_construct,shell,thiscall,inferred,objdump + strings,4,Constructs the shared SettingsWindow.win object later stored at 0x006d1350. The helper binds the SettingsWindow.win resource through 0x0053fa50 allocates a page-selection helper at 0x006d1358 walks the 13-entry category table rooted at 0x00622870 and populates the resulting shell control tree with the page labels and ordering data before the window is shown.,objdump + strings
0x00501e50,201,shell_open_settings_window,shell,cdecl,inferred,objdump + strings,4,Lazily allocates and shows the shared SettingsWindow.win shell object at 0x006d1350. When no settings window is live it allocates a 0x78-byte object constructs it through shell_settings_window_construct publishes it to the shell runtime through 0x00538f10 and then notifies the active shell owner at 0x0062be68. Current grounded callers are the direct shell command wrapper at 0x00482b00 the fileopt settings escape branch and one larger shell UI dispatcher branch near 0x0050366a.,objdump + strings + caller xrefs
0x00468d00,222,multiplayer_update_semicolon_name_list,shell,cdecl,inferred,ghidra-headless,4,Adds or removes one player-name token in the semicolon-delimited moderation list rooted at `[ecx+0x905c]`. With mode `1` it appends the supplied token only when not already present writing `;` as the delimiter; with mode `0` it removes the matched token collapses the remainder left and skips an adjacent delimiter when present.,ghidra + rizin + llvm-objdump + strings
0x00468de0,14,multiplayer_session_event_forward_action1_request,shell,unknown,inferred,ghidra-headless,2,Session-event callback wrapper that always forwards request id `1` through multiplayer_set_pending_session_substate with a zero auxiliary payload. The callback clears EDX before the shared setter call and currently lands on a request id that does not yet map to a visible pending substate so this row remains structural.,ghidra + rizin + llvm-objdump
0x00468e00,188,multiplayer_session_event_publish_pair_chat_template,shell,unknown,inferred,ghidra-headless,3,Session-event callback that formats one two-string chat/status line through multiplayer_route_chat_line when the callback status in EDX is zero and the current live session count is not positive. A selector near `[esp+0x214]` chooses the template `%s* %s` `%s %s` or `%s > %s`; the helper length-checks both inputs against the local 0x1f4-byte buffer before formatting and returns without publishing when either string is null or too long.,ghidra + rizin + llvm-objdump + strings
0x00468ec0,144,multiplayer_session_event_publish_action2_single_name,shell,unknown,inferred,ghidra-headless,3,Session-event callback wrapper for the one-name action-2 status path. When the callback status in EDX is zero and the current session count is positive it length-checks the supplied name formats localized text id `0xb73` routes the resulting line through multiplayer_route_chat_line and then forwards request id `2` through multiplayer_set_pending_session_substate with that same name payload. The currently grounded setter does not visibly store a pending substate for id `2` so this row stays partly structural.,ghidra + rizin + llvm-objdump
0x00468f50,192,multiplayer_session_event_publish_action2_pair,shell,unknown,inferred,ghidra-headless,3,Session-event callback wrapper for the two-string action-2 status path. When the callback status in EDX is zero and the supplied name lengths fit within the local buffer it formats localized text id `0xb74` or `0xe34` depending on whether the first string is present routes the resulting line through multiplayer_route_chat_line and then forwards request id `2` through multiplayer_set_pending_session_substate with the second string as the target payload and the first string as the auxiliary payload. The currently grounded setter does not visibly store a pending substate for id `2` so this row stays partly structural.,ghidra + rizin + llvm-objdump
0x00469010,30,multiplayer_session_event_forward_action4_request,shell,unknown,inferred,ghidra-headless,3,Session-event callback wrapper that forwards request id `4` only when both supplied payload pointers are non-null. It passes the second stack argument as the action payload and a zero auxiliary argument through multiplayer_set_pending_session_substate. The currently grounded setter does not visibly store a pending substate for id `4` so this row remains structural.,ghidra + rizin + llvm-objdump
0x00469030,30,multiplayer_session_event_forward_action7_request,shell,unknown,inferred,ghidra-headless,2,Session-event callback wrapper that forwards one payload pointer through multiplayer_set_pending_session_substate with request id `7` when the callback status in EDX is nonzero. The wrapper normalizes its incoming pointer into the second stack slot before tail-calling the shared setter but the currently grounded setter does not map request id `7` to a visible pending substate so this row remains structural.,ghidra + rizin + llvm-objdump
0x00469060,3,multiplayer_session_event_noop_12byte_stub,shell,unknown,inferred,ghidra-headless,4,Three-byte no-op callback stub in the Multiplayer.win session-event registration table. It returns immediately with `ret 0xc` and does not touch any state.,ghidra + rizin + llvm-objdump
0x00469070,87,multiplayer_session_event_publish_status_value,shell,unknown,inferred,ghidra-headless,3,Session-event callback that publishes one status value into the destination text builder passed in the third stack argument. It first compares the supplied index against the live session count from `0x006d40d0`; out-of-range entries publish the fixed fallback text at `0x005c87a8`; in-range entries publish integer `100` through 0x0058cd40 when event code EDX is `0x18`; publish the string at `0x00521d40+0x08` when EDX is `0x15`; and otherwise fall back to the same fixed text token.,ghidra + rizin + llvm-objdump + strings
0x004690d0,15,multiplayer_session_event_publish_fixed_status_text,shell,unknown,inferred,ghidra-headless,3,Session-event callback that appends the fixed status text token at `0x005c87a8` into the destination text builder passed in the second stack argument. This is the smallest text-publisher sibling in the same callback family and shares the same append helper 0x0058bce0 used by 0x00469070.,ghidra + rizin + llvm-objdump
0x004690f0,106,multiplayer_session_event_seed_control_id_list,shell,unknown,inferred,ghidra-headless,3,Session-event callback that seeds a byte-list builder with the fixed control-id set `3 1 8 10 11 19 4 5` when the callback status in EDX is zero. It appends each id through 0x0058bcb0 into the destination builder passed in the first stack argument and returns immediately when the callback status is nonzero.,ghidra + rizin + llvm-objdump
0x00469160,26,multiplayer_session_event_query_session_count,shell,unknown,inferred,ghidra-headless,4,Session-event callback helper that returns the live session count from `0x006d40d0` through 0x00521670 only when the callback mode in EDX equals `1`; all other modes return zero. This looks like the count-query slot in the same registration table.,ghidra + rizin + llvm-objdump
0x00469180,3,multiplayer_session_event_noop_8byte_stub,shell,unknown,inferred,ghidra-headless,4,Three-byte no-op callback stub in the Multiplayer.win session-event registration table. It returns immediately with `ret 8` and does not touch any state.,ghidra + rizin + llvm-objdump
0x00469190,8,multiplayer_session_event_latch_status_code,shell,unknown,inferred,ghidra-headless,4,Small session-event callback helper that stores the incoming status code from EDX into `0x006cd974` and returns. The registration branch later clears the same global before transport teardown or retry reset.,ghidra + rizin + llvm-objdump
0x004691a0,45,multiplayer_session_event_notify_owner_and_queue_action8,shell,unknown,inferred,ghidra-headless,3,Session-event callback wrapper that first notifies the current Multiplayer.win owner through multiplayer_notify_window_owner. When the callback status in EDX is zero it then queues request id `8` through multiplayer_set_pending_session_substate with the same payload pointer; otherwise it returns after the owner notification only.,ghidra + rizin + llvm-objdump
0x004691d0,39,multiplayer_find_session_event_capacity_entry,shell,unknown,inferred,ghidra-headless,4,Scans the fixed 0x80-entry session-event capacity array for a live record owned by the supplied key pointer in EDX. Each 0x11c-byte record is live when [entry+0x104] is nonzero and a match requires [entry+0x10c] to equal the incoming key. The helper returns the matched entry pointer or null.,ghidra + rizin + llvm-objdump
0x00469200,428,multiplayer_sync_session_event_capacity_entry,shell,unknown,inferred,ghidra-headless,3,Session-event cache-field callback that creates updates or clears one cached capacity record for the supplied owner key. Mode `0` creates the first free 0x11c-byte record when none exists mode `1` updates an existing record and mode `2` clears an existing record by zeroing [entry+0x104]. The create and update paths store the owner key at [entry+0x10c] seed [entry+0x104] with 0x2328 resolve `numplayers` and `maxplayers` handles through 0x0058d6d0 and copy the current display string into [entry+0x84].,ghidra + rizin + llvm-objdump + strings
0x004693b0,80,multiplayer_session_event_cache_line_callback,shell,unknown,inferred,ghidra-headless,4,Transport-side callback that appends one incoming status line into the cached session-event line store at `0x006ae4d8`. When the callback status in EDX is nonzero and the incoming line pointer is valid it copies the string from the third stack argument into slot `0x006cd97c << 8` subject to the `0x1f4` entry cap and a small flag filter on the fourth stack argument then increments `0x006cd97c` for later iteration.,ghidra + rizin + llvm-objdump
0x00469410,56,multiplayer_init_session_event_transport_state,shell,unknown,inferred,ghidra-headless,3,Initializes the Multiplayer.win session-event transport state rooted at `0x006cd970`. The helper latches the incoming mode or state into `0x006cd978`; when that value is nonzero it zeroes the large scratch block at `0x006ae4d8` resets `0x006cd97c` and registers the cached-line callback block rooted at `0x004693b0` through multiplayer_transport_register_selector_callback before returning.,ghidra + rizin + llvm-objdump
0x00469450,97,multiplayer_teardown_session_event_transport,shell,unknown,inferred,ghidra-headless,3,Tears down the active session-event transport object at `0x006cd970`. When the latched mode at `0x006cd978` is nonzero and the multiplayer session object at `0x006cd920` exists it first switches the transport back to status route `0` through multiplayer_transport_select_status_route clears the status pump through multiplayer_transport_clear_status_pump disconnects through multiplayer_transport_disconnect shuts the object down through multiplayer_transport_shutdown and finally clears `0x006cd970`.,ghidra + rizin + llvm-objdump
0x004694c0,57,multiplayer_publish_session_event_fixed_token,shell,unknown,inferred,ghidra-headless,3,Small session-event transport helper that publishes one fixed token through the active transport object when the latched mode and multiplayer session object are both present. It first switches the transport to status route `1` through multiplayer_transport_select_status_route and then sends the fixed token at `0x005c87a8` plus flag `1` through multiplayer_transport_publish_fixed_token_message. The current grounded caller is the Multiplayer.win branch at `0x0046c3c0`.,ghidra + rizin + llvm-objdump + strings
0x00469500,27,multiplayer_flush_session_event_transport,shell,unknown,inferred,ghidra-headless,3,"Lightweight session-event transport flush wrapper. When the active transport object at `0x006cd970` exists it first forces a status flush through multiplayer_transport_force_status_flush and then tail-calls multiplayer_transport_flush_and_maybe_shutdown on that same object. Current grounded callers include the top-level Multiplayer.win service loop and neighboring preview-reset or initializer branches, which makes this the shell-side cadence bridge into the deeper transport pump.",ghidra + rizin + llvm-objdump
0x00469520,94,multiplayer_register_session_event_cache_fields,shell,unknown,inferred,ghidra-headless,3,Registers the session-event cache-field subscription set for the active Multiplayer.win object. When no multiplayer session object is present it marks `[this+0x8f18]` armed and subscribes callback `0x00469200` through multiplayer_transport_subscribe_field_callback_set with the fixed field-id list `3 1 4 8 10 11 19 5` rooted at `[this+0x10]`.,ghidra + rizin + llvm-objdump
0x00469580,65,multiplayer_begin_session_event_line_iteration,shell,unknown,inferred,ghidra-headless,4,Primes iteration over the cached session-event line store at `0x006ae4d8`. When the multiplayer session object at `0x006cd920` is absent it sets `[this+0x9874]` armed clears the cached line slots and line index at `0x006cd97c` and re-registers the line callback `0x004693b0` through multiplayer_transport_register_selector_callback before returning.,ghidra + rizin + llvm-objdump
0x004695d0,66,multiplayer_next_session_event_cached_line,shell,unknown,inferred,ghidra-headless,4,Returns the next non-empty cached session-event line from the fixed store at `0x006ae4d8`. On first use after multiplayer_begin_session_event_line_iteration it resets `0x006cd97c` and clears `[this+0x9874]`; afterwards it returns the current 0x100-byte slot pointer when the first byte is nonzero and advances `0x006cd97c` or returns null when no further cached lines remain.,ghidra + rizin + llvm-objdump
0x00469620,52,multiplayer_submit_owner_notified_session_event_text,shell,unknown,inferred,ghidra-headless,3,Submits one caller-supplied text buffer through the active session-event transport using callback multiplayer_session_event_notify_owner_and_queue_action8. The helper first sanitizes the input string into a local 0x100-byte transport record through multiplayer_transport_sanitize_identifier and then forwards that record through multiplayer_transport_submit_text_record with fixed mode arguments `0` and `1`.,ghidra + rizin + llvm-objdump
0x00469660,27,multiplayer_send_session_event_text_selector0,shell,unknown,inferred,ghidra-headless,3,Thin session-event transport wrapper that sends one caller-supplied text pointer through multiplayer_transport_send_selector_text with selector `0` when the pointer is non-null. The current grounded caller is the Multiplayer.win control dispatcher around `0x00469d30`.,ghidra + rizin + llvm-objdump
0x00469680,14,multiplayer_pump_session_event_status,shell,unknown,inferred,ghidra-headless,3,Thin session-event transport wrapper that immediately requests a status pump through multiplayer_transport_request_status_pump on the active transport object at `0x006cd970` and discards one stack argument. Current grounded callers use it after updating Multiplayer.win status text ids `0xe60` and `0xe61`.,ghidra + rizin + llvm-objdump
0x00469700,27,multiplayer_preview_dataset_stage_selected_path,shell,thiscall,inferred,objdump + caller xrefs,3,Small Multiplayer preview-dataset helper that copies one caller-supplied selected path string into the dataset-local staging buffer at `[this+0x8f48]`. Current grounded callers feed it the active session-entry path from the live session list before later preview or launch-side dataset work.,objdump + caller xrefs
0x00469720,221,multiplayer_preview_dataset_service_frame,shell,thiscall,inferred,objdump + caller xrefs,3,"Recurring shell-frame service for the Multiplayer preview dataset rooted at `0x006cd8d8`. When the gating global at `0x006cd910` and the dataset render target at `[this+0x9884]` are live it walks the active session list under `0x006d40d0`, formats one roster or status line per entry through the template at `0x005ce1ac`, and then pushes the accumulated text through the render/update helper at `0x005519f0` with fixed presentation parameters. The current grounded caller is `shell_state_service_active_mode_frame`, which makes this a shell-owned per-frame refresh path for multiplayer preview text rather than a transport I/O loop.",objdump + caller xrefs + strings
0x0046b780,368,multiplayer_preview_dataset_service_launch_state_and_warn_out_of_sync,shell,thiscall,inferred,objdump + caller xrefs + strings + callsite inspection,4,"Services one higher-level launch or preview transition slice on the Multiplayer preview dataset rooted at `0x006cd8d8`. At entry it checks global `0x006cd91c` and, when armed, formats localized id `3879` `Out of Sync` through `0x5193f0` and pushes it into the shell status presenter at `0x5386e0` with timeout `0xbb8`; this is the current grounded owner of that string and it is not part of the station-detail overlay. The same helper then gates on preview and launcher globals `0x006cd8dc`, `0x006ce9b8`, `0x006ce9c4`, and shell-state latches under `0x006cec78`, drives one modal shell branch through `0x482150`, timestamps `[this+0x9058]`, chains the internal dataset-side helpers at `0x46af70`, `0x46b0c0`, `0x46ad80`, `0x46aeb0`, `0x469b00`, and `0x46a590`, and can finally relaunch into `shell_map_file_entry_coordinator` at `0x00445ac0` through staged buffer `0x006ce630`. Current grounded callers include the multiplayer-side service loop around `0x004373c5` and `0x00437435`, plus later shell-side branches at `0x00483638`, `0x00483d79`, and `0x00484054`.","objdump + caller xrefs + strings + callsite inspection + multiplayer-preview correlation"
0x0046a6c0,307,multiplayer_session_event_publish_registration_field,shell,unknown,inferred,ghidra-headless + objdump,3,"Switch-driven session-event callback that publishes one Multiplayer.win registration or status field into the destination builder passed on the stack. Depending on selector `EDX` it now clearly includes the local executable version string through `runtime_query_cached_local_exe_version_string` `0x00482d80` on runtime root `0x006cec74`, the profile text at `0x006cd8d8+0x8e10`, the constant `0x2328`, the live session count from `0x006d40d0`, the field at `[0x006d1270+0x3b6]`, the active profile string at `[0x006cec7c+0x44]`, or fixed strings such as `Initializing...`, `openstaging`, and `closedplaying`; unsupported selectors fall back to the fixed token at `0x005c87a8`.","ghidra + rizin + llvm-objdump + strings + registration-field correlation"
0x0046a830,194,multiplayer_session_event_retry_with_random_player_name,shell,unknown,inferred,ghidra-headless,3,Registration-side callback that increments the retry counter at `0x006cd984` and on early retries formats a randomized `RT3Player%d` name into `0x006ae0c0` sanitizes it into a local notification object notifies the current Multiplayer.win owner and forwards that object through multiplayer_transport_set_local_name. On the first retry it also routes request id `5` or `6` through multiplayer_set_pending_session_substate depending on the incoming status flag; after 25 retries it resets `0x006cd984` and `0x006cd974` and calls multiplayer_transport_reset_and_maybe_shutdown instead.,ghidra + rizin + llvm-objdump + strings
0x0046a900,522,multiplayer_register_session_event_callbacks,shell,thiscall,inferred,ghidra-headless,4,Builds and registers the Multiplayer.win session-event callback table rooted at the local block on `[esp+0x28]`. The function seeds slots with multiplayer_session_event_forward_action1_request multiplayer_session_event_publish_pair_chat_template multiplayer_session_event_publish_action2_single_name multiplayer_session_event_publish_action2_pair multiplayer_session_event_forward_action4_request multiplayer_session_event_forward_action7_request multiplayer_session_event_noop_12byte_stub multiplayer_session_event_publish_registration_field multiplayer_session_event_publish_status_value multiplayer_session_event_publish_fixed_status_text multiplayer_session_event_seed_control_id_list multiplayer_session_event_query_session_count multiplayer_session_event_noop_8byte_stub multiplayer_session_event_latch_status_code multiplayer_session_event_notify_owner_and_queue_action8 multiplayer_init_session_event_transport_state and multiplayer_session_event_retry_with_random_player_name. It allocates the transport callback object under `0x006cd970` stages the session name into the local descriptor block and then finishes registration through multiplayer_transport_register_callback_table which in turn routes through multiplayer_transport_attach_callback_table_descriptor multiplayer_transport_enqueue_descriptor_block_record and multiplayer_transport_dispatch_callback_table_binding.,ghidra + rizin + llvm-objdump + strings
0x0046c360,32,multiplayer_route_chat_line,shell,cdecl,inferred,ghidra-headless,3,Routes one multiplayer chat line through the active transport object at `0x006cec78` when present or falls back to the local Multiplayer.win chat publisher otherwise. The transport path forwards the supplied text into 0x4554e0 with fixed mode arguments `5 1 0`; the local fallback tail-calls multiplayer_publish_wrapped_chat_message.,ghidra + rizin + llvm-objdump
0x0046f960,2209,multiplayer_dispatch_chat_command,shell,cdecl,inferred,ghidra-headless,4,Parses and dispatches one slash-prefixed Multiplayer.win chat command line from `[eax+0x08]`. The parser normalizes `/` to `\\` and handles the grounded command family `\\kick` `\\clear` `\\whois` `\\me` `\\unban` `\\ban` `\\snore` `\\sneeze` `\\hurry` `\\trackisfree` `\\loadgame` and `\\sendgame`. The strongest branches are now clear: `\\kick` resolves a typed peer name through the active session tables and forwards the resulting peer object through multiplayer_request_peer_session_control when the target is neither null nor the local player; `\\clear` clears the local chat pane through multiplayer_publish_wrapped_chat_message(null); `\\whois` finds a named peer and emits multi-line `%s Ip = %s` `Cpu` `Game` and `Build Time` diagnostics through multiplayer_route_chat_line; `\\ban` and `\\unban` resolve either a dotted player name or the selected peer name then update the semicolon-delimited moderation list through multiplayer_update_semicolon_name_list with add/remove modes while `\\unban` can also forward a live peer object through multiplayer_request_peer_session_control; `\\snore` `\\sneeze` and `\\hurry` build transient presentation objects then broadcast text ids `0xb79` `0xb7a` and `0xb7b`; `\\loadgame` copies the requested filename into `0x006ce630` and arms flag `0x006ce9bc`; `\\trackisfree` arms flag `0x006ce9b4`; and `\\sendgame` allocates one 0x5c-byte transfer record under `0x006ce290` for the chosen player slot. The parser returns `1` only when a command branch handled the line and otherwise leaves the caller to treat it as ordinary chat text.,ghidra + rizin + llvm-objdump + strings
0x00470210,119,multiplayer_submit_chat_or_command_line,shell,cdecl,inferred,ghidra-headless,4,Submits one Multiplayer.win chat-entry line. The wrapper first calls multiplayer_dispatch_chat_command on the raw line buffer; when the parser returns zero it formats a normal `%s > %s` named chat line from the sender object at `[edi+0x08]` and the message payload; then either publishes it locally through multiplayer_publish_wrapped_chat_message or routes it through the active transport object at `0x006cec78`. When the parser returns nonzero the wrapper skips normal chat formatting because the slash-command branch already consumed the line.,ghidra + rizin + llvm-objdump + strings
0x004ecc90,52,multiplayer_set_pending_session_substate,shell,unknown,inferred,ghidra-headless,2,Small pending-session-substate setter used by the multiplayer session-event callback family. The grounded stores are request id `5` to substate `5` request id `6` to substate `6` and request id `8` to substate `8` at `0x006d1288`. Other current callback-family callers still pass ids `1` `2` `4` and `7` without a visible store in this helper so this row stays structural for now.,ghidra + rizin + llvm-objdump
0x004edce0,19,multiplayer_notify_window_owner,shell,unknown,inferred,ghidra-headless,3,Thin Multiplayer.win owner-notification wrapper. It loads the current window owner singleton from `0x006d1268` and when present forwards the supplied payload pointer into 0x004eccd0 for owner-side handling; current grounded callers are the session-event callback family around 0x004691a0 and the related registration path near 0x0046a8b3.,ghidra + rizin + llvm-objdump
0x004ecb20,101,multiplayer_reset_local_session_slot_state,shell,cdecl,inferred,ghidra-headless,4,Resets the local Multiplayer.win session-slot state before window init or add-open-slot flows. The helper marks the local state at `0x006cec7c+0x97` initialized clears the local slot counters at `+0x79` and `+0x7b` zeroes the slot-marker bytes at `+0x87` clears the local summary block at `+0x44` and zero-fills the large session backing block at `0x006d1270` when present.,ghidra + rizin + llvm-objdump
0x004ecb90,191,multiplayer_probe_or_allocate_open_player_slot,shell,cdecl,inferred,ghidra-headless,3,Probes or allocates one open local player-slot marker against the active Multiplayer.win session block at 0x006d1270. In probe mode `ecx=1` the helper checks that the local open-slot count and slot-marker bytes at `0x006cec7c+0x87` still fit within the remote slot counts and occupancy bytes rooted at `session+0x31b` and `session+0x3a3` and returns nonzero only when one additional slot can be claimed. In allocate mode `ecx=0` it finds the first locally empty slot whose remote occupancy byte is nonzero writes marker `0x64+index` into the local slot array increments `0x006cec7c+0x7b` and returns `0xff` on success.,ghidra + rizin + llvm-objdump
0x004ed590,224,multiplayer_sync_staged_text_controls,shell,cdecl,inferred,ghidra-headless,3,Synchronizes the shared Multiplayer.win staged-text buffer into the two mirrored text controls at ids 0xe48 and 0xe5d and then copies the same string back into the active selection buffer at 0x006cec74+0x1ef when it changed. The helper reallocates each control-owned backing string as needed and is used from the larger window initializer pending-status service and one delayed service-loop recovery branch.,ghidra + rizin + llvm-objdump
0x004ed800,109,multiplayer_preview_dataset_construct,shell,thiscall,inferred,objdump + caller xrefs,3,"Constructor-style zero initializer for the large Multiplayer preview-dataset object later stored at `0x006cd8d8`. It clears the leading linkage and mode fields, resets the request and staging words around `0x8f18..0x8f44`, zeroes the shell-mode snapshot slots at `0x9050` and `0x9054`, clears the dataset state word at `0x985c`, seeds `0x9860` to `-1`, and leaves the object ready for the follow-on reset and dispatch paths.",objdump + caller xrefs
0x004ed890,164,multiplayer_schedule_requested_action,shell,cdecl,inferred,ghidra-headless,3,Initializes one requested Multiplayer.win action and resets the shared action globals before later dispatch. The helper writes the requested action id from EDI into 0x006d127c marks the action-active bit at 0x006d1274 clears the pending-step and substate fields at 0x006d1278 0x006d1280 and 0x006d1288 tears down the prior helper object at 0x006d1294 and allocates a fresh 0x10-byte helper. The currently named action writers above it queue action ids 1 and 4 from preview-dataset reset 2 from staged text-entry dialog setup 3 from staged text-entry commit and 5 or 6 from selected-preview follow-up branches.,ghidra + rizin + llvm-objdump
0x004ed940,235,multiplayer_rebuild_open_player_slot_markers,shell,cdecl,inferred,ghidra-headless,3,Rebuilds the local Multiplayer.win open-player slot markers from the active session slot table and republishes the resulting count. The helper clears any existing local slot bytes above `0x64` from `0x006cec7c+0x87` while decrementing `0x006cec7c+0x7b` then walks the remote slot records at `session+0x31b` with count `session+0x3ae`. For each remotely open record it uses multiplayer_probe_or_allocate_open_player_slot to claim the next local marker when capacity remains and then formats the updated open-slot count into shell control `0x6f` with resource id `0xe36`.,ghidra + rizin + llvm-objdump
0x004edc40,145,multiplayer_reset_preview_dataset_and_request_action,shell,cdecl,inferred,ghidra-headless,3,Resets the active Multiplayer.win preview dataset object at 0x006cd8d8 and immediately schedules the next requested action. The helper destroys any existing 0x9898-byte dataset object allocates and constructs a fresh one through 0x004ed800 clears the text control at id 0xe47 and the staged entry buffer at 0x006d11a8 and then queues action id 1 when the caller passes zero or action id 4 when the caller passes a nonzero dataset-related value.,ghidra + rizin + llvm-objdump
0x004ee0e0,225,multiplayer_open_staged_text_entry_dialog,shell,cdecl,inferred,ghidra-headless,3,Opens the small Multiplayer.win staged text-entry dialog and queues requested action 2. The helper chooses one of two prompt ids from the current preview mode copies the current profile text from 0x006cec74+0x1ef into the staging buffer at 0x006d1128 persists the profile state through 0x00484910 builds a formatted prompt string through 0x00518de0 and opens the modal shell dialog through 0x004c98a0 with the local callbacks at 0x004ed100 and 0x004ed4c0 before queuing action 2.,ghidra + rizin + llvm-objdump
0x004ee1d0,456,multiplayer_commit_staged_text_entry,shell,cdecl,inferred,ghidra-headless,3,Commits one staged Multiplayer.win text entry and queues requested action 3 when validation succeeds. The helper refreshes the mode-dependent prompt text saves the shared profile state through 0x00484910 copies either the caller-provided string or the text control 0xe47 into the staging buffer at 0x006d11a8 derives the companion buffer at 0x006d1228 from the current preview object or fallback globals and when the staged text exceeds five bytes schedules action 3 through multiplayer_schedule_requested_action; otherwise it clears the staged buffer and text control.,ghidra + rizin + llvm-objdump
0x004ee3a0,244,multiplayer_reset_tool_globals,shell,thiscall,inferred,ghidra-headless,3,Resets the smaller multiplayer-tool singleton state rooted around 0x006d1268 through 0x006d1270 for one shell mode created from 0x00482ec0. The helper seeds the shared vtable clears or rebinds the active singleton pointers and performs the same early shell-service notifications used by the larger Multiplayer.win initializer before later selection or preview code runs.,ghidra + rizin + llvm-objdump + strings
0x004ee430,141,multiplayer_update_preview_mode_labels,shell,cdecl,inferred,ghidra-headless,3,Updates the small mode-dependent label widget pair used by the Multiplayer.win preview branch. The helper chooses one of two label-id pairs anchored by string ids 0xe12 0xe18 and 0xe73 then writes them through 0x00540120 into shell controls such as ids 0x65 0x6d 0x86 and 0x87. It is called from multiplayer_load_selected_map_preview_surface the larger multiplayer initializer and the restore-from-globals callback.,ghidra + rizin + llvm-objdump + strings
0x004ee4c0,49,multiplayer_publish_control_0x69_mode,shell,cdecl,inferred,ghidra-headless,2,Publishes the current mode for Multiplayer.win control 0x69 from the presence of the session-related singleton at 0x006d40dc. The helper pushes mode 3 when that object exists or mode 1 otherwise through 0x00469d30 and is used after preview and count-setting branches to keep that control in sync with session state.,ghidra + rizin + llvm-objdump
0x004ee500,50,multiplayer_are_all_peer_ready,shell,cdecl,inferred,ghidra-headless,4,Returns true only when every element in the shell-owned multiplayer peer list exposed through 0x00521680 has ready flag bit 0x01 set at offset +0x5c. The service loop uses this gate before committing the larger multiplayer launch or transition branch.,ghidra + rizin + llvm-objdump
0x004ee540,352,multiplayer_refresh_peer_roster_list,shell,cdecl,inferred,ghidra-headless,3,Refreshes the Multiplayer.win peer-roster list for preview modes 0xe12 and 0xe13. The helper chooses one of two mode-dependent text ids updates control 0x8b when the current roster selection is valid enumerates either the direct peer list at 0x006d40d0 or the fallback dataset-backed names from 0x006cd8d8 into repeated control-0x88 entries and when no roster entries remain forces a preview-dataset reset through multiplayer_reset_preview_dataset_and_request_action. It also republishes one session-state byte into shell control 9 before returning.,ghidra + rizin + llvm-objdump
0x004ee6a0,359,multiplayer_refresh_map_entry_list,shell,cdecl,inferred,ghidra-headless,3,Refreshes the Multiplayer.win map-entry list for preview modes 0xe11 and 0xe13. The helper chooses one of two mode-dependent text ids writes the active selection header into control 0x8b walks up to 0x80 0x11c-byte records from the list object exposed by control 0xe47 publishes each entry into repeated control-0x88 rows and mirrors the currently selected matching row into control 0x66. The comparison path uses the current staged selection text copied into a local buffer before the list walk.,ghidra + rizin + llvm-objdump
0x004ee810,308,multiplayer_publish_wrapped_chat_message,shell,cdecl,inferred,ghidra-headless,4,Publishes one Multiplayer.win chat or status message into the mode-dependent chat pane. The helper chooses text resource `0xe32` or `0xe5c` from the current preview mode at `[window+0x7c]`; resolves the corresponding text list object through `0x0053f830`; word-wraps the supplied string to width `0x3e`; emits each wrapped row into control `0x88` through `0x00540120`; stores per-row metadata back into the list object; and finally updates the summary row in control `0x66` or clears the pane when the caller passes a null string. It is used by the local chat transport fallback; the named `%s > %s` message publisher; and the Multiplayer.win launch-side action wrappers.,ghidra + rizin + llvm-objdump + strings
0x004eed30,208,multiplayer_sync_selected_map_entry,shell,cdecl,inferred,ghidra-headless,3,Selection wrapper above 0x004ee950 for the multiplayer map-preview branch. It walks the current 0x25a-byte multiplayer entry table compares the selected record string against the shell selection buffer near 0x006cec7c and then calls 0x004ee950 with either the matching strings or null inputs to refresh the active preview state.,ghidra + rizin + llvm-objdump
0x004ee950,982,multiplayer_load_selected_map_preview_surface,shell,cdecl,inferred,ghidra-headless,4,Loads or refreshes the currently selected .gmt-backed preview surface for the multiplayer window family rooted at 0x006d1270. The routine validates the selected filename suffix copies selected strings into the active record updates preview or status values under offsets such as +0x3b2 and +0x3b6 formats several shell text fields through 0x00540120 and finishes by decoding a 256x256 image through 0x0053f830 and surface_init_rgba_pixel_buffer. The branch is anchored by the larger Multiplayer.win initializer at 0x004efe80.,ghidra + rizin + llvm-objdump + strings
0x004eee00,649,multiplayer_refresh_map_preview_panel,shell,cdecl,inferred,ghidra-headless,3,Refreshes the multiplayer map-preview panel for one requested preview state or sentinel value. The helper stores the requested state at [this+0x78] updates several shell text fields through 0x00540120 handles the special active state 0xe15 and the fallback -1 case copies the selected entry strings out of the multiplayer entry table at 0x006d126c into the shell selection buffer near 0x006cec7c and then routes through multiplayer_sync_selected_map_entry or multiplayer_load_selected_map_preview_surface before returning.,ghidra + rizin + llvm-objdump + strings
0x004ef090,365,multiplayer_select_preview_mode_and_refresh,shell,cdecl,inferred,ghidra-headless,3,Selects one of the top-level multiplayer preview modes identified by command ids 0xe10 through 0xe13 then refreshes the preview panel. The helper stores the requested mode at [this+0x7c] updates the four mode-button states through 0x00540120 handles the special 0xe12 branch with extra multiplayer refresh helpers and a direct multiplayer_refresh_map_preview_panel call for state 0xe15 emits a summary status field at 0xe55 falls back through multiplayer_refresh_map_preview_panel(-1) and finally refreshes the panel timestamp at [this+0x80] through 0x0051d890.,ghidra + rizin + llvm-objdump + strings
0x004ef200,1786,multiplayer_service_pending_status_state_machine,shell,cdecl,inferred,ghidra-headless,4,Services the pending Multiplayer.win status or transition state machine when the global flag at `0x006d1278` is set. The routine clears the pending flag switches over the queued step id at `0x006d1280` and now has several grounded branches: step `1` builds modal status `0xe4f` optionally appends owner text from `0x006d4118/0x006d411c` tears down the preview dataset at `0x006cd8d8` and refreshes control `0xcc`; step `2` clears `0x006cd920` destroys the preview dataset and opens status `0xe50`; step `3` gates on latch byte `0x006d1292` and warns with `0xe51`; step `4` requires `0x006cd920 != 0` and `0x006ae3c8 >= 3` or warns with `0xe52` otherwise it seeds a random `RT3Player%d` name into the staged-text controls through multiplayer_sync_staged_text_controls and sets `0x006ae3c4 = 2`; step `5` opens status `0xe54` then rebuilds the preview dataset through multiplayer_reset_preview_dataset_and_request_action. A second substate switch on `0x006d1284` formats statuses `0xe55..0xe5f` `0xe92` and `0xf53`; its `0x5` and `0x8` families either force preview mode `0xe13` or reseed the default player-name path before syncing the staged-text controls.,ghidra + rizin + llvm-objdump + strings
0x004ef960,1260,multiplayer_dispatch_requested_action,shell,cdecl,inferred,ghidra-headless,4,Dispatches the current requested Multiplayer.win action stored in `0x006d127c`. The switch drives six higher-level action cases that combine immediate mode changes through multiplayer_select_preview_mode_and_refresh with deferred pending-step writes into `0x006d1278` and `0x006d1280`. The grounded wrappers are now broader than before: action `1` either enters preview mode `0xe11` immediately or schedules pending step `1`; action `2` resets the local session-slot state through multiplayer_reset_local_session_slot_state copies the staged text buffers into the active dataset seeds one local open-slot marker refreshes the local player rows enters preview mode `0xe12` and rebuilds the open-slot markers; action `3` copies the staged text buffers back into the active multiplayer object and then uses the dataset mode at `[0x006cd8d8+0x0c]` to schedule pending steps `0xa` `0xb` `0xc` `0xe` or fallback `0x2` while its resolved-mode branch re-enters preview mode `0xe12` clears latches `0x006d1291/0x006d1292` and seeds the local player panel; action `4` promotes the committed staged text into preview mode `0xe13` or schedules pending step `5` or `6` from the launcher substate at `0x006d1288`; action `5` pumps the selected-map follow-up callback then either rebuilds the open-slot markers and refreshes status control `0x109` or schedules pending step `1` with control `0x11` updates depending on the current launch-side state; action `6` validates the staged text against the active dataset and schedules pending step `6` when the launcher substate remains armed.,ghidra + rizin + llvm-objdump
0x004efe80,1388,multiplayer_window_init_globals,shell,thiscall,inferred,ghidra-headless,4,Initializes the Multiplayer.win shell window family and its large backing state block. The constructor seeds the shared vtable at 0x005d12ac clears multiplayer globals under 0x006d1274 through 0x006d1288 allocates and zeroes a 0x100f2-byte data block stored at 0x006d1270 registers the active singleton at 0x006d1268 pushes the Multiplayer.win resource into the standard shell window setup helper and then continues with multiplayer-specific list and status initialization.,ghidra + rizin + llvm-objdump + strings
0x004f03f0,3612,multiplayer_window_service_loop,shell,cdecl,inferred,ghidra-headless,3,Top-level Multiplayer.win service loop. The function performs an early startup countdown through `0x006cd90c` calls multiplayer_service_pending_status_state_machine processes the special pending-step-10 gate with latch byte `0x006d1292` clears one text field when pending step 2 completes and then continues into the broader multiplayer update loop with timed retries staged-text synchronization peer-roster and map-entry list refresh helpers object-state checks and several mode-specific update branches. It queues requested action 5 after rebuilding one selected-map preview follow-up path and requested action 6 after the validated staged-text follow-up dialog branch. The launch-side inline wrappers now separate into three behaviors: a peers-not-ready warning dialog on resource `0xf15`; an add-open-slot path that seeds `0x006cec7c+0x83` stores the callback owner in `0x006d4110` and refreshes status control `0x109`; and a missing-session or slot-capacity warning path that opens modal dialogs on resources `0x2cf` `0x2b8` or `0x2b9`.,ghidra + rizin + llvm-objdump
0x004f13e0,167,multiplayer_restore_preview_state_from_globals,shell,thiscall,inferred,ghidra-headless,3,Restores the Multiplayer.win preview UI from the current global mode and preview-state fields. The callback refreshes the mode-dependent labels through multiplayer_update_preview_mode_labels mirrors selection presence into the active shell object toggles the 0x006d1291 recursion guard replays multiplayer_select_preview_mode_and_refresh and multiplayer_refresh_map_preview_panel using the saved fields at [this+0x7c] and [this+0x78] and if the active preview resources are missing schedules pending status step 7 by writing 0x006d1278 and 0x006d1280 instead of forcing an immediate redraw.,ghidra + rizin + llvm-objdump + strings
0x00502220,813,paint_terrain_load_selected_gmt_surface,shell,cdecl,inferred,ghidra-headless,4,Loads or refreshes the currently selected .gmt-backed preview surface for the PaintTerrain tool family rooted at 0x006d14bc and tied to the PaintTerrain.win or GroundTerrain.tga branch. The routine validates the selected filename suffix copies selected strings into the active record updates tool status bytes and counters formats several shell text fields through 0x00540120 and finishes by decoding a 256x256 image through 0x0053f830 and surface_init_rgba_pixel_buffer.,ghidra + rizin + llvm-objdump + strings
0x00502550,456,paint_terrain_refresh_status_panel,shell,cdecl,inferred,ghidra-headless,3,Refreshes the PaintTerrain tool status or selection panel after the active .gmt surface changes. The helper reads the PaintTerrain singleton at 0x006d14bc consults shell selection globals and lookup tables formats several text or numeric fields through 0x00540120 and toggles the side flag at 0x006d14a8 before returning.,ghidra + rizin + llvm-objdump + strings
0x00502720,144,paint_terrain_tool_init_globals,shell,thiscall,inferred,ghidra-headless,4,Initializes the PaintTerrain shell tool singleton rooted at 0x006d14bc. The constructor seeds the tool vtable and default fields registers the active instance globally and is selected directly from shell_transition_mode alongside the neighboring terrain-edit tool constructor at 0x004ee3a0.,ghidra + rizin + llvm-objdump + strings
0x0047d810,182,placed_structure_remove_route_entry_key_and_compact,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Removes one matching `u16` route-entry key from the six-byte route-entry list rooted at `[this+0x462]/[this+0x466]`. The helper scans the current list, copies surviving six-byte entries into a newly allocated compacted buffer, frees the old buffer, stores the replacement pointer back into `[this+0x466]`, and decrements the route-entry count at `[this+0x462]`. Current grounded caller is the linked-site refresh or teardown branch at `0x0040e102`, so this now looks like the keyed remove-and-compact companion to the linked site's route-entry list rather than another generic free helper.","objdump + caller xrefs + callsite inspection + route-entry-list compaction correlation"
0x0047d8e0,346,placed_structure_load_dynamic_side_buffers_from_stream,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Deserializes the variable-size side buffers on one placed-structure record from the caller-supplied persistence stream. The helper reads tagged blocks through `0x00531360` and `0x00531150`, repopulates the six-byte route-entry list at `[this+0x462]/[this+0x466]`, the three five-byte-per-site arrays rooted at `[this+0x24]` from count `[this+0x30]`, the five eight-byte proximity-bucket arrays counted at `[this+0x590..0x5a0]` and rooted at `[this+0x5a4..0x5b4]`, and the trailing twelve-byte scratch band at `[this+0x34]/[this+0x38]`, then clears `[this+0x5bd]` and re-enters `0x00407780`. Current direct caller is the collection-level load pass at `0x00481464`. The real body begins at `0x0047d8e0` even though current recovered calls target the preceding padding slot `0x0047d8d0`.","objdump + caller xrefs + callsite inspection + stream-layout correlation"
0x0047dcd0,64,placed_structure_clear_proximity_bucket_lists,map,thiscall,inferred,objdump + caller xrefs + data-layout inspection,3,"Clears the five proximity-bucket arrays rooted at `[this+0x5a4..0x5b4]`, zeroes the corresponding per-bucket counts at `[this+0x590..0x5a0]`, and resets the total proximity-entry count at `[this+0x5b8]`. Current grounded callers are the linked-site teardown pass at `0x00480590` and the sibling route-anchor refresh family at `0x00480719`, so this now reads as the common clear step for the nearby-site bucket family rather than a generic free helper.","objdump + caller xrefs + data-layout inspection + proximity-bucket correlation"
0x0047dd10,130,placed_structure_remove_site_id_from_proximity_bucket_lists,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Removes one matching site id from every proximity bucket rooted at `[this+0x590..0x5b8]`. The helper scans all five bucket arrays, matches the supplied site id against the first dword of each eight-byte entry, compacts the surviving tail when needed, decrements the per-bucket count, and decrements the total count at `[this+0x5b8]`. Current direct caller is the collection sweep at `0x004814e9`, which makes this the remove-one-site companion to the nearby-site bucket append path rather than a broader route helper.","objdump + caller xrefs + callsite inspection + proximity-bucket correlation"
0x0047fdb0,317,placed_structure_append_nearby_transit_site_distance_bucket_entry,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Appends one nearby station-or-transit site into the current record's five proximity buckets. The helper first requires the caller-supplied peer record to pass `0x0047fd50`, then measures the current-to-peer distance through `0x00455800`, `0x00455810`, and `math_measure_float_xy_pair_distance` `0x0051db80`, rejects peers outside the fixed distance threshold at `0x005c8738`, classifies the surviving peer through `0x0040d350`, and finally appends one `(peer site id, distance)` pair into the corresponding eight-byte bucket array at `[this+bucket*4+0x5a4]` while incrementing both the per-bucket count and total count `[this+0x5b8]`. Current direct caller is the collection sweep at `0x004814a9`.","objdump + caller xrefs + callsite inspection + distance-threshold correlation + proximity-bucket correlation"
0x00482d10,110,runtime_query_cached_local_exe_version_float,simulation,thiscall,inferred,objdump + local disassembly,3,"Returns one cached local executable version as a float-like `major + minor/100` value. On first use the helper queries the version-info resource of the literal stem `RT3.EXE` at `0x005cec18` through `0x0055d9c0`, splits the returned packed dword into low and high 16-bit words, converts them into one float as `hi + lo/100.0`, caches the result at `0x006cec5c`, and returns that cached value on later calls. The sibling formatter `0x00482d80` and the rounded hundredths query `0x00482e00` both consume the same source, which now makes this the clearest current owner for the local `1.03/1.04/1.05/1.06`-style version float rather than a gameplay progress value.","objdump + local disassembly + version-resource correlation"
0x00482d80,128,runtime_query_cached_local_exe_version_string,simulation,thiscall,inferred,objdump + local disassembly + string inspection,3,"Returns one cached local executable version string formatted from the same `RT3.EXE` version-info source used by `0x00482d10`. On first use the helper queries the packed local version dword through `0x0055d9c0`, formats it with the literal pattern `%d.%02d` at `0x005ced5c`, allocates one small shell string object at `0x006cec24`, and returns that cached string on later calls. Current grounded callers include `multiplayer_session_event_publish_registration_field` `0x0046a6c0` and the later shell text path at `0x00503254`, which makes this the clearest current local version-string owner.","objdump + local disassembly + string inspection + caller xrefs + version-resource correlation"
0x00482e00,70,runtime_query_hundredths_scaled_build_version,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared rounded hundredths-scaled build-version query used by route, company, train, and world-side logic. In the ordinary local path the helper consults the cached local executable version float from `runtime_query_cached_local_exe_version_float` `0x00482d10`, adds the fixed offset `0.0001`, multiplies by `100.0`, and rounds the result through the CRT helper at `0x005a10d0`, which makes the local outputs line up with integer build values such as `0x67/0x68/0x69/0x6a == 1.03/1.04/1.05/1.06`. When the multiplayer-side runtime rooted at `0x006cd8d8` is active, or when the local scenario-state gate at `0x004349a0` reports a later mode, it instead delegates to the multiplayer companion path at `0x0046a4b0`, which can reuse a cached network-side integer at `0x006cd96c` or scan live session-peer version fields before falling back to the same local executable-version path. Current grounded callers include the city-connection route builder `0x00402cb0`, the auxiliary tracker pair-metric dispatcher `0x004a65b0`, and numerous neighboring world-side maintenance branches. This is no longer best-read as a gameplay progress or era index: the recovered threshold pattern is a shared executable or session build-version gate.","objdump + caller xrefs + local disassembly + multiplayer-fallback correlation + version-resource correlation + threshold-correlation"
0x004801a0,105,placed_structure_is_linked_transit_site_reachable_from_company_route_anchor,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Boolean gate between one linked transit site and one company-side route anchor. The helper first requires the current placed structure to pass the station-or-transit gate `0x0047fd50`, then requires its linked-instance class test through `0x0040c990 == 1`. It resolves the caller-supplied company id through the live company collection `0x0062be10`, asks that company for one cached route-anchor entry id through `company_query_cached_linked_transit_route_anchor_entry_id` `0x00401860`, resolves the site's own route-entry anchor through collection `0x006cfca8`, and finally re-enters `0x0048e3c0` to test whether the two route-entry anchors lie in the same reachable route-side family. Current grounded caller is `company_rebuild_linked_transit_site_peer_cache` `0x004093d0`, where this helper gates whether a foreign linked transit site can still participate in the current company's peer cache.","objdump + caller xrefs + callsite inspection + linked-transit reachability correlation"
0x00480590,371,placed_structure_teardown_linked_site_runtime_state_before_removal,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Tears down the mutable runtime side of one linked placed-structure record before collection removal. The helper clears the route-style scratch lane through `0x004077e0`, clears the proximity buckets through `placed_structure_clear_proximity_bucket_lists` `0x0047dcd0`, frees the trailing scratch buffer at `[this+0x34]`, clears the route-link list through `0x0047f320`, detaches or invalidates the current route-entry anchor at `[this+0x08]` through the route-entry collection `0x006cfca8`, recomputes the current grid-keyed owner lane through `0x0042bbf0`, frees the three per-site byte arrays at `[this+0x24..0x2c]`, clears this record's indexed byte in the corresponding arrays of every later placed-structure record in `0x006cec20`, and finally re-enters the scenario-side follow-on at `0x00436040` with the current site id. Current direct caller is `placed_structure_collection_remove_linked_site_record` `0x004813d0`, so this now looks like the linked-site teardown pass rather than another route-anchor refresh helper.","objdump + caller xrefs + callsite inspection + linked-site teardown correlation"
0x00480bb0,1535,placed_structure_refresh_linked_site_display_name_and_route_anchor,map,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,3,"Single-site post-create or post-edit refresh helper reached from `placed_structure_finalize_creation_or_rebuild_local_runtime_state` `0x0040ef10` when the current placed structure keeps one linked site id at `[this+0x2a8]`. The helper operates on that linked placed-structure record, optionally rebuilds one route-entry anchor at `[this+0x08]` through `route_entry_collection_try_build_path_between_optional_endpoint_entries` `0x004a01a0` with both optional endpoint-entry ids unset and literal policy byte `2`, then binds the chosen route entry back to the site through `0x0048abc0` and re-enters `aux_route_entry_tracker_collection_refresh_route_entry_group_membership` `0x004a45f0` so the auxiliary tracker family at `0x006cfcb4` can regroup around the refreshed anchor. Current caller correlation makes that byte the strongest current match for the broader linked-site route-anchor rebuild lane, as opposed to the narrower direct endpoint-anchor creation or replacement lane that neighboring repair branches drive through literal byte `1` into `0x00493cf0`. It also rebuilds the display-name buffer at `[this+0x46b]`: when the current site coordinates resolve a city or region entry through `0x0044a830` it copies that entry name from `[entry+0x356]`, optionally appends one civic suffix from RT3.lng ids `585..588` `Township`, `New`, `Modern`, and `Renaissance`, and on special linked-instance class branches appends `589` `Service Tower` or `590` `Maintenance Facility` with per-city counters instead. When no city entry resolves it falls back to `591` `Anytown`. The ordinary non-special branch also rotates through RT3.lng ids `578..584` `Junction`, `Crossing`, `Depot`, `Corners`, `Exchange`, `Point`, and `Center` via the static table at `0x005f2cf8`. After trimming trailing spaces it conditionally re-enters `placed_structure_route_link_collection_recompute_all_endpoint_pair_state` `0x004682c0` when the narrower station-or-transit gate `0x0047fd50` passes, clears or seeds adjacent city-side cached state through `0x004358d0` and `0x00420650`, and returns. Current direct caller is `0x0040f626`, so this now looks like the linked-site display-name and route-anchor refresh beneath placed-structure finalization rather than another city-connection owner.","objdump + caller xrefs + callsite inspection + RT3.lng strings + route-anchor correlation + linked-site refresh correlation + linked-site policy-byte split correlation + tracker-regrouping correlation"
0x00481390,55,placed_structure_collection_allocate_and_construct_linked_site_record,map,thiscall,inferred,objdump + caller xrefs + constructor inspection,3,"Small allocator wrapper over the live placed-structure collection at `0x006cec20`. The helper allocates one fresh collection entry id through `0x00518900`, resolves the new record through `0x00518140`, and then hands the new id plus the caller-supplied anchor site id and coordinate pair into `placed_structure_construct_linked_site_record_from_anchor_and_coords` `0x00480210`. Current direct caller is `placed_structure_construct_entry_from_candidate_and_world_args` `0x0040f6d0`, where the returned id is published into `[site+0x2a8]` when the backing candidate subtype byte `[candidate+0x32]` is `1`. This now looks like the allocator wrapper for the linked-site records used by the later policy-`1` and policy-`2` route-anchor refresh families rather than another anonymous collection helper.","objdump + caller xrefs + constructor inspection + linked-site correlation"
0x004813d0,91,placed_structure_collection_remove_linked_site_record,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Removes one linked-site record from the live placed-structure collection. The helper resolves the supplied site id through `0x006cec20`, derives one station-or-transit or linked-instance-class latch through `0x0047de00 -> 0x0040c990`, runs `placed_structure_teardown_linked_site_runtime_state_before_removal` `0x00480590`, and then removes the collection entry through `0x00518a30`. When scenario field `[0x006cec78+0x4c93]` is clear and the removed record passed the narrower latch, it also re-enters the company-wide follow-on at `0x00429c10`. Current direct caller is the subtype-`1` destruction path around `0x0040f626`.","objdump + caller xrefs + callsite inspection + linked-site removal correlation"
0x00481430,72,placed_structure_collection_load_dynamic_side_buffers_from_stream,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Collection-level load pass for the variable-size side buffers on placed-structure records. When the shell or world-side stream slot at `[0x006cec74+0x1c7]` is present, the helper walks the live placed-structure collection at `0x006cec20`, resolves each record by id, and re-enters `placed_structure_load_dynamic_side_buffers_from_stream` `0x0047d8e0` on it. Current direct caller is the wider post-load world-side refresh path at `0x00433b93`.","objdump + caller xrefs + callsite inspection + stream-load correlation"
0x00481480,64,placed_structure_collection_append_site_into_all_proximity_bucket_lists,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Walks the live placed-structure collection at `0x006cec20` and asks every record to consider one caller-supplied peer site for proximity-bucket insertion. The helper resolves each live record and re-enters `placed_structure_append_nearby_transit_site_distance_bucket_entry` `0x0047fdb0` with the supplied peer placed-structure pointer. Current direct callers are the subtype-`4` update paths at `0x0040ec73` and `0x0040fa11`, so this now reads as the add-peer sweep for the nearby-site bucket family rather than another generic collection iterator.","objdump + caller xrefs + callsite inspection + proximity-bucket correlation"
0x004814c0,64,placed_structure_collection_remove_site_id_from_all_proximity_bucket_lists,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Walks the live placed-structure collection at `0x006cec20` and asks every record to remove one caller-supplied site id from its proximity buckets. The helper resolves each live record and re-enters `placed_structure_remove_site_id_from_proximity_bucket_lists` `0x0047dd10` with the supplied site id. Current direct callers are the subtype-`4` pre-update or pre-destroy paths at `0x0040e0a2` and `0x0040ebc7`.","objdump + caller xrefs + callsite inspection + proximity-bucket correlation"
0x00429c10,88,company_collection_refresh_active_company_linked_transit_site_peer_caches,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Collection-wide company sweep above the linked-transit peer cache family. The helper first counts the active companies in the live company collection at `0x0062be10` by testing `[company+0x3f]`, then walks that active ordinal range through `company_collection_get_nth_active_company_id` `0x00429a90` and re-enters `company_rebuild_linked_transit_site_peer_cache` `0x004093d0` on each resolved company record. Current grounded callers are the linked-site removal follow-on at `0x00481421` and the wider world-side company refresh branch at `0x00444c9c`.","objdump + caller xrefs + callsite inspection + active-company sweep correlation"
0x00481d00,612,bootstrap_parse_command_line_flags,bootstrap,cdecl,inferred,ghidra-headless,4,Parses the startup command line from ECX handling slash and dash switches and writes multiple bootstrap globals and option buffers before shell service init.,ghidra + rizin
0x00481fd0,348,bootstrap_scan_autorun_media,bootstrap,cdecl,inferred,ghidra-headless,4,Scans drive letters for RT3 autorun marker files rt3d1.txt and rt3d2.txt using GetDriveTypeA and open or close helpers before deeper shell init.,ghidra + rizin
0x00482160,101,shell_state_service_active_mode_frame,shell,thiscall,inferred,objdump + analysis-context,4,Acts as the broader shell-state service pass around one active-mode update on the shell state rooted at 0x006cec74. The helper increments nested-service depth at [this+0x64] optionally notifies the active mode object at 0x006cec78 through 0x0051f940 and 0x00434050 primes the shell runtime at 0x006d401c through 0x00538b60 conditionally services the Multiplayer preview-dataset object at 0x006cd8d8 through 0x00469720 and then dispatches shell_service_frame_cycle on the global shell controller at 0x006d4024 before decrementing the depth counter.,objdump + analysis-context + caller xrefs
0x004821d0,1019,shell_recompute_layout_slots,bootstrap,thiscall,inferred,ghidra-headless,4,Recomputes the shell layout-slot table after resolution or related display selectors change; derives normalized coordinates from static float tables updates 144 slot entries through the shell bundle child at [0x006d4024+0x18] and then commits the refreshed state.,ghidra + rizin
0x00482ec0,1359,shell_transition_mode,bootstrap,thiscall,inferred,ghidra-headless,4,Switches the shell state's active mode at [this+0x08] tearing down any prior mode object selecting one of seven mode-specific handlers and updating globals like 0x006cec78 before notifying the shell bundle through 0x00538e50.,ghidra + rizin
0x005a2d64,101,crt_init_exit_handlers,startup,cdecl,inferred,ghidra-headless,3,Initializes on-exit tables and registers atexit handling before control reaches application startup.,ghidra + rizin
0x005a30f2,34,__amsg_exit,startup,cdecl,inferred,ghidra-headless,4,CRT fatal-exit helper that forwards startup failures into __exit.,ghidra + rizin
0x005a3117,36,crt_fast_error_exit,startup,cdecl,inferred,ghidra-headless,4,Startup error path that optionally emits the CRT banner then formats the failure and terminates through ___crtExitProcess.,ghidra + rizin
0x005a313b,423,crt_startup_entrypoint,startup,cdecl,inferred,ghidra-headless,4,PE entrypoint for patch 1.06; performs CRT and environment setup then validates early state before handing off to application bootstrap.,sha256:01b0d2496cddefd80e7e8678930e00b13eb8607dd4960096f527564f02af36d4 + ghidra + rizin + llvm-objdump
0x0053b020,70,bootstrap_reset_locale_state,bootstrap,unknown,inferred,ghidra-headless,2,Calls the locale helper at 0x0053ae70 then frees and clears related global pointers before later shell setup continues.,ghidra + rizin
0x0053b010,11,bootstrap_mark_runtime_started,bootstrap,cdecl,inferred,ghidra-headless,2,Single-purpose bootstrap helper that flips a process-global started flag to one before branding and shell setup continue.,ghidra + rizin
0x0054e6d0,42,bootstrap_capture_keyboard_state,bootstrap,cdecl,inferred,ghidra-headless,4,Single-purpose bootstrap probe that snapshots the host keyboard state through GetKeyboardState.,ghidra + rizin
0x00540a47,75,shell_control_refresh_matching_dynamic_text_payload,shell,unknown,inferred,objdump + caller inspection,3,"Small shell-control helper used on one matching control descriptor during refresh or replacement. When the incoming control id matches `[control+0x4]`, the helper frees any prior heap-backed text payload at `[control+0xce]`, clears that field, optionally copies a replacement payload from the caller descriptor through `0x0051d820`, and then returns `0` when the incoming control type is `0x6f` or `1` otherwise. Current grounded importance is the `CompanyDetail.win` section-0 overview widget `0x947f`: together with the sibling helper at `0x005639d2`, this makes type `0x6f` look like a special heap-backed dynamic-text control rather than an ordinary callback widget.","objdump + caller inspection + type-0x6f control correlation"
0x005639d2,22,shell_control_release_dynamic_text_payload,shell,unknown,inferred,objdump + caller inspection,3,"Tiny shell-control release helper that clears one control's attached payload through `0x0051d820` and then returns `0` when the control type at `[this+0x0]` is `0x6f` or `1` otherwise. Current grounded importance is the same CompanyDetail section-0 overview lane around control `0x947f`, where this reinforces that type `0x6f` is treated as a special dynamic-text family with its own release path instead of a normal callback-style widget.","objdump + caller inspection + type-0x6f control correlation"
0x0055da40,424,bootstrap_probe_system_profile,bootstrap,cdecl,inferred,ghidra-headless,4,Collects GlobalMemoryStatus and CPUID feature bits then stores coarse machine capability flags used by later bootstrap decisions.,ghidra + rizin
0x00507b90,346,station_place_refresh_category_controls,shell,cdecl,inferred,objdump + strings + RT3.lng,4,"Refreshes the StationPlace.win category and mode controls for the current placement mode stored at 0x00622af4. The helper now grounds the six top-level category buttons rooted at 0x697c through 0x6981 as `Place a small station` 2197, `Place a medium station` 2198, `Place a large station` 2199, `Place a service tower` 2200, `Place a maintenance facility` 2201, and `Place a non-station building` 2202. It also refreshes the dependent controls around 0x69c8 0x69c9 0x6985 0x6986 and 0x6983 through 0x00540120; current evidence now bounds 0x6985 and 0x6986 as a two-state station-rotation policy toggle keyed by 0x006d1728, where 0x6985 aligns with `When placing the building, it will rotate itself as needed to orient to track or avoid obstacles.` string 2207 and 0x6986 aligns with `When placing the building, it will strictly adhere to the rotation specified by the circle above.` string 2206. In non-station-building mode 5 it can also seed [this+0x8c] from the active StationPlace list control under 0x006d1720 before preview formatting continues.",objdump + strings + RT3.lng + caller xrefs + callsite inspection
0x00508550,363,station_place_format_selected_site_summary,shell,cdecl,inferred,objdump + strings,3,Formats the selected StationPlace target summary for the live tool object. It looks up the active placement record index [this+0x8c] in 0x0062b2fc follows secondary data through field +0x173 into 0x0062b268 combines that with the current staged world coordinates at 0x006d1738 and 0x006d173c and emits the localized summary block through 0x00540120 into the StationPlace.win status area.,objdump + strings + caller xrefs + callsite inspection
0x00508730,292,station_place_format_preview_panel,shell,cdecl,inferred,objdump + strings,4,Formats the StationPlace.win preview panel for the currently selected placement record stored at [arg_4h+0x8c]. It chooses preview assets like 2DLabel.imb 2DCity.imb 2DVent.imb 2DMist.imb and 2DVolcano.imb for control 0x6982 and emits the matching text block through control 0x6984 using the geography tables rooted at 0x0062b2fc and 0x0062b268.,objdump + strings + caller xrefs + callsite inspection
0x00508880,727,station_place_select_category_and_refresh,shell,cdecl,inferred,objdump + strings + RT3.lng,4,"Primary StationPlace.win category and selection refresh helper. It stores the requested placement mode at 0x00622af4, where current grounded evidence now maps 0..5 to small station, medium station, large station, service tower, maintenance facility, and non-station building. For the three station modes it also enables the secondary style strip rooted at 0x6988 0x6989 and 0x698c, where 0x6988 and 0x6989 cycle the current building style and 0x698c displays the active style token built from `StationSml` `StationMed` or `StationLrg` plus one of the six localized architecture styles `Victorian` 2672 `Tudor` 2671 `Southwest` 2670 `Persian` 2669 `Kyoto` 2668 and `Clapboard` 2667; the player-facing tooltip for that strip is `Scroll through building styles.` string 2203. The helper resolves the current selection through 0x00622af0 and 0x00622aec, repopulates the StationPlace list controls at 0x69df and 0x69e3, and then refreshes the preview and category panels through 0x00508730 and 0x00507b90.",objdump + strings + RT3.lng + caller xrefs + callsite inspection
0x00508bb0,510,station_place_world_surface_sync_and_dispatch,shell,thiscall,inferred,objdump + caller xrefs + strings,4,"Shared world-surface helper for the active StationPlace.win tool object. It accepts direct `0x07d6` control traffic from the window dispatcher or falls back to the same shell detail-panel surface looked up through 0x006d0818, rechecks flag bit 0x4 on that control, performs world hit tests through 0x00448ac0, stages world coordinates into 0x006d1738 and 0x006d173c, refreshes the selected-site summary through 0x00508550, and updates the live placement selection globals at 0x00622af0 0x00622aec and 0x006d1740 plus helper objects rooted at [this+0x80] [this+0x84] and [this+0x88]. This makes it the clearest StationPlace-side consumer of the shared main-world interaction surface rather than only a passive status refresh helper.",objdump + caller xrefs + strings + callsite inspection
0x005091b0,967,station_place_window_handle_message,shell,thiscall,inferred,objdump + strings + RT3.lng,4,"Primary message dispatcher for the StationPlace.win tool object at 0x006d1720. It switches over the incoming shell message id then handles the StationPlace control family rooted at category ids 0x697c through 0x6981, now grounded as the player-facing small station, medium station, large station, service tower, maintenance facility, and non-station-building buttons from strings 2197 through 2202. It also handles the style-strip controls at 0x6988 and 0x6989, which cycle the current building-style override used by station categories, the dependent controls around 0x6985 and 0x6986, now bounded as the two station-rotation policy choices from strings 2207 and 2206, the dedicated station-rotation circle control 0x6987, the list controls 0x69df and 0x69e3, and the shared world-surface control 0x07d6. The handler routes category and selection changes through 0x00508880 and 0x00507b90, uses 0x00507d80 for the live station-rotation drag/update branch, and delegates the world-hit-test path through 0x00508bb0. That makes it the clearest grounded owner for StationPlace player-facing tool commands rather than only a constructor plus frame hook.",objdump + strings + RT3.lng + caller xrefs + callsite inspection
0x00509d80,1936,station_place_window_construct,shell,thiscall,inferred,objdump + strings + RT3.lng,4,"Constructs the StationPlace.win world-tool window object later published at 0x006d1720. The constructor seeds the vtable at 0x005d17c0 binds the StationPlace.imb helper asset and StationPlace.win resource through 0x0053d110 and 0x0053fa50 clears local selection and preview fields rooted at [this+0x7c] through [this+0x94], seeds the dedicated station-rotation circle control at 0x6987 through callback 0x00507a90, seeds the list controls 0x69df and 0x69e3, and stores the singleton plus helper handle globally at 0x006d1720 and 0x006d1724. Current evidence ties that 0x6987 branch to the player-facing `Click to rotate the building. You can also use bracket keys [ and ] to rotate buildings.` string 2208 rather than to the older `Building placement center` string 671; current recovered StationPlace code paths do not show a direct live lookup of string id 671 at all, which makes it look more like a stale or legacy label than a surviving control caption in the present window flow. The current grounded caller is the shell detail-panel constructor branch at 0x004dddc4.",objdump + strings + RT3.lng + caller xrefs + callsite inspection
0x0050a530,64,station_place_window_service_frame,shell,thiscall,inferred,objdump + caller xrefs,3,Recurring StationPlace.win service pass for the live station-placement tool object at 0x006d1720. The helper checks the local latch at [this+0x94] plus current shell or world selection state and then delegates one branch into 0x00508bb0 for follow-up station-placement synchronization on the same shared `0x07d6` main-world surface used by the dispatcher when the surrounding world tool remains active. Current grounded callers sit in the same recurring world and shell post-frame hooks used by sibling world-tool windows at 0x004423df 0x00444eda and 0x00445a64.,objdump + caller xrefs + callsite inspection
0x0050d2d0,1245,track_lay_window_refresh_controls,shell,thiscall,inferred,objdump + strings + RT3.lng,4,"Refreshes the visible TrackLay.win control state after mode or preference changes. The helper highlights the three mutually exclusive primary mode buttons rooted at control ids 0x985e 0x985f and 0x9860 from the shared track-lay mode field at 0x00622b0c; current primary evidence now strongly aligns those grounded values as 1=`Lay single track.` string id 2054 4=`Lay double track.` string id 2055 and 0x40=`Bulldoze` string id 1721. The same refresh pass also updates the bridge-type selector family rooted at 0x006cec74+0x138 through controls 0x9861 and above; formats the two wrapped frequency values at 0x006cec74+0x140 and 0x006cec74+0x13c into controls 0x9870 and 0x9871 using the localized `Never` through `Common` string ids 615 through 618; and updates the two boolean preference toggles rooted at 0x006cec74+0x144 and 0x006cec78+0x4c74 through controls 0x986e and 0x986d. Current evidence now strongly aligns that pairing as 0x986e or 0x006cec74+0x144 = `Auto-Hide Trees During Track Lay` strings 1838 and 1839 and 0x986d or 0x006cec78+0x4c74 = `Auto-Show Grade During Track Lay` strings 3904 and 3905: the first toggle lives in the compact track-lay preference block alongside bridge and frequency settings while the second lives in the broader display-runtime block and fits the grade-overlay behavior. The same refresh path also updates the electrify-all action control at 0x9873 and the surrounding status widgets, which makes it the clearest grounded owner for the TrackLay.win status panel rather than only a generic shell redraw.",objdump + strings + RT3.lng + callsite inspection
0x0050e1e0,534,track_lay_window_service_frame,shell,thiscall,inferred,objdump + caller xrefs + strings,4,"Recurring TrackLay.win service pass for the active track-lay tool object at 0x006d1a8c. The helper decrements the local reentry guard at [this+0x87] and when the pass is active it either routes the current track-lay drag state through 0x0050d740 while the grounded `Bulldoze` mode value 0x40 is live in 0x00622b0c or synchronizes the staged world-interaction state back into the live world owner through 0x006cfca8 and 0x0050dce0. The same service family also special-cases control id 0x07d6 through the tool-owned current-control field [this+0x7e], which now strongly suggests that 0x07d6 is the shared main-world interaction surface for TrackLay.win rather than a generic shell-detail button. Current grounded callers sit in the recurring world and shell post-frame hooks at 0x004423ee 0x00444ee9 and 0x00445a73.",objdump + caller xrefs + strings + callsite inspection
0x0050e400,448,track_lay_window_construct,shell,thiscall,inferred,objdump + caller xrefs + strings,4,Constructs the TrackLay.win world-tool window object later published at 0x006d1a8c. The constructor seeds the vtable at 0x005d191c clears the tool-state fields rooted at [this+0x78] [this+0x7d] [this+0x82] and [this+0x87] binds the TrackLay.win resource through 0x0053fa50 refreshes the visible control set through 0x0050dc00 snapshots one world span from 0x0062c120 into 0x006d1a94 and stores the singleton globally before returning. The current grounded caller is the shell detail-panel constructor branch at 0x004ddecd.,objdump + caller xrefs + strings + callsite inspection
0x0050e5c0,3867,track_lay_window_handle_message,shell,thiscall,inferred,objdump + strings + RT3.lng,4,"Primary message dispatcher for the TrackLay.win tool object at 0x006d1a8c. It switches over the incoming shell message id then handles control ids in the TrackLay.win family such as 0x9858 through 0x9874 plus the special world-surface control 0x07d6. The handler uses world hit tests through 0x00448ac0 to arm and release the drag latch at [this+0x7d] on 0x07d6 transitions, routes the active mode through the shared track-lay state at 0x00622b0c including the now-bounded primary values 1=`Lay single track.` 4=`Lay double track.` and 0x40=`Bulldoze`, updates the selected world object path rooted at 0x006cfca8+0x118, and refreshes the tool UI through 0x0050d2d0 0x0050d740 and 0x0050dce0. The same dispatcher also owns the TrackLay.win preference and action controls: it toggles the two boolean track-lay options rooted at 0x006cec74+0x144 and 0x006cec78+0x4c74, where current evidence now strongly aligns the first control branch at 0x985a with `Auto-Hide Trees During Track Lay` and the later `0x006cec78+0x4c74` branch with `Auto-Show Grade During Track Lay`; it also cycles the bridge-type selector family at 0x006cec74+0x138, wraps the two frequency settings at 0x006cec74+0x140 and 0x006cec74+0x13c, and routes the electrify-all command through the localized confirmation and failure strings 3083 3084 3837 and 3900. This makes it the clearest grounded owner for player-facing TrackLay.win commands rather than only a passive status panel.",objdump + strings + RT3.lng + callsite inspection
0x0051d900,155,string_find_substring_ex,support,cdecl,inferred,ghidra-headless,3,Reusable substring finder that returns a pointer to the first matching window in the haystack or null. It precomputes both string lengths then slides across the haystack calling one of two compare helpers depending on the mode flag pushed on the stack; the graphics branch uses it to probe adapter strings for legacy GPU-profile tokens and bootstrap code uses it for startup media or compatibility string checks.,ghidra + rizin + llvm-objdump
0x0051d870,21,bootstrap_seed_tick_count,bootstrap,cdecl,inferred,ghidra-headless,4,Lazily snapshots GetTickCount into a bootstrap-global cache so later subsystems start from a nonzero host tick baseline.,ghidra + rizin
0x0051ebc0,731,shell_reset_display_runtime_defaults,shell,cdecl,inferred,ghidra-headless,3,Resets the global display runtime defaults rooted at 0x006d4024. It clears the large display-settings block under offsets 0x11468a and above seeds default resolution and capability flags from mode 0x006d4028 and reinitializes several shell display toggles before later preset application continues.,ghidra + rizin + llvm-objdump
0x0051eea0,128,shell_save_display_runtime_config,shell,cdecl,inferred,ghidra-headless,4,Writes the larger display-runtime blob to data\\configuration\\engine.cfg. It stores version key 0x41b serializes the 0x1e4-byte runtime block rooted at [this+0x11468a] and writes an additional 0x1ec-byte companion block before closing the file.,ghidra + rizin + llvm-objdump + strings
0x0051ef20,194,shell_load_display_runtime_config_or_init_defaults,shell,cdecl,inferred,ghidra-headless,4,Loads the larger display-runtime blob from data\\configuration\\engine.cfg. When the file is missing invalid or already superseded by mode state at 0x006d4028 it falls back to 0x0051ebc0 and 0x0051eea0; otherwise it validates key 0x41b restores the 0x1e4-byte and 0x1ec-byte blocks and clears one shell display flag when [this+0x11474a] is set.,ghidra + rizin + llvm-objdump + strings
0x0051f0f0,3,shell_controller_get_window_handle,shell,thiscall,inferred,objdump + import-table,4,Returns the native shell window handle stored at [this+0x00]. Callers forward the returned handle into USER32 imports such as SetFocus SetMenu and SetCapture during shell startup and presentation interaction.,objdump + USER32 import table + callsite xrefs
0x0051f1d0,90,shell_signal_deferred_work_item_shutdown,shell,thiscall,inferred,ghidra-headless,3,Walks the shell deferred-work item queue at [this+0x1136a5] and inspects each queued payload object's nested message queue at [item+0xe4]. When intrusive_queue_peek_tail_payload finds a nonnull tail payload it clears the outer queued-handle slot at [item+0xe8] and appends a null sentinel into the nested queue through intrusive_queue_push_back before continuing iteration.,ghidra + rizin + llvm-objdump
0x0051f230,128,shell_enqueue_deferred_work_message,shell,thiscall,inferred,ghidra-headless,4,Routes one deferred-work message through the shell queue system. When the global routing gate at 0x006d4034 and shell flag [this+0x11369c] are both set it feeds the special queue at [this+0x11369d]; otherwise a nonnull payload object is queued once in [this+0x1136a5] with the returned queue-node handle cached at [item+0xe8] and the message is appended to the payload-owned nested queue at [item+0xe4] while a null payload appends directly into the fallback queue at [this+0x1136a1].,ghidra + rizin + llvm-objdump
0x0051f2b0,104,shell_post_deferred_message_type5,shell,thiscall,inferred,ghidra-headless,4,Allocates one 0x5e-byte deferred-message record from the shell-owned slab rooted at [this+0x5c] using count [this+0x58] tags it as type 0x05 stores four caller dwords at offsets +0x01 +0x05 +0x09 and +0x0d and then posts the record directly into the shell deferred queue roots through [this+0x11369d] or [this+0x1136a1].,ghidra + rizin + llvm-objdump
0x0051f320,72,shell_post_deferred_message_type6,shell,thiscall,inferred,ghidra-headless,4,Allocates one 0x5e-byte deferred-message record from the same shell slab and tags it as type 0x06 before posting it directly into the shell deferred queue roots. This is the minimal direct-post sibling of the type-0x05 builder and uses the same count field at [this+0x58] and slab base at [this+0x5c].,ghidra + rizin + llvm-objdump
0x0051f370,229,shell_enqueue_deferred_message_type4,shell,thiscall,inferred,ghidra-headless,4,Allocates one 0x5e-byte deferred-message record from the shell-local slab at [this+0x5c] populates the larger multi-field payload tags it as type 0x04 mixes the shell byte [this+0x114227] into record byte +0x5d and routes the finished record through shell_enqueue_deferred_work_message.,ghidra + rizin + llvm-objdump
0x0051f460,173,shell_enqueue_deferred_message_type1,shell,thiscall,inferred,ghidra-headless,4,Allocates one 0x5e-byte deferred-message record from the same shell-local slab fills the smaller type-0x01 payload subset mixes the shell byte [this+0x114227] into record byte +0x5d and routes the finished record through shell_enqueue_deferred_work_message.,ghidra + rizin + llvm-objdump
0x0051f510,48,shell_set_gamma_ramp_scalar,shell,thiscall,inferred,ghidra-headless,4,Applies one shell gamma-ramp scalar to the active display runtime state. When the presentation service pointer at [this+0x0c] is live it forwards the scalar into 0x00547f20 for an immediate hardware upload; otherwise it only caches the requested value at [this+0x1146b9] until the service is ready.,ghidra + rizin + llvm-objdump
0x0051fd70,516,shell_update_frame_time_history,shell,thiscall,inferred,ghidra-headless,4,Updates a 256-sample frame-time history from successive GetTickCount deltas. The helper advances the ring index in 0x006d403c stores each delta under [this+0x11428a] and derives a smoothed frame scalar at [this+0x114282] for later shell frame consumers such as 0x0051ff80 and the presentation-frame path.,ghidra + rizin + llvm-objdump
0x0051ff80,7,shell_get_smoothed_frame_scalar,shell,thiscall,inferred,objdump,4,Returns the smoothed frame scalar cached at [this+0x114282]. shell_update_frame_time_history refreshes that field each frame and shell_refresh_presentation_frame consumes it during the main presentation refresh path.,objdump + callsite xrefs
0x0051ff90,24,shell_install_global_controller,shell,thiscall,inferred,objdump + analysis-context,4,Installs one shell controller as the process-global singleton at 0x006d4024 clears controller flag [this+0x114201] reruns the local state reset helper at 0x0051ea80 and returns the same controller pointer. bootstrap_init_shell_window_services calls it immediately after allocating the 0x11486e-byte controller object.,objdump + analysis-context + startup xrefs
0x00521d10,38,multiplayer_request_peer_session_control,shell,cdecl,inferred,ghidra-headless,3,Requests one direct session-control action for a resolved multiplayer peer object. When the live session transport at `0x006d40dc` is present it follows the transport-owned interface at `[ecx+0x18e]->+0x08` and invokes vtable slot `+0x68` with the target peer object and three zero trailing arguments; the current grounded callers are the `\\kick` branch and the online-peer `\\unban` follow-up path.,ghidra + rizin + llvm-objdump
0x0051fa00,56,shell_get_memory_budget_ceiling_bytes,shell,thiscall,inferred,ghidra-headless,3,Returns the current upper memory-budget bucket in bytes for the shell display runtime. When override field [this+0x1146ca] is set it maps that tier through the shared table at 0x00624c34 containing 0 1MB 2MB and 4MB entries; otherwise it starts from baseline field [this+0x1136ad] and adjusts it by the active lower-tier delta derived from [this+0x1146c6] and [this+0x1136a9] before clamping negative results to zero.,ghidra + rizin + llvm-objdump
0x0051fa40,25,shell_get_memory_budget_floor_bytes,shell,thiscall,inferred,ghidra-headless,3,Returns the current lower memory-budget bucket in bytes for the shell display runtime. When field [this+0x1146c6] is nonzero it maps that tier through the shared 0 1MB 2MB 4MB table at 0x00624c34; otherwise it falls back to baseline field [this+0x1136a9].,ghidra + rizin + llvm-objdump
0x0051fa60,63,shell_get_nonnegative_memory_budget_floor_bytes,shell,thiscall,inferred,ghidra-headless,3,Returns a nonnegative lower memory-budget value for float consumers in the shell and presentation paths. It prefers explicit tier field [this+0x1146ce] then the active floor bucket behind [this+0x1146c6] and finally baseline field [this+0x1136a9] using the shared 0 1MB 2MB 4MB table at 0x00624c34 and clamping negative results to zero.,ghidra + rizin + llvm-objdump
0x005204b0,128,shell_flush_deferred_work_queues,shell,thiscall,inferred,ghidra-headless,4,Flushes the shell controller's three deferred-work queue roots at [this+0x1136a1] [this+0x11369d] and [this+0x1136a5]. The helper clears the first two containers through intrusive_queue_clear_and_release then rewinds the deferred-item queue through intrusive_queue_rewind_iterator repeatedly pops each queued payload through intrusive_queue_next_iterator_node clears its outer queued-handle slot at [item+0xe8] and finally releases the remaining queue storage before returning. It is used at the end of shell_service_frame_cycle and from the broader shell-mode helper at 0x00443a50.,ghidra + rizin + llvm-objdump
0x00520620,141,shell_service_frame_cycle,shell,thiscall,inferred,ghidra-headless,4,Acts as the outer owner for one pending shell frame cycle on the active controller. When pending-frame state is armed through [this+0x56] and controller pointers [this+0x18] [this+0x1c] and [this+0x28] are live it runs shell_refresh_presentation_frame through 0x0052b990; otherwise it still updates frame timing through 0x0051fd70 runs the mouse-cursor frame updater 0x0053f4e0 requests the deeper layout-state rebuild path through 0x00565110 performs a one-time ShowWindow on the controller window handle at [this] drains deferred work through 0x005204b0 and clears the pending flags at [this+0x56] and [this+0x58].,ghidra + rizin + llvm-objdump
0x00521060,805,bootstrap_init_shell_service_bundle,bootstrap,cdecl,inferred,ghidra-headless,4,Builds the shell-facing singleton bundle stored through globals like 0x006d4024 0x006d402c and 0x006d4030 wiring startup width and height state an rt3_ prefixed service path and the separate shell input-state object rooted at 0x006d4018.,ghidra + rizin + objdump
0x00521390,486,bootstrap_destroy_shell_service_bundle,bootstrap,cdecl,inferred,ghidra-headless,4,Destroys the shell service bundle created by 0x00521060 releasing each global singleton and clearing 0x006d4024 0x006d402c 0x006d4030 0x006d4020 and 0x006d4018.,ghidra + rizin
0x00523d90,65,shell_commit_layout_updates,bootstrap,thiscall,inferred,ghidra-headless,3,Applies pending layout-slot changes from the shell controller into its subordinate layout-state object at [this+0x2d] by walking embedded service pointers and issuing the follow-on rebuild or refresh calls that make the updated slot table live.,ghidra + rizin
0x00523e40,51,shell_invalidate_layout_state,bootstrap,thiscall,inferred,ghidra-headless,4,Marks the shell controller's layout-state path dirty by setting flags [this+0x3747] [this+0x3748] and [this+0x3749] then forwarding two state parameters into the subordinate object at [this+0x2d].,ghidra + rizin
0x005270d0,8,shell_mark_layout_dirty,bootstrap,thiscall,inferred,ghidra-headless,2,Marks the shell layout child dirty by setting byte flag [this+0x3749] before later code forces a commit pass.,ghidra + rizin
0x00527650,1476,shell_publish_texture_budget_report,shell,thiscall,inferred,ghidra-headless,4,Builds and publishes a shell-side texture budget report through the current layout state at [this+0x2d]. The routine formats the current memory-budget floor and ceiling buckets from 0x0051fa40 and 0x0051fa00 converts them to kilobytes adds the current texture-change counter through 0x0055d390 appends labels like Texture changes per frame Texture SRAM and Texture VRAM and forwards the assembled text into 0x00566980.,ghidra + rizin + llvm-objdump + strings
0x00527e10,868,shell_update_layout_tracking_sample,bootstrap,thiscall,inferred,ghidra-headless,4,Samples a tracked shell target from the object argument computes distance heading and orientation deltas against cached values at [this+0x36b8..0x36cc] consults the dirty flags and index helper at 0x00526590 and returns whether the controller should drive a fresh layout-state apply; on success it updates the cached sample fields and the global tick at 0x00cc3b4c.,ghidra + rizin
0x0052b990,4993,shell_refresh_presentation_frame,shell,thiscall,inferred,ghidra-headless,3,Main shell frame-style refresh pass for the active controller and layout-state path. It handles mode-sensitive layout-state rebuilds and dirties updates tracked shell samples through 0x00527e10 runs the nearby geographic-label static-cell animated-quad ranked-overlay and ranked-billboard sweeps applies presentation-node properties and cached vertex spans optionally publishes the texture budget report through 0x00527650 may request a deeper rebuild through 0x00565110 and can recurse once for a follow-up presentation pass before downstream timing or present helpers run.,ghidra + rizin + llvm-objdump
0x0052da00,102,vehicle_visual_register_attachment_object,bootstrap,thiscall,inferred,ghidra-headless,3,Registers one prebuilt attachment object on the owning vehicle visual. The helper lazily allocates a small attachment list at [this+0x81] pushes the object through 0x00556e10 copies the owner tint triple from [this+0x1e2] [this+0x1e6] and [this+0x1ea] into the object through 0x005545d0 and links the owner back through 0x005540a0.,ghidra + rizin + llvm-objdump
0x00529840,400,shell_build_static_cell_triangle_sweep,bootstrap,thiscall,inferred,ghidra-headless,4,Builds the fixed-cell triangle sweep over the grid returned by 0x00533cd0. It samples shell brightness to derive one grayscale packed color binds the layout-state vertex24 table once and then expands each accepted 0x24-byte cell record into six vertex24 records by emitting the same three-point face twice before committing the span and restoring presentation state.,ghidra + rizin + llvm-objdump
0x00529b50,1149,shell_build_geographic_label_vertex24_sweep,bootstrap,thiscall,inferred,ghidra-headless,4,Builds the geographic-label vertex24 sweep over the grid returned by 0x00533db0. It gates on config byte [this+0x29+0x63] primes one vertex24 span and text presentation state samples shell brightness and the 0x006d9098 priority map to derive per-item alpha rejects items through virtual check +0x0c emits per-item geographic-label frame geometry through 0x00539fb0 optionally emits geographic-label text through 0x0053a960 and commits buffered spans through the layout-state presentation helpers. The naming matches the dedicated geographic-label asset family backed by gpdLabelDB and 2DLabel.imb.,ghidra + rizin + llvm-objdump
0x00528d90,1824,shell_process_nearby_presentation_item,bootstrap,thiscall,inferred,ghidra-headless,3,Processes one candidate item for the nearby-presentation sweep. It rejects disabled entries and mode-mismatched flags optionally gates by forward-range tests around the caller origin lazily assigns the item's segment-record window from the layout-state tables stores accepted nearest-candidate distances in the side buffer at [this+0xa9] and [this+0xad] and forwards the item plus eligible child collections into the active presentation lists.,ghidra + rizin + llvm-objdump
0x005294b0,912,shell_update_nearby_presentation_sweep,bootstrap,thiscall,inferred,ghidra-headless,3,Performs the higher-level nearby-presentation sweep for the current shell state. It scans candidate cells from the offset table at [this+0x374f] using the priority map at 0x006d9098 enumerates item lists for each accepted cell normalizes the first accepted direction vector binds the segment-record presentation table through 0x0054bab0 calls 0x00528d90 for each candidate and then selects the nearest buffered item into [this+0x366e] before refreshing presentation batches through 0x00548da0.,ghidra + rizin + llvm-objdump
0x00529fd0,793,shell_build_cell_vertex24_sweep,bootstrap,thiscall,inferred,ghidra-headless,4,Builds the animated-quad cell sweep over the grid returned by 0x00533e30 depending on the boolean mode argument. It gates on configuration bytes [this+0x29+0x5f] or [this+0x29+0x60] walks candidate-cell offsets from [this+0x374f] selects the primary list at [cell+0x1c] or alternate list at [cell+0x20] initializes the layout-state vertex24 table once through 0x0054bb70 streams each list through 0x00567c70 or 0x00567ce0 and then commits the accumulated span through 0x00545c50 before restoring presentation state.,ghidra + rizin + llvm-objdump
0x0052a2f0,736,shell_build_ranked_overlay_vertex24_sweep,bootstrap,thiscall,inferred,ghidra-headless,3,Builds a ranked secondary vertex24 overlay pass over the cell grid returned by 0x00533e50 and two object collections at [this+0x85] and [this+0x81]. It computes a per-frame packed tint from the current shell brightness gathers and sorts candidate items by priority field [item+0x1d9] binds the layout-state vertex24 table and emits accepted items through 0x00524780 and 0x00554e70 before committing the span.,ghidra + rizin + llvm-objdump
0x0052a5d0,1784,shell_build_ranked_object_billboard_sweep,bootstrap,thiscall,inferred,ghidra-headless,3,Builds the sibling ranked object-overlay pass gated by config byte [this+0x29+0x5e]. It merges candidates from the object collections at [this+0x85] and [this+0x81] sorts them by priority field [item+0x1d9] prepares billboard basis state through 0x00566670 and emits accepted entries through 0x00554e70 before committing the vertex24 span.,ghidra + rizin + llvm-objdump
0x0052dd00,864,shell_expand_segment_record_triplets,bootstrap,thiscall,inferred,ghidra-headless,4,Expands one active presentation-batch record into three transformed 0x20-byte segment records inside the caller-provided buffer; each output record is two vec3 blocks at +0x00 and +0x0c plus scalar slots at +0x18 and +0x1c. The selected batch record supplies a source-array pointer at +0x04 a source-count at +0x0c and 0x4c-byte packed source entries that carry four point sources plus three scalar pairs for the emitted triplet.,ghidra + rizin
0x0053f4e0,739,mouse_cursor_update_frame_state,shell,thiscall,inferred,ghidra-headless,4,Per-frame MouseCursor.cpp updater for the global cursor controller at 0x00ccbb20. It refreshes elapsed tick state through 0x0051d890 re-arms the active cursor selection through 0x0053f450 and 0x0053f000 when the 150 ms and 15 s idle thresholds trip resets per-frame cursor globals through 0x0054f6c0 and 0x0054f6d0 samples cursor placement and world-relative state through world_anchor_measure_projected_half_width world_anchor_measure_projected_half_height and shell_queue_world_anchor_marker and publishes the resulting cursor presentation state through shell_publish_text_callout_presentation before finalizing through 0x0054f6e0.,ghidra + rizin + llvm-objdump + strings
0x0052e060,537,shell_expand_vertex24_triplets,bootstrap,thiscall,inferred,ghidra-headless,4,Sibling emitter for the same active presentation-batch record family; expands each 0x4c-byte packed source entry into three 0x18-byte vertex24 records in the caller-provided buffer. Each emitted record stores a vec3 at +0x00 a style dword from [this+0x43] at +0x0c and scalar slots at +0x10 and +0x14 while the output-count accumulator advances by count*3.,ghidra + rizin
0x0052eb20,51,shell_read_optional_presentation_extents4,bootstrap,thiscall,inferred,ghidra-headless,4,Reads an optional four-float extent block from the active presentation-batch record when byte flag [this+0x25] is set; copies dwords at +0x26 +0x2a +0x2e and +0x32 into caller outparams for the presentation-extents helper at 0x547d10.,ghidra + rizin
0x0052eca0,43,shell_get_next_presentation_batch_record,bootstrap,thiscall,inferred,ghidra-headless,4,Returns the next 0x45-byte presentation-batch record for the active item family rooted at [this+0x14] if current index [this+0x21] plus one is still below the family count at [+0x14]; otherwise returns null.,ghidra + rizin
0x00524780,1252,shell_emit_ranked_overlay_cell_items,bootstrap,thiscall,inferred,ghidra-headless,3,Processes one ranked-overlay cell list for 0x0052a2f0. It samples shell range thresholds through 0x00533180 and 0x00533160 filters cell items by distance and intensity derives an alpha-biased packed color from the caller input and emits accepted items into the current vertex24 span through layout helper 0x005468c0.,ghidra + rizin + llvm-objdump
0x00533ba0,39,shell_grid_get_nearby_presentation_cell,bootstrap,thiscall,inferred,ghidra-headless,4,Returns one tile-grid cell from the nearby-presentation layer rooted at [this+0x1671]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x1671].,ghidra + rizin + llvm-objdump
0x00533cd0,39,shell_grid_get_static_vertex24_cell,bootstrap,thiscall,inferred,ghidra-headless,4,Returns one tile-grid cell from the fixed-geometry vertex24 layer rooted at [this+0x167d]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x167d].,ghidra + rizin + llvm-objdump
0x00533db0,30,shell_grid_get_geographic_label_cell,bootstrap,thiscall,inferred,ghidra-headless,4,Returns one tile-grid cell from the geographic-label layer rooted at [this+0x1675]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x1675].,ghidra + rizin + llvm-objdump
0x00533e30,32,shell_grid_get_animated_quad_cell,bootstrap,thiscall,inferred,ghidra-headless,4,Returns one tile-grid cell from the animated-quad presentation layer rooted at [this+0x1681]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x1681].,ghidra + rizin + llvm-objdump
0x00533e50,32,shell_grid_get_ranked_overlay_cell,bootstrap,thiscall,inferred,ghidra-headless,4,Returns one tile-grid cell from the ranked secondary overlay layer rooted at [this+0x1685]. The helper uses the same 16x16 tile addressing and grid width field at [this+0x15d9] as the other shell cell-grid accessors and currently feeds 0x0052a2f0.,ghidra + rizin + llvm-objdump
0x00539fb0,924,shell_emit_geographic_label_frame_vertex24_records,bootstrap,thiscall,inferred,ghidra-headless,4,Expands the current geographic-label item into cached frame vertex24 records inside the caller buffer. The helper patches packed alpha into up to sixteen prebuilt 0x18-byte records copies additional 24-byte frame blocks from fixed item offsets and returns the emitted vertex count for the label border or backing geometry.,ghidra + rizin + llvm-objdump
0x0053a440,14,shell_set_geographic_label_item_alpha,bootstrap,thiscall,inferred,ghidra-headless,4,Stores an 8-bit alpha input into the high-byte color field at [this+0x5b] for the current geographic-label item before frame or text emission.,ghidra + rizin + llvm-objdump
0x0053a960,723,shell_emit_geographic_label_text_span,bootstrap,thiscall,inferred,ghidra-headless,4,Builds and emits one geographic-label text span for the current cell item. The helper calls the item vtable at +0x10 to materialize a null-terminated display string up to 0x12c bytes computes placement from item float fields and shell service state checks visibility through the shell bundle and forwards the resolved text payload into the presentation path through 0x005519f0. The item family aligns with gpdLabelDB and 2DLabel.imb rather than the parallel city assets.,ghidra + rizin + llvm-objdump
0x00543f10,853,layout_state_bind_presentation_asset_bundle,bootstrap,thiscall,inferred,ghidra-headless,4,Initial bind-time asset loader for the layout state's presentation node at [this+0x25df]; pulls a fixed presentation bundle through the node vtable at +0x5c and +0x60 including standalone assets stored around 0x2643 0x2647 0x264b 0x264f 0x2653 0x265b 0x265f and 0x2663 plus a 64-entry asset bank at 0x31ab while advancing an internal asset-offset cursor at [this+0x2543].,ghidra + rizin
0x00554830,142,attachment_object_init_named_asset,bootstrap,thiscall,inferred,ghidra-headless,3,Initializes one named attachment object from a caller-supplied asset string and placement parameters. The helper copies the asset name into the local object buffer at [this+0x10] stores attachment selectors at [this+0x130] and [this+0x138] optionally derives a cached scale pair at [this+0x120] and [this+0x124] and then finalizes object state through 0x005545d0.,ghidra + rizin + llvm-objdump
0x005455e0,224,layout_state_set_slot_triplet_lo,bootstrap,thiscall,inferred,ghidra-headless,4,Updates the first three cached per-slot presentation scalars in the 24-byte slot table at [this+0x2597+slot*24]. In notify mode it compares against the cached values and forwards only changed fields into the bound presentation node through vtable slot +0xfc with subproperty ids 1 through 3.,ghidra + rizin + llvm-objdump
0x005456d0,240,layout_state_set_slot_triplet_hi,bootstrap,thiscall,inferred,ghidra-headless,4,Updates the second three cached per-slot presentation scalars in the same 24-byte slot table at [this+0x2597+slot*24]. In notify mode it compares against the cached values and forwards only changed fields into the bound presentation node through vtable slot +0xfc with subproperty ids 4 through 6.,ghidra + rizin + llvm-objdump
0x005458f0,169,layout_state_read_segment_record_window,bootstrap,thiscall,inferred,ghidra-headless,4,Gates the 32-byte segment-record table at [this+0x2643]; queries record bounds then copies a start-to-end or wrapped window into scratch storage at [this+0x2657] through vtable slot +0x2c while toggling byte flag [this+0x254e]. The downstream shell path treats each 0x20-byte record as two vec3 blocks plus two trailing scalars.,ghidra + rizin
0x005459a0,69,layout_state_read_segment_record_block,bootstrap,thiscall,inferred,ghidra-headless,4,Reads one 32-byte-indexed segment-record block from the same [this+0x2643] table into scratch storage at [this+0x2657] through vtable slot +0x2c using a fixed 0x2800-byte transfer span.,ghidra + rizin
0x00545b10,57,layout_state_read_vertex24_block,bootstrap,thiscall,inferred,ghidra-headless,4,Reads one 24-byte-indexed vertex block from the presentation table at [this+0x2647] through vtable slot +0x2c using index*24 addressing and returns the copied pointer through a stack outparam. The downstream shell emitter treats each record as vec3 plus a style dword plus two trailing scalars.,ghidra + rizin
0x00545b50,59,layout_state_read_vertex24_window,bootstrap,thiscall,inferred,ghidra-headless,4,Copies a window between two 24-byte vertex indices from [this+0x2647] into scratch storage at [this+0x2657] through vtable slot +0x2c using index*24 addressing and a fixed 0x1800-byte transfer span. The downstream shell emitter treats each record as vec3 plus a style dword plus two trailing scalars.,ghidra + rizin
0x00545c50,67,layout_state_commit_vertex24_span,bootstrap,thiscall,inferred,ghidra-headless,4,Converts a start and end vertex index range into a triplet count by dividing the delta by three accumulates that count at [this+0x3711] and notifies the bound presentation node at [this+0x25df] through vtable slot +0x118 with primitive-type argument 4.,ghidra + rizin
0x00546a30,333,layout_state_rebuild_variant_asset_cache,bootstrap,thiscall,inferred,ghidra-headless,3,Releases any loaded entries in the 64-slot presentation asset bank rooted at 0x31ab then rebuilds the paired-key metadata table at 0x266b tracking active entries count at [this+0x2667] and sibling or reuse links for later keyed lookups.,ghidra + rizin
0x005467a0,50,layout_state_enable_presentation_gate,bootstrap,thiscall,inferred,ghidra-headless,4,Ensures the presentation node gate property 0x1c is enabled once for the layout state when the template flag at [[this+0x83c]+0x2e] permits it by setting [this+0x2549] and forwarding the toggle into the node at [this+0x25df].,ghidra + rizin
0x00547d10,288,layout_state_apply_presentation_extents4,bootstrap,thiscall,inferred,ghidra-headless,4,Applies a four-float extent or quad block onto presentation property 0x18 for the bound node at [this+0x25df]. If all four inputs are nonpositive it clears the property through vtable slot +0xfc; otherwise it builds a 0x10-field stack block with the four caller values and a unit scalar then commits it through node slots +0xfc and +0x94.,ghidra + rizin + llvm-objdump
0x00547f20,177,layout_state_apply_gamma_ramp_scalar,bootstrap,thiscall,inferred,ghidra-headless,4,Builds a 256-entry three-channel gamma-ramp buffer from the caller scalar and uploads it through vtable slot +0x48 on the bound presentation node at [this+0x25df]. The helper clamps each 16-bit ramp entry stores the accepted scalar in the subordinate state block at [[this+0x83c]+0x2f] and respects shell capability guards under 0x006d4024 before touching the display device.,ghidra + rizin + llvm-objdump
0x00548da0,1328,layout_state_refresh_presentation_batches,bootstrap,thiscall,inferred,ghidra-headless,4,Walks the active presentation-batch list and refreshes the bound node state for each selected item. The routine applies batch extents through 0x00547d10 pushes style and gate properties including packed color property 0x3c updates per-slot triplets through 0x005455e0 and 0x005456d0 and emits segment-record or vertex24 spans from the current batch family before advancing to the next record.,ghidra + rizin + llvm-objdump
0x005492d0,3747,layout_state_probe_d3d8_capabilities,bootstrap,thiscall,inferred,ghidra-headless,4,Creates a Direct3D8 probe object and walks adapter or device capability queries for the layout-state presentation path. The routine caches probed texture-memory style fields into shell globals under 0x006d4024 including the values later reported as Texture SRAM and Texture VRAM consults the shell memory-budget helpers 0x0051fa40 and 0x0051fa60 refreshes the gamma ramp through 0x00547f20 when needed and assigns a local renderer capability tier at [this+0x04].,ghidra + rizin + llvm-objdump + strings
0x0054a280,626,layout_state_apply_presentation_properties,bootstrap,thiscall,inferred,ghidra-headless,4,Pushes visibility color and mode-dependent scalar properties from the layout state into the bound presentation node at [this+0x25df]; toggles gate property 0x1c writes packed color property 0x22 from bytes 0x2510..0x2512 updates mode properties 0x23 through 0x26 from template flags and caller-supplied scalars and caches the leading scalar at [this+0x25b3].,ghidra + rizin
0x0054bab0,89,layout_state_bind_segment_record_table,bootstrap,thiscall,inferred,ghidra-headless,4,Binds the current 32-byte segment-record table at [this+0x2643] onto the presentation node if it changed since the last bind. The helper drives node property 0x112 through vtable slots +0x130 and +0x14c with record size 0x20 and clears the local dirty byte at [this+0x263b].,ghidra + rizin + llvm-objdump
0x0054bb70,90,layout_state_bind_vertex24_table,bootstrap,thiscall,inferred,ghidra-headless,4,Binds the current 24-byte vertex24 table at [this+0x2647] onto the presentation node if it changed since the last bind. The helper drives node property 0x142 through vtable slots +0x130 and +0x14c with record size 0x18 and clears the local dirty byte at [this+0x263b].,ghidra + rizin + llvm-objdump
0x0054bc10,592,shell_init_layout_state_defaults,bootstrap,thiscall,inferred,ghidra-headless,4,Initializes the large subordinate layout-state object allocated by 0x0055e2b0; seeds default float and flag fields points [this+0x83c] at a shell-bundle template block near 0x006d4024+0x11468a optionally copies a 0x72c-byte preset table and notifies the shell bundle service at [0x006d4024+0x28].,ghidra + rizin
0x0054bea0,1399,layout_state_apply_interpolated_pose,bootstrap,thiscall,inferred,ghidra-headless,4,Applies an interpolated pose and palette sample on the subordinate layout-state object using the controller counters passed by callers; clamps the time window blends preset tables at offsets 0x840 through 0x86f updates color bytes at 0x2510 through 0x2512 invokes the bound presentation node at [this+0x25df] and finishes through 0x0054a280.,ghidra + rizin
0x0054e3a0,528,shell_controller_window_message_dispatch,shell,stdcall,inferred,objdump,4,Primary window-message ingress for the active shell controller window. The dispatcher branches over low window lifecycle messages handles `WM_KEYDOWN` and `WM_KEYUP` by first updating the shell controller through 0x0051f0c0 or 0x0051f0d0 and then forwarding the transition into shell_input_apply_window_key_transition at 0x0054f290 on the shell input object rooted at 0x006d4018 routes `WM_COMMAND` through 0x0054eb10 routes mouse messages in the `0x0200..0x0208` family through 0x0054ee50 and falls back to `DefWindowProcA` for unhandled cases. This is the first grounded shell-side input ingest path rather than only a generic message drain.,objdump + import table + callsite inspection
0x0054e5d0,88,shell_drain_pending_window_messages,shell,cdecl,inferred,objdump + analysis-context,4,Shared pending-message drain that loops on `PeekMessageA` with remove mode 1 and feeds each dequeued record through `TranslateMessage` and `DispatchMessageA` until the queue is empty. Shell modal waits layout rebuild paths mouse-cursor frame work and the keyboard-toggle helpers all reuse this routine so it sits below the real input handlers rather than serving as the input dispatcher itself.,objdump + analysis-context + import table
0x0054e710,110,shell_input_state_init,shell,thiscall,inferred,objdump + analysis-context,3,Initializes the standalone shell input-state object later stored at 0x006d4018. It zeroes the 0xaa8-byte state block resets counters and flags under +0xa88 through +0xa9c caches host metrics through `GetSystemMetrics` and `GetDoubleClickTime` and clears the per-key state storage that later window-message handlers update.,objdump + analysis-context + import table
0x0054f290,480,shell_input_apply_window_key_transition,shell,thiscall,inferred,objdump + analysis-context,4,Normalizes one `WM_KEYDOWN` or `WM_KEYUP` transition for the shell input object at 0x006d4018. The helper samples `GetKeyboardState` optionally derives an ASCII byte through `ToAscii` updates the 256-byte per-key table starting at [this+0x100] and maps selected keyboard scan codes into packed modifier flags at [this+0xa8c]: 0x1d sets or clears bit 0x4 Control 0x2a sets or clears bit 0x2 Left Shift 0x36 sets or clears bit 0x1 Right Shift and 0x38 sets or clears bit 0x20 Alt. It then forwards the synthesized event record through 0x0054e9c0 for later shell consumers. The shell controller window dispatcher at 0x0054e3a0 is the grounded caller.,objdump + analysis-context + import table + callsite inspection
0x0054f4d0,109,shell_input_snapshot_dispatch_state,shell,thiscall,inferred,objdump + analysis-context,3,Captures one filtered snapshot of the current shell input object state into a 0x30-byte caller buffer while temporarily zeroing the nested-dispatch counter at [this+0xa90]. Several shell and cursor consumers use this as the read-side companion to shell_input_apply_window_key_transition optionally passing the snapshot through the callback hook stored at 0x006d4008 before consuming it.,objdump + analysis-context + caller xrefs
0x0054f540,111,shell_input_cursor_inside_active_view,shell,cdecl,inferred,objdump + analysis-context,3,Returns whether the current cursor position should count as being inside the active shell controller view. When controller byte [0x006d4024+0x114226] is already set it returns true immediately; otherwise it samples the host cursor through `GetCursorPos` converts it into client coordinates for the active controller window through `ScreenToClient` and checks that point against the current view bounds selected from the shell controller table at [0x006d4024+0x34] and [0x006d4024+0x11421e]. Current grounded callers are the mouse-cursor mode helper at 0x0053f450 and the shell camera action helper at 0x004e0780 which suggests later world-relative cursor work still reuses the same shell controller path rather than a separate gameplay-only input object.,objdump + analysis-context + import table + caller xrefs
0x0054f640,83,shell_step_global_presentation_phase_scalar,shell,cdecl,inferred,ghidra-headless,2,Steps the shared presentation-phase scalar stored at 0x00d93850 downward by a small constant then clamps the returned value against fixed lower-bound constants. Callout-marker world-anchor and other presentation helpers use this as a common time-varying scalar after one of the nearby setters has seeded the global phase.,ghidra + rizin + llvm-objdump
0x0054f700,12,shell_set_global_presentation_phase_scalar,shell,cdecl,inferred,ghidra-headless,3,Stores one caller-supplied float into the shared presentation-phase scalar at 0x00d93850. Mouse-cursor geographic-label and other presentation helpers seed this global before later batch or marker helpers consume it through 0x0054f640.,ghidra + rizin + llvm-objdump
0x0054f710,729,shell_queue_callout_segment_marker,shell,cdecl,inferred,ghidra-headless,2,Queues one short world-space callout segment or marker packet using the shell zoom table rooted at [0x006d4024+0x11421e] and [0x006d4024+0x34]. The helper derives scaled endpoint deltas from the caller inputs applies flag-controlled clamps from arg_14h and emits three type-0x01 deferred messages through shell_enqueue_deferred_message_type1.,ghidra + rizin + llvm-objdump
0x0054f9f0,281,shell_queue_callout_frame_segments,shell,cdecl,inferred,ghidra-headless,4,Builds a four-segment callout frame around one projected extent box. The helper samples the same shell zoom and reciprocal scale tables under 0x006d4024 computes the four box legs from the caller extent inputs and emits each side through shell_queue_callout_segment_marker.,ghidra + rizin + llvm-objdump
0x0054fb10,699,shell_queue_callout_leader_path,shell,cdecl,inferred,ghidra-headless,3,Builds one longer world-space callout leader path between two points. It derives slope and angle terms from the caller inputs recursively reuses itself or 0x0054f710 for shorter segments chooses style branches from distance and flag tests and enqueues the resulting type-0x01 deferred messages. shell_publish_text_callout_presentation uses this helper for text-associated leader geometry.,ghidra + rizin + llvm-objdump
0x0054fdd0,256,shell_queue_presentation_batch_pair,shell,cdecl,inferred,ghidra-headless,2,Queues a two-record presentation batch through the shell deferred-message path. One branch emits a single trailing type-0x04 record while the other brackets two type-0x04 payload posts with direct type-0x05 and type-0x06 begin-end records; both legs seed their animated scalar through shell_step_global_presentation_phase_scalar before routing through the shell bundle at 0x006d4024.,ghidra + rizin + llvm-objdump
0x0054fed0,440,shell_queue_presentation_batch_quad,shell,cdecl,inferred,ghidra-headless,2,Queues a four-record presentation batch through the same deferred-message family. It posts a type-0x05 begin record emits four type-0x04 payload records with refreshed phase scalars from shell_step_global_presentation_phase_scalar and finally closes the batch with a type-0x06 end record. The current high-level callers build this from four related point or extent tuples.,ghidra + rizin + llvm-objdump
0x005519f0,902,shell_publish_text_callout_presentation,shell,cdecl,inferred,ghidra-headless,3,Publishes one styled text or callout presentation payload through the active shell bundle at 0x006d4024. It accepts text placement and style inputs conditionally emits a leader path through 0x0054fb10 allocates backing text resources through 0x0051f0b0 and 0x00543c10 sets presentation flags from the mode arguments and finalizes the payload through 0x0051fc20. Geographic-label text and mouse-cursor presentation both feed this helper.,ghidra + rizin + llvm-objdump + strings
0x00552160,56,world_anchor_measure_projected_half_width,shell,cdecl,inferred,ghidra-headless,3,Measures one absolute projected half-width-like extent from the caller world-anchor object. It chooses the X or Z span depending on orientation byte [this+0x24] scales by the owner coefficients at +0x2e or +0x32 multiplies by local width scalar [this+0x1c] and returns the absolute result for later cursor or marker placement code.,ghidra + rizin + llvm-objdump
0x005521a0,56,world_anchor_measure_projected_half_height,shell,cdecl,inferred,ghidra-headless,3,Measures one absolute projected half-height-like extent from the caller world-anchor object. It chooses the complementary axis span using the same orientation byte [this+0x24] scales by owner coefficients at +0x2e or +0x32 multiplies by local height scalar [this+0x20] and returns the absolute result for later cursor or marker placement code.,ghidra + rizin + llvm-objdump
0x005521e0,894,world_anchor_project_screen_extent_pair,shell,cdecl,inferred,ghidra-headless,3,Projects one world-anchor object into a paired screen-space extent result. The helper samples the shell zoom table under 0x006d4024 computes integer-scaled axis spans from the anchor geometry converts them through multiple clamp or reciprocal stages and writes two output integers through the caller pointers before later marker builders use the results for anchor presentation sizing.,ghidra + rizin + llvm-objdump
0x00552560,916,shell_queue_world_anchor_marker,shell,cdecl,inferred,ghidra-headless,3,Builds one world-anchor marker packet from the caller point object and optional scale or style inputs. It samples anchor extents from the object fields converts them through 0x0053dde0 0x0053ddf0 and world_anchor_project_screen_extent_pair consults the shell zoom table rooted at [0x006d4024+0x11421e] and [0x006d4024+0x34] and finally enqueues one type-0x01 deferred message through shell_enqueue_deferred_message_type1. mouse_cursor_update_frame_state uses it for one branch of cursor world-relative presentation.,ghidra + rizin + llvm-objdump
0x00552900,1304,shell_queue_projected_world_anchor_quad,shell,cdecl,inferred,ghidra-headless,3,Builds one oriented projected quad around the caller world-anchor object. It derives four projected corner points from the anchor extents and orientation computes edge and diagonal lengths through 0x0051db80 samples the shared presentation phase through shell_step_global_presentation_phase_scalar refines screen-space bounds through world_anchor_project_screen_extent_pair and finally emits two type-0x04 deferred-message posts through shell_enqueue_deferred_message_type4.,ghidra + rizin + llvm-objdump
0x0051db80,32,math_measure_float_xy_pair_distance,support,cdecl,inferred,objdump + caller xrefs + callsite inspection,4,"Tiny shared float distance helper. It subtracts one caller-supplied X or Y point pair from the other, squares both deltas, sums them, and returns the Euclidean distance `sqrt(dx*dx + dy*dy)`. Current grounded callers include the city-connection chooser at `0x00402cb0`, the route-entry search family at `0x0049bd40` and `0x0049d380`, several company and world-side scoring branches, and shell presentation helpers such as `shell_queue_projected_world_anchor_quad` `0x00552900`. This now grounds `0x0051db80` as a generic float XY distance primitive rather than another opaque quality helper.","objdump + caller xrefs + callsite inspection + arithmetic inspection"
0x00554d70,248,billboard_item_build_anchor_point_cache,bootstrap,thiscall,inferred,ghidra-headless,3,Builds or refreshes the cached point list for one billboard item at [this+0x1dd]. When source points exist at [this+0x10] it transforms them through the owner object matrix near [this+0x0c]+0xce; otherwise it seeds a one-point fallback from the baked vector at [this+0xfe..0x106].,ghidra + rizin + llvm-objdump
0x00554e70,680,shell_emit_ranked_sprite_billboard_item,bootstrap,thiscall,inferred,ghidra-headless,4,Emits one ranked sprite-billboard item into the current vertex24 span. The helper computes a distance-weighted fade against shell and world state stores the derived scalar at [item+0xdc] and then walks either the item's linked child list at [item+0x4] or the cached anchor list at [item+0x1dd] to write textured quad geometry through 0x005662a0.,ghidra + rizin + llvm-objdump
0x00555740,49,billboard_item_refresh_child_sprite_colors,bootstrap,thiscall,inferred,ghidra-headless,3,Refreshes packed child-sprite colors for one billboard item by iterating the linked child list at [this+0x4] recomputing each child color through 0x005554f0 and storing the 24-bit result at [child+0x70].,ghidra + rizin + llvm-objdump
0x00555780,1739,sprite_billboard_spawn_particle_instance,bootstrap,thiscall,inferred,ghidra-headless,4,Builds one emitted sprite-billboard instance from the template item. It randomizes local offsets through fields [this+0x7c..0x90] optionally samples anchor points from the owner matrix or cached path data chooses atlas uv bounds from [this+0x110..0x124] applies scale and fade terms from [this+0x94..0x108] recomputes packed colors through 0x005554f0 and finalizes the instance through 0x00565e80 and 0x00565f40.,ghidra + rizin + llvm-objdump
0x00555e50,1808,sprite_billboard_update_particle_emitter,bootstrap,thiscall,inferred,ghidra-headless,4,Advances one sprite-billboard emitter template and spawns new instances through 0x00555780. The routine updates emitter clocks and travel bounds in [this+0x68..0xc8] applies burst or repeat controls through [this+0x1ed..0x1f9] walks up to [this+0x34] spawn lanes resolves anchor positions from cached or owner-derived points and refreshes the active emitter origin at [this+0xc0] and [this+0xc4].,ghidra + rizin + llvm-objdump
0x0055d430,6,system_get_total_physical_memory_bytes,support,cdecl,inferred,ghidra-headless,4,Returns the cached total physical-memory byte count from the shared MEMORYSTATUS block at 0x00d9754c. The graphics preset bundle uses this value as one of its coarse runtime capability probes after the cache has been refreshed through GlobalMemoryStatus nearby.,ghidra + rizin + llvm-objdump
0x0055d440,17,system_refresh_available_physical_memory_bytes,support,cdecl,inferred,ghidra-headless,4,Refreshes the shared MEMORYSTATUS block at 0x00d97548 through GlobalMemoryStatus and returns the resulting available physical-memory byte count from dwAvailPhys. This is the active memory-availability probe companion to 0x0055d430.,ghidra + rizin + llvm-objdump + strings
0x0055d460,81,os_is_non_nt_platform,support,cdecl,inferred,ghidra-headless,4,Calls GetVersionExA and returns true only when the platform id is not VER_PLATFORM_WIN32_NT. The graphics preset bundle inverts this result into an NT-family capability flag before finalizing several display-runtime bytes under 0x006d4024.,ghidra + rizin + llvm-objdump + strings
0x0055d8d0,138,display_get_primary_adapter_descriptor,support,cdecl,inferred,ghidra-headless,4,Enumerates display devices through USER32.EnumDisplayDevicesA until it finds the primary adapter flag then copies the adapter DeviceString field into the global buffer at 0x00d97448 and returns that buffer. When enumeration fails it leaves the descriptor empty and still returns the same shared buffer pointer. The graphics preset matcher at 0x00484a60 consumes this descriptor text directly.,ghidra + rizin + llvm-objdump + strings
0x005a0f70,209,stream_cipher_xor_in_place,support,cdecl,inferred,rizin,4,Applies one stateful stream-cipher pass in place over the caller buffer in ECX for the caller byte count in EDX using the 0x102-byte cipher state block passed on the stack. The helper mutates the two state bytes at offsets `+0x100` and `+0x101` and uses the 0x100-byte permutation table at the start of the state block to XOR every byte in the buffer. Current grounded callers are the multiplayer transport text-stream receive and send paths.,rizin + llvm-objdump
0x005a18a0,292,string_copy_bounded_zerofill,support,cdecl,inferred,ghidra-headless,4,Shared bounded string-copy helper that copies up to count bytes from source to destination stops after the first NUL byte and zero-fills the remaining span before returning the destination pointer. The graphics preset matcher uses it to stage the primary adapter descriptor into a local probe buffer before substring token scans,ghidra + rizin + llvm-objdump
0x00556620,305,sprite_billboard_manager_reset,bootstrap,thiscall,inferred,ghidra-headless,3,Releases the shared sprite-billboard manager state including emitter slots at [this+0x10] queued templates at [this+0x18] and owned resource handles or containers before zeroing the manager pointers again.,ghidra + rizin + llvm-objdump
0x00556770,420,sprite_billboard_manager_init_pools,bootstrap,thiscall,inferred,ghidra-headless,4,Initializes the shared sprite-billboard manager when the shell first needs emitter templates. It allocates the long-lived emitter arrays and container objects at [this+0x10] [this+0x18] [this+0x8] [this+0x4] and [this+0x0] with a default capacity of 0xc350 slots unless the caller overrides it.,ghidra + rizin + llvm-objdump
0x00556920,814,sprite_billboard_init_emitter_template,bootstrap,thiscall,inferred,ghidra-headless,4,Initializes one sprite-billboard emitter template from optional source geometry color flags and atlas bounds. It copies source points or seeds a fallback anchor path stores owner position seeds default fade and timing fields across [this+0x94..0xd8] computes atlas uv steps from [this+0xe0..0xec] into [this+0x110..0x124] and optionally prewarms the spawn list through 0x00554ce0 when the caller flags request it.,ghidra + rizin + llvm-objdump
0x00556c50,143,sprite_billboard_manager_create_template_node,bootstrap,thiscall,inferred,ghidra-headless,4,Allocates or reuses one manager node then creates a fresh sprite-billboard template through 0x00556920 with flag 0x400 forced on. The helper stores the new template at [node+0x4] and queues the node into the manager container at [this+0x8].,ghidra + rizin + llvm-objdump
0x00556ce0,160,sprite_billboard_manager_clone_template_node,bootstrap,thiscall,inferred,ghidra-headless,4,Looks up one existing manager node and either returns its current template or clones a new sprite-billboard template from it through 0x00556920. On the first clone path it prewarms the source template through 0x00554ce0 and then queues the new node into the manager container at [this+0x4].,ghidra + rizin + llvm-objdump
0x00556e10,54,intrusive_queue_push_back,support,cdecl,inferred,ghidra-headless,4,Allocates one intrusive-queue node then appends the caller payload pointer to the tail of the container. The helper writes the payload at [node+0x00] links the previous tail through [node+0x04] and [tail+0x08] updates the head and tail slots when needed and increments the queued-node count at [this+0x0c].,ghidra + rizin + llvm-objdump
0x00556ef0,6,intrusive_queue_rewind_iterator,support,cdecl,inferred,ghidra-headless,4,Resets one intrusive-queue iterator by copying the container head pointer at [this+0x00] into the current-iterator slot at [this+0x04]. The helper is reused broadly across shell presentation and gameplay container walkers before repeated next-node calls.,ghidra + rizin + llvm-objdump
0x00556f00,19,intrusive_queue_next_iterator_node,support,cdecl,inferred,ghidra-headless,4,Returns the current intrusive-queue iterator node from [this+0x04] then advances the iterator to the linked next pointer at [node+0x08]. When the iterator is exhausted it returns null without mutating any payload state.,ghidra + rizin + llvm-objdump
0x00556f90,13,intrusive_queue_peek_tail_payload,support,cdecl,inferred,ghidra-headless,4,Returns the payload pointer stored in the current tail node at [this+0x08]. When the container is empty it returns null without mutating the queue state.,ghidra + rizin + llvm-objdump
0x00557010,159,intrusive_queue_clear_owned_nodes,support,cdecl,inferred,ghidra-headless,3,Specialized intrusive-queue clear path for containers with an auxiliary owner or context pointer at [this+0x14]. It iterates the owned node chain through the queue iterator helpers releases nested payload state unlinks each node and decrements the queue count before returning to the outer container clear helper.,ghidra + rizin + llvm-objdump
0x005570b0,80,intrusive_queue_clear_and_release,support,cdecl,inferred,ghidra-headless,4,Clears and releases every node in one intrusive queue container. When [this+0x14] is present it routes through intrusive_queue_clear_owned_nodes; otherwise it walks the linked nodes directly releases them zeroes the head iterator and tail slots and resets the queued-node count at [this+0x0c].,ghidra + rizin + llvm-objdump
0x00559520,166,surface_init_rgba_pixel_buffer,support,thiscall,inferred,ghidra-headless,3,Initializes or refreshes a small 0xec-byte RGBA pixel-buffer object from caller-supplied image data and dimensions. On first use it allocates the backing object through 0x0053b070 stores width and height at [this+0xa2] and [this+0xa6] seeds the inner surface through 0x00543980 and 0x00541970 then copies width*height*4 bytes from the source buffer before finalizing through 0x005438d0. Current callers use it from the PaintTerrain preview path and the Multiplayer.win map-preview branch.,ghidra + rizin + llvm-objdump + strings
0x00565110,600,shell_rebuild_layout_state_and_optional_texture_report,shell,thiscall,inferred,ghidra-headless,3,Rebuilds the active shell layout-state branch when the current mode requires a deeper reset and optionally publishes the texture budget report through 0x00527650. The routine checks the current layout mode through 0x00545e00 tears down and recreates layout-state services through 0x0055dd80 and 0x0055e2b0 optionally notifies global shell services and when the caller flag is set emits the report then commits one layout refresh step through 0x00545d60.,ghidra + rizin + llvm-objdump + strings
0x0058bc90,23,multiplayer_gamespy_route_set_extended_payload_callback,shell,thiscall,inferred,objdump,3,"Tiny callback-slot helper for one GameSpy-style route object. It stores the caller callback pointer in `[route+0xa0]`, or in the default route singleton at `0x00629948` when `ecx` is null. The current grounded transport-side caller is multiplayer_transport_try_connect_status_route, which patches the status route's validated extended-payload callback slot to `0x597330` after route construction.",objdump
0x0058c9b0,404,multiplayer_gamespy_route_construct_and_seed_callback_vector,shell,thiscall,inferred,objdump,3,"Constructs or replaces one 0x108-byte GameSpy-style route object and seeds its callback vector. The helper allocates the route object when the caller owner slot is non-null, copies two caller strings into the local route buffers at `+0x04` and `+0x44`, stores the supplied callback table across `[route+0x88]` through `[route+0x9c]`, records the owner context at `[route+0x104]`, initializes the route cookie state and recent-cookie ring, and explicitly zeroes the secondary callback slots `[route+0xa0]`, `[route+0xa4]`, and `[route+0xd4]` before any later patch-up. Current grounded callers are multiplayer_transport_try_connect_status_route and multiplayer_transport_try_connect_live_route through the wrapper at `0x58cc40` or the constructor directly.","objdump"
0x0058d170,40,multiplayer_gamespy_server_descriptor_query_string_property_or_fallback,shell,cdecl,inferred,objdump,3,"Looks up one string property on a compact GameSpy-style server or route descriptor and falls back to the caller default string when the property is missing. It probes the descriptor-owned key store at `[this+0x18]` through `0x58f9c0`; on success it returns the matched value pointer at `[entry+0x04]`, and on failure it returns the fallback string from the stack. Current grounded callers use keys such as `hostname` and `gamever` when formatting route and selector status text.","objdump + caller inspection + strings"
0x0058d5b0,112,multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record,shell,cdecl,inferred,objdump,3,"Allocates one 0x24-byte compact server-descriptor record and seeds its primary endpoint fields from the caller tuple. It allocates the descriptor body through `tracked_heap_alloc_with_header`, allocates the owned property-store block at `[entry+0x18]` through `0x58f840`, writes the primary IPv4 dword to `[entry+0x00]`, writes the raw primary port word to `[entry+0x04]`, and zero-initializes state byte `[entry+0x14]`, flag byte `[entry+0x15]`, both endpoint-extension fields, and the age or timestamp lanes at `[entry+0x1c]` and `[entry+0x20]`. Current grounded caller is the primary-endpoint table seed path around `0x590dc0`.","objdump + caller inspection + descriptor-allocation correlation"
0x0058d1f0,3,multiplayer_gamespy_server_descriptor_query_primary_ipv4_raw,shell,cdecl,inferred,objdump,3,"Returns the descriptor's primary endpoint IPv4 dword from `[this+0x00]` without byte-order conversion. Current grounded consumers pair it with the raw primary port getter `0x58d210` as the compact identity key in `0x5903a0`, and pair it with the host-order port getter `0x58d200` when building route-binding payloads and compatibility checks.","objdump + caller inspection + WSOCK32 byte-order correlation"
0x0058d200,13,multiplayer_gamespy_server_descriptor_query_primary_port_host_order,shell,cdecl,inferred,objdump,3,"Returns the descriptor's primary endpoint port from `[this+0x04]` after converting the stored raw word through the imported `ntohs` shim at `0x5b31fe`. Current grounded callers use this host-order port in route-binding payload formatting and compatibility checks when no secondary endpoint flag is present.","objdump + caller inspection + WSOCK32 ntohs correlation"
0x0058d210,5,multiplayer_gamespy_server_descriptor_query_primary_port_raw,shell,cdecl,inferred,objdump,3,"Returns the descriptor's primary endpoint port word from `[this+0x04]` without byte-order conversion. Current grounded consumer `0x5903a0` pairs it with raw primary IPv4 `0x58d1f0` as the compact lookup key in the descriptor collection.","objdump + caller inspection + raw-key correlation"
0x0058d1c0,9,multiplayer_gamespy_server_descriptor_query_state_flag_bit0,shell,cdecl,inferred,objdump,3,"Returns state bit `0x1` from descriptor byte `[this+0x14]`. Current evidence now bounds this bit against two owners rather than one: queue service can promote pending field-cache state `0x4` into ready bit `0x1`, and the compact descriptor decode helper `0x58ff60` also ORs in bit `0x1` after the inline keyed-property vector path gated by source header bit `0x40` completes. Current grounded caller `0x595a6d` uses it to skip reinsertion into the field-cache family.","objdump + caller inspection + queue-state correlation + compact-decode correlation"
0x0058d1d0,9,multiplayer_gamespy_server_descriptor_query_state_flag_bit1,shell,cdecl,inferred,objdump,3,"Returns state bit `0x2` from descriptor byte `[this+0x14]`. Current evidence now bounds this bit against two owners too: queue service can promote pending `gsi_am_rating` descriptor state `0x8` into ready bit `0x2`, and the compact descriptor decode helper `0x58ff60` also ORs in bit `0x2` after the signed trailing string-pair tail runs to completion. Current grounded callers in the `gsi_am_rating` route branch use bit `0x2` as the split between immediate transition handling and reinsertion into the queued-descriptor family.","objdump + caller inspection + am-rating-branch correlation + queue-state correlation + compact-decode correlation"
0x0058d220,9,multiplayer_gamespy_server_descriptor_has_secondary_endpoint_flag,shell,cdecl,inferred,objdump,3,"Returns bit `0x2` from descriptor flag byte `[this+0x15]`. Current grounded callers use it to decide whether the descriptor exposes a secondary endpoint tuple at `[this+0x08]/[this+0x0c]` and therefore whether route-binding payload and compatibility checks should use the secondary port getter `0x58d250` instead of the primary port getter `0x58d200`.","objdump + caller inspection + secondary-endpoint correlation"
0x0058d230,9,multiplayer_gamespy_server_descriptor_query_flag_byte15_bit0,shell,cdecl,inferred,objdump,3,"Returns source-side header bit `0x1` from descriptor flag byte `[this+0x15]`. Current evidence now bounds this bit more tightly than before: it is not generated by queue service, is explicitly set during the raw primary-endpoint seed refresh around `0x590dc0` together with bit `0x10` before insertion into `[transport+0x18bc]`, and is also preserved by the compact descriptor decode path at `0x58ff60`. The strongest current read is therefore one primary-endpoint-seed or endpoint-only source marker: grounded transport callers still only use it in the `gsi_am_rating` branch, where clear routes a richer descriptor through direct primary-endpoint handling at `[transport+0x18bc]` via `0x00591330`, while set routes the descriptor through the queued-descriptor family at `[transport+0x1e7c]` via `0x005a09a0` and later suppresses the direct `0x595dc0` transition even after ready bit `0x2` is present. Current evidence is strong enough to reject a queue-generated meaning and to treat this as the source-side marker for descriptors that still need later queue-backed enrichment before direct transition.","objdump + caller inspection + am-rating-branch correlation + endpoint-table correlation + queue-state correlation + compact-decode correlation + transition-suppression correlation + raw-endpoint-seed correlation"
0x0058d240,4,multiplayer_gamespy_server_descriptor_query_secondary_ipv4_raw,shell,cdecl,inferred,objdump,3,"Returns the descriptor's secondary endpoint IPv4 dword from `[this+0x08]` without byte-order conversion. Current grounded callers only use it when `multiplayer_gamespy_server_descriptor_has_secondary_endpoint_flag` reports bit `0x2` set in `[this+0x15]`, which makes this the current strongest match for an optional secondary address tuple rather than another scalar field.","objdump + caller inspection + secondary-endpoint correlation"
0x0058d250,13,multiplayer_gamespy_server_descriptor_query_secondary_port_host_order,shell,cdecl,inferred,objdump,3,"Returns the descriptor's secondary endpoint port from `[this+0x0c]` after converting the stored raw word through the imported `ntohs` shim at `0x5b31fe`. Current grounded callers only use it when flag bit `0x2` in descriptor byte `[this+0x15]` is set, and then compare it against bound-route word `[binding->route+0x30]` in the route-binding compatibility gate.","objdump + caller inspection + WSOCK32 ntohs correlation + secondary-endpoint correlation"
0x0058d260,3,multiplayer_gamespy_server_descriptor_store_intrusive_next_link,shell,cdecl,inferred,objdump,2,"Stores one intrusive next-descriptor link into field `[this+0x20]`. Current grounded caller `0x590410` uses it to prepend one descriptor onto the transport-owned primary-endpoint list headed at `[table+0x5bc]`.","objdump + caller inspection + descriptor-list correlation"
0x0058d270,3,multiplayer_gamespy_server_descriptor_query_intrusive_next_link,shell,cdecl,inferred,objdump,2,"Returns intrusive next-descriptor link field `[this+0x20]`. Current grounded caller `0x590490` uses it to walk and release the transport-owned primary-endpoint list headed at `[table+0x5bc]`.","objdump + caller inspection + descriptor-list correlation"
0x0058d630,3,multiplayer_gamespy_server_descriptor_store_flag_byte15,shell,cdecl,inferred,objdump,2,"Stores one source-side compact header flag byte into descriptor field `[this+0x15]`. Current grounded callers are the compact descriptor decode helper `0x58ff60`, which copies the source header byte verbatim through this setter, and the raw primary-endpoint seed path `0x590dc0`, which stamps literal `0x11` into the same field for seeded descriptors.","objdump + caller inspection + compact-header correlation"
0x0058d640,13,multiplayer_gamespy_server_descriptor_store_secondary_endpoint_tuple,shell,cdecl,inferred,objdump,3,"Stores one secondary endpoint tuple into descriptor fields `[this+0x08]/[this+0x0c]`. The caller supplies the secondary IPv4 dword in `edx` and the secondary port word on the stack. Current grounded caller is the compact descriptor decode helper `0x58ff60`, which reaches this setter after header bit `0x02` selects an inline secondary IPv4 dword and header bit `0x20` either supplies the paired secondary port word or falls back to the owner default port at `[caller+0x498]`.","objdump + caller inspection + compact-header correlation"
0x0058d650,4,multiplayer_gamespy_server_descriptor_store_auxiliary_inline_dword10,shell,cdecl,inferred,objdump,2,"Stores one inline auxiliary dword into descriptor field `[this+0x10]`. Current grounded caller is the compact descriptor decode helper `0x58ff60`, which reaches this setter only when source header bit `0x08` is present. A local xref scan across the multiplayer descriptor family now makes the negative result tighter too: no dedicated semantic reader has been recovered yet. Current evidence only shows the field being preserved by later descriptor-record copy or callback marshaling helpers around `0x591410`, `0x591480`, and `0x591510`, not branched on or formatted through a dedicated accessor. So the field ownership and header-bit gate are explicit, while the higher-level meaning remains open.","objdump + caller inspection + compact-header correlation + local-xref scan + descriptor-copy correlation"
0x0058d660,3,multiplayer_gamespy_server_descriptor_store_state_byte14,shell,cdecl,inferred,objdump,2,"Stores one state byte into descriptor field `[this+0x14]`. Current grounded callers include queue-service paths that promote pending descriptor tags into ready bits and the compact decode helper `0x58ff60`, which ORs in bit `0x1` after the inline keyed-property vector path and bit `0x2` after the signed trailing string-pair tail.","objdump + caller inspection + queue-state correlation + compact-decode correlation"
0x0058d670,3,multiplayer_gamespy_server_descriptor_query_state_byte14,shell,cdecl,inferred,objdump,2,"Returns descriptor state byte `[this+0x14]` unchanged. Current grounded caller is the compact decode helper `0x58ff60`, which reads the existing state before OR-ing in bits `0x1` or `0x2` and writing the result back through `0x58d660`.","objdump + caller inspection + compact-decode correlation"
0x0058d5a0,3,multiplayer_gamespy_server_descriptor_query_special_numeric_scalar_dword1c,shell,cdecl,inferred,objdump,2,"Returns special numeric scalar field `[this+0x1c]` unchanged. Current grounded callers are the special-key fallback path inside `multiplayer_gamespy_server_descriptor_query_numeric_property_or_special_ping_yid_fallback` `0x58d6d0`, where both `queryid` and `ping` currently collapse onto this field, and the multiplayer session-event capacity-entry updater around `0x469251`, which copies the same scalar into entry field `[entry+0x118]` alongside `numplayers`, `maxplayers`, and the primary-endpoint text.","objdump + caller inspection + strings"
0x0058d6d0,66,multiplayer_gamespy_server_descriptor_query_numeric_property_or_special_ping_yid_fallback,shell,cdecl,inferred,objdump,3,"Looks up one numeric property on a compact GameSpy-style server or route descriptor and falls back to the caller default integer when the property is missing. For ordinary keys it probes the descriptor string-key store through `multiplayer_gamespy_server_descriptor_query_string_property_or_fallback` and parses the resulting decimal text through `0x5a1ea5`. It also has two fixed-key special cases for `queryid` and `ping`, both currently routed through `multiplayer_gamespy_server_descriptor_query_special_numeric_scalar_dword1c` `0x58d5a0` instead of the generic property store. Current grounded callers use it for fields such as `numplayers`, `maxplayers`, `maxwaiting`, `numservers`, `numwaiting`, and `gsi_am_rating`.","objdump + caller inspection + strings + rdata-key correlation"
0x0058d7a0,55,multiplayer_transport_set_local_name,shell,thiscall,inferred,ghidra-headless,3,Updates the local identity string stored in the session-event transport object. When the transport is already configured through [this+0x44] and the incoming name pointer is non-null and non-empty it copies up to 0x40 bytes into [this+0x04] clears byte [this+0x43] and then forwards the same name into the lower transport update path through 0x0058f330.,ghidra + rizin + llvm-objdump
0x0058d830,40,multiplayer_transport_disconnect,shell,thiscall,inferred,ghidra-headless,3,Disconnects the session-event transport object from its current live route. The helper flips the internal active state through 0x005965d0 and 0x005961b0 calls the shared teardown block at 0x0058d810 and finally clears byte [this+0x60] and the copied local name at [this+0xaf4].,ghidra + rizin + llvm-objdump
0x0058d860,59,multiplayer_transport_release_worker_and_reset_runtime_state,shell,cdecl,inferred,rizin,3,Small runtime-reset wrapper for the outer session-event transport object. When the owned worker pointer at [this] is present it first tears that worker down through multiplayer_transport_worker_shutdown_gracefully then clears the worker pointer the configured flag byte at [this+0x04] the text-stream owner slots at [this+0x44] and [this+0x48] reruns 0x00593370 and the shared reset block at 0x0058d810 and finally clears the live route and deferred-runtime fields at [this+0x180c] [this+0x1810] and [this+0x1edc].,rizin + llvm-objdump
0x0058d8d0,143,multiplayer_transport_service_frame,shell,cdecl,inferred,objdump + caller xrefs,3,"Recurring service pump for the outer session-event transport object. When the transport is configured through `[this+0x44]` or `[this+0x48]` it first services one worker step through multiplayer_transport_service_worker_once on the owned worker at `[this]`; if deferred reset is armed at `[this+0x1edc]` and the outstanding-work count has reached zero it falls straight into the common reset path at `0x0058de50`. Otherwise it conditionally emits the keepalive text at `0x005e1c24` after roughly `0x493e0` ms of inactivity, services the deeper selector or route helpers through `0x00596210` and `0x00597380`, finalizes deferred reset when the work count at `[this+0x1808]` reaches zero, and finishes by forwarding the caller selector through `0x00592800`. Current grounded callers reach it through multiplayer_transport_flush_and_maybe_shutdown and the immediate-drain submission paths, which places it at the center of the shell-owned multiplayer transport cadence.","objdump + caller xrefs + strings"
0x005a152e,176,math_abs_double_with_crt_special_case_handling,support,cdecl,inferred,objdump + arithmetic inspection + caller xrefs,4,"Returns the absolute value of one caller-supplied `double`. On ordinary finite inputs the helper simply clears the sign bit of the high dword before returning; on NaN or infinity it re-enters the surrounding CRT status machinery before returning either the preserved or sign-flipped value. Current grounded callers include the route-entry search family at `0x0049d380` and `0x0049c900`, where it is used as the absolute-value side of the span and angle quality gates.","objdump + arithmetic inspection + caller xrefs + CRT special-case correlation"
0x0058c340,144,multiplayer_gamespy_decode_triplet_control_payload,shell,cdecl,inferred,objdump,3,"Decodes one length-coded three-part GameSpy control payload and re-emits it through the shared packet-field builder at `0x58c0c0`. The helper reads up to three bounded variable-length slices from the caller payload, then packages them as field classes `0`, `1`, and `2`. The current grounded caller is subtype `0` of multiplayer_gamespy_route_dispatch_inbound_packet's `0xfe 0xfd` switch.",objdump
0x0058c5c0,60,multiplayer_gamespy_build_backslash_query_response,shell,cdecl,inferred,objdump + strings,3,"Builds one backslash-delimited GameSpy query reply into the caller buffer. It seeds the leading `\\`, emits three callback-driven field groups through `0x58c3e0` for selectors `0`, `1`, and `2`, appends the fixed terminator token at `0x005e1b6c`, and leaves the result ready for immediate send. The current grounded caller is the backslash-packet branch inside multiplayer_gamespy_route_dispatch_inbound_packet.",objdump + strings
0x0058c600,142,multiplayer_gamespy_dispatch_natneg_or_raw_callback,shell,cdecl,inferred,objdump + strings,3,"Dispatches one validated extended GameSpy payload into route-owner callbacks. When the payload begins with the six-byte magic `fd fc 1e 66 6a b2` it treats bytes `[payload+6..+9]` as a little-endian value, materializes a small wrapper object through `0x5b31f8`, and forwards it through the route callback at `[route+0xa0]`; otherwise it falls back to the raw payload callback at `[route+0xa4]`. Both slots are optional: the helper tests them for null and returns without dispatch when the selected callback is absent. The current grounded caller is subtype `6` of multiplayer_gamespy_route_dispatch_inbound_packet.",objdump + strings
0x0058c690,58,multiplayer_gamespy_route_dedupe_recent_cookie,shell,cdecl,inferred,objdump,3,Maintains a small ring of the last ten 32-bit route cookies or packet ids under `[route+0xd8]` and `[route+0x100]`. It returns `1` when the caller id is already present and otherwise inserts it into the rotating slot table and returns `0`. The current grounded caller is subtype `6` of multiplayer_gamespy_route_dispatch_inbound_packet before dispatching the validated extended payload.,objdump
0x0058c6d0,606,multiplayer_gamespy_route_dispatch_inbound_packet,shell,cdecl,inferred,objdump + strings,3,"Main inbound packet parser for one GameSpy-style route object. It sends semicolon-prefixed lines through the route callback at `[route+0xd4]`, but only when that slot is non-null; otherwise the semicolon branch returns without additional work. It treats backslash-prefixed packets as query requests and answers them by building a reply through multiplayer_gamespy_build_backslash_query_response, and otherwise requires at least seven bytes plus the `0xfe 0xfd` header before entering a subtype switch on byte `2`. The grounded subtype branches are now tighter: subtype `0` decodes a three-slice control payload through multiplayer_gamespy_decode_triplet_control_payload; subtype `1` copies one bounded NUL-terminated string through `0x58c030`; subtype `2` copies up to `0x20` raw bytes into the local packet builder as field class `5`; subtype `4` validates the four-byte route cookie at `[route+0x84]`, clears `[route+0xb0]`, and dispatches the remaining payload through the validated route callback at `[route+0x9c]`, which the transport-owned status and live routes seed to `0x5972c0`; subtype `6` validates the same cookie, emits a field-class `7` record with the next dword, dedupes that dword through multiplayer_gamespy_route_dedupe_recent_cookie, and then dispatches the trailing payload through multiplayer_gamespy_dispatch_natneg_or_raw_callback. In the currently grounded transport-owned status route, that extended callback layer is patched after construction so `[route+0xa0]` points at `0x597330`; the raw fallback slot `[route+0xa4]` remains unresolved and currently no-ops when null. Subtypes `3` and `5` currently fall through without additional work. The current grounded caller is multiplayer_gamespy_route_drain_inbound_packets.","objdump + strings"
0x0058cfd0,107,multiplayer_gamespy_route_release_and_free,shell,thiscall,inferred,objdump,3,"Common teardown helper for one GameSpy-style route object. When the route still looks live through `[route+0xb4]` it first sends the mode-`2` control frame through `0x58cd70`, closes the current route handle at `[route]` when needed through `0x58bc4e`, resets the handle and last-send timestamp fields, and finally frees the route object through `0x58f3c0` when it is not the default singleton at `0x00629840`. Current grounded callers are multiplayer_transport_release_status_route, multiplayer_transport_release_live_route, and the status-route reconnect path.","objdump"
0x0058ccd0,107,multiplayer_gamespy_route_drain_inbound_packets,shell,cdecl,inferred,objdump + strings,3,"Inbound packet drain for one GameSpy-style route object. While the route receive queue remains non-empty it pulls one datagram through `0x58bc7e`, routes the payload into `multiplayer_gamespy_route_dispatch_inbound_packet`, and then repeats. The parser accepts semicolon-prefixed lines through the route callback at `[route+0xd4]`, backslash-delimited key bundles, and `0xfe 0xfd` GameSpy control packets. The current grounded caller is the lower route-service helper at `0x58d040`.","objdump + strings"
0x0058cee0,164,multiplayer_gamespy_route_service_retry_and_keepalive_timers,shell,cdecl,inferred,objdump + strings,3,"Timer and retry side of one GameSpy-style route object. It checks the active route handle and challenge or retry fields around `[route+0xa8]`, `[route+0xac]`, and `[route+0xb0]`, emits outbound control traffic through the local send helper when the `master.gamespy.com` challenge or state flow stalls, raises the `No challenge value was received from the master server.` callback through `[route+0x9c]` after repeated failures, and periodically refreshes the auxiliary timestamp through `0x58c950`. The current grounded caller is the lower route-service helper at `0x58d040`, which makes this the timer or retry half of the recurring GameSpy route cadence.","objdump + strings"
0x0058d040,37,multiplayer_gamespy_route_service_frame,shell,cdecl,inferred,objdump + strings,3,"Low-level recurring service step for one GameSpy-style route object. When the route handle state at `[route+0xb4]` is live it first services retry and keepalive timers through `multiplayer_gamespy_route_service_retry_and_keepalive_timers` and then drains inbound packets through `multiplayer_gamespy_route_drain_inbound_packets`. Current grounded callers are `multiplayer_transport_service_status_and_live_routes`, which uses the same helper for both the auxiliary status route at `[transport+0xaf0]` and the current live route at `[transport+0x1ecc]`.","objdump + strings"
0x0058d960,7,multiplayer_transport_select_status_route,shell,thiscall,inferred,ghidra-headless,3,Thin route-selector wrapper for the session-event transport. It forwards the requested small route id in EDX into multiplayer_transport_set_mode_q_flag which updates [this+0x560] formats the underlying `MODE %s -q` or `MODE %s +q` command text and reconfigures the transport-side callback plumbing.,ghidra + rizin + llvm-objdump
0x0058d970,89,multiplayer_transport_subscribe_field_callback_set,shell,thiscall,inferred,ghidra-headless,3,"Registers one field-subscription callback set on the session-event transport. When active byte `[this+0x60]` is set it stores the caller callback pair into `[this+0x176c]` and `[this+0x1770]`, then forwards the field-id list string plus callback and context into `multiplayer_transport_open_field_subscription_route_callback_table` `0x5962e0`; on failure it falls back through `multiplayer_transport_enqueue_field_snapshot_record` `0x592b50`. Current evidence now makes this the closest explicit lifecycle owner for the replay-band fields immediately below the still-unrecovered sidecar pointer at `[this+0x1778]`.","ghidra + rizin + llvm-objdump + local disassembly + field-subscription correlation"
0x0058d9e0,55,multiplayer_transport_send_selector_text,shell,thiscall,inferred,ghidra-headless,3,Sends one caller-supplied text pointer through a selector-specific transport slot. The helper looks up the selector entry from the handler table rooted at [this+0x390] and when both the text pointer and slot are valid forwards the string plus caller flag into the lower send helper at 0x0058e7e0 using the descriptor block at [this+0x80+selector*0x101].,ghidra + rizin + llvm-objdump
0x0058da60,75,multiplayer_transport_register_selector_callback,shell,thiscall,inferred,ghidra-headless,3,Registers or dispatches one selector callback against the transport slot table rooted at [this+0x390]. When the selected slot is absent it directly invokes the supplied callback with mode -1 and null payloads; otherwise it packages the caller context on the stack and walks the registered slot through 0x00594ac0 using helper 0x0058da20.,ghidra + rizin + llvm-objdump
0x0058db00,23,multiplayer_transport_request_status_pump,shell,thiscall,inferred,ghidra-headless,3,Marks the session-event transport status path dirty by setting [this+0xb44] to 1 and then calling multiplayer_transport_service_status_pump when the transport is active.,ghidra + rizin + llvm-objdump
0x0058db20,53,multiplayer_transport_clear_status_pump,shell,thiscall,inferred,ghidra-headless,3,Clears the session-event transport status-pump flag at [this+0xb44] then reruns multiplayer_transport_service_status_pump. When the transport still owns the auxiliary object at [this+0xaf0] it follows up with either 0x00597370 or 0x00597350 depending on whether selector slot [this+0x398] is present.,ghidra + rizin + llvm-objdump
0x0058db60,5,multiplayer_transport_force_status_flush,shell,thiscall,inferred,ghidra-headless,3,Tail-call wrapper into 0x00597370 for the active session-event transport object. The shell flush path uses it immediately before multiplayer_transport_flush_and_maybe_shutdown.,ghidra + rizin + llvm-objdump
0x0058dc30,22,multiplayer_transport_is_route_mode_active_nonterminal,shell,cdecl,inferred,ghidra-headless,3,Tiny predicate over the route-mode field at [this+0x18b8]. It returns false when the mode is zero or terminal mode `5` and true for the other active route modes. Current grounded callers use it to decide whether route callbacks can run inline or whether route work must be re-enqueued.,ghidra + rizin + llvm-objdump
0x0058de90,95,multiplayer_transport_shutdown,shell,thiscall,inferred,ghidra-headless,3,Shuts down the session-event transport object and either marks deferred-close state or tears the object down immediately. It preserves [this+0x178c] across the common shutdown helper at 0x0058de50 disconnects active routes through multiplayer_transport_disconnect and when no outstanding work remains drops into the reset path at 0x0058d8a0; otherwise it latches deferred-close flag [this+0x1ee0].,ghidra + rizin + llvm-objdump
0x0058def0,40,multiplayer_transport_flush_and_maybe_shutdown,shell,thiscall,inferred,ghidra-headless,3,Flushes the transport state through 0x0058d8d0 with selector -1 and when deferred-close flag [this+0x1ee0] is set and the outstanding-work count at [this+0x1808] has reached zero immediately falls into multiplayer_transport_shutdown.,ghidra + rizin + llvm-objdump
0x0058d720,35,multiplayer_transport_context_id_is_absent_from_queued_and_active_collections,shell,cdecl,inferred,objdump + caller inspection,2,"Small immediate-drain quiescence gate for one transport context id carried in `ESI`. It first checks the transient work-record collection at `[transport+0x1780]` through `multiplayer_transport_queued_work_collection_lacks_context_id` `0x593400`, then checks the active opcode-record collection at `[transport+0x17fc]` through `multiplayer_transport_active_opcode_record_collection_lacks_context_id` `0x592970`, and returns success only when both collections lack that same id. Current grounded callers are the immediate-drain tails in `multiplayer_transport_submit_text_record` `0x58df20`, the neighboring formatted selector-text publish root at `0x58dfb0`, and `multiplayer_transport_register_callback_table` `0x58e200`.","objdump + caller inspection + immediate-drain correlation + collection-quiescence correlation"
0x0058df20,131,multiplayer_transport_submit_text_record,shell,thiscall,inferred,ghidra-headless,3,"Submits one prepared text record through the session-event transport using a caller-supplied callback wrapper. The helper first seeds one shared immediate-drain context id through `multiplayer_transport_next_work_sequence` `0x5934c0`, then tries the text fastpath through `multiplayer_transport_try_submit_text_record_fastpath` `0x593d60`; when that fast path declines it packages the caller callback mode and payload into `0x593170` together with the same context id. When the caller requested immediate draining it services the transport queue through `0x58d8d0` and waits in `0x58d720` until that same id disappears from both queued work field `+0x0c` and active opcode-record field `+0x14`, then may fall into `multiplayer_transport_shutdown` when deferred close is armed.","ghidra + rizin + llvm-objdump"
0x0058e100,230,multiplayer_transport_publish_fixed_token_message,shell,thiscall,inferred,ghidra-headless,3,Publishes one fixed-token status message through selector `2` on the session-event transport. The helper requires the transport to be active and fully configured builds a formatted status line from the caller token plus internal fields such as [this+0x282] and [this+0x54] sends that line through multiplayer_transport_send_selector_text sets [this+0xb44] to 1 reruns the status pump and when appropriate nudges the downstream mode helper at 0x00595650 or the auxiliary object paths 0x00597350 and 0x00597370.,ghidra + rizin + llvm-objdump + strings
0x0058e200,211,multiplayer_transport_register_callback_table,shell,thiscall,inferred,ghidra-headless,3,"Registers or refreshes the session-event transport callback table and descriptor block. The helper first seeds one shared immediate-drain context id through `multiplayer_transport_next_work_sequence` `0x5934c0`. When the transport is not yet fully configured it copies the local name into `[this+0x04]`, stores the callback-table pointers at `[this+0x4c]` and `[this+0x5c]`, sets `[this+0x44]` active, and forwards the descriptor block plus caller metadata into `multiplayer_transport_attach_callback_table_descriptor` `0x593650` with that same context id. It then routes the resolved table through `multiplayer_transport_dispatch_callback_table_binding` `0x592a40`, and when immediate draining is requested it pumps `0x58d8d0` until `0x58d720` confirms that same id has disappeared from both the queued work and active opcode collections before honoring deferred-close state.","ghidra + rizin + llvm-objdump"
0x0058e2e0,38,multiplayer_transport_reset_and_maybe_shutdown,shell,thiscall,inferred,ghidra-headless,3,Resets the common transport state through 0x0058de50 and when deferred-close flag [this+0x1ee0] is armed and the outstanding-work count at [this+0x1808] has reached zero immediately falls into multiplayer_transport_shutdown.,ghidra + rizin + llvm-objdump
0x0058e370,33,multiplayer_transport_is_request_pending,shell,cdecl,inferred,ghidra-headless,3,Returns true while the caller transport request still appears in either the queued request collection at [this+0x550] or the secondary active-work collection checked through 0x0059c540. Immediate-drain callers use it as the loop predicate after pumping queued text and sleeping for 10 ms.,ghidra + rizin + llvm-objdump
0x0058e3f0,137,multiplayer_transport_drain_request_text_queue,shell,cdecl,inferred,ghidra-headless,3,Immediate-drain helper for one transport request. When request kind [req+0x20] is `1` it walks queued transport text lines under [this+0x1c] republishes them through 0x0059b790 and notifies the small observer table through 0x0058e310 until the queue is empty. When request kind `2` drains it also publishes `Disconnected`. Both paths refresh timeout state through 0x00598030 and finish by forwarding the request into 0x0059c470.,ghidra + rizin + llvm-objdump + strings
0x0058e480,105,multiplayer_transport_worker_shutdown_gracefully,shell,cdecl,inferred,rizin,3,"Graceful shutdown wrapper for one multiplayer transport worker. If the callback object at `[this+0x538]` and its owner slot `[this+0x544]` are present it first emits a final owner notification through the callback vtable using fallback text at `0x005c87a8`. When the owned text-stream socket at `[this+0x1c]` is still live it appends `QUIT :Later!` through multiplayer_transport_text_stream_append_crlf_line and services one I/O step through multiplayer_transport_text_stream_service_io before destroying the registered-name store at `[this+0x548]`, the pending-template dispatch store at `[this+0x54c]`, the text-stream object at `[this+0x1c]`, and finally the worker backing block itself.","rizin + llvm-objdump + strings"
0x0058e4f0,12,multiplayer_transport_service_worker_once,shell,cdecl,inferred,objdump,3,"Very small bridge from the outer session-event transport object into its owned worker. It forwards the worker pointer in `[this]` into multiplayer_transport_drain_request_text_queue with a null request pointer, making it the one-step worker service helper used by the recurring transport pump.",objdump
0x0058e650,80,multiplayer_transport_sanitize_identifier,shell,cdecl,inferred,ghidra-headless,4,Normalizes a caller-supplied identifier string into the destination buffer by replacing leading punctuation and any later disallowed characters with underscores while preserving acceptable bytes from the source. Current grounded callers use it for the randomized `RT3Player%d` retry name and for locally submitted session-event text records.,ghidra + rizin + llvm-objdump + strings
0x0058e6b0,98,multiplayer_transport_set_mode_q_flag,shell,thiscall,inferred,ghidra-headless,4,Updates the transport mode-q flag tracked at [this+0x560]. When the requested value changes it formats either `MODE %s -q` or `MODE %s +q` against the active name buffer at [this+0x36c] stores the new flag and for mode `0` refreshes the downstream callback plumbing through 0x0059e070 and 0x0059de00 using helper 0x0058e6a0.,ghidra + rizin + llvm-objdump + strings
0x0058e8c0,37,multiplayer_transport_publish_topic_status_line,shell,thiscall,inferred,ghidra-headless,3,Formats and publishes one `TOPIC %s :%s` status line through the active transport text buffer at [this+0x1c]. When the caller text is null it falls back to the shared empty sample at 0x005c87a8. Current grounded caller is multiplayer_transport_handle_names_query_response.,ghidra + rizin + llvm-objdump + strings
0x0058e8f0,56,multiplayer_transport_publish_mode_key_status_line,shell,thiscall,inferred,ghidra-headless,3,Formats and publishes one mode-key status line through the active transport text buffer at [this+0x1c]. Depending on the caller flag it emits either `MODE %s +k %s` or `MODE %s -k %s`. Current grounded caller is multiplayer_transport_handle_bound_route_request.,ghidra + rizin + llvm-objdump + strings
0x0058e930,53,multiplayer_transport_publish_mode_level_status_line,shell,thiscall,inferred,ghidra-headless,3,Formats and publishes one mode-level status line through the active transport text buffer at [this+0x1c]. Depending on whether the caller level value is nonzero it emits either `MODE %s +l %d` or `MODE %s -l`. Current grounded caller is multiplayer_transport_handle_names_query_response.,ghidra + rizin + llvm-objdump + strings
0x0058e970,36,multiplayer_transport_invoke_registered_name_query_callback,shell,cdecl,inferred,ghidra-headless,3,Small callback shim used by the registered-name fast path. It loads the caller callback object from the dispatch frame and invokes its entry method with success flag `1`; the queried sample string; and the collected callback-entry arrays produced by multiplayer_transport_collect_registered_name_callback_entries.,ghidra + rizin + llvm-objdump
0x0058e9a0,177,multiplayer_transport_submit_names_query_with_callback,shell,thiscall,inferred,ghidra-headless,3,Builds and submits one `NAMES %s` query against the active transport text buffer at [this+0x1c]. When the caller sample is already present it bypasses transport submission through multiplayer_transport_dispatch_registered_name_query_fastpath. Otherwise it validates the sample through multiplayer_transport_has_registered_name packages the request through multiplayer_transport_enqueue_names_query_record and when immediate draining is requested loops through multiplayer_transport_drain_request_text_queue system_sleep_milliseconds and multiplayer_transport_is_request_pending. Current grounded callers are multiplayer_transport_handle_bound_route_request and multiplayer_transport_handle_selector_text_route_request.,ghidra + rizin + llvm-objdump + strings
0x0058eb70,212,multiplayer_transport_append_getkey_command,shell,cdecl,inferred,rizin,3,Formats one `GETKEY %s %s 0 :` command into a temporary 0x200-byte stack buffer and appends it to the owned transport text stream through multiplayer_transport_text_stream_append_crlf_line. After the fixed header it walks the caller string-vector argument and appends each additional item separated by backslashes. Current grounded caller is the synchronous submit wrapper at 0x0058ec50.,rizin + llvm-objdump + strings
0x0058ec50,140,multiplayer_transport_submit_getkey_command_and_wait,shell,cdecl,inferred,rizin,3,Synchronous `GETKEY` submit wrapper for the multiplayer transport worker. It resolves the query name from the caller string or falls back to [this+0x36c] primes one transient request through 0x0058eb30 emits the command text through multiplayer_transport_append_getkey_command and then loops through multiplayer_transport_drain_request_text_queue system_sleep_milliseconds and multiplayer_transport_is_request_pending until the request completes.,rizin + llvm-objdump + strings
0x0058ece0,197,multiplayer_transport_append_setchankey_or_setckey_command,shell,cdecl,inferred,rizin,3,Formats either `SETCHANKEY %s :` or `SETCKEY %s %s :` into a temporary 0x200-byte stack buffer and appends the resulting line to the owned transport text stream through multiplayer_transport_text_stream_append_crlf_line. The two-token `SETCKEY` form is selected when the optional caller key string at arg_210h is present and non-empty; otherwise the helper emits the simpler channel-key form.,rizin + llvm-objdump + strings
0x0058edb0,367,multiplayer_transport_append_setchankey_pair_list_command,shell,cdecl,inferred,rizin,2,Builds one larger backslash-delimited channel-key payload and appends it to the owned transport text stream through multiplayer_transport_text_stream_append_crlf_line. The helper formats normalized `\\%s\\%s` pair fragments in a 0x200-byte stack buffer converts backslashes to forward slashes in one staging path handles wildcard samples through the `*` token at 0x005e1e1c and is the main text builder beneath the synchronous submit wrapper at 0x0058ef20.,rizin + llvm-objdump + strings
0x0058ef20,199,multiplayer_transport_submit_setchankey_pair_list_command_and_wait,shell,cdecl,inferred,rizin,2,Synchronous channel-key submit wrapper for the multiplayer transport worker. It primes one transient request through 0x0058eb30 emits the larger backslash-delimited key payload through multiplayer_transport_append_setchankey_pair_list_command dispatches the caller result path through 0x005983b0 or 0x005984c0 depending on the staged optional arguments and then loops through multiplayer_transport_drain_request_text_queue system_sleep_milliseconds and multiplayer_transport_is_request_pending until the request completes.,rizin + llvm-objdump + strings
0x0058eff0,78,multiplayer_transport_is_valid_nick_string,shell,cdecl,inferred,rizin,4,Validates one transport nick string. It rejects null or empty strings rejects a leading digit or `-` through 0x005a53f2 and then scans every remaining byte against the allowed nick-character table at 0x005e1c70. It returns 1 when the full string is acceptable and 0 otherwise.,rizin + llvm-objdump + strings
0x0058f040,90,multiplayer_transport_dispatch_or_release_callback_binding,shell,cdecl,inferred,rizin,3,Generic dispatcher for one optional transport callback-binding structure. When binding field [this+0x0c] is present it packages the caller mode from EDX together with binding fields [this+0x18] and [this+0x36c] into opcode 0x1a through 0x0059b790. Otherwise it clears [this+0x04] and if callback pointer [this+0x14] is installed invokes it directly with the owner cookie at [this+0x18] and a zero status value.,rizin + llvm-objdump + strings
0x0058f380,64,tracked_heap_alloc_with_header,support,cdecl,inferred,ghidra-headless,4,Allocates one caller-sized heap block through the shared allocator at 0x005a125d stores the payload size in a 4-byte header immediately before the returned pointer and updates the global allocation counters at 0x00dba4c8 through 0x00dba4d0. Callers treat the returned value as a payload pointer just past the size header.,rizin + llvm-objdump
0x0058f3c0,43,tracked_heap_free_with_header,support,cdecl,inferred,ghidra-headless,4,Releases one heap block previously returned by tracked_heap_alloc_with_header. It reads the stored payload size from the 4-byte header decrements the shared allocation counters at 0x00dba4c8 and 0x00dba4cc and frees the underlying base pointer through 0x005a1145.,rizin + llvm-objdump
0x0058f3f0,94,tracked_heap_resize_with_header,support,cdecl,inferred,ghidra-headless,4,Resizes one header-tracked heap block to a new payload size. Null plus nonzero size falls through to tracked_heap_alloc_with_header; nonnull plus zero size frees through tracked_heap_free_with_header; and the main path reallocates through 0x005a5922 while preserving and re-accounting the payload size tracked in the 4-byte header.,rizin + llvm-objdump
0x0058f460,8,system_sleep_milliseconds,support,cdecl,inferred,ghidra-headless,4,Tiny wrapper over `Sleep` that forwards the caller millisecond delay in `ecx`. Current grounded callers use it as the 10 ms backoff inside immediate transport-drain loops.,rizin + llvm-objdump
0x0058fb10,24,memory_query_bounded_nul_terminated_byte_span_length,support,cdecl,inferred,objdump,3,"Scans one caller-supplied byte span for the first NUL terminator and returns the terminating length in bytes. The helper walks forward from the caller base pointer in `ecx` until it either finds a zero byte and returns the consumed count, or exhausts the caller byte budget in `edx` and returns `-1`. Current grounded callers use it as the bounded string-length primitive under compact descriptor tail validation and decode helpers such as `0x58fe50`, `0x58fe90`, and `0x58ff60`.","objdump + caller inspection + bounded-string correlation"
0x0058fe20,44,multiplayer_gamespy_server_descriptor_query_minimum_fixed_compact_header_byte_count,shell,cdecl,inferred,objdump,3,"Computes the minimum fixed byte count required by one compact descriptor header before any variable-length property or string tails are considered. The helper starts from `5` bytes for the source header byte plus the always-present primary IPv4 dword, then adds `4` when header bit `0x02` carries a secondary IPv4 dword, adds `4` when bit `0x08` carries the auxiliary inline dword stored at `[descriptor+0x10]`, adds `2` when bit `0x10` carries an inline primary port word, and adds `2` when bit `0x20` carries an inline secondary port word. Current grounded caller `0x5907d0` uses this as the first fixed-shape precheck above the heavier compact payload validators `0x58fe90` and `0x58fe50`.","objdump + caller inspection + compact-header correlation"
0x0058fe50,56,multiplayer_gamespy_server_descriptor_validate_signed_string_pair_tail_shape,shell,cdecl,inferred,objdump,3,"Validates the variable-length trailing tail used when the compact descriptor source header carries signed bit `0x80`. The helper repeatedly scans one bounded NUL-terminated string through `memory_query_bounded_nul_terminated_byte_span_length` `0x58fb10`, advances twice per loop to cover an alternating string pair, and only succeeds when the remaining byte budget ends on one final empty-string terminator. Current grounded caller `0x5907d0` uses this as the signed-tail shape precheck above the heavier decode path `0x58ff60`.","objdump + caller inspection + compact-header correlation + bounded-string correlation"
0x0058fe90,135,multiplayer_gamespy_server_descriptor_validate_inline_keyed_property_vector_shape,shell,cdecl,inferred,objdump,3,"Validates the variable-length inline keyed-property vector used when compact descriptor source header bit `0x40` is present. It walks the owner descriptor schema at `[owner+0x08]` through `0x59e110/0x59e120` and checks that the caller payload can supply each declared property item in sequence: one-byte entries for descriptor type `1`, two-byte entries for descriptor type `2`, and either one-byte dictionary selectors or bounded inline strings prefixed by `0xff` for descriptor type `0`, with the inline string lengths verified through `memory_query_bounded_nul_terminated_byte_span_length` `0x58fb10`. Current grounded caller `0x5907d0` uses this as the `0x40`-vector shape precheck before `0x58ff60` decodes the same property vector into the descriptor store.","objdump + caller inspection + compact-header correlation + bounded-string correlation"
0x0058ff20,52,multiplayer_gamespy_server_descriptor_preparse_compact_primary_endpoint_tuple,shell,cdecl,inferred,objdump,3,"Pre-parses the compact descriptor payload just far enough to recover the primary endpoint key used by the keyed-upsert decode lane. When the payload is at least `5` bytes long it reads the header byte at offset `0`, always copies the primary IPv4 dword from payload offset `+1` into one caller out slot, and then either copies the inline primary port word from payload offset `+5` when header bit `0x10` is present or falls back to the owner-side default port at `[caller+0x498]` when that bit is clear. Current grounded callers are the larger compact decode owners `0x5907d0` and `0x590d00`. This is the strongest current proof that compact descriptors always carry the primary IPv4 dword and that header bit `0x10` only gates the inline primary port word.","objdump + caller inspection + compact-header correlation"
0x00590140,78,multiplayer_gamespy_server_descriptor_compare_numeric_property_or_special_scalar,shell,cdecl,inferred,objdump,3,"Comparator helper for descriptor-collection property sorting. It resolves the caller-selected property key from global scratch slot `0x00db8c6c+0x488`, queries that key on both candidate descriptors through `multiplayer_gamespy_server_descriptor_query_numeric_property_or_special_ping_yid_fallback` `0x58d6d0` with zero fallback, subtracts the two integer-like results, and optionally negates the sign according to the reverse-sort latch at `0x00db8c6c+0x48c`. Current grounded caller is the collection sorter `0x590310` in comparator mode `0`.","objdump + caller inspection + descriptor-sort correlation"
0x00590190,138,multiplayer_gamespy_server_descriptor_compare_double_parsed_property,shell,cdecl,inferred,objdump,3,"Comparator helper for descriptor-collection property sorting on double-parsed property values. It resolves the caller-selected property key from global scratch slot `0x00db8c6c+0x488`, queries both candidate descriptors through `0x58d1a0` with `0.0` fallback, compares the resulting doubles against zero, and returns `-1/0/1` with optional sign inversion driven by the reverse-sort latch at `0x00db8c6c+0x48c`. Current grounded caller is the collection sorter `0x590310` in comparator mode `1`.","objdump + caller inspection + descriptor-sort correlation"
0x00590220,130,multiplayer_gamespy_server_descriptor_compare_string_property_lexicographically_inline,shell,cdecl,inferred,objdump,3,"Comparator helper for descriptor-collection property sorting on string properties. It resolves the caller-selected property key from global scratch slot `0x00db8c6c+0x488`, queries both candidate descriptors through `multiplayer_gamespy_server_descriptor_query_string_property_or_fallback` `0x58d170` with empty-string fallback, compares the two strings bytewise inlined, and optionally flips the result through the reverse-sort latch at `0x00db8c6c+0x48c`. Current grounded caller is the collection sorter `0x590310` in comparator mode `2`.","objdump + caller inspection + descriptor-sort correlation"
0x005902b0,88,multiplayer_gamespy_server_descriptor_compare_string_property_via_crt_compare,shell,cdecl,inferred,objdump,3,"Alternate string-property comparator for descriptor-collection sorting. It resolves the caller-selected property key from global scratch slot `0x00db8c6c+0x488`, queries both candidate descriptors through `multiplayer_gamespy_server_descriptor_query_string_property_or_fallback` `0x58d170` with empty-string fallback, compares them through the CRT string-compare helper at `0x5a57cf`, and optionally negates the sign according to the reverse-sort latch at `0x00db8c6c+0x48c`. Current grounded caller is the collection sorter `0x590310` in comparator modes above `2`.","objdump + caller inspection + descriptor-sort correlation"
0x00590310,76,multiplayer_gamespy_server_descriptor_collection_sort_by_property_mode,shell,cdecl,inferred,objdump,3,"Sorts one compact-descriptor collection by a caller-selected property comparator mode. The helper stores the chosen property-key pointer into global scratch slot `0x00db8c6c+0x488`, stores the reverse-sort latch into `0x00db8c6c+0x48c`, picks one comparator callback from `0x590140`, `0x590190`, `0x590220`, or `0x5902b0` according to the caller mode, and then sorts the backing vector at `[this+0x04]` through `generic_vector_sort` `0x59e170`. Current grounded caller `0x595f70` uses mode `1` with key `gsi_am_rating` before selecting the head descriptor from the primary-endpoint table.","objdump + caller inspection + descriptor-sort correlation + caller correlation"
0x00590370,45,multiplayer_gamespy_server_descriptor_collection_append_and_notify_owner,shell,cdecl,inferred,objdump,3,"Appends one descriptor pointer into the caller collection and immediately notifies the route-callback-table owner. It inserts the descriptor into the backing vector at `[this+0x04]` through `0x59e4d0`, then invokes the owner callback at `[this+0x480]` with mode `0`, passing the appended descriptor plus cookie `[this+0x484]`. Current grounded callers are the compact append paths `0x5907d0`, `0x590d00`, and the raw primary-endpoint seed path `0x590dc0`. This is now the clearest generic append-notify owner-callback lane for route-callback tables, and the capacity-descriptor owner `0x595bc0` uses that same mode-`0` branch for its populated live publish path.","objdump + caller inspection + descriptor-collection correlation + owner-callback correlation + capacity-owner-mode correlation"
0x005903a0,97,multiplayer_gamespy_server_descriptor_collection_find_by_primary_ipv4_and_port,shell,cdecl,inferred,objdump,3,"Searches one descriptor collection for an entry whose compact primary endpoint key matches the caller tuple. It walks the backing collection at `[this+0x04]`, compares each candidate descriptor's raw primary IPv4 dword through `0x58d1f0`, and then compares its raw primary port word through `0x58d210`. It returns the matching collection index or `-1` when no descriptor carries that same primary endpoint pair. This is the current strongest proof that descriptor fields `[0x00]` and `[0x04]` form the compact identity key for the server or route descriptor family.","objdump + caller inspection + descriptor-key correlation"
0x00590410,24,multiplayer_transport_route_callback_table_stage_descriptor_on_intrusive_list,shell,cdecl,inferred,objdump,2,"Prepends one descriptor pointer onto the route-callback table's staged intrusive list headed at `[this+0x5bc]`. It writes the prior head into descriptor field `+0x20` through `multiplayer_gamespy_server_descriptor_store_intrusive_next_link` `0x58d260`, then replaces `[this+0x5bc]` with the staged descriptor. Current grounded callers are the generic remove-notify lane `0x590430` and the active-collection release pass `0x5904d0`.","objdump + caller inspection + intrusive-list correlation"
0x00590430,57,multiplayer_gamespy_server_descriptor_collection_remove_index_notify_owner_and_stage_intrusive_link,shell,cdecl,inferred,objdump,3,"Removes one descriptor pointer from the caller collection by index, notifies the route-callback-table owner, and stages the removed descriptor onto the intrusive list head at `[this+0x5bc]`. It resolves the indexed descriptor through `0x59e120`, publishes owner callback mode `2` with that descriptor plus cookie `[this+0x484]`, erases the vector slot through `0x59e3d0`, and then prepends the removed descriptor onto the intrusive list through `0x590410`. Current grounded caller is the `gsi_am_rating` maintenance lane `0x595f70` when a descriptor fails the openstaging capacity gate. This is now the clearest generic remove-notify-and-stage owner-callback lane for route-callback tables, distinct from the append-notify mode-`0` path at `0x590370`.","objdump + caller inspection + descriptor-collection correlation + owner-callback correlation + generic-mode-split correlation"
0x00590470,8,multiplayer_gamespy_server_descriptor_collection_count,shell,cdecl,inferred,objdump,2,"Returns the live descriptor count in the caller collection by forwarding `[this+0x04]` into `generic_vector_count` `0x59e110`. Current grounded callers include the `gsi_am_rating` maintenance lane `0x595f70`.","objdump + caller inspection + descriptor-collection correlation"
0x00590480,11,multiplayer_gamespy_server_descriptor_collection_get_nth,shell,cdecl,inferred,objdump,2,"Returns the descriptor pointer stored at one zero-based collection index by forwarding the caller index into `generic_vector_get_nth` `0x59e120` on `[this+0x04]`. Current grounded callers include the keyed upsert path `0x590d00` and the `gsi_am_rating` maintenance lane `0x595f70`.","objdump + caller inspection + descriptor-collection correlation"
0x00590490,55,multiplayer_transport_route_callback_table_release_staged_intrusive_descriptor_list,shell,cdecl,inferred,objdump,3,"Releases the staged intrusive descriptor list headed at `[this+0x5bc]` for one route-callback table. It repeatedly reads the next-link through `multiplayer_gamespy_server_descriptor_query_intrusive_next_link` `0x58d270`, destroys the current staged descriptor through `0x58d0d0`, and advances the head until the intrusive list is empty. Current grounded callers are the broader active-collection teardown `0x5904d0` and the recurring table service helper `0x591290`, which now uses this to clear staged removals before the next state-driven service pass.","objdump + caller inspection + intrusive-list correlation + descriptor-destroy correlation"
0x005904d0,59,multiplayer_transport_route_callback_table_release_active_descriptor_collection,shell,cdecl,inferred,objdump,3,"Releases the active descriptor vector rooted at `[this+0x04]` for one route-callback table. It walks every live descriptor, stages each one onto the intrusive head at `[this+0x5bc]` through `0x590410`, clears the backing vector through `0x59e4b0`, and then destroys the staged intrusive list through `multiplayer_transport_route_callback_table_release_staged_intrusive_descriptor_list` `0x590490`. Current grounded callers are the broader runtime destroy helper `0x5907a0` and `multiplayer_transport_open_field_subscription_route_callback_table` `0x5962e0`, which uses it to drop prior active descriptors before rebuilding the field-subscription table.","objdump + caller inspection + descriptor-collection correlation + intrusive-list correlation + field-subscription correlation"
0x0058d680,14,multiplayer_gamespy_server_descriptor_matches_special_global_record,shell,cdecl,inferred,objdump,2,Returns 1 only when the caller descriptor pointer is exactly the special global descriptor stored at `0x00db8b4c`. Current grounded compact-descriptor owners use this as a hard reject before insertion so the shared global record does not get appended into normal descriptor collections.,objdump + caller inspection
0x005907d0,222,multiplayer_gamespy_server_descriptor_collection_append_decoded_compact_payload_if_new,shell,cdecl,inferred,objdump,3,"Decodes and appends one compact descriptor payload into the caller collection when the payload is self-consistent and not one special global descriptor. It first validates the payload length against the compact-header precheck helpers at `0x58fe20`, `0x58fe90`, and `0x58fe50`, then parses the header shape through `0x58ff20`, allocates one fresh descriptor through `multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record` `0x58d5b0`, rejects the special global record through `multiplayer_gamespy_server_descriptor_matches_special_global_record` `0x58d680`, decodes the header and property payload through `multiplayer_gamespy_server_descriptor_decode_compact_header_and_property_payload` `0x58ff60` with decode mode `1`, and finally inserts the surviving descriptor through `0x590370`. Unlike the keyed upsert lane at `0x590d00`, this path always allocates a fresh descriptor after the precheck succeeds.","objdump + caller inspection + compact-descriptor correlation"
0x00590540,95,multiplayer_route_callback_runtime_acquire_shared_string_copy,shell,cdecl,inferred,objdump,3,"Acquires one refcounted shared string copy for the route-callback-table runtime. It lazily initializes the global shared-string pool through `0x58d6a0`, probes that pool by exact string through `0x58f9c0`, increments the stored refcount and returns the pooled string pointer on hit, and otherwise duplicates the caller string through `0x58f4a0` and inserts a new `{string, refcount=1}` pair through `0x58f920`. Current grounded callers are the route-callback receive/decode state machine `0x5908c0`, which uses this helper while materializing schema-owned dictionary strings.","objdump + caller inspection + shared-string-pool correlation"
0x005905a0,58,multiplayer_route_callback_runtime_release_shared_string_copy,shell,cdecl,inferred,objdump,3,"Releases one refcounted shared string copy from the route-callback-table runtime. It probes the global shared-string pool through `0x58d6a0/0x58f9c0`, decrements the stored refcount on hit, and removes the backing entry through `0x58f970` once the refcount reaches zero. Current grounded callers are the runtime teardown helpers `0x5906f0` and `0x5906c1` beneath the route-callback-table family.","objdump + caller inspection + shared-string-pool correlation"
0x005905e0,194,multiplayer_transport_route_callback_table_construct,shell,cdecl,inferred,objdump,3,"Constructs one transport-owned route callback table runtime. The helper seeds table state to `1`, clears the intrusive-head slot at `[this+0x5bc]`, copies three caller strings into local buffers `[this+0x0c]`, `[this+0x2c]`, and `[this+0x4c]`, stores the owner callback and cookie at `[this+0x480]/[this+0x484]`, seeds default strings at `[this+0x488]` and `[this+0x49c]`, zeroes staged companion fields `[this+0x490]/[this+0x494]`, resets live socket and receive-buffer state at `[this+0x4a0]`, `[this+0x74]`, and `[this+0x78]`, stores the caller schema or descriptor owner pointer at `[this+0x4a8]`, and initializes the decoded schema dictionary lanes rooted at `[this+0x08]` and `[this+0x478/0x47c]`. Current grounded callers are the callback-table initialization paths under `0x590ed0` and the larger transport table bring-up family.","objdump + caller inspection + route-callback-table correlation"
0x005906b0,53,multiplayer_transport_route_callback_table_release_schema_shared_string_slots,shell,cdecl,inferred,objdump,3,"Releases the table-local shared schema-string slot array rooted at `[this+0x7c]` with live count `[this+0x478]`. It walks each stored shared-string pointer through `multiplayer_route_callback_runtime_release_shared_string_copy` `0x5905a0` and then clears the live count back to zero. Current grounded callers are the broader live-route reset helper `0x590740` and the decode-side teardown paths that abandon schema materialization midstream.","objdump + local disassembly + caller inspection + shared-string-slot correlation"
0x005906f0,68,multiplayer_transport_route_callback_table_release_decoded_schema_dictionary,shell,cdecl,inferred,objdump,3,"Releases the decoded schema-dictionary runtime rooted at `[this+0x08]` for one route callback table. It walks every stored shared-string pointer through the collection at `[this+0x08]`, releases each one through `multiplayer_route_callback_runtime_release_shared_string_copy` `0x5905a0`, destroys the backing collection through `0x59e330`, and clears the owner slot afterward. Current grounded callers are the larger route-callback receive/decode and teardown paths.","objdump + caller inspection + route-callback-table correlation"
0x00590740,84,multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime,shell,cdecl,inferred,objdump,3,"Resets the live route and decode-side runtime for one route-callback table without destroying the outer table object. It frees the staged receive buffer at `[this+0x74]`, closes the live route handle at `[this+0x4a0]` when present, restores table state to sentinel `1`, releases the decoded schema dictionary through `multiplayer_transport_route_callback_table_release_decoded_schema_dictionary` `0x5906f0`, resets schema companion field `[this+0x47c]` to `-1`, and releases the table-local shared schema-string slots through `multiplayer_transport_route_callback_table_release_schema_shared_string_slots` `0x5906b0`. Current grounded callers are the disconnect-publication helper `0x590ea0`, the one-shot resend wrapper `0x5912c0`, and the broader destroy path `0x5907a0`.","objdump + local disassembly + caller inspection + route-callback-table correlation"
0x005907a0,43,multiplayer_transport_route_callback_table_destroy_runtime_and_release_descriptor_collection,shell,cdecl,inferred,objdump,3,"Destroys the full route-callback-table runtime. It first resets the live route and decode-side state through `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740`, then releases the active descriptor collection through `0x5904d0`, performs one remaining shared multiplayer cleanup call through `0x58d0a0`, destroys the backing descriptor vector at `[this+0x04]` through `0x59e330` when present, and clears that owner slot afterward. Current grounded callers are the larger transport teardown lanes and the auxiliary capacity-descriptor cache cleanup family.","objdump + local disassembly + caller inspection + route-callback-table correlation + descriptor-collection correlation"
0x005908c0,804,multiplayer_transport_route_callback_table_service_receive_decode_state_machine,shell,cdecl,inferred,objdump,3,"Services the live receive/decode state machine for one transport-owned route callback table using staged buffer `[this+0x74]/[this+0x78]` and state dword `[this+0x5b8]`. The current bounded model is: state `0` validates the leading route companion header, stores the first dword into `[this+0x490]`, stores the first word or sentinel into `[this+0x498]`, can publish owner callbacks in modes `6` and `5`, and either enters a terminal route-mode branch or continues into schema decode; states `1..3` build the table-owned descriptor schema and shared-string dictionaries under `[this+0x08]` and `[this+0x7c..]` through `0x59e0b0`, `0x590540`, and `0x59e4d0`; and state `4` repeatedly hands the remaining compact payload stream to `multiplayer_gamespy_server_descriptor_collection_append_decoded_compact_payload_if_new` `0x5907d0` until the staged receive buffer is exhausted. Decode failures return `5`, while successful progress updates the staged-buffer pointers and leaves the remaining byte count back in `[this+0x78]`. Current grounded caller is `multiplayer_transport_service_route_callback_table_once` `0x591290` in table states `2/3`.","objdump + caller inspection + route-callback-table correlation + compact-descriptor correlation"
0x00590ea0,34,multiplayer_transport_route_callback_table_publish_disconnect_and_reset,shell,cdecl,inferred,objdump,3,"Publishes one route-callback-table disconnect event and then tears the live route side down. It invokes the owner callback at `[this+0x480]` in mode `4`, passing the special global descriptor at `0x00db8b4c` plus cookie `[this+0x484]`, and then tails into the broader table reset helper `0x590740`. Current grounded callers are the state-`2/3` receive-service helper `0x5911e0`, the connect-or-send wrapper `0x5912c0`, and failure paths beneath the route-table open helper `0x590ed0`.","objdump + caller inspection + route-callback-table correlation + owner-callback correlation"
0x00590ed0,531,multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state,shell,cdecl,inferred,objdump,3,"Opens or reopens the live route side for one transport-owned callback table. The helper validates the caller-supplied route-name strings, resets temporary builder state, seeds a small descriptor schema block in stack scratch, copies the chosen route labels into the table-local buffers `[this+0x0c]` and `[this+0x2c]`, stages one outbound request payload into the local send buffer rooted at `[this+0x6c]`, opens the live route handle into `[this+0x4a0]` through `0x5b3216`, and on success sets table state to `3`, clears decode-substate `[this+0x5b8]`, allocates the initial receive buffer at `[this+0x74]` when needed, and zeroes the staged receive count `[this+0x78]`. Failure paths return `3`, `5`, or `6` and can tear the live route side back down through `multiplayer_transport_route_callback_table_publish_disconnect_and_reset` `0x590ea0`. Current grounded callers are the reconnect wrapper `0x5912c0`, the direct `gsi_am_rating` upsert path `0x591330`, and the larger transport-owned route bring-up paths around `0x5964e1` and `0x59655f`.","objdump + caller inspection + route-callback-table correlation + live-route-handle correlation + caller correlation"
0x005911e0,332,multiplayer_transport_route_callback_table_service_live_socket_and_feed_decode_machine,shell,cdecl,inferred,objdump,3,"Services one open route-callback-table socket in states `2/3`. It polls the live route handle at `[this+0x4a0]`, reads newly available bytes into the staged receive buffer `[this+0x74]/[this+0x78]` through `0x5b321c`, grows that backing buffer through `0x59e750` when the staged byte count would overflow the current capacity, enters the heavier decode state machine `0x5908c0` once the table is in state `3`, compacts any unconsumed tail back to the start of the buffer, and tears the route side down through `multiplayer_transport_route_callback_table_publish_disconnect_and_reset` `0x590ea0` on closure or decode failure. Current grounded caller is `multiplayer_transport_service_route_callback_table_once` `0x591290` for table states `2/3`.","objdump + caller inspection + route-callback-table correlation + staged-buffer correlation"
0x00590dc0,155,multiplayer_transport_primary_endpoint_table_seed_from_raw_endpoint_list,shell,cdecl,inferred,objdump,3,"Rebuilds the transport-owned primary-endpoint table from the raw endpoint list exposed by the live route handle at `[this+0x4a0]`. It first probes list availability through `0x58f4e0`, then repeatedly reads one endpoint tuple through `0x58bc7e` record type `0x1f3`, skips tuples already present in the table through `multiplayer_gamespy_server_descriptor_collection_find_by_primary_ipv4_and_port` `0x5903a0`, allocates fresh descriptor records through `multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record` `0x58d5b0`, rejects one special global descriptor through `0x58d680`, then stamps descriptor flag byte `[entry+0x15]` with `0x11` and inserts the surviving record into the table through `0x590370`. That makes this the strongest current source-side writer for header bit `0x1`, and it also ties bit `0x10` to the same source-header family later decoded as the inline primary-port-present branch in `0x58ff20/0x58ff60`. Current grounded caller is the recurring table service helper `0x591290` when the table sits in state `0`.","objdump + local disassembly + caller inspection + endpoint-table correlation + header-flag correlation + compact-header correlation"
0x0058ff60,432,multiplayer_gamespy_server_descriptor_decode_compact_header_and_property_payload,shell,cdecl,inferred,objdump,3,"Decodes one compact server-descriptor header and trailing property payload into the caller descriptor record. The helper copies the source header byte into descriptor flag byte `[entry+0x15]` through `0x58d630`, then conditionally consumes endpoint and scalar fields according to header bits `0x02`, `0x08`, `0x10`, `0x20`, `0x40`, and signed bit `0x80`. Current grounded split is tighter now: the primary IPv4 dword is always present immediately after the header byte; bit `0x10` only marks the inline primary port word branch, otherwise the helper falls back to the owner default port at `[caller+0x498]`; bit `0x02` supplies the secondary IPv4 dword; bit `0x20` supplies the paired secondary port word, otherwise the helper again falls back to the owner default port; bit `0x08` supplies one still-unresolved auxiliary dword through `[entry+0x10]`; bit `0x40` enables one inline keyed-property vector decoded through `0x59e110/0x59e120` plus the property-store writers rooted at `0x58d0f0` and `0x58d130`, after which the helper ORs descriptor state byte `[entry+0x14]` with bit `0x1`; and signed bit `0x80` enables one trailing NUL-terminated string-pair tail decoded through repeated `0x58d0f0` stores, after which the helper ORs state byte `[entry+0x14]` with bit `0x2`. Current grounded callers are the larger compact decode paths at `0x5907d0` and `0x590d00`. This remains the strongest proof that byte-`0x15` bit `0x1` is a source-side descriptor header bit rather than a queue-generated flag.","objdump + caller inspection + compact-decode correlation + header-flag correlation + secondary-endpoint correlation + state-byte correlation"
0x00590d00,184,multiplayer_transport_decode_compact_descriptor_payload_upsert_by_primary_endpoint_and_notify_owner,shell,cdecl,inferred,objdump,3,"Decodes one compact descriptor payload into the transport-owned primary-endpoint family while reusing an existing descriptor when the compact primary endpoint key already exists. After one short header-shape precheck through `0x58ff20`, it looks up the descriptor by primary IPv4 and port through `multiplayer_gamespy_server_descriptor_collection_find_by_primary_ipv4_and_port` `0x5903a0`. If no match exists it allocates a fresh record through `multiplayer_gamespy_server_descriptor_alloc_primary_endpoint_record` `0x58d5b0`, rejects the special global record through `multiplayer_gamespy_server_descriptor_matches_special_global_record` `0x58d680`, and later inserts the new descriptor through `0x590370`; otherwise it reuses the existing record through `0x590480`. It then decodes the compact header and property payload through `multiplayer_gamespy_server_descriptor_decode_compact_header_and_property_payload` `0x58ff60` with decode mode `0`, and finally notifies the owner callback at `[this+0x480]` in mode `1` with the updated descriptor plus cookie `[this+0x484]`.","objdump + caller inspection + compact-descriptor correlation + owner-callback correlation"
0x00591290,43,multiplayer_transport_service_route_callback_table_once,shell,cdecl,inferred,objdump,3,"Shared recurring service helper for one transport-owned route callback or descriptor table. It first clears the staged intrusive descriptor list at `[this+0x5bc]` through `multiplayer_transport_route_callback_table_release_staged_intrusive_descriptor_list` `0x590490`, then switches on table state dword `[this+0x00]`: state `0` seeds the primary-endpoint side through `multiplayer_transport_primary_endpoint_table_seed_from_raw_endpoint_list` `0x590dc0`; states `2` and `3` service the live receive path rooted at socket `[this+0x4a0]` by appending new bytes into the staging buffer at `[this+0x74]/[this+0x78]`, growing the backing buffer through `0x59e750` when needed, and invoking the heavier decode state machine `0x5908c0` once buffered data is available in state `3`; other states return immediately. Receive failure or closure tears the live route side down through `0x590ea0` and returns status `3`. Current grounded caller is `multiplayer_transport_service_route_callback_tables` `0x596210`, which uses this helper on the route tables at `[transport+0xba4]`, `[transport+0x1164]`, and `[transport+0x18bc]`.","objdump + caller inspection + route-table-service correlation + intrusive-list correlation"
0x005912c0,108,multiplayer_transport_route_callback_table_send_payload_with_one_reopen_retry,shell,cdecl,inferred,objdump,3,"Attempts one outbound send on the live route handle at `[this+0x4a0]` and performs at most one full reopen retry on failure. It forwards the caller payload pointer and byte count into `0x5b3216`; if that first send fails it resets the live route side through `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740`, reopens the route through `multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state` `0x590ed0` in mode `2`, retries the same send once, and on persistent failure publishes disconnect plus reset through `multiplayer_transport_route_callback_table_publish_disconnect_and_reset` `0x590ea0`. Current grounded callers are the keyed primary-endpoint upsert lane `0x591330` and the direct route-send family under the callback-table transport block.","objdump + local disassembly + caller inspection + route-send correlation"
0x00591330,96,multiplayer_transport_primary_endpoint_table_upsert_descriptor_by_primary_ipv4_and_port,shell,cdecl,inferred,objdump,3,"Upserts one compact descriptor record into the `gsi_am_rating` primary-endpoint table rooted at `[transport+0x18bc]`. When the table is still in sentinel state `1` it first reinitializes it through `0x590ed0` mode `2`; afterward it converts the caller host-order port through `0x58bc5a`, builds a 9-byte stack record with tag byte `1`, primary IPv4 dword, and primary port word, and forwards that record into `0x5912c0` for keyed insertion or replacement. Current grounded caller is `multiplayer_transport_dispatch_am_rating_route_event_mode` when descriptor flag byte `0x15` bit `0x1` is clear.","objdump + caller inspection + endpoint-table correlation"
0x005913f0,25,generic_callback_invoke_record2_and_trailing_context,support,cdecl,inferred,objdump,2,"Small callback-marshaling helper over one outer wrapper whose field `[record+0x10]` points at a two-dword inner payload and whose field `[record+0x0c]` carries one trailing context scalar. It pushes `(inner[0], inner[1], outer[0x0c])` into the callback at `[record+0x08]` with callback context `[record+0x04]`. Current evidence only bounds the record shape, not a more specific subsystem owner.","objdump + local disassembly"
0x00591410,85,generic_record_0x1c_deep_copy_with_owned_string_at_0x08,support,cdecl,inferred,objdump,2,"Deep-copies one `0x1c`-byte record whose fields are `u32` at `+0x00/+0x04/+0x0c/+0x10/+0x14/+0x18` plus one owned string pointer at `+0x08`. It copies the scalar fields verbatim, duplicates the optional string through `0x58f4a0`, and returns failure only when the source string is nonnull and duplication fails. Current evidence now makes this one of the generic preservation helpers that can carry descriptor-adjacent payload fields such as a copied `+0x10` scalar without interpreting them.","objdump + local disassembly + preservation-path correlation"
0x00591480,45,generic_callback_invoke_record7_and_trailing_context,support,cdecl,inferred,objdump,2,"Small callback-marshaling helper over one outer wrapper whose field `[record+0x10]` points at a seven-dword inner payload and whose field `[record+0x0c]` carries one trailing context scalar. It pushes `(inner[0..6], outer[0x0c])` into the callback at `[record+0x08]` with callback context `[record+0x04]`. Current evidence only bounds the record shape, not a more specific subsystem owner.","objdump + local disassembly"
0x005914b0,69,generic_record_0x14_deep_copy_with_owned_string_at_0x00,support,cdecl,inferred,objdump,2,"Deep-copies one `0x14`-byte record whose leading field `+0x00` is an owned string pointer and whose remaining fields at `+0x04/+0x08/+0x0c/+0x10` are copied verbatim. It duplicates the optional leading string through `0x58f4a0` and fails only when that duplication is required but returns null.","objdump + local disassembly"
0x00591510,37,generic_callback_invoke_record5_and_trailing_context,support,cdecl,inferred,objdump,2,"Small callback-marshaling helper over one outer wrapper whose field `[record+0x10]` points at a five-dword inner payload and whose field `[record+0x0c]` carries one trailing context scalar. It pushes `(inner[0..4], outer[0x0c])` into the callback at `[record+0x08]` with callback context `[record+0x04]`. Current evidence only bounds the record shape, not a more specific subsystem owner.","objdump + local disassembly"
0x005927b0,77,multiplayer_transport_service_and_retire_nth_active_opcode_record,shell,cdecl,inferred,objdump,3,"Services one active opcode record by ordinal from the collection rooted at `[this+0x17fc]`. It marks the selected record busy at `+0x18`, increments in-flight counter `[this+0x1808]`, dispatches through the opcode-specific service callback table rooted at `0x005e200c`, then clears the busy flag, decrements `[this+0x1808]`, increments completed count `[this+0x1804]`, and removes the serviced record from the active collection through `0x59e3d0`.","objdump + local disassembly + opcode-table correlation + active-collection correlation"
0x00592800,147,multiplayer_transport_remove_active_opcode_records_by_context_or_idle,shell,cdecl,inferred,objdump,3,"Removes records from the active opcode-record collection rooted at `[this+0x17fc]`. With `EDX != -1` it scans for records whose dword field `+0x14` matches the requested context id or whose opcode type dword at `+0x00` is `0x17`, then retires them through `multiplayer_transport_service_and_retire_nth_active_opcode_record` `0x5927b0`. With `EDX == -1` it instead retires every non-busy record whose in-flight flag at `+0x18` is clear.","objdump + local disassembly + active-collection correlation + immediate-drain correlation"
0x005928a0,189,multiplayer_transport_enqueue_opcode_record,shell,cdecl,inferred,ghidra-headless,3,Common allocator and queue-submit helper for session-event transport opcode records. It allocates a zeroed caller-sized record through tracked_heap_alloc_with_header invokes the opcode-specific initializer from the handler table at 0x005e2004 plus opcode times 0x10 packages the resulting payload together with caller metadata into 0x0059e4d0 and increments [this+0x1800] on success. Allocation or initializer failure releases the temporary record through tracked_heap_free_with_header and returns -1.,ghidra + rizin + llvm-objdump
0x005929a0,69,multiplayer_transport_remove_active_opcode_records_by_type,shell,cdecl,inferred,objdump,3,"Removes active opcode records of one requested type from the collection rooted at `[this+0x17fc]`. It walks the live records in reverse ordinal order, compares opcode dword `+0x00` against the requested type in `EBX`, and removes each match through `0x59e3d0`. Current grounded caller `multiplayer_transport_clear_progress_field_cache` `0x595b80` uses it with opcode type `3`, which corrects that helper as an active field-snapshot cleanup rather than a queued-work sweep.","objdump + local disassembly + caller inspection + active-collection correlation"
0x005929f0,78,multiplayer_transport_remove_active_field_snapshot_records_by_callback_pair,shell,cdecl,inferred,objdump,3,"Removes active field-snapshot opcode records keyed by one subscribed callback pair. It walks the active opcode-record collection at `[this+0x17fc]` in reverse ordinal order, filters for opcode type `3`, resolves the opcode payload pointer at record `+0x10`, and removes records whose payload dword `+0x04` matches the requested callback or context dword in `EBX`. Current grounded caller `multiplayer_transport_enqueue_field_snapshot_record` `0x592b50` uses it before building a fresh opcode-`3` snapshot entry.","objdump + local disassembly + caller inspection + opcode-3 correlation + active-collection correlation"
0x00592970,41,multiplayer_transport_active_opcode_record_collection_lacks_context_id,shell,thiscall,inferred,objdump + caller inspection,2,"Predicate over the active opcode-record collection rooted at `[this+0x17fc]`. It performs a comparator-driven collection search through `0x59e420` using comparator `0x592960`, which orders records by dword field `+0x14`, and returns `1` only when no active opcode record carries the requested context id. Current grounded caller is the immediate-drain completion gate `0x58d720`, so current evidence now bounds active field `+0x14` specifically as the active-side mirror of the shared drain context id seeded by `0x5934c0`.","objdump + caller inspection + collection-search correlation + immediate-drain correlation"
0x00592a40,40,multiplayer_transport_dispatch_callback_table_binding,shell,cdecl,inferred,ghidra-headless,2,"Small deferred callback-table binding wrapper over `multiplayer_transport_enqueue_opcode_record` with opcode `4`. It packages the caller binding fields into the 0x08-byte opcode-`4` record builder at `0x592c40`; current grounded callback-table owners now show the staged work-record triplet more concretely as `(callback fn @ +0x10, callback companion @ +0x18, drain context id @ +0x0c)`, with the final dword still aligned to the shared `0x5934c0`-seeded immediate-drain context later waited on through `0x58d720`.","ghidra + rizin + llvm-objdump + local disassembly + callback-triplet correlation"
0x00592a70,109,multiplayer_transport_probe_or_enqueue_route_record,shell,cdecl,inferred,ghidra-headless,2,"Small route-probe or deferred route-record wrapper over `multiplayer_transport_enqueue_opcode_record`. It first calls `multiplayer_transport_is_route_mode_active_nonterminal` and when that succeeds with caller mode `2` directly invokes the supplied callback; otherwise it falls back to an 0x08-byte opcode-`1` record built from the caller callback and payload fields. Current grounded callers now show the staged work-record triplet more concretely as `(callback fn @ +0x10, callback companion @ +0x18, drain context id @ +0x0c)` with extra route-mode control bytes layered on top, and the final dword again aligned to the shared `0x5934c0`-seeded drain context used by the deferred path.","ghidra + rizin + llvm-objdump + local disassembly + callback-triplet correlation"
0x00592ae0,111,multiplayer_transport_enqueue_descriptor_block_record,shell,cdecl,inferred,objdump + local disassembly,3,"Copies one caller-supplied seven-dword descriptor-block payload into a local `0x1c` buffer and enqueues it through `multiplayer_transport_enqueue_opcode_record` `0x5928a0` as opcode `2`. The deeper opcode-`2` initializer family rooted at `0x591410/0x591470/0x591480` now bounds that payload more tightly: it stores dwords `+0x00/+0x04/+0x0c/+0x10/+0x14/+0x18` verbatim and duplicates the optional string pointer at `+0x08` into owned heap storage. Current grounded callers are now broader than the earlier callback-registration-only note: the helper is also the enqueue tail beneath `multiplayer_transport_enqueue_capacity_descriptor_record` `0x595bc0`, where live mode supplies a populated descriptor payload but replay modes `3/5` intentionally pass an all-zero seven-dword payload while reusing separate sidecar metadata slots from the cached work record.","objdump + local disassembly + opcode-record table correlation + descriptor-block initializer correlation + capacity-descriptor correlation"
0x00592b50,226,multiplayer_transport_enqueue_field_snapshot_record,shell,cdecl,inferred,ghidra-headless,3,"Builds and enqueues one field-snapshot transport record through `multiplayer_transport_enqueue_opcode_record` using opcode `3` and a `0x14`-byte payload. Depending on the caller mode it can first remove prior matching entries through `0x5929f0`, then normalizes the `hostname` field against `(No Name)`, samples the `gamemode` field and compares it against `openstaging`, computes one 0-to-100 progress percentage from cached progress slot `[this+0x1774]` plus counters `[this+0x1734]` and `[this+0x1740]` and the current active descriptor count under `[this+0xba4]`, and packages the subscribed callback pointers from `[this+0x176c]` and `[this+0x1770]`. Current grounded caller `0x596500` seeds `[this+0x1774]` to `1` immediately before the first mode-`3` snapshot under `multiplayer_transport_open_field_subscription_route_callback_table` `0x5962e0`.","ghidra + rizin + llvm-objdump + strings + local disassembly + caller inspection"
0x00593330,57,multiplayer_transport_construct_transient_work_record_collection,shell,thiscall,inferred,objdump + local disassembly,3,"Constructs the transient transport work-record collection at `[this+0x1780]`. It clears counters `[this+0x1784]` and `[this+0x1788]`, allocates one vector-like owner through `0x59e0b0` using cleanup shim `0x5932f0`, stores the resulting collection root at `[this+0x1780]`, and returns success when that root is nonnull.","objdump + local disassembly + work-queue correlation"
0x00593370,16,multiplayer_transport_clear_transient_work_record_collection,shell,thiscall,inferred,objdump + local disassembly,2,"Thin clearer for the transient transport work-record collection rooted at `[this+0x1780]`. When that collection exists it tailcalls the generic clear helper `0x59e4b0`; otherwise it returns immediately.","objdump + local disassembly + work-queue correlation"
0x00593380,30,multiplayer_transport_destroy_transient_work_record_collection,shell,thiscall,inferred,objdump + local disassembly,2,"Destructor-side helper for the transient transport work-record collection rooted at `[this+0x1780]`. When the collection exists it destroys that vector owner through `0x59e330`, then clears `[this+0x1780]` to null.","objdump + local disassembly + work-queue correlation"
0x005933a0,83,multiplayer_transport_remove_queued_work_record_by_pointer,shell,thiscall,inferred,objdump + local disassembly,3,"Scans the transient transport work-record collection at `[this+0x1780]` for one exact record-pointer match and removes that vector slot through `generic_vector_remove_index` `0x59e3d0`. Successful removal also increments the released-or-completed work counter at `[this+0x1788]`. Current grounded callers include the callback-table binding result helper `0x593570`, route-binding release `0x595620`, and the names or bound-route or selector-text completion lanes when they drop stale or finished work records.","objdump + local disassembly + caller inspection + work-queue correlation"
0x00593400,90,multiplayer_transport_queued_work_collection_lacks_context_id,shell,thiscall,inferred,objdump + local disassembly,2,"Predicate over the same transient work-record collection at `[this+0x1780]`. It returns `1` when no queued work record carries the requested dword context id in field `+0x0c`, and returns `0` on the first match. Current grounded caller is the small transport gate at `0x58d720`, which uses this uniqueness test immediately before `0x592970`; that now bounds queued field `+0x0c` specifically as the queued-side mirror of the shared drain context id seeded by `0x5934c0`.","objdump + local disassembly + caller inspection + work-queue correlation + immediate-drain correlation"
0x00592c40,54,multiplayer_transport_enqueue_callback_binding_record,shell,cdecl,inferred,ghidra-headless,2,Builds and enqueues one 0x08-byte opcode `4` callback-binding record through multiplayer_transport_enqueue_opcode_record. The helper uses the registered callback-table pointer at [this+0x4c] and is the direct worker beneath multiplayer_transport_dispatch_callback_table_binding.,ghidra + rizin + llvm-objdump
0x00592c80,80,multiplayer_transport_enqueue_callback_slot9_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x10-byte opcode `9` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x1790] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592cd0,85,multiplayer_transport_enqueue_callback_slot10_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x14-byte opcode `10` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x1794] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592d30,62,multiplayer_transport_enqueue_callback_slot11_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x04-byte opcode `11` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x1798] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592d70,77,multiplayer_transport_enqueue_callback_slot12_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that copies a caller-supplied seven-dword block and enqueues it as a 0x20-byte opcode `12` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x179c] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592dc0,72,multiplayer_transport_enqueue_callback_slot13_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `13` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a0] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592e10,72,multiplayer_transport_enqueue_callback_slot14_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x10-byte opcode `14` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a4] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592ee0,62,multiplayer_transport_enqueue_callback_slot17_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x08-byte opcode `17` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is the current-selector profile-key callback root at `0x59f8b0`, which submits one profile-key bundle and then forwards the same selector context through this owner-callback lane.","objdump + caller xrefs"
0x00592f20,69,multiplayer_transport_enqueue_callback_slot18_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `18` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b4]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`.","objdump"
0x00592f70,72,multiplayer_transport_enqueue_callback_slot19_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `19` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b8]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f850`, which resets selector-side state and then forwards the same selector-name pair through this owner-callback lane.","objdump + caller xrefs"
0x00592fc0,50,multiplayer_transport_enqueue_callback_slot20_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x04-byte opcode `20` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17bc]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`.","objdump"
0x00593000,69,multiplayer_transport_enqueue_callback_slot21_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `21` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17c0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`.","objdump"
0x00593050,77,multiplayer_transport_enqueue_callback_slot22_record,shell,cdecl,inferred,objdump,3,"Gated callback-slot wrapper that enqueues one 0x10-byte opcode `22` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17c4]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded callers are the per-key profile callback helper at `0x596970`, which forwards one selector name plus the parsed `X...X|%d` probe tuple `(request id, displayed version/build integer)` or a zeroed `(END)` sentinel payload, and the same helper's sibling path at `0x596a45`, which republishes the currently armed selector-view probe tuple.","objdump + caller xrefs"
0x005930a0,50,multiplayer_transport_enqueue_callback_slot23_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x04-byte opcode `23` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x178c]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is the callback root at `0x59f5c0`, which first arms deferred-close state at `[this+0x1edc]`.","objdump + caller xrefs"
0x005930e0,62,multiplayer_transport_enqueue_callback_slot24_record,shell,cdecl,inferred,objdump,3,"Gated callback-slot wrapper that enqueues one 0x08-byte opcode `24` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17cc]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is multiplayer_transport_commit_selector_view_refresh_probe_success, which forwards the selector-view entry pointer together with the current averaged probe sample through this owner-callback lane.","objdump + caller xrefs"
0x00593120,72,multiplayer_transport_enqueue_callback_slot25_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `25` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f560`, which first updates selector-view runtime state through `0x5948f0` and then forwards the same selector-name pair through this owner-callback lane.","objdump + caller xrefs"
0x00593200,78,multiplayer_transport_enqueue_callback_slot28_record,shell,cdecl,inferred,objdump + local disassembly,2,"Gated callback-slot wrapper that enqueues one `0x10`-byte opcode `28` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d8]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded callers are `multiplayer_transport_callback_query_slot_built_in_profile_key_and_publish_slot28` `0x59fbd0` and its helper `0x596b90`.","objdump + local disassembly + caller inspection"
0x00592e60,64,multiplayer_transport_enqueue_callback_slot15_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x08-byte opcode `15` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a8] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592ea0,64,multiplayer_transport_enqueue_callback_slot16_record,shell,cdecl,inferred,ghidra-headless,2,"Gated callback-slot wrapper that enqueues one `0x08`-byte opcode `16` record through `multiplayer_transport_enqueue_opcode_record` when byte `[this+0x17ac]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded caller `0x59f440` forwards the staged route-callback payload handle from `[this+0xb50]` together with fixed text at `0x00db9dd8` through this lane just before `multiplayer_transport_set_route_mode` forces mode `5`, so slot `16` is no longer just an abstract callback-slot wrapper.","ghidra + rizin + llvm-objdump + caller inspection"
0x0059f2e0,64,multiplayer_transport_is_selector_control_line,shell,cdecl,inferred,objdump,2,"Small selector-text classifier used in the second callback descriptor lane. It returns true only when the caller string is at least four bytes long and begins with `@@@` but not `@@@ `, which makes it the current gate between control-line handling and the ordinary selector-name callback lanes.","objdump + caller xrefs + strings"
0x0059f320,131,multiplayer_transport_split_selector_payload_token_and_tail,shell,cdecl,inferred,objdump,2,"Splits one selector payload string at the first space into the two shared scratch buffers `0x00db9dd0` and `0x00db9dd8`. Current grounded callers are the mode-`3/4` selector callback helpers at `0x59f650` and `0x59f720`, which use that token-plus-tail pair as the payload for callback slots `14` and `10`.","objdump + caller xrefs + strings"
0x0059f5e0,111,multiplayer_transport_sync_selector_view_nfo_r_flag,shell,cdecl,inferred,objdump,3,"Local `@@@NFO` helper shared by the selector callback lanes at `0x59f650` and `0x59f720`. It only accepts control lines ending in the literal tail `X\\`, searches the same line for the field marker `\\$flags$\\`, and then sets or clears bit `0x2` in the selector-view entry flag word at `[entry+0x64]` depending on whether the following flag segment contains the letter `r` before the next backslash. The current grounded entry gate is `[entry+0x48]`, so this path is specific to selector entries that participate in the third selector slot.","objdump + caller xrefs + strings"
0x00593460,87,multiplayer_transport_mark_selector_slot_records_stale,shell,cdecl,inferred,ghidra-headless,3,Scans the queued transport request collection at [this+0x1780] for records of type `1` or `2` whose selector-slot field at +0x1c matches the requested slot id. Matching records are marked stale by setting byte or dword field +0x38 to one. Current grounded caller is multiplayer_transport_reset_selector_slot.,ghidra + rizin + llvm-objdump
0x005934e0,130,multiplayer_transport_allocate_and_enqueue_work_record,shell,cdecl,inferred,objdump + local disassembly,3,"Allocates one zeroed `0x3c` transient transport work record and appends it into the work collection at `[this+0x1780]`. The helper stores the owner transport pointer at `+0x00`, caller-supplied type and metadata dwords at `+0x04`, `+0x08`, `+0x0c`, `+0x10`, and `+0x18`, clears bookkeeping field `+0x20` and stale latch `+0x38`, inserts the finished pointer through `generic_vector_push_back` `0x59e4d0`, and increments `[this+0x1784]` on success. Current grounded callers include callback-table descriptor attach, bound-route request submission, selector-text route request submission, and the type-`9` text fastpath. The wider caller set now proves one stronger boundary on the metadata triplet itself: these three dwords are shared transport wrapper metadata reused across type `0/1/2/9` work records, not one capacity-only or route-only cache tuple. Current direct consumers now bound that triplet more concretely as `drain context id @ +0x0c`, deferred callback function pointer @ `+0x10`, and callback companion or context @ `+0x18`; the callback-table lane still gives the cleanest concrete subcase because it intentionally duplicates the same caller metadata dword into both `+0x0c` and `+0x18` while preserving the callback pointer in `+0x10`.","objdump + local disassembly + caller inspection + work-queue correlation + metadata-triplet correlation + cross-type work-record correlation + callback-dispatch correlation"
0x00593570,160,multiplayer_transport_publish_callback_table_binding_result_and_release_work_record,shell,cdecl,inferred,objdump + local disassembly,3,"Consumes one transient callback-table attach work record. It resolves the owner transport from work field `+0x00`, conditionally downgrades a nominal success when the current live transport probe through `0x58d7e0/0x58d810` fails, stores the final boolean result into `[transport+0x48]`, and on the success branch also stamps tick field `[transport+0x50]` plus copies one callback-table label string into the local transport name buffer at `[transport+0x04]`. Both the success and failure tails then publish opcode-`4` callback-binding state through `multiplayer_transport_dispatch_callback_table_binding` `0x592a40` using work fields `(callback fn +0x10, callback companion +0x18, drain context id +0x0c)`; the failure tail additionally arms deferred reset latch `[transport+0x1edc]`. The helper always finishes by unlinking the consumed work record through `multiplayer_transport_remove_queued_work_record_by_pointer` `0x5933a0`.","objdump + local disassembly + caller inspection + callback-binding correlation + work-queue correlation + callback-triplet correlation"
0x00593790,351,multiplayer_transport_handle_names_query_response,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_names_query_with_callback. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can update route-binding state through multiplayer_transport_is_route_mode_active_nonterminal and multiplayer_transport_try_connect_status_route_once seeds selector slot `2` through multiplayer_transport_init_selector_slot upserts returned name records through multiplayer_transport_upsert_selector_name_entry publishes `TOPIC` and `MODE` lines through multiplayer_transport_publish_topic_status_line and multiplayer_transport_publish_mode_level_status_line and may promote one deferred route binding into [this+0x1ec8]. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump + strings
0x005938f0,145,multiplayer_transport_handle_bound_route_request,shell,cdecl,inferred,ghidra-headless,3,"Completion callback for `multiplayer_transport_submit_bound_route_request`. If the request is already stale at `+0x38` it just unlinks through `0x5933a0`. On nonzero result it can publish `[req+0x24]` through `multiplayer_transport_publish_mode_key_status_line` and then schedules `multiplayer_transport_handle_names_query_response` through `multiplayer_transport_submit_names_query_with_callback`. On zero result it resets selector slot `2` and falls back to `multiplayer_transport_probe_or_enqueue_route_record` using the staged work fields `(callback fn +0x10, callback companion +0x18, drain context id +0x0c)` plus the request-specific route-mode pair before unlinking the request.","ghidra + rizin + llvm-objdump + local disassembly + callback-triplet correlation"
0x00594620,106,multiplayer_transport_reset_selector_view_entry_runtime_state,shell,cdecl,inferred,objdump,2,"Clears the extended runtime fields of one selector-view entry. When the transport-side selector-view layer is present through `[this+0xac8]` it zeroes the entry block from `+0x68` through `+0xa8`, including the dirty or refresh flags at `+0xa0`, `+0xa4`, and `+0xa8`, then returns success. Current grounded caller is the selector-view snapshot export path at `0x594ee0`.","objdump"
0x00594690,76,multiplayer_transport_mark_selector_slot_views_dirty,shell,cdecl,inferred,ghidra-headless,2,"Marks one selector slot dirty in the transport-side selector-view layer rooted at `[this+0xab4]` with backing arrays around `[this+0xad0]..[this+0xae4]`. It sets slot-specific dirty bits at `+0xa0` and `+0xa4` when the matching backing arrays are populated and also sets `+0xa8` for selector slot `2`. Current grounded callers are multiplayer_transport_set_selector_slot_flags and multiplayer_transport_upsert_selector_name_entry.","ghidra + rizin + llvm-objdump"
0x005949a0,80,multiplayer_transport_ensure_selector_view_store,shell,thiscall,inferred,objdump,3,"Ensures the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it allocates a `0xac`-byte keyed container through `0x58faf0`, stores the resulting root at `[this+0xab4]`, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport setup and reset path around `0x58d7ee`.","objdump + caller xrefs"
0x005949f0,56,multiplayer_transport_release_selector_view_store,shell,thiscall,inferred,objdump,3,"Releases the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it frees the root at `[this+0xab4]` through `0x58f8b0`, clears that root, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport teardown path around `0x58d81a`.","objdump + caller xrefs"
0x00594a30,11,multiplayer_transport_remove_selector_view_entry_from_store,shell,cdecl,inferred,objdump + local disassembly,3,"Tiny selector-view store remover. It tailcalls the keyed-container erase helper `0x58f970` against the selector-view store rooted at `[this+0xab4]` using the caller entry pointer in `edx`. Current grounded callers are `multiplayer_transport_clear_selector_view_entry_slot_and_remove_if_empty` `0x594fb0` and `multiplayer_transport_rekey_selector_view_entry_preserving_slot_runtime` `0x595010`.","objdump + local disassembly + caller inspection"
0x00594a40,80,multiplayer_transport_find_selector_view_entry_by_name,shell,cdecl,inferred,objdump,3,"Looks up one selector-view entry by its bounded name string. It copies up to `0x40` bytes of the caller key into a local buffer, then probes the keyed selector-view store rooted at `[this+0xab4]` through `0x58f9c0` and returns the matching entry pointer or null. Current grounded callers include multiplayer_transport_set_selector_slot_flags, multiplayer_transport_merge_selector_mode_mask, multiplayer_transport_upsert_selector_name_entry, and several later selector-view formatting helpers.","objdump + caller xrefs"
0x00594e30,52,multiplayer_transport_count_selector_view_entries_with_slot_flag20_and_optional_name_match,shell,cdecl,inferred,objdump + local disassembly,3,"Counts selector-view entries in the keyed store rooted at `[this+0xab4]` whose per-slot flag dword at `[entry+0x5c+slot*4]` carries bit `0x20`. When the optional caller string is nonnull it first requires that string to match the entry's leading name field through `0x5a57cf`; otherwise it counts every entry that passes the same flag test. Current grounded callers are the staged route-callback submit-result handler `0x595860` and the later selector-view decision helper at `0x59f9c0`, where both use slot `2` and the current transport name buffer at `[this+0x04]`.","objdump + local disassembly + caller inspection + selector-view-store correlation"
0x00594d50,28,multiplayer_transport_selector_view_entry_slot_has_presence_mask,shell,cdecl,inferred,objdump,3,"Small selector-view predicate over one slot-local flag dword. When the requested slot has a live pointer at `[entry+0x40+slot*4]`, it returns whether the paired slot flag word at `[entry+0x5c+slot*4]` carries either presence bit `0x20` or `0x40`. Current grounded caller is multiplayer_transport_filter_insert_refreshable_selector_view_entry, which uses slot `2` to bias entry ordering and dedupe inside the periodic refreshable-entry collector.","objdump + caller xrefs"
0x00594d70,21,multiplayer_transport_selector_view_entry_has_gml_disconnect_gate,shell,cdecl,inferred,objdump,3,"Tiny selector-view predicate used only in the current grounded `GML` control path. It returns nonzero only when the selector-view entry participates in the third selector slot through `[entry+0x48]` and bit `0x20` is set in the entry flag word at `[entry+0x64]`. The current grounded caller is multiplayer_transport_handle_gml_or_png_selector_control, where it gates the `GML Disconnected` branch before the transport forces one status-pump pass, emits callback slot `16`, and re-enters route mode `5`.","objdump + caller xrefs + strings"
0x0059f5c0,20,multiplayer_transport_callback_arm_deferred_close_and_enqueue_slot23,shell,cdecl,inferred,objdump,2,"Small callback-root helper installed through the transport-side callback descriptor table at `0x59f5c0`. It takes the owner transport pointer from the first stack argument, sets deferred-close latch `[this+0x1edc]` to one, and then forwards into multiplayer_transport_enqueue_callback_slot23.","objdump + caller xrefs"
0x00594150,65,multiplayer_transport_schedule_selector_view_entry_refresh_probe,shell,cdecl,inferred,objdump,3,"Arms one deferred refresh probe for a selector-view entry when no probe is already pending at `[entry+0x74]`. It schedules callback `0x594110` after `0x1388` ms, latches the pending flag at `[entry+0x74]`, stores the current tick count at `[entry+0x68]`, and clears the entry-local transient field at `[entry+0xa8]`. The current grounded caller is the periodic selector-view service path at `0x594540`.","objdump + caller xrefs"
0x005941a0,376,multiplayer_transport_filter_insert_refreshable_selector_view_entry,shell,cdecl,inferred,objdump,3,"Store-walk callback used by the periodic selector-view service path. It filters one selector-view entry before insertion into a temporary refresh list: the entry must have local backing at `[entry+0xa0]`, live state at `[entry+0x58]`, no pending probe at `[entry+0x74]`, and no blocker at `[entry+0x4c]`; if slot pointers `[entry+0x40]`, `[entry+0x44]`, or `[entry+0x48]` are present, the corresponding slot flag words `[entry+0x5c]`, `[entry+0x60]`, and `[entry+0x64]` must not carry mask `0x0c`, which matches the `g`/`a` bits produced by multiplayer_transport_parse_selector_mode_letters. Eligible entries then pass slot-aware retry timing based on `[entry+0x68]`, `[entry+0x6c]`, `[entry+0x78]`, and `[entry+0x7c]`, after which the helper inserts the entry into the caller list while biasing third-slot entries through multiplayer_transport_selector_view_entry_slot_has_presence_mask and name comparisons.","objdump + caller xrefs + existing slot-flag map"
0x00594320,115,multiplayer_transport_collect_refreshable_selector_view_entries,shell,cdecl,inferred,objdump,3,"Collects a bounded list of refreshable selector-view entries from the keyed selector-view store rooted at `[this+0xab4]`. It clears the caller count to at most `0x0c` entries, walks the store through callback `0x5941a0`, and returns the finished temporary entry pointer list. The current grounded caller is the periodic selector-view service path at `0x594540`, which then schedules deferred refresh probes for the collected entries.","objdump + caller xrefs"
0x005940d0,61,multiplayer_transport_finish_selector_view_refresh_probe_if_matching,shell,cdecl,inferred,objdump,3,"Probe-completion callback used by the deferred selector-view refresh path. When the entry still has a pending probe at `[entry+0x74]`, live selector-view state at `[entry+0x58]`, and the callback request id matches `[entry+0x50]`, it clears the pending latch. Result `-1` increments the consecutive-failure counter at `[entry+0x7c]`; any other result forwards the returned payload pointer into multiplayer_transport_commit_selector_view_refresh_probe_success.","objdump + caller xrefs"
0x00594110,48,multiplayer_transport_dispatch_selector_view_refresh_probe_result,shell,cdecl,inferred,objdump,3,"Deferred callback shim for selector-view refresh probes. It walks the keyed selector-view store at `[transport+0xab4]` and runs multiplayer_transport_finish_selector_view_refresh_probe_if_matching against each entry using the completed request descriptor on the stack. Current grounded caller is multiplayer_transport_schedule_selector_view_entry_refresh_probe.","objdump + caller xrefs"
0x00593f00,171,multiplayer_transport_commit_selector_view_refresh_probe_success,shell,cdecl,inferred,objdump,3,"Success path for one selector-view refresh probe. It increments the probe-success generation at `[entry+0x78]`, clears the consecutive-failure counter at `[entry+0x7c]`, stamps the last-success tick at `[entry+0x6c]`, writes the returned probe sample into the rolling history at `[entry+0x84..]`, grows the bounded sample-count at `[entry+0x94]` up to four, computes the current averaged millisecond sample into `[entry+0x80]`, increments total-success count `[entry+0x98]`, and publishes that averaged `ms` value through multiplayer_transport_enqueue_callback_slot24_record.","objdump + caller xrefs"
0x00594b60,104,multiplayer_transport_arm_selector_view_probe_tracking,shell,cdecl,inferred,objdump,3,"Resolves one selector-view entry by name and arms its fast probe-tracking fields. It stores the parsed probe request id at `[entry+0x50]`, stores the parsed displayed version/build companion integer at `[entry+0x54]`, sets the live probe gate at `[entry+0x58]`, and refreshes the per-slot dirty gates at `+0xa0/+0xa4/+0xa8` for any active selector slots through multiplayer_transport_mark_selector_slot_views_dirty. Current grounded callers are the profile-key callback-table lanes around `0x596a18` and `0x59f929`, both after parsing one `X...X|%d` marker through `0x5977b0`.","objdump + caller xrefs"
0x005943a0,231,multiplayer_transport_stage_selector_view_progress_snapshot,shell,cdecl,inferred,objdump,3,"Slow selector-view sidecar helper reached from multiplayer_transport_service_selector_view_refresh_cycle after multiplayer_transport_select_stale_selector_view_progress_entry picks one candidate. It requires the entry-local progress gate at `[entry+0xa4]`, rebuilds the local core `X%sX` probe marker from request id `[entry+0x50]` through multiplayer_transport_format_selector_view_probe_marker_core, formats one `PNG %s %d` line around that marker and the averaged millisecond sample at `[entry+0x80]`, appends up to three selector-slot-specific `PNG` fragments when the corresponding slot pointers and generation counters are live, then marks the entry progress snapshot in-flight at `[entry+0x9c]` and stamps both `[entry+0x70]` and the transport-wide throttle tick `[transport+0xaec]`. Current evidence still does not show the wider `|%d` companion suffix being emitted on this path.","objdump + caller xrefs + strings + marker-format correlation"
0x00594490,83,multiplayer_transport_pick_stale_selector_view_progress_entry,shell,cdecl,inferred,objdump,3,"Store-walk callback used by multiplayer_transport_select_stale_selector_view_progress_entry. It only considers selector-view entries whose slow progress gate `[entry+0xa4]` is set, blocker `[entry+0x4c]` is clear, total-success count `[entry+0x98]` is nonzero, and in-flight progress latch `[entry+0x9c]` is clear; among those, it requires at least `0x1388` ms since the last progress tick `[entry+0x70]` and keeps the stalest candidate in the caller scratch slot.","objdump + caller xrefs"
0x005944f0,69,multiplayer_transport_select_stale_selector_view_progress_entry,shell,cdecl,inferred,objdump,3,"Walks the keyed selector-view store at `[transport+0xab4]` through callback `0x594490` and returns the stalest eligible selector-view entry for the slow progress-snapshot lane, or null when none qualify. Current grounded caller is multiplayer_transport_service_selector_view_refresh_cycle.","objdump + caller xrefs"
0x00594540,214,multiplayer_transport_service_selector_view_refresh_cycle,shell,thiscall,inferred,objdump,3,"Recurring selector-view maintenance pass beneath the multiplayer transport frame owner. When the selector-view layer is enabled and not blocked by the `g`/`a` route gates at `[this+0xb44]` and `[this+0x180c]`, it first rate-limits and runs the fast probe lane by collecting refreshable entries through multiplayer_transport_collect_refreshable_selector_view_entries and scheduling deferred probes through multiplayer_transport_schedule_selector_view_entry_refresh_probe. It then runs a slower sidecar lane every `0x7d0` ms by selecting one stale progress entry through multiplayer_transport_select_stale_selector_view_progress_entry and staging a progress snapshot through multiplayer_transport_stage_selector_view_progress_snapshot before falling into the shared timer service at `0x5a05d0`.","objdump + caller xrefs"
0x0059f3c0,498,multiplayer_transport_handle_gml_or_png_selector_control,shell,cdecl,inferred,objdump,3,"Small control-token handler reached from the slot-`25` selector-view callback lane after multiplayer_transport_split_selector_payload_token_and_tail. When the token is `GML` and the tail is `Disconnected`, it requires the current selector-view entry to pass multiplayer_transport_selector_view_entry_has_gml_disconnect_gate, then forces one status-pump pass, emits callback slot `16` with the tail text, and re-enters route mode `5`. Its sibling `PNG` branch resolves a named selector-view entry from the tail text and, when that entry overlaps the active selector-slot ownership, refreshes selector-view runtime state through `0x5948f0` and republishes callback slot `25`.","objdump + caller xrefs + strings"
0x0059f650,193,multiplayer_transport_callback_dispatch_selector_name_payload_lane,shell,cdecl,inferred,objdump,3,"Main selector-name branch in the second transport-side callback descriptor lane. It first classifies the incoming payload through multiplayer_transport_is_selector_control_line. `@@@NFO` control lines resolve one selector-view entry through multiplayer_transport_find_selector_view_entry_by_name and forward into multiplayer_transport_sync_selector_view_nfo_r_flag; non-control mode-`3/4` payloads split through multiplayer_transport_split_selector_payload_token_and_tail and publish callback slot `14`; and the remaining non-control payloads publish callback slot `13`.","objdump + caller xrefs + strings"
0x0059f720,289,multiplayer_transport_callback_dispatch_current_selector_payload_lane,shell,cdecl,inferred,objdump,3,"Sibling callback root that first resolves the current selector through `0x5951a0` and then dispatches one payload against that active selector context. It reuses multiplayer_transport_is_selector_control_line, the `@@@GML` and `@@@NFO` control tokens, and the shared token-tail splitter at `0x59f320`: `@@@NFO` lines flow into multiplayer_transport_sync_selector_view_nfo_r_flag, `@@@GML` lines plus mode-`3/4` payloads feed callback slot `10`, and the remaining non-control payloads feed callback slot `9`.","objdump + caller xrefs + strings"
0x0059f850,87,multiplayer_transport_callback_reset_selector_and_enqueue_slot19,shell,cdecl,inferred,objdump,2,"Callback-root helper from the second transport-side descriptor lane. It resolves the current selector slot through `0x5951a0`, resets that selector text path through `0x5954b0`, forwards the supplied selector-name pair through multiplayer_transport_enqueue_callback_slot19, and when the resolved selector is `2` plus route mode is still active it re-enters multiplayer_transport_set_route_mode with mode `1`.","objdump + caller xrefs"
0x00594bd0,97,multiplayer_transport_set_selector_slot_flags,shell,cdecl,inferred,ghidra-headless,3,Updates one selector-slot flag dword at [entry+0x5c] after resolving the current selector entry through 0x00594a40. When selector index `2` flips bit `1` it forwards the new bit value through multiplayer_transport_enqueue_callback_slot15_record and then notifies the shared selector-change callback path through 0x00593250 with selector id old flags and new flags.,ghidra + rizin + llvm-objdump
0x00594c40,103,multiplayer_transport_parse_selector_mode_letters,shell,cdecl,inferred,ghidra-headless,3,Parses one selector-mode letter string into a small bitmask by probing for the letters `s` `r` `g` `a` and `h`. Current grounded callers merge this mask into the selector-slot flags that live at [entry+0x5c].,ghidra + rizin + llvm-objdump + strings
0x00594cb0,65,multiplayer_transport_merge_selector_mode_mask,shell,cdecl,inferred,ghidra-headless,3,Resolves one selector entry through 0x00594a40 parses the caller mode-letter string through multiplayer_transport_parse_selector_mode_letters preserves the current presence bits 0x20 and 0x40 from [entry+0x5c] and commits the merged result through multiplayer_transport_set_selector_slot_flags.,ghidra + rizin + llvm-objdump + strings
0x00594d00,72,multiplayer_transport_set_selector_presence_mask,shell,cdecl,inferred,ghidra-headless,3,Overwrites the selector presence bits 0x20 and 0x40 in [entry+0x5c] from one caller byte mask while preserving the rest of the selector-slot flags. The helper then commits the new value through multiplayer_transport_set_selector_slot_flags.,ghidra + rizin + llvm-objdump
0x00594f20,142,multiplayer_transport_upsert_selector_name_entry,shell,cdecl,inferred,ghidra-headless,3,Looks up or creates one selector-name entry for the requested selector slot. It resolves the current slot entry through 0x594a40 allocates a new entry through 0x594e70 when no match exists marks the selector index active at [entry+0x40+slot*4] increments the per-slot generation counter at [this+0xab8+slot*4] applies the caller flag bits 0x20 and 0x40 into [entry+0x5c+slot*4] and then marks the slot views dirty through multiplayer_transport_mark_selector_slot_views_dirty. Current grounded callers come from multiplayer_transport_handle_names_query_response and multiplayer_transport_handle_selector_update_response.,ghidra + rizin + llvm-objdump
0x00594fb0,93,multiplayer_transport_clear_selector_view_entry_slot_and_remove_if_empty,shell,cdecl,inferred,objdump + local disassembly,3,"Resolves one selector-view entry by name, clears the requested selector-slot ownership pointer at `[entry+0x40+slot*4]`, decrements the paired generation counter at `[this+0xab8+slot*4]`, clears the corresponding slot-flag dword at `[entry+0x5c+slot*4]`, and refreshes selector-view side effects through `0x594790`. When all three slot ownership pointers at `[entry+0x40]`, `[entry+0x44]`, and `[entry+0x48]` are then null it removes the whole keyed entry through `multiplayer_transport_remove_selector_view_entry_from_store` `0x594a30` before notifying `0x596900`. Current grounded callers are the later selector-view callback root at `0x59f9c0` and the keyed store-walk helper at `0x5950a0`.","objdump + local disassembly + caller inspection"
0x00595010,102,multiplayer_transport_rekey_selector_view_entry_preserving_slot_runtime,shell,cdecl,inferred,objdump + local disassembly,3,"Rekeys one selector-view entry under a new bounded name while preserving its slot-local runtime block. It resolves the old entry by name, copies the `0x1b`-dword runtime band rooted at `[entry+0x40]` into stack scratch, removes the old keyed entry through `multiplayer_transport_remove_selector_view_entry_from_store` `0x594a30`, allocates or resolves the replacement entry through `0x594e70`, restores the copied runtime band into `[new_entry+0x40]`, and then refreshes the surrounding selector-name side through `0x596c10`. Current grounded caller is the adjacent selector callback root at `0x59fab0`.","objdump + local disassembly + caller inspection"
0x005950a0,36,multiplayer_transport_clear_selector_view_slot_from_all_entries,shell,cdecl,inferred,objdump + local disassembly,3,"Walks the keyed selector-view store at `[this+0xab4]` and clears one selector slot from every entry that still owns it. The local store-walk callback `0x595080` checks `[entry+0x40+slot*4]` and, when present, forwards into `multiplayer_transport_clear_selector_view_entry_slot_and_remove_if_empty` `0x594fb0`. Current grounded callers are `multiplayer_transport_reset_selector_slot` `0x5954b0` and the later callback root `0x59fb60`.","objdump + local disassembly + caller inspection"
0x005950d0,101,multiplayer_transport_reset_selector_tables,shell,cdecl,inferred,ghidra-headless,4,Resets the three selector registration tables rooted at [this+0x80] [this+0x390] and [this+0x39c] together with state at [this+0x9a8] and [this+0x9ac]. When [this+0xab0] is set it preserves selector slot `0`; otherwise it clears all three selector slots.,ghidra + rizin + llvm-objdump
0x00595140,89,multiplayer_transport_set_selector_name,shell,cdecl,inferred,ghidra-headless,4,Copies one selector name into the fixed 0x101-byte selector-name slot at [this+0x80+index*0x101] when the caller string fits. It then marks the selector present at [this+0x384+index*4] and clears the paired transient pointer at [this+0x99c+index*4].,ghidra + rizin + llvm-objdump
0x005951a0,67,multiplayer_transport_find_selector_name,shell,cdecl,inferred,ghidra-headless,4,Scans the three selector-name slots rooted at [this+0x80] for an exact string match and returns the matching selector index through the caller pointer. The callback-slot wrapper family uses this helper before enqueueing several selector-bound opcode records.,ghidra + rizin + llvm-objdump
0x005951f0,579,multiplayer_transport_service_status_pump,shell,cdecl,inferred,ghidra-headless,3,Central session-event transport status-pump and route-service loop. It inspects selector presence under [this+0x384] and [this+0x390] builds temporary selector-mode masks through multiplayer_transport_parse_selector_mode_letters emits status text and field updates through multiplayer_transport_append_setchankey_or_setckey_command multiplayer_transport_dispatch_field_snapshot_mode and related helpers and drives the deeper route-state machine through multiplayer_transport_init_selector_slot multiplayer_transport_reset_selector_slot 0x005965d0 0x0059f3c0 and related helpers.,ghidra + rizin + llvm-objdump + strings
0x00595440,98,multiplayer_transport_init_selector_slot,shell,cdecl,inferred,ghidra-headless,3,Initializes one selector slot under [this+0x384] and [this+0x390]. It copies caller text or the default sample at 0x005c87a8 into the fixed selector buffer at [slot+0x39c] clears byte [slot+0x59b] reruns multiplayer_transport_service_status_pump and then notifies multiplayer_transport_submit_profile_key_query_bundle_default for the refreshed selector slot.,ghidra + rizin + llvm-objdump + strings
0x005954b0,238,multiplayer_transport_reset_selector_slot,shell,cdecl,inferred,ghidra-headless,3,Resets one selector slot under [this+0x384] and [this+0x390]. When the slot is active it tears the current selector object down through 0x593460 optionally republishes caller text through 0x58e7a0 refreshes selector bookkeeping through 0x5950a0 and clears the active and present flags before returning.,ghidra + rizin + llvm-objdump
0x00595620,35,multiplayer_transport_release_route_binding,shell,cdecl,inferred,ghidra-headless,3,Releases the current route binding stored at [this+0x1ec8]. It detaches the binding from the descriptor object at [this+0x1ed0] through 0x58f3c0 unlinks it through 0x5933a0 and clears [this+0x1ec8].,ghidra + rizin + llvm-objdump
0x00595650,688,multiplayer_transport_set_route_mode,shell,cdecl,inferred,ghidra-headless,3,Main route-mode state machine for the session-event transport. It latches the requested small mode at [this+0x18b8] and dispatches modes `0` through `5` across live-route teardown selector-slot init or reset am-rating route seeding live-route connect and route-binding release paths. The currently grounded mode transitions converge by tearing live routes down through multiplayer_transport_release_live_route and rebuilding them through multiplayer_transport_try_connect_live_route rather than mutating the live route object's callback slots in place. The branch uses multiplayer_transport_release_live_route multiplayer_transport_try_seed_am_rating_route_table multiplayer_transport_try_connect_live_route and multiplayer_transport_release_route_binding to converge on the next stable mode.,ghidra + rizin + llvm-objdump + strings
0x00595860,125,multiplayer_transport_handle_staged_route_callback_submit_result,shell,cdecl,inferred,objdump + local disassembly,3,"Completion callback used by `multiplayer_transport_try_stage_route_callback_payload` `0x5958e0`. On a nonzero submit result it first checks whether the third selector-generation counter at `[this+0xac0]` exceeds `1`; when it does, the helper counts matching selector-view entries for slot `2` through `0x594e30` using the current transport name buffer at `[this+0x04]`. A positive count advances the route-mode state machine through mode `3`, and when the transport remains in route mode `3` and the same third selector-generation counter has reached the target at `[this+0xb48]` it advances once more through mode `4`. Otherwise, and on the zero-result path too, it resets selector slot `2` to the default sample through `multiplayer_transport_reset_selector_slot` `0x5954b0`; when the current route mode is still `2` it then re-enters `multiplayer_transport_set_route_mode` `0x595650` with mode `2`. This now bounds the callback as a real staged-route-capacity submit result handler rather than a generic route-mode nudge.","objdump + local disassembly + caller correlation + selector-generation correlation"
0x005958e0,156,multiplayer_transport_try_stage_route_callback_payload,shell,cdecl,inferred,ghidra-headless,3,"Builds one staged route-callback payload from the caller route object and transport-local text buffer at `[this+0x60]`. It extracts a small compact descriptor tuple from the caller route object through `0x58d1f0`, `0x58d220`, `0x58d240`, and `0x58d250` or `0x58d200`, packs that tuple through multiplayer_transport_format_route_binding_gsp_payload, submits the staged text through `multiplayer_transport_submit_selector_text_route_request` `0x593c40` using callback `multiplayer_transport_handle_staged_route_callback_submit_result` `0x595860`, and on success stores the cloned callback payload returned by multiplayer_transport_clone_staged_callback_payload at `[this+0xb50]`. The same descriptor family later reappears in the route-binding compatibility gate at `0x595d00`, so this payload lane is now bounded as a real route-binding descriptor publisher rather than a pure presentation helper. Current evidence does not yet prove this tuple is the same field family as the selector-view probe marker companion integer at `[entry+0x54]`.","ghidra + rizin + llvm-objdump + strings + later compatibility correlation + descriptor-layout correlation + callback correlation"
0x00595d00,83,multiplayer_transport_route_binding_matches_route_callback_descriptor_tuple,shell,cdecl,inferred,objdump,3,"Small compatibility gate over one staged route-callback payload versus the current bound route object. It compares the caller payload's primary descriptor dword through `0x58d1f0` against bound-route field `[binding+0x54]`; when payload byte-flag getter `0x58d220` carries bit `0x2`, it also requires getter `0x58d240` to match `[binding+0x58]` and getter `0x58d250` to match word `[binding->route+0x30]`; otherwise it falls back to getter `0x58d200` against that same route word. Current grounded caller is multiplayer_transport_check_openstaging_capacity_gate at `0x595d60`, where this tuple check can short-circuit the broader capacity path. This row is now intentionally scoped to the route-binding descriptor family, not the selector-view `X...X|%d` marker tuple.","objdump + caller inspection + descriptor-getter correlation + route-binding-layout correlation"
0x00595980,84,multiplayer_transport_handle_route_status_result,shell,cdecl,inferred,ghidra-headless,2,Completion callback used by multiplayer_transport_submit_route_status_request. When the callback result is nonzero it compares the third selector-generation counter at [this+0xac0] against the current route-status target at [this+0xb48] and advances the route-mode state machine through mode `2` or modes `3` or `4`. When the callback result is zero it sets [this+0x1ed8] and re-enters multiplayer_transport_set_route_mode using the current am-rating route state at [this+0x1ed4].,ghidra + rizin + llvm-objdump + selector-generation correlation
0x005959e0,81,multiplayer_transport_submit_route_status_request,shell,cdecl,inferred,ghidra-headless,3,Submits one route-status request for the current binding at [this+0x1ec8]. It gathers the binding fields at +0x2c and +0x30 together with the local counter at [this+0xb48] and default sample text at 0x005c87a8 then sends that request through 0x593980 using multiplayer_transport_handle_route_status_result as the completion callback. Failure sets [this+0x1ed8] so the route-mode setter can fall back immediately.,ghidra + rizin + llvm-objdump
0x00596270,70,multiplayer_transport_clone_staged_callback_payload,shell,cdecl,inferred,ghidra-headless,3,Clones one staged route-callback payload block by allocating a same-sized object through 0x58d5b0 copying the first nine dwords and then registering a cleanup callback through 0x58fa00 with shim 0x596260. Current grounded caller is multiplayer_transport_try_stage_route_callback_payload.,ghidra + rizin + llvm-objdump
0x00597720,96,multiplayer_transport_format_route_binding_gsp_payload,shell,cdecl,inferred,ghidra-headless,3,"Formats one route-binding or callback payload with the `#GSP!%s!%c%s%c` template at `0x005e2358`. It takes the caller text payload in `esi`, then wraps one encoded descriptor fragment with either `X...X` or `M...M` depending on whether the global formatter state at `0x00dba4c4` is present. On the simpler branch it encodes the primary descriptor dword through `0x597590` and chooses wrapper char `0x58` (`X`); on the mixed branch it folds two dwords plus one normalized word through `0x5976c0` and chooses wrapper char `0x4d` (`M`). It then emits the final `#GSP!` line through `0x5a19c4`. Current grounded callers are multiplayer_transport_submit_bound_route_request and multiplayer_transport_try_stage_route_callback_payload.","ghidra + rizin + llvm-objdump + strings + route-binding-payload correlation"
0x005977b0,127,multiplayer_transport_parse_selector_view_probe_marker,shell,cdecl,inferred,objdump,3,"Parses one selector-view probe marker in the local `X%sX|%d` family. It requires a length of at least `0x0c`, accepts the marker only when byte `0` or byte `9` is `X`, decodes the wrapped request-id fragment through `0x597630`, parses the decimal tail after the `|` through `0x5a1ea5`, and returns those two values through caller output pointers as `(probe request id, displayed version/build integer)`. Current grounded callers are the profile-key callback lanes at `0x596a01` and `0x59f912`, which forward that tuple into multiplayer_transport_arm_selector_view_probe_tracking.","objdump + caller xrefs + format string"
0x00597840,30,multiplayer_transport_format_selector_view_probe_marker_core,shell,cdecl,inferred,objdump,3,"Formats the core `X%sX` wrapper used inside the selector-view probe marker family. It encodes the caller request id through `0x597590`, wraps the result with sentinel `X` bytes, and terminates the destination buffer at byte `0x0a`. Current grounded caller is multiplayer_transport_stage_selector_view_progress_snapshot, which uses `[entry+0x50]` as the marker id when building `PNG %s %d` progress lines. The trailing `|%d` companion integer from the wider `X%sX|%d` family is parsed by `0x5977b0`, but current evidence does not show it being emitted here.","objdump + caller xrefs + format string + staged-progress correlation"
0x00593980,382,multiplayer_transport_submit_bound_route_request,shell,cdecl,inferred,ghidra-headless,3,"Builds and submits one bound-route request using the current transport text buffers and a caller-supplied binding id or fallback route id. It formats the request payload through multiplayer_transport_format_route_binding_gsp_payload allocates a type `1` transient request record through 0x5934e0 and stages the same three transport wrapper metadata dwords later consumed from work fields `+0x0c/+0x10/+0x18` on the completion side publishes selector `2` text through multiplayer_transport_set_selector_name and finally submits the request through 0x58e720 using multiplayer_transport_handle_bound_route_request. A nonempty caller text sample sets [this+0xb4c].","ghidra + rizin + llvm-objdump + strings + work-record-triplet correlation"
0x00593b00,161,multiplayer_transport_handle_selector_update_response,shell,cdecl,inferred,ghidra-headless,3,"Follow-up callback used by `multiplayer_transport_handle_selector_text_route_request`. When the callback succeeds it initializes or repopulates selector slot `[req+0x1c]` through `multiplayer_transport_init_selector_slot` and `multiplayer_transport_upsert_selector_name_entry`. When it fails it resets that selector slot. Both paths finish by enqueueing a route record through `multiplayer_transport_probe_or_enqueue_route_record` using the staged work fields `(callback fn +0x10, callback companion +0x18, drain context id +0x0c)` plus the request-local selector slot id at `+0x1c`, then unlinking the request through `0x5933a0`.","ghidra + rizin + llvm-objdump + local disassembly + callback-triplet correlation"
0x00593bb0,144,multiplayer_transport_handle_selector_text_route_request,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_selector_text_route_request. If the request is already stale at +0x38 it clears the transient state through 0x5962c0 and unlinks the request. On nonzero result it schedules multiplayer_transport_handle_selector_update_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot [req+0x1c] and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump
0x00593c40,177,multiplayer_transport_submit_selector_text_route_request,shell,cdecl,inferred,ghidra-headless,3,"Builds and submits one selector-text route request. It validates the caller text defaults the sample text to 0x005c87a8 allocates a type `2` transient request record through 0x5934e0 stores the selector id at +0x1c stages the same three transport wrapper metadata dwords later consumed from work fields `+0x0c/+0x10/+0x18` refreshes selector naming through 0x59fc80 and multiplayer_transport_set_selector_name and then submits the request through 0x58e720 using multiplayer_transport_handle_selector_text_route_request.","ghidra + rizin + llvm-objdump + strings + work-record-triplet correlation"
0x00595a40,245,multiplayer_transport_dispatch_field_snapshot_mode,shell,cdecl,inferred,ghidra-headless,3,"Dispatches several session-field snapshot update modes into multiplayer_transport_enqueue_field_snapshot_record. Current grounded cases are tighter now: mode `0` enqueues one descriptor-backed snapshot and, when descriptor ready bit `0x1` is still clear, also inserts that descriptor into the local field-cache family `[this+0x1724]` with pending tag `0x4`; mode `1` enqueues the same snapshot without cache insertion; mode `2` removes descriptors carrying pending state bits `0x04/0x08` from that local field-cache family before enqueueing; mode `3` clears progress scalar `[this+0x1774]` and resets the callback payload to zero; mode `4` enqueues one empty selector snapshot through mode `0`; and mode `5` copies the transport-staged route companion dword from `[this+0x490]` into `[this+0x54]` while mirroring that same value into the local field cache rooted at `[this+0x1724]`. Queue service later promotes pending tag `0x4` into ready bit `0x1`.","ghidra + rizin + llvm-objdump + strings + queue-state correlation + caller inspection"
0x00595b60,25,multiplayer_transport_enqueue_field_snapshot_mode1_if_enabled,shell,cdecl,inferred,ghidra-headless,2,Tiny field-snapshot wrapper that enqueues one mode-1 field snapshot only when the caller enable flag is zero. The helper is a thin front end over multiplayer_transport_enqueue_field_snapshot_record.,ghidra + rizin + llvm-objdump
0x00595b80,50,multiplayer_transport_clear_progress_field_cache,shell,cdecl,inferred,ghidra-headless,3,Clears the progress-related field cache rooted at [this+0xba0] and then clears the local field cache at [this+0x1724]. It finishes by forwarding opcode type `3` into 0x005929a0 to remove matching active field-snapshot records from the active opcode collection at [this+0x17fc].,ghidra + rizin + llvm-objdump + strings + local disassembly
0x00595bc0,272,multiplayer_transport_enqueue_capacity_descriptor_record,shell,cdecl,inferred,objdump,3,"Builds and enqueues one opcode-`2` descriptor-block record tied to the local capacity or occupancy sidecar at `[this+0x1778]`. Current evidence now bounds that sidecar more tightly: it behaves as one cached pointer into the transient transport work-record family rooted at `[this+0x1780]`, because every meaningful branch in this helper first reads that pointer and then consumes the familiar work-record metadata triplet at `+0x0c/+0x10/+0x18`. Mode `0` is the live append-notify branch, lining up directly with the generic descriptor owner callback at `0x590370`: it samples the current descriptor's primary IPv4, `hostname`, `numwaiting`, `maxwaiting`, `numservers`, and `numplayers` properties through `0x58d1f0`, `0x58d170`, and `0x58d6d0`, then packs a populated seven-dword descriptor payload through `multiplayer_transport_enqueue_descriptor_block_record` `0x592ae0` while also carrying the same outer callback-wrapper triplet as `(drain context id [cache+0x0c], callback fn [cache+0x10], callback companion [cache+0x18])`. Modes `3` and `5` are the live receive-state callbacks sourced by `multiplayer_transport_route_callback_table_service_live_socket_and_feed_decode_machine` `0x5911e0` and its inner decode state machine `0x5908c0`: they deliberately enqueue an all-zero seven-dword descriptor payload, forward only that same stored callback-wrapper triplet in the outer slots, and then unlink the cached work record through `0x5933a0`, using `EDX=1` for mode `3` and `EDX=0` for mode `5`. Other owner-callback modes fall through without staging a descriptor block here, and the negative result is stronger now too: direct local field-xref scans hit neighboring lifecycle fields `[this+0x176c]`, `[this+0x1770]`, `[this+0x1774]`, `[this+0x177c]`, `[this+0x1780]`, and `[this+0x1784]`, but `[this+0x1778]` still appears only as this helper's single read; broader local text scans also fail to show any obvious `lea`-based replay-band writer. So the sidecar writer remains upstream of this leaf family and is not one ordinary direct or nearby derived-address field store in local text. Mode `2` stays separate as the generic remove-notify-and-stage path at `0x590430`, not one of this helper's own branches. Current evidence therefore bounds this as a real capacity or occupancy descriptor publisher over one cached work record, not a vague route-progress helper or a custom replay-scalar blob.","objdump + local disassembly + strings + capacity-cache correlation + work-record correlation + descriptor-block correlation + mode split correlation + opcode2-payload correlation + generic-owner-mode correlation + negative-xref correlation + callback-triplet correlation + neighboring-field-lifecycle correlation + live-receive-owner correlation + negative-derived-address-scan"
0x00595ce0,22,multiplayer_transport_clear_capacity_descriptor_route_callback_table,shell,cdecl,inferred,objdump + local disassembly,3,"Clears the auxiliary capacity-descriptor route callback table when `[this+0xba0]` is present by forwarding the embedded runtime at `[this+0x1164]` into `multiplayer_transport_route_callback_table_reset_live_route_and_decode_runtime` `0x590740`. Current grounded callers use this before disconnect or larger route-state cleanup. The helper does not target the field-subscription table at `[this+0xba4]`; current evidence ties it specifically to the callback table whose owner handler is `multiplayer_transport_enqueue_capacity_descriptor_record` `0x595bc0`.","objdump + local disassembly + caller inspection + route-callback-table correlation"
0x00595d60,84,multiplayer_transport_check_openstaging_capacity_gate,shell,cdecl,inferred,ghidra-headless,2,Checks whether the current transport object still matches the cached openstaging-like descriptor and whether numplayers remains below maxplayers. When the cached route object at [this+0x1ecc] already matches the current transport identifiers it returns success immediately; otherwise it compares the current maxplayers and numplayers fields and on success falls into 0x00592710 for the caller's route transition path.,ghidra + rizin + llvm-objdump + strings
0x00595dc0,79,multiplayer_transport_try_transition_after_capacity_gate,shell,cdecl,inferred,ghidra-headless,2,"Rejects when `[this+0x1e8c]` or selector slot `[this+0x38c]` is busy, then runs `multiplayer_transport_check_openstaging_capacity_gate` `0x595d60`, refreshes route-side selector state through `0x5973b0` and `multiplayer_transport_reset_selector_slot` `0x5954b0` on slot `2`, forwards the caller descriptor into `multiplayer_transport_try_stage_route_callback_payload` `0x5958e0`, and on success transitions through `multiplayer_transport_set_route_mode` `0x595650` mode `0`. Current grounded callers are the ready-descriptor branch in `0x595e10` mode `1` and the mode-`0` fastpath in `0x595f70`.","ghidra + rizin + llvm-objdump + caller inspection"
0x00595e10,321,multiplayer_transport_dispatch_am_rating_route_event_mode,shell,cdecl,inferred,ghidra-headless,3,"Dispatches route-event modes for the `gsi_am_rating` callback branch rooted at the primary-endpoint table `[this+0x18bc]` and the queued descriptor family `[this+0x1e7c]`. Current grounded cases are tighter now: mode `0` uses descriptor flag-byte-`0x15` bit `0x1` to choose between direct primary-endpoint handling through `multiplayer_transport_primary_endpoint_table_upsert_descriptor_by_primary_ipv4_and_port` `0x00591330` and queued insertion through `multiplayer_gamespy_server_descriptor_queue_insert_with_pending_state_tag` `0x005a09a0`; mode `1` uses descriptor state-byte ready bit `0x2` to choose between immediate transition handling through `multiplayer_transport_try_transition_after_capacity_gate` `0x595dc0` and reinsertion into that same queue family, but then applies one second guard through flag bit `0x1`, which suppresses the direct transition path even when ready bit `0x2` is already present; mode `2` removes descriptors still carrying pending state bits `0x04/0x08` from the queued family through `0x005a0cd0`; mode `3` forces route mode `2` when the primary-endpoint table at `[this+0x18bc]` is empty; mode `4` updates `[this+0x1ed4]` and can switch transport mode based on the callback-table sentinel at `[this+0x18b8]` plus deferred descriptor pointer `[this+0x1ed8]`; and mode `5` copies the transport-staged route companion dword from `[this+0x490]` into `[this+0x54]` while mirroring that same value into the local field cache rooted at `[this+0x1724]`. The strongest current read is that flag byte `0x15` bit `0x1` marks primary-endpoint-seed or endpoint-only descriptors: those descriptors can be staged and enriched through the queue family, but they do not take the richer direct transition path used by clear-bit descriptors.","ghidra + rizin + llvm-objdump + am-rating-owner correlation + endpoint-table correlation + queued-descriptor correlation + queue-state correlation + caller inspection + transition-suppression correlation + raw-endpoint-seed correlation"
0x00595f70,237,multiplayer_transport_dispatch_am_rating_route_callback,shell,cdecl,inferred,ghidra-headless,3,"Callback handler for the `gsi_am_rating` route branch rooted at the primary-endpoint table `[this+0x18bc]`. Mode `0` forwards directly into multiplayer_transport_try_transition_after_capacity_gate. Mode `2` now has a cleaner ownership split: it walks the primary-endpoint table through `0x590470/0x590480`, prunes stale entries against multiplayer_transport_check_openstaging_capacity_gate, updates surviving entries through `0x58d130` using the `gsi_am_rating` key, and then either forces transport mode `2` when the table empties or forwards the surviving head descriptor into `0x5958e0` before transitioning through `0x595650` mode `0`.","ghidra + rizin + llvm-objdump + strings + endpoint-table correlation"
0x00596060,48,multiplayer_transport_reset_am_rating_route_state,shell,cdecl,inferred,ghidra-headless,3,"Small reset helper for the active `gsi_am_rating` route state. When `[this+0xba0]` is set it clears the primary-endpoint callback table at `[this+0x18bc]` through `0x590740`, resets `[this+0x1ec4]` to zero, and clears the queued descriptor family at `[this+0x1e7c]` through `0x5a0950`.",ghidra + rizin + llvm-objdump + strings
0x00596090,272,multiplayer_transport_init_route_callback_tables,shell,cdecl,inferred,ghidra-headless,3,"Initializes the transport-owned route callback tables at `[this+0xba4]`, `[this+0x1164]`, and `[this+0x18bc]` together with the descriptor caches at `[this+0x1724]` and `[this+0x1e7c]`. Current evidence now bounds the constructor lanes more tightly than the earlier handler-table note: it constructs `[this+0xba4]` through `multiplayer_transport_route_callback_table_construct` `0x5905e0` with owner callback `0x595a40`, shared owner cookie `this`, route-label buffers rooted at `[this+0xb58]` and `[this+0xb78]`, and schema or descriptor-owner pointer `[this+0xb98]`; it seeds the local field-cache family `[this+0x1724]` through `0x5a08f0` with helper `0x595b60`; it constructs `[this+0x1164]` through the same `0x5905e0` path but with owner callback `0x595bc0`; and it constructs `[this+0x18bc]` through `0x5905e0` with owner callback `0x595e10` before seeding `[this+0x1e7c]` through `0x5a08f0` with helper `0x595f70`. On success it also clears the staged route-callback payload slot `[this+0xb50]` and sets callback-table enable latch `[this+0xba0]` to `1`.","ghidra + rizin + llvm-objdump + handler-table correlation + local disassembly + constructor-argument correlation + latch-state correlation"
0x005961b0,92,multiplayer_transport_teardown_route_callback_tables,shell,cdecl,inferred,ghidra-headless,4,"Full teardown for the transport-owned route callback tables. It first clears progress and local field-cache state through `0x595b80`, resets the capacity-descriptor route callback table at `[this+0x1164]` through `0x595ce0`, and then, when callback-table plumbing latch `[this+0xba0]` is set, destroys the callback tables at `[this+0xba4]`, `[this+0x1164]`, and `[this+0x18bc]` through `0x5907a0`, clears the related caches at `[this+0x1724]` and `[this+0x1e7c]` through `0x5a0970`, and resets `[this+0x1ec4]` to zero. Current grounded caller is `multiplayer_transport_disconnect` `0x58d830`.","ghidra + rizin + llvm-objdump + caller inspection + route-callback-table correlation"
0x00596210,71,multiplayer_transport_service_route_callback_tables,shell,cdecl,inferred,objdump,3,"Recurring service sweep for the transport-owned callback tables and descriptor caches. When route callback plumbing is enabled at `[this+0xba0]` it services the callback tables at `[this+0xba4]`, `[this+0x1164]`, and the `gsi_am_rating` primary-endpoint table `[this+0x18bc]` through the shared table-service helper `0x591290`, services the cache blocks at `[this+0x1724]` and the companion queued descriptor family `[this+0x1e7c]` through `multiplayer_gamespy_server_descriptor_queue_service_and_publish_empty_transition` `0x005a0c80`, and otherwise returns immediately. Current evidence now bounds those queue families more tightly too: service promotes pending descriptor state tags `0x4/0x8` into ready bits `0x1/0x2` before the higher transport-owned branches consume them. The current grounded caller is multiplayer_transport_service_frame, which makes this the callback-table side of the recurring multiplayer transport cadence.",objdump + am-rating-owner correlation + queue-state correlation
0x005962c0,32,multiplayer_transport_clear_staged_route_callback_payload,shell,cdecl,inferred,objdump + local disassembly,3,"Clears the cloned staged route-callback payload handle at `[this+0xb50]`. When that slot is non-null the helper forwards the embedded owned object slot through `0x58d0d0`, then zeroes `[this+0xb50]`. Current grounded callers are the stale-request branch in `multiplayer_transport_handle_selector_text_route_request` `0x593bb0` and the selector-slot-`2` reset path around `0x595561`.","objdump + local disassembly + caller inspection + payload-slot correlation"
0x005962e0,583,multiplayer_transport_open_field_subscription_route_callback_table,shell,cdecl,inferred,objdump,3,"Builds and opens the field-subscription route callback table rooted at `[this+0xba4]`. After clearing the progress field cache through `0x595b80` and releasing any prior active descriptors through `0x5904d0`, it builds one route-label string from the optional suffix text plus the static route stem family at `0x005e22a0..0x005e22d0`, seeds the local field-cache family `[this+0x1724]` with the initial callback keys through `0x5a0cc0`, appends per-field selector names from the caller field-id list through the string table at `0x00629958`, and then opens the live route through `multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state` `0x590ed0` in mode `4`. On success it seeds cached progress percentage `[this+0x1774]` to `1` and immediately enqueues one mode-`3` field snapshot through `multiplayer_transport_enqueue_field_snapshot_record` `0x592b50`; on failure it falls back through the same progress-cache clear path. This is the strongest current upstream owner above the `[transport+0xba4]` route-callback table.","objdump + local disassembly + caller inspection + field-cache correlation + route-callback-table correlation"
0x00596530,101,multiplayer_transport_try_open_am_rating_route_callback_table_from_stored_route_label,shell,cdecl,inferred,objdump,3,"Tries to reopen the `gsi_am_rating` route callback table rooted at `[this+0x18bc]` from the stored route label at `[this+0x1ed0]`. It first resets the am-rating route state through `multiplayer_transport_reset_am_rating_route_state` `0x596060`, releases any prior active descriptors through `0x5904d0`, and then opens one mode-`4` live route through `multiplayer_transport_route_callback_table_open_live_route_and_seed_receive_state` `0x590ed0` with a null companion route string. Success clears `[this+0x1ed4]`, sets `[this+0x1ec4]` to `1`, and leaves the primary-endpoint table ready for later raw-endpoint seeding through `0x590dc0`; failure reverts through the same reset path and sets `[this+0x1ed4]`. Current grounded caller is the larger route-mode setter around `0x595650`.","objdump + local disassembly + caller inspection + am-rating-owner correlation + route-callback-table correlation"
0x005965a0,44,multiplayer_transport_try_connect_status_route_once,shell,cdecl,inferred,ghidra-headless,3,Single-shot wrapper for the auxiliary status-route object at [this+0xaf0]. When the in-flight latch at [this+0xb40] is already set it returns false immediately. Otherwise it sets that latch and forwards the caller route id into multiplayer_transport_try_connect_status_route then booleanizes the result. Current grounded caller is multiplayer_transport_handle_names_query_response.,ghidra + rizin + llvm-objdump
0x00596970,404,multiplayer_transport_handle_profile_key_query_result,shell,cdecl,inferred,objdump,3,"Per-key callback helper for the profile-key query bundle family. It ignores empty selector names, treats a null fallback text as `0x005c87a8`, special-cases the `username` key by parsing one `X...X|%d` marker through multiplayer_transport_parse_selector_view_probe_marker, arming selector-view probe tracking through multiplayer_transport_arm_selector_view_probe_tracking, and optionally publishing callback slot `22` with the selector name plus the parsed probe tuple `(request id, displayed version/build integer)` or a zeroed `(END)` sentinel payload. It also special-cases `b_flags` by forwarding the returned mode-letter string into multiplayer_transport_merge_selector_mode_mask, then hashes the selector name, key name, and resolved value text through `0x58f4a0` and upserts that triplet into the caller table through hashed_entry_table_upsert.","objdump + strings + caller context"
0x00596b90,72,multiplayer_transport_query_slot_built_in_profile_key_and_publish_slot28_on_success,shell,cdecl,inferred,objdump + local disassembly,3,"Small helper above the generic per-key profile query path. Using the caller selector slot in `edx`, it indexes one per-slot built-in string pair from `[this+0x189c+slot*4]` and `[this+0x18ac+slot*4]`, forwards that pair plus the caller selector name and fallback text into `multiplayer_transport_handle_profile_key_query_result` `0x596970` with its publication flag enabled, and, when that lower helper returns success, also publishes callback slot `28` through `multiplayer_transport_enqueue_callback_slot28_record` `0x593200`. Current grounded callers are the selector callback root `0x59fbd0` and the later multi-entry sweep around `0x596d33`.","objdump + local disassembly + caller inspection"
0x00596da0,497,multiplayer_transport_submit_profile_key_query_bundle,shell,cdecl,inferred,rizin,2,Wrapper above the transport key-command builders that stages a small named-key query bundle around the strings `username` and `b_flags`. It allocates temporary key-name arrays and callback-entry tables submits the first request through multiplayer_transport_submit_getkey_command_and_wait folds returned key results into transport-owned callback state through 0x0058f8f0 and 0x0058fa00 and then follows with the larger channel-key submission path through multiplayer_transport_submit_setchankey_pair_list_command_and_wait when the staged key set is nonempty.,rizin + llvm-objdump + strings
0x00596fa0,19,multiplayer_transport_submit_profile_key_query_bundle_with_context,shell,cdecl,inferred,rizin,2,Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector or route context in `edx` and forwards the stack-supplied context pointer as the extra bundle argument. Current grounded use is through the local callback table rooted at 0x0059f8b0.,rizin + llvm-objdump
0x00596fc0,14,multiplayer_transport_submit_profile_key_query_bundle_default,shell,cdecl,inferred,rizin,3,Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector slot in `edx` and forces a null extra-context argument. Current grounded caller is multiplayer_transport_init_selector_slot and the same wrapper is also installed through the local callback table rooted at 0x0059fb60.,rizin + llvm-objdump
0x0059f8b0,260,multiplayer_transport_callback_upsert_current_selector_and_request_profile_keys,shell,cdecl,inferred,objdump,3,"Callback-root helper adjacent to the second transport-side descriptor lane. It resolves the current selector through multiplayer_transport_find_selector_name, upserts that selector name into the selector-view store through multiplayer_transport_upsert_selector_name_entry, optionally reuses a cached `username` marker from `0x58eb10` to arm selector-view probe tracking through multiplayer_transport_parse_selector_view_probe_marker and multiplayer_transport_arm_selector_view_probe_tracking, then submits one profile-key query bundle through multiplayer_transport_submit_profile_key_query_bundle_with_context and publishes callback slot `17`. When selector `2` is active, the same helper can also force the route-mode transitions `2 -> 3 -> 4` through multiplayer_transport_set_route_mode after checking the status-route latch at `[this+0xb54]`, route activity, and the generation gate `[this+0xac0] >= [this+0xb48]`.","objdump + caller xrefs + strings"
0x0059f9c0,239,multiplayer_transport_callback_clear_named_selector_view_slot_publish_slot18_and_maybe_set_route_mode,shell,cdecl,inferred,objdump + local disassembly,3,"Callback-root helper installed in the second transport-side selector descriptor lane at `0x59fc80`. It resolves the current selector through `0x5951a0`; when selector `2` is active and the route is live, it derives one follow-on route-mode request from the current selector-view state by combining the route-status latch at `[this+0xb40]`, the slot-`2` flag-`0x20` count from `multiplayer_transport_count_selector_view_entries_with_slot_flag20_and_optional_name_match` `0x594e30`, and the third selector-generation gate `[this+0xac0]` versus target `[this+0xb48]`. It then clears the named selector-view slot membership through `multiplayer_transport_clear_selector_view_entry_slot_and_remove_if_empty` `0x594fb0`, publishes callback slot `18` through `0x592f20` using the selector name plus either the default sample `0x005c87a8`, the alternate token `0x005e24e0` for selectors `2/3`, or the caller text when present, and finally re-enters `multiplayer_transport_set_route_mode` `0x595650` when the earlier route-mode decision armed a transition. This now bounds the helper as the named selector-view slot-clear and callback-slot-`18` publication lane rather than an anonymous route-mode side effect.","objdump + local disassembly + callback-table install correlation + caller inspection"
0x0059fab0,58,multiplayer_transport_callback_rekey_named_selector_view_entry_and_publish_slot21,shell,cdecl,inferred,objdump + local disassembly,3,"Callback-root helper installed in the same selector descriptor lane at `0x59fc80`. It resolves the current selector through `0x5951a0`, rekeys the named selector-view entry through `multiplayer_transport_rekey_selector_view_entry_preserving_slot_runtime` `0x595010`, and then publishes callback slot `21` through `0x593000` using the old and new selector names plus the caller context in `edx`. Current grounded role is the rename or relabel sibling next to the slot-clear lane, not a generic selector-text setter.","objdump + local disassembly + callback-table install correlation"
0x0059faf0,98,multiplayer_transport_callback_set_selector_slot_sample_text_and_refresh_active_object,shell,cdecl,inferred,objdump + local disassembly,2,"Callback-root helper adjacent to `0x59fab0`. After resolving the caller selector name into one slot index through `0x5951a0`, it copies up to `0x200` bytes of caller text into the fixed selector sample buffer at `[this+0x39c+slot*0x200]`, clears the trailing byte at `[this+0x59b+slot*0x200]`, and, when an active selector object is still present at `[this+0x390+slot*4]`, refreshes that object through `0x592d30`. This currently bounds the helper as the selector-sample-text update lane rather than a broader selector-table mutator.","objdump + local disassembly + selector-buffer correlation"
0x0059fb60,104,multiplayer_transport_callback_replace_selector_slot_name_set_request_default_profile_keys_and_publish_slot20,shell,cdecl,inferred,objdump + local disassembly,3,"Callback-root helper installed at offset `0x24` in the selector descriptor lane seeded by `0x59fc80`. It resolves the caller selector name into one slot index through `0x5951a0`, clears that selector slot from every selector-view entry through `multiplayer_transport_clear_selector_view_slot_from_all_entries` `0x5950a0`, then iterates one caller-supplied name list and re-upserts each name into that slot through `multiplayer_transport_upsert_selector_name_entry` `0x594f20` using the paired caller-side flag words. After the replacement sweep it requests the default profile-key bundle for that selector slot through `0x596fc0` and publishes callback slot `20` through `0x592fc0`.","objdump + local disassembly + callback-table install correlation + caller inspection"
0x0059fbd0,69,multiplayer_transport_callback_query_slot_built_in_profile_key_and_publish_slot28,shell,cdecl,inferred,objdump + local disassembly,3,"Callback-root helper installed at offset `0x28` in the selector descriptor lane seeded by `0x59fc80`. It resolves the caller selector name into one slot index through `0x5951a0`, forwards the caller trio into `multiplayer_transport_query_slot_built_in_profile_key_and_publish_slot28_on_success` `0x596b90`, and then publishes the same trio through `multiplayer_transport_enqueue_callback_slot28_record` `0x593200`. This currently bounds the helper as the built-in per-slot profile-key query sibling next to the selector-set replacement lane, rather than another generic selector-text path.","objdump + local disassembly + callback-table install correlation + helper correlation"
0x005a0950,18,multiplayer_gamespy_server_descriptor_queue_clear_active_and_pending_lists,shell,cdecl,inferred,objdump,3,"Clears both linked lists in one compact server-descriptor queue family by forwarding the active list at `[this+0x08]` and pending list at `[this+0x14]` into the shared list-clear helper `0x5a07b0`. Current grounded caller is `multiplayer_transport_reset_am_rating_route_state`, which uses it to clear the queued-descriptor family at `[transport+0x1e7c]`.","objdump + caller inspection + queue-family correlation"
0x005a0970,48,multiplayer_gamespy_server_descriptor_queue_destroy_and_release_owned_buffer,shell,cdecl,inferred,objdump,2,"Destructor-side helper for one compact server-descriptor queue family. It releases the owned scratch buffer or stream handle at `[this+0x20]` through `0x58bc4e`, resets that slot to `-1`, and then clears the active and pending lists through the same lower list-clear helper used by `0x005a0950`. Current grounded caller is the queued-descriptor family teardown path beneath the multiplayer transport callback-table shutdown.","objdump + caller inspection + queue-family correlation"
0x005a09a0,84,multiplayer_gamespy_server_descriptor_queue_insert_with_pending_state_tag,shell,cdecl,inferred,objdump,3,"Inserts one compact server descriptor into a queue family while stamping a pending state tag into descriptor byte `[entry+0x14]`. The helper first clears transient state bits `0x4/0x8/0x10`; then its second stack argument chooses pending bit `0x4` or `0x8`, which later service code promotes into ready bits `0x1` or `0x2`. The first stack argument chooses whether insertion goes through the pending-list path at `[this+0x14]` or the active-list path at `[this+0x08]`. If the family is full it grows storage through `0x5a07c0`. Current grounded callers use pending tag `0x4` for the local field-cache family at `[transport+0x1724]` and pending tag `0x8` for the `gsi_am_rating` queued-descriptor family at `[transport+0x1e7c]`.","objdump + caller inspection + queue-state correlation"
0x005a0c80,79,multiplayer_gamespy_server_descriptor_queue_service_and_publish_empty_transition,shell,cdecl,inferred,objdump,3,"Recurring service helper for one compact server-descriptor queue family. When the family still owns descriptors it runs the heavier refresh pass at `0x5a0b40`, the age or expiry sweep at `0x5a0c00`, and the compaction pass at `0x5a0c50`; if the family becomes empty afterward it notifies the owner callback at `[this+0x40]` with mode `2` and null entry. Current grounded callers are `multiplayer_transport_service_route_callback_tables`, which services the transport-owned field-cache family at `[transport+0x1724]` and the companion `gsi_am_rating` queued-descriptor family at `[transport+0x1e7c]`.","objdump + caller inspection + queue-family correlation"
0x005a0cd0,35,multiplayer_gamespy_server_descriptor_queue_remove_matching_entry,shell,cdecl,inferred,objdump,3,"Removes one matching compact descriptor from a queue family by probing the active list at `[this+0x08]` first and falling back to the pending list at `[this+0x14]` when no active match is found. Current grounded caller is `multiplayer_transport_dispatch_am_rating_route_event_mode`, which removes descriptors carrying pending state bits `0x4/0x8` from the `gsi_am_rating` queued family at `[transport+0x1e7c]`.","objdump + caller inspection + queue-family correlation"
0x00596fd0,441,multiplayer_transport_dispatch_status_route_event,shell,cdecl,inferred,rizin,3,Main local callback dispatcher for the auxiliary status-route object. It gates on [this+0x398] [this+0xb44] and flag bits in [this+0xb38] then maps route event ids through the local table at 0x005970c4 into selector text publication openstaging publication boolean status publication and callback forwarding paths. The dispatcher publishes through multiplayer_transport_send_selector_text and multiplayer_transport_publish_fixed_token_message and can also invoke the owner callback at [this+0x17dc] with payload [this+0x17f8].,rizin + llvm-objdump + strings
0x005970e0,156,multiplayer_transport_status_route_publish_selector_name_or_probe_average_or_forward_owner,shell,cdecl,inferred,objdump + caller correlation + strings,3,"Status-route callback helper from the six-entry route vector seeded by `multiplayer_transport_try_connect_status_route`. When the transport is active and the status-route gate around `[this+0x398]`, `[this+0xb44]`, and bit `0x4` in `[this+0xb38]` permits it, event id `0x15` resolves the active selector-view entry through `0x594dc0` mode `2` and appends the returned selector text through `0x58bce0`, while event id `0x18` resolves that same entry and publishes the averaged probe sample from `[entry+0x80]` through `0x58cd40`. When no active entry is available it falls back to the fixed text token at `0x005c87a8`. Outside those bounded cases it forwards the same `(event id, payload)` pair into the owner callback at `[this+0x17e0]` with context `[this+0x17f8]`. This is currently the strongest safe role for one status-route callback-vector lane, while the exact user-facing label of the averaged sample remains open.","objdump + caller correlation + strings + selector-view correlation"
0x00597180,40,multiplayer_transport_status_route_forward_owner_event_payload,shell,cdecl,inferred,objdump + caller correlation,3,"Thin owner-forwarding lane in the status-route callback vector. It forwards the caller event id in `ecx` and payload pointer in `edx` into the owner callback at `[this+0x17e4]` with context `[this+0x17f8]` when that callback is present, and otherwise returns immediately. Current grounded caller is the status-route callback table seeded by `multiplayer_transport_try_connect_status_route`.","objdump + caller correlation"
0x005971b0,192,multiplayer_transport_status_route_seed_control_id_list_and_notify_owner,shell,cdecl,inferred,objdump + caller correlation + strings,3,"Status-route callback-vector lane that seeds one control-id list into the caller byte builder through `0x58bcb0`. In its first grounded mode it appends the currently available local status-control ids, including the always-on `8` lane plus conditional ids `1`, `0x0b`, `0x13`, `0x14`, and `0x0a` according to the current status-route state at `[this+0x1ecc]`, `[this+0xb4c]`, `[this+0xb3c]`, and `[this+0xb48]`; in its second grounded mode it emits the smaller pair `0x15` and `0x18`. After seeding that local list it optionally forwards the same mode plus builder into the owner callback at `[this+0x17e8]` with context `[this+0x17f8]`. Current grounded caller is the status-route callback table seeded by `multiplayer_transport_try_connect_status_route`.","objdump + caller correlation + control-id-list correlation"
0x00597270,80,multiplayer_transport_status_route_query_third_selector_generation_or_forward_owner_scalar,shell,cdecl,inferred,objdump + caller correlation,2,"Small scalar-query lane in the status-route callback vector. When the caller event id is `1` and the transport-side status gate around `[this+0x398]`, `[this+0xb44]`, and bit `0x4` in `[this+0xb38]` permits it, the helper returns the third selector-slot generation counter at `[this+0xac0]`. Otherwise it forwards the same selector or scalar query into the owner callback at `[this+0x17ec]` with context `[this+0x17f8]`, returning zero when that callback is absent. Current grounded caller is the status-route callback table seeded by `multiplayer_transport_try_connect_status_route`.","objdump + caller correlation + selector-generation correlation"
0x005972c0,97,multiplayer_transport_handle_validated_route_cookie_event,shell,cdecl,inferred,objdump,3,"Validated subtype-`4` callback for the transport-owned GameSpy route family. The route constructor seeds this helper into `[route+0x9c]`; after multiplayer_gamespy_route_dispatch_inbound_packet validates the current route cookie it forwards the event id in `ecx`, the remaining payload pointer in `edx`, and the owner transport context from `[route+0x104]`. When multiplayer_transport_is_route_mode_active_nonterminal succeeds it marks `[this+0x1ed8]` and re-enters multiplayer_transport_set_route_mode with a mode-selection bit derived from `[this+0x1ed4]` and `[this+0x18b8]`; otherwise it falls back to the owner callback at `[this+0x17f0]` using context `[this+0x17f8]`.","objdump"
0x00597330,28,multiplayer_transport_forward_validated_extended_route_payload,shell,cdecl,inferred,objdump,3,"Small forwarding callback used for the transport-owned status route's validated extended-payload slot. It treats `edx` as the owner transport object, checks the owner callback pointer at `[this+0x17f4]`, and when present forwards the validated payload wrapper in `ecx` together with owner context `[this+0x17f8]`. Current grounded caller is the status-route connect helper through multiplayer_gamespy_route_set_extended_payload_callback.","objdump"
0x00597350,30,multiplayer_transport_release_status_route,shell,cdecl,inferred,ghidra-headless,3,Releases the auxiliary status-route object stored at [this+0xaf0] through 0x58cfd0 and clears the owner slot afterward. Status-pump cleanup fixed-token publishing and the auxiliary route connect helper use this before rebuilding status-route state.,ghidra + rizin + llvm-objdump
0x00597380,34,multiplayer_transport_service_status_and_live_routes,shell,cdecl,inferred,objdump,3,"Recurring route-object sweep for the session-event transport. It services the auxiliary status-route object at `[this+0xaf0]` through the shared low-level route tick helper `0x58d040` when present and then services the current live route at `[this+0x1ecc]` through that same helper. The current grounded caller is multiplayer_transport_service_frame, which makes this the route-object side of the recurring multiplayer transport cadence.",objdump
0x005973d0,170,multiplayer_transport_try_connect_status_route,shell,cdecl,inferred,ghidra-headless,3,"Attempts to connect or rebuild the auxiliary status-route object at [this+0xaf0]. It first tears any existing status route down through multiplayer_transport_release_status_route then builds a callback table from the local handler set rooted at multiplayer_transport_dispatch_status_route_event through multiplayer_transport_handle_validated_route_cookie_event chooses either the default route id `0x1964` or the caller route id and connects through `0x58cc40` or multiplayer_gamespy_route_construct_and_seed_callback_vector. On success it copies [this+0x9a8] into [this+0xb3c] patches the created route object's extended-payload callback slot through multiplayer_gamespy_route_set_extended_payload_callback using callback `0x597330` and clears [this+0xb38].","ghidra + rizin + llvm-objdump + strings"
0x005973b0,30,multiplayer_transport_release_live_route,shell,cdecl,inferred,ghidra-headless,4,Releases the current live route object stored at [this+0x1ecc] through 0x58cfd0 and clears the owner slot afterward. The route-mode setter and connect helper use it before rebuilding or switching live route state.,ghidra + rizin + llvm-objdump
0x00597480,261,multiplayer_transport_try_connect_live_route,shell,cdecl,inferred,ghidra-headless,3,"Attempts to connect or rebuild the current live route object at [this+0x1ecc]. It first clears any existing live route through multiplayer_transport_release_live_route then formats a local identifier from [this+0x60] and 0x005dccfc chooses either the default route id `0x1964` or the binding-specific id and connects through 0x58cc40 or multiplayer_gamespy_route_construct_and_seed_callback_vector. In the currently grounded connect path it does not patch `[route+0xa0]`, `[route+0xa4]`, or `[route+0xd4]` after construction the way the status-route helper patches `[route+0xa0]`; on success it only updates [this+0x1ed8] and preserves the new live route state for the route-mode setter.","ghidra + rizin + llvm-objdump + strings"
0x00598230,67,multiplayer_transport_enqueue_names_query_record,shell,cdecl,inferred,ghidra-headless,3,Allocates one 0x10-byte transient names-query work item zeroes its four dword fields and submits it through 0x5980f0 as request kind `3` using the caller-provided sample or callback context pointer. The helper returns the allocated work item on success and null on allocation or submit failure. Current grounded caller is multiplayer_transport_submit_names_query_with_callback.,ghidra + rizin + llvm-objdump
0x0058f0a0,99,multiplayer_transport_append_user_and_optional_nick_commands,shell,cdecl,inferred,rizin,3,Builds the initial identity command bundle for one multiplayer transport worker. It appends `USER %s %s %s :%s` to the owned text stream using worker text fields at [this+0x3ac] [this+0x42c] and [this+0x4b0] together with the fallback host `127.0.0.1` then checks the current nick through multiplayer_transport_is_valid_nick_string and either falls through multiplayer_transport_dispatch_or_release_callback_binding with mode `1` or appends `NICK %s` directly through the same text-stream path.,rizin + llvm-objdump + strings
0x0058f920,72,hashed_entry_table_upsert,support,cdecl,inferred,rizin,4,Generic hashed-entry-table upsert over a bucket array of contiguous vectors. It computes the bucket index through the table hash callback at [this+0x0c] looks for an existing matching entry through hashed_entry_table_lookup and when found overwrites that slot through generic_vector_overwrite_with_callback; otherwise it appends the caller record into the selected bucket vector through 0x0059e4d0.,rizin + llvm-objdump
0x0058f970,69,hashed_entry_table_remove,support,cdecl,inferred,rizin,4,Generic hashed-entry-table remove over a bucket array of contiguous vectors. It hashes the caller key into one bucket and erases the matching slot through generic_vector_erase_with_callback when present; otherwise it returns false.,rizin + llvm-objdump
0x0058f9c0,63,hashed_entry_table_lookup,support,cdecl,inferred,rizin,4,Generic hashed-entry-table lookup over a bucket array of contiguous vectors. It hashes the caller key into one bucket resolves the matching index through generic_vector_find_index and returns the matched entry pointer or null.,rizin + llvm-objdump
0x0058f110,465,multiplayer_transport_worker_init,shell,cdecl,inferred,rizin,3,"Initializes one heap-backed multiplayer transport worker and its owned text-stream and store state. It zeroes the `0x5e4`-byte worker copies caller identifier strings into the fixed buffers at `[this+0x00]`, `[this+0x36c]`, `[this+0x3ac]`, `[this+0x42c]`, and `[this+0x4b0]`, copies one 5-dword descriptor block into `[this+0x534]`, seeds the state fields at `[this+0x04]` and `[this+0x558]`, initializes the registered-name store at `[this+0x548]`, the pending-template dispatch store at `[this+0x54c]`, and the owned text-stream object at `[this+0x1c]`, and tears partial state back down on failure.","rizin + llvm-objdump"
0x0058f2f0,60,multiplayer_transport_worker_create,shell,cdecl,inferred,rizin,3,"Thin allocation wrapper for multiplayer_transport_worker_init. It allocates one `0x5e4`-byte worker block through tracked_heap_alloc_with_header and then forwards the descriptor pointer already staged in `EDX` plus the caller argument bundle into multiplayer_transport_worker_init.","rizin + llvm-objdump"
0x0059d430,47,string_hash_sum_mod,support,cdecl,inferred,rizin,3,Small string-hash helper that accumulates one normalized integer value per input byte through 0x005a5900 and returns the running sum modulo the caller divisor. Current grounded callers use it as the bucket-selector callback for registered-name entry tables.,rizin + llvm-objdump
0x0059d470,57,multiplayer_transport_lookup_registered_name,shell,cdecl,inferred,ghidra-headless,3,Copies one caller string into a stack-local buffer and looks it up against the registered-name store rooted at [this+0x548] through hashed_entry_table_lookup. It returns the matched entry pointer or null. Current grounded callers are multiplayer_transport_has_registered_name and the deeper names-query payload helper family.,ghidra + rizin + llvm-objdump
0x0059d520,91,multiplayer_transport_init_registered_name_store,shell,thiscall,inferred,rizin,4,Initializes the transport-side registered-name store by allocating the hashed bucket table at [this+0x548] with 7 buckets and a 0x1e0-byte entry shape through 0x0058f840 and then allocating the companion flat entry vector at [this+0x54c] through 0x0059e0b0. On allocation failure it tears any partial state back down.,rizin + llvm-objdump
0x0059d580,35,multiplayer_transport_destroy_registered_name_store,shell,thiscall,inferred,rizin,4,Destroys the transport-side registered-name store by releasing the hashed bucket table at [this+0x548] through 0x0058f8b0 and the companion flat entry vector at [this+0x54c] through generic_vector_destroy when present.,rizin + llvm-objdump
0x0059d610,81,multiplayer_transport_contains_registered_name_entry,shell,cdecl,inferred,rizin,3,Linear membership check over the flat registered-name entry vector at [this+0x54c]. It compares each live entry against the caller key through 0x005a57cf and returns true on the first exact match.,rizin + llvm-objdump
0x0059d670,240,multiplayer_transport_upsert_registered_name_entry,shell,cdecl,inferred,rizin,3,Builds one temporary 0x1e0-byte registered-name entry on the stack from the caller descriptor and name string; allocates the entry-owned callback table through 0x0058f840; removes any older flat-vector entry with the same key from [this+0x54c]; and then inserts or replaces the canonical entry in the hashed registered-name store at [this+0x548] through hashed_entry_table_upsert.,rizin + llvm-objdump
0x0059d760,103,multiplayer_transport_remove_registered_name_entry,shell,cdecl,inferred,rizin,4,Copies the caller name into a stack-local temporary key; removes any matching entry from the flat registered-name vector at [this+0x54c]; and then removes the canonical hashed-store entry from [this+0x548] through hashed_entry_table_remove.,rizin + llvm-objdump
0x0058fa00,49,generic_callback_list_for_each,support,cdecl,inferred,ghidra-headless,4,Generic callback-list walker over one `[items count]` style callback collection. It uses generic_vector_for_each to visit every entry pointer and forwards the caller context through the supplied callback shim unchanged. Transport registration and the registered-name fast path reuse it to fan out one callback over all registered entries.,rizin + llvm-objdump
0x0059e110,3,generic_vector_count,support,cdecl,inferred,rizin,4,Returns the current element count from dword [this+0x00] for one contiguous vector-style container.,rizin + llvm-objdump
0x0059e120,10,generic_vector_index_ptr,support,cdecl,inferred,rizin,4,Computes one element pointer as base [this+0x14] plus index times stride [this+0x08]. Most higher-level vector helpers funnel slot access through this helper.,rizin + llvm-objdump
0x0059e130,58,generic_vector_erase,support,cdecl,inferred,rizin,4,Removes one indexed element from a contiguous vector. When the erased slot is not already the tail it memmoves the trailing span down and then decrements the element count at [this+0x00].,rizin + llvm-objdump
0x0059e170,21,generic_vector_sort,support,cdecl,inferred,rizin,4,Sorts the backing element range at [this+0x14] through the shared qsort-style helper using the current count and stride from the vector header.,rizin + llvm-objdump
0x0059e190,49,generic_vector_for_each,support,cdecl,inferred,rizin,4,Forward iterator for one contiguous vector. It walks indices `0..count-1` resolves each slot through generic_vector_index_ptr and invokes the caller callback with the shared context argument.,rizin + llvm-objdump
0x0059e1d0,42,generic_vector_for_each_reverse,support,cdecl,inferred,rizin,4,Reverse iterator for one contiguous vector. It walks indices `count-1..0` and invokes the caller callback on each resolved slot pointer.,rizin + llvm-objdump
0x0059e200,61,generic_vector_find_first,support,cdecl,inferred,rizin,4,Scans the vector from the front and returns the first element pointer whose caller predicate returns zero. When no match is found it returns null.,rizin + llvm-objdump
0x0059e2f0,19,generic_vector_invoke_element_callback,support,cdecl,inferred,rizin,4,Invokes the optional per-element callback stored at [this+0x10] for one indexed slot when that callback pointer is nonnull. Erase overwrite and destroy helpers reuse it before mutating storage.,rizin + llvm-objdump
0x0059e310,31,generic_vector_store_at,support,cdecl,inferred,rizin,4,Copies one caller-supplied element record into the indexed slot resolved through generic_vector_index_ptr using the current element stride from the vector header.,rizin + llvm-objdump
0x0059e330,49,generic_vector_destroy,support,cdecl,inferred,rizin,4,Walks all live elements through generic_vector_invoke_element_callback then frees the backing storage at [this+0x14] and finally releases the vector object itself through tracked_heap_free_with_header.,rizin + llvm-objdump
0x0059e370,87,generic_vector_insert_copy_at,support,cdecl,inferred,rizin,4,Ensures capacity grows through 0x0059e090 when full increments the count shifts the tail upward when inserting before the end and copies the caller element record into the requested slot through generic_vector_store_at.,rizin + llvm-objdump
0x0059e3d0,22,generic_vector_erase_with_callback,support,cdecl,inferred,rizin,4,Calls generic_vector_invoke_element_callback for the indexed slot and then removes that slot through generic_vector_erase. Current grounded callers use it for registered-name and callback-entry teardown paths.,rizin + llvm-objdump
0x0059e3f0,33,generic_vector_overwrite_with_callback,support,cdecl,inferred,rizin,4,Invokes generic_vector_invoke_element_callback for one indexed slot and then copies the caller replacement record back into that same slot through generic_vector_store_at. Hashed entry-table upsert uses it when replacing an existing matching record.,rizin + llvm-objdump
0x0059e420,137,generic_vector_find_index,support,cdecl,inferred,rizin,4,Returns the index of one matching element within the contiguous vector or `-1` when none is found. Depending on the caller flag it uses either the linear comparator scan at 0x0059e240 or the ordered search helper at 0x0059e290 and derives the final index from the matched element pointer and stride.,rizin + llvm-objdump
0x0059d7f0,86,multiplayer_transport_collect_registered_name_callback_entries,shell,cdecl,inferred,ghidra-headless,3,Callback collector used by the registered-name fast path. For each callback entry in the name entry's callback list it grows two parallel pointer arrays in the caller scratch frame through tracked_heap_resize_with_header and appends the callback entry pointer plus its `[entry+0xdc]` payload pointer. Current grounded caller is multiplayer_transport_dispatch_registered_name_query_fastpath through generic_callback_list_for_each.,ghidra + rizin + llvm-objdump
0x0059d850,114,multiplayer_transport_dispatch_registered_name_query_fastpath,shell,cdecl,inferred,ghidra-headless,3,Fast path for multiplayer_transport_submit_names_query_with_callback when the queried sample already exists in the registered-name table. It resolves the name entry through multiplayer_transport_lookup_registered_name collects entry-owned callback state through multiplayer_transport_collect_registered_name_callback_entries and invokes the caller callback through multiplayer_transport_invoke_registered_name_query_callback without enqueueing a transport names-query record. Temporary callback arrays are released through tracked_heap_free_with_header on exit.,ghidra + rizin + llvm-objdump
0x0059d8d0,15,multiplayer_transport_has_registered_name,shell,cdecl,inferred,ghidra-headless,3,Boolean wrapper over multiplayer_transport_lookup_registered_name. It returns true when the caller string resolves to one registered-name entry in the transport-side table and false otherwise. Current grounded caller is multiplayer_transport_submit_names_query_with_callback.,ghidra + rizin + llvm-objdump
0x0059d8e0,64,multiplayer_transport_try_read_registered_name_header_block,shell,cdecl,inferred,rizin,4,Looks up one registered-name entry and when the header-valid flag at `[entry+0x154]` is set copies the 7-dword header block at `[entry+0x138]` into the caller buffer and returns true. Otherwise it returns false without mutating the destination.,rizin + llvm-objdump
0x0059d920,48,multiplayer_transport_set_registered_name_header_block,shell,cdecl,inferred,rizin,4,Looks up one registered-name entry copies 7 caller-supplied dwords into the header block at `[entry+0x138]` and sets the paired valid flag at `[entry+0x154]` to one.,rizin + llvm-objdump
0x0059d950,112,multiplayer_transport_set_registered_name_status_text,shell,cdecl,inferred,rizin,3,Looks up one registered-name entry frees the prior heap string at `[entry+0x158]` and replaces it with a heap copy of the caller text or the shared empty string when the caller passes null. The helper currently looks like the main per-name status or topic text setter for the registered-name store.,rizin + llvm-objdump
0x0059d9c0,32,multiplayer_transport_mark_registered_name_dirty,shell,cdecl,inferred,rizin,3,Looks up one registered-name entry and sets the dword dirty or active flag at `[entry+0x15c]` to one.,rizin + llvm-objdump
0x0059d9e0,32,multiplayer_transport_get_registered_name_dirty,shell,cdecl,inferred,rizin,3,Looks up one registered-name entry and returns the current dword dirty or active flag stored at `[entry+0x15c]` or zero when the entry is absent.,rizin + llvm-objdump
0x0059da00,64,multiplayer_transport_set_registered_name_display_text,shell,cdecl,inferred,rizin,3,Looks up one registered-name entry copies up to 0x80 bytes of caller text into the embedded buffer at `[entry+0x160]` through string_copy_bounded_zerofill and clears the trailing byte flag at `[entry+0x1df]`. This is a second inline text field distinct from the heap string at `[entry+0x158]`.,rizin + llvm-objdump
0x0059da40,208,multiplayer_transport_upsert_registered_name_callback_entry,shell,cdecl,inferred,rizin,4,Looks up one registered-name entry zeroes a temporary 0xe0-byte nested callback-entry record copies the secondary key string into the local record and when both payload blocks are provided copies 0x18 bytes into `[record+0x80]` and 0x40 bytes into `[record+0x98]` sets the local active flag at `[record+0xd8]` and stores one caller dword at `[record+0xdc]` before upserting the record into the entry-owned callback table at `[entry+0x134]` through hashed_entry_table_upsert.,rizin + llvm-objdump
0x0059db10,80,multiplayer_transport_remove_registered_name_callback_entry,shell,cdecl,inferred,rizin,4,Looks up one registered-name entry copies the caller secondary key into a stack-local temporary and removes the matching nested callback-entry record from the entry-owned callback table at `[entry+0x134]` through hashed_entry_table_remove.,rizin + llvm-objdump
0x0059db90,96,multiplayer_transport_dispatch_registered_name_callback_entry,shell,cdecl,inferred,rizin,3,Fans one callback descriptor over the transport-side registered-name store. It copies the primary name into a stack-local key builds a small dispatch frame and visits all registered-name entries through generic_callback_list_for_each where helper 0x0059db60 resolves the matching nested callback-entry record and invokes the descriptor function pointer at `[desc+0x08]` with the descriptor owner context plus the secondary key plus the payload cookie plus the owning registered-name entry.,rizin + llvm-objdump
0x0059dcb0,48,multiplayer_transport_update_registered_name_callback_key,shell,cdecl,inferred,rizin,3,Visits every registered-name entry through generic_callback_list_for_each and runs helper 0x0059dbf0 to rewrite one nested callback-entry key. The helper removes the existing nested record from `[entry+0x134]` copies the replacement key into the local record reinserts it through hashed_entry_table_upsert and conditionally emits transport opcode 8 through 0x0059b790 when the name entry is marked dirty and has owner callbacks installed.,rizin + llvm-objdump
0x0059dce0,256,multiplayer_transport_update_registered_name_callback_flags,shell,cdecl,inferred,rizin,4,Looks up one registered-name entry then resolves one nested callback-entry record by secondary key from the entry-owned callback table at `[entry+0x134]`. Depending on the caller mode flag it ORs or clears the caller bitmask against `[subentry+0xdc]` and when the parent entry has transport callbacks installed publishes an opcode-11 update through 0x0059b790 carrying the primary name plus the secondary key plus the new flag mask.,rizin + llvm-objdump
0x0059de00,64,multiplayer_transport_dispatch_registered_name_callbacks,shell,cdecl,inferred,rizin,3,If the owning transport is active at `[*this]` it walks the full registered-name store through generic_callback_list_for_each and helper 0x0059dde0 increments a dispatch count and invokes the caller-provided callback function for each live registered-name entry.,rizin + llvm-objdump
0x0059de40,96,multiplayer_transport_stage_registered_name_callback_payload,shell,cdecl,inferred,rizin,3,Resolves one nested callback-entry record by secondary key from the caller registered-name entry then copies a 0x18-byte payload block into `[subentry+0x80]` and a 0x40-byte payload block into `[subentry+0x98]` null-terminates both copied regions and sets the active flag at `[subentry+0xd8]` to one.,rizin + llvm-objdump
0x0059dea0,96,multiplayer_transport_stage_registered_name_callback_payload_for_name,shell,cdecl,inferred,rizin,3,Looks up one primary registered-name entry then fans helper multiplayer_transport_stage_registered_name_callback_payload across the registered-name store through generic_callback_list_for_each using the caller secondary key plus the two payload buffers. Current grounded role is a primary-name keyed payload staging wrapper for nested callback-entry records.,rizin + llvm-objdump
0x0059df00,96,multiplayer_transport_try_resolve_registered_name_callback_payload,shell,cdecl,inferred,rizin,4,Fast resolver for one nested callback-entry payload. When the descriptor either has no selector string or matches the shared two-byte default token at 0x005e1e1c it looks up the nested callback-entry record by key from `[entry+0x134]` and if the entry is active at `[subentry+0xd8]` marks the descriptor successful and returns pointers to the staged payload blocks at `[subentry+0x80]` and `[subentry+0x98]`.,rizin + llvm-objdump
0x005934c0,30,multiplayer_transport_next_work_sequence,shell,thiscall,inferred,ghidra-headless,3,"Returns the next monotonically increasing transport work-sequence value by incrementing dword `[this+0x177c]` and clamping negative wraparound back to zero. Current grounded callers now bound this more tightly than a generic work-sequence source: the returned dword is also the shared immediate-drain context id later copied into queued work field `+0x0c`, mirrored into active opcode-record field `+0x14`, and waited on through `0x58d720` by the text-submission and callback-table registration roots.","ghidra + rizin + llvm-objdump"
0x00593650,229,multiplayer_transport_attach_callback_table_descriptor,shell,cdecl,inferred,ghidra-headless,3,"Builds one transport-side callback-table descriptor from the caller table pointers and metadata. The helper first allocates one transient work record through `multiplayer_transport_allocate_and_enqueue_work_record` `0x5934e0`, and this lane now constrains that staged metadata more tightly: it uses work-record type `0`, leaves field `+0x08` zero, duplicates one caller metadata dword into both fields `+0x0c` and `+0x18`, and carries the remaining caller callback function pointer in field `+0x10` for later replay through `multiplayer_transport_publish_callback_table_binding_result_and_release_work_record` `0x593570 -> 0x592a40`. It then installs callback vectors from `0x59f5c0` and `0x59f650`, copies the caller transport pointer into the local descriptor frame, and finishes by linking the result through `multiplayer_transport_worker_create` `0x58f2f0`. Failure unlinks the staged work record through `multiplayer_transport_remove_queued_work_record_by_pointer` `0x5933a0`. The current grounded caller is `multiplayer_transport_register_callback_table`.","ghidra + rizin + llvm-objdump + local disassembly + work-queue correlation + callback-binding-triplet correlation"
0x00593d60,66,multiplayer_transport_try_submit_text_record_fastpath,shell,cdecl,inferred,ghidra-headless,3,"Attempts the fast submission path for one prepared transport text record. It allocates a type-`9` transient record through `0x005934e0`, again staging the shared transport wrapper triplet as `(drain context id +0x0c, callback fn +0x10, callback companion +0x18)`, and when that succeeds forwards the caller callback and payload through `0x0058e510` with callback shim `0x00593d00`. That shim copies the returned text into `[transport+0x04]` and, when work field `+0x10` is nonnull, re-emits one follow-on callback record through `0x00593170` using the staged callback pointer and companion plus the same drain context id. The current grounded caller is `multiplayer_transport_submit_text_record`.","ghidra + rizin + llvm-objdump + work-record-triplet correlation + local disassembly"
0x00598d50,496,multiplayer_transport_handle_registered_name_callback_bind_record_mode1,shell,cdecl,inferred,rizin,3,Owner-side wrapper for record mode 1 in the registered-name branch. It parses the mode prefix from the secondary key string at record field `+0x08` checks whether the primary name matches the local transport name at `[this+0x36c]` and either seeds one local registered-name entry through multiplayer_transport_upsert_registered_name_entry plus multiplayer_transport_set_registered_name_status_text or upserts one nested callback-entry record through multiplayer_transport_upsert_registered_name_callback_entry and emits follow-up opcode 6 or opcode 12 notifications when the target name entry is already marked dirty.,rizin + llvm-objdump
0x00598f40,255,multiplayer_transport_handle_registered_name_callback_remove_record_mode1,shell,cdecl,inferred,rizin,3,Owner-side removal wrapper for registered-name record mode 1. It resolves the primary and secondary key strings from the caller record removes the matching nested callback-entry through multiplayer_transport_remove_registered_name_callback_entry and then emits opcode 7 or opcode 12 notifications from the current registered-name owner callbacks when the target entry is dirty.,rizin + llvm-objdump
0x00599040,308,multiplayer_transport_handle_registered_name_callback_remove_record_mode23,shell,cdecl,inferred,rizin,3,Owner-side removal wrapper for registered-name record modes 2 and 3. It removes one nested callback-entry record by secondary key and then branches on whether the primary name matches the local transport name. The local-owner branch can emit opcode 5 and remove the whole registered-name entry through multiplayer_transport_remove_registered_name_entry while the remote branch emits opcode 7 subtype notifications through the installed owner callbacks.,rizin + llvm-objdump
0x00599180,160,multiplayer_transport_publish_registered_name_callback_remove_mode1,shell,cdecl,inferred,rizin,3,Small publish helper for registered-name callback-removal mode 1. It removes the named nested callback-entry and then emits the same owner callback notifications as the wider mode-1 removal path through opcode 7 and opcode 12 when the target entry is dirty and callback-enabled.,rizin + llvm-objdump
0x00599230,25,multiplayer_transport_dispatch_registered_name_callback_remove_mode1,shell,cdecl,inferred,rizin,3,Dispatch shim for registered-name callback-removal mode 1. When the input record kind equals 1 it forwards the primary name and one mode-1 removal helper descriptor into multiplayer_transport_dispatch_registered_name_callback_entry so the removal helper runs against each matching registered-name entry.,rizin + llvm-objdump
0x00599250,160,multiplayer_transport_publish_registered_name_callback_remove_mode3,shell,cdecl,inferred,rizin,3,Small publish helper for registered-name callback-removal mode 3. It removes the named nested callback-entry and emits the mode-3 owner callback notifications through opcode 7 and opcode 12 when the target registered-name entry is dirty and callback-enabled.,rizin + llvm-objdump
0x00599300,25,multiplayer_transport_dispatch_registered_name_callback_remove_mode3,shell,cdecl,inferred,rizin,3,Dispatch shim for registered-name callback-removal mode 3. When the input record kind equals 2 it forwards the primary name and one mode-3 removal helper descriptor into multiplayer_transport_dispatch_registered_name_callback_entry.,rizin + llvm-objdump
0x00599320,93,multiplayer_transport_handle_registered_name_display_text_record_mode2,shell,cdecl,inferred,rizin,4,Owner-side wrapper for registered-name display-text record mode 2. It copies the record string into the inline display buffer through multiplayer_transport_set_registered_name_display_text and when the target registered-name entry has an installed owner callback emits opcode 9 carrying the primary name and copied display text.,rizin + llvm-objdump
0x00599380,253,multiplayer_transport_apply_registered_name_update_bundle,shell,cdecl,inferred,rizin,4,Applies one parsed update bundle to an existing registered-name entry. It walks the decoded element list from 0x00598630 and uses the element tags to route updates into multiplayer_transport_update_registered_name_callback_flags multiplayer_transport_set_registered_name_status_text and the header read or write pair multiplayer_transport_try_read_registered_name_header_block plus multiplayer_transport_set_registered_name_header_block before releasing the decoded bundle object.,rizin + llvm-objdump
0x005997f0,177,multiplayer_transport_handle_registered_name_display_text_record_mode3,shell,cdecl,inferred,rizin,3,Owner-side wrapper for registered-name display-text record mode 3. It stores the supplied display text into the inline registered-name buffer and either resolves one pending template node through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node or falls back to emitting opcode 9 through the installed owner callback for the target registered-name entry.,rizin + llvm-objdump
0x005998b0,171,multiplayer_transport_handle_registered_name_display_text_clear_record,shell,cdecl,inferred,rizin,3,Owner-side wrapper for clearing registered-name display text. It builds a small mode-2 template with the shared empty string and either satisfies that request through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node or emits opcode 9 with the empty display text through the installed owner callback for the target registered-name entry.,rizin + llvm-objdump
0x00599960,144,multiplayer_transport_handle_pending_template_pair_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Structural mode-3 wrapper over the pending-template path. It builds one single-entry pending-template query from the pair of caller strings then resolves a matching node through multiplayer_transport_find_pending_template_node and dispatches it through multiplayer_transport_dispatch_pending_template_node. When no pending node exists it falls back to the transport-side callback at `[this+0x04]` through multiplayer_transport_dispatch_or_release_callback_binding.,llvm-objdump
0x005999f0,412,multiplayer_transport_handle_registered_name_callback_payload_record_mode8,shell,cdecl,inferred,rizin,3,Owner-side wrapper for registered-name record mode 8. It stages the supplied nested callback-entry payload blocks through multiplayer_transport_stage_registered_name_callback_payload_for_name and then walks the returned template nodes to emit higher-level follow-up notifications including opcode 0x16 and opcode 0x17 based on the decoded template kinds and the marker characters found in the staged payload text through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node.,rizin + llvm-objdump
0x00599c40,96,multiplayer_transport_copy_backslash_segment,shell,cdecl,inferred,llvm-objdump,4,Copies one backslash-delimited segment from the caller text into a freshly allocated heap string and writes the consumed byte count back through the out-parameter. Higher-level pending-template handlers reuse it to split multi-segment payloads before dispatch or callback fallback.,llvm-objdump
0x00599ca0,320,multiplayer_transport_handle_segment_list_template_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Mode-4 pending-template wrapper for template kind 0x0c. It resolves one pending node through multiplayer_transport_find_pending_template_node splits the caller payload into a temporary heap string list with multiplayer_transport_copy_backslash_segment and then either dispatches that list through multiplayer_transport_dispatch_pending_template_node or falls back to emitting opcode 0x1e through the node-owned callback path before freeing the temporary segments.,llvm-objdump
0x00599de0,128,multiplayer_transport_handle_pair_template_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Compact mode-4 pending-template wrapper for template kind 0x0c. After multiplayer_transport_find_pending_template_node succeeds it forwards two dword values from the matched node-owned payload block into one simple dispatch descriptor and completes the request through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x00599e60,768,multiplayer_transport_handle_segment_broadcast_template_record_mode5,shell,cdecl,inferred,llvm-objdump,3,Structural mode-5 pending-template wrapper over split payload broadcasting. One branch matches a fixed token and walks the registered-name owner callback list to emit opcode 0x1d once per backslash-delimited segment. The other branch resolves one template-kind 0x0d pending node builds a temporary split-string array with multiplayer_transport_copy_backslash_segment optionally appends node-owned paired strings and then either dispatches the finished descriptor through multiplayer_transport_dispatch_pending_template_node or falls back to opcode 0x1f through the node callback path.,llvm-objdump
0x0059a160,128,multiplayer_transport_handle_triplet_template_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Compact mode-4 pending-template wrapper for template kind 0x0d. After multiplayer_transport_find_pending_template_node succeeds it forwards the caller primary string plus two dword fields from the matched node payload block through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059a1e0,1024,multiplayer_transport_handle_segment_pair_template_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Structural mode-4 sibling of the split-payload template path for template kind 0x0e. One branch matches the fixed auxiliary token and emits opcode 0x1d once per backslash-delimited segment through the installed registered-name owner callbacks. The other branch resolves one pending node builds a temporary split-string array with multiplayer_transport_copy_backslash_segment appends paired node-owned strings and completes the request through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059a650,64,multiplayer_transport_mark_pending_template_kind1_ready,shell,cdecl,inferred,llvm-objdump,3,Small pending-template helper that looks up one kind-1 node through multiplayer_transport_find_pending_template_node and sets the first dword in its payload block to one when present.,llvm-objdump
0x0059a690,448,multiplayer_transport_stage_pending_template_triplet_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Mode-4 helper for pending-template kind 1. It resolves one kind-1 node through multiplayer_transport_find_pending_template_node duplicates the caller strings plus one normalized helper string into heap storage emits opcode 0x0e through 0x0059b790 using the node-owned callback metadata and appends the three staged values into the node payload's parallel pointer arrays for later dispatch.,llvm-objdump
0x0059a850,112,multiplayer_transport_dispatch_pending_template_quintuple_helper,shell,cdecl,inferred,llvm-objdump,3,Small helper that resolves one kind-5 pending-template node through multiplayer_transport_find_pending_template_node and forwards the four dword payload fields stored at `[node+0x1c+0x04..0x10]` through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059a8c0,272,multiplayer_transport_handle_registered_name_update_bundle_record_mode3plus,shell,cdecl,inferred,llvm-objdump,3,Owner-side registered-name update handler for record kinds 3 and above. It decodes one update bundle through 0x00598630 and 0x00598860 tries the registered-name header read or write path through multiplayer_transport_try_read_registered_name_header_block plus multiplayer_transport_set_registered_name_header_block publishes opcode 0x0a when the target entry already has owner callbacks and then completes any waiting kind-5 pending-template node through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059a9d0,320,multiplayer_transport_handle_pending_template_triplet_record_mode6,shell,cdecl,inferred,llvm-objdump,3,Mode-6 pending-template wrapper that looks up either a kind-4 or kind-7 node through multiplayer_transport_find_pending_template_node. The kind-4 branch copies three caller strings into the node-owned payload slots while the kind-7 branch formats a derived string through 0x0059cbd0 and completes the request through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059ab10,256,multiplayer_transport_handle_token_list_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Mode-3 pending-template helper for kind 4. It parses the caller text into a token list with 0x005a3db9 trims leading `-` `@` and `+` markers duplicates each token into heap storage and appends the cleaned strings into the node-owned dynamic vector after multiplayer_transport_find_pending_template_node succeeds.,llvm-objdump
0x0059ac10,144,multiplayer_transport_dispatch_extended_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Mode-3 helper for kind-4 pending-template nodes. After multiplayer_transport_find_pending_template_node succeeds it builds one extended dispatch descriptor from the caller string a boolean derived from the first payload dword and the remaining four dwords stored in the node payload block then completes the request through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059aca0,176,multiplayer_transport_append_string_template_record_mode8,shell,cdecl,inferred,llvm-objdump,3,Helper for pending-template kind 8. It resolves one node through multiplayer_transport_find_pending_template_node grows the node-owned pointer vector through tracked_heap_resize_with_header duplicates the caller string and appends that heap string to the vector.,llvm-objdump
0x0059ad50,112,multiplayer_transport_dispatch_string_vector_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Mode-3 dispatch helper for pending-template kind 8. It resolves one node through multiplayer_transport_find_pending_template_node then forwards the caller key together with the node-owned string-count and string-vector pointers through multiplayer_transport_dispatch_pending_template_node.,llvm-objdump
0x0059adc0,96,multiplayer_transport_handle_local_name_record_mode2,shell,cdecl,inferred,llvm-objdump,4,Mode-2 transport-state setter for the local name buffer at `[this+0x36c]`. It copies the caller string into that fixed buffer clears state dword `[this+0x04]` sets active flag `[this+0x00]` and when the transport owner callback at `[this+0x14]` is installed invokes it with mode `1` and the owner cookie at `[this+0x18]`.,llvm-objdump
0x0059ae20,176,multiplayer_transport_handle_transport_text_pair_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Mode-3 transport-state setter for a pair of fixed text buffers. It copies the caller strings into the fixed buffers at `[this+0x564]` and `[this+0x140]` updates the associated length or dirty fields through helpers 0x005a1050 and 0x005a0d00 marks `[this+0x13c]` active and refreshes the transport-side status line rooted at `[this+0x1c]` through 0x0059caf0.,llvm-objdump
0x0059aed0,112,multiplayer_transport_handle_normalized_pair_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Mode-3 wrapper that normalizes the secondary caller string through 0x005a1ea5 then resolves one kind-0x10 pending-template node through multiplayer_transport_find_pending_template_node and completes it through multiplayer_transport_dispatch_pending_template_node with the normalized value plus the original secondary string.,llvm-objdump
0x00597920,56,multiplayer_transport_find_pending_template_kind0c_by_key,shell,cdecl,inferred,llvm-objdump,4,Searches the linked pending-template list rooted at `[this+0x550]` for the first kind-0x0c node whose payload string at `[node+0x1c+0x08]` exactly matches the caller key. It returns the matched node or null.,llvm-objdump
0x0059af40,186,multiplayer_transport_dispatch_fallback_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Mode-3 fallback wrapper over the pending-template path. It first queries for either a kind-1 or kind-5 node keyed by the caller string through multiplayer_transport_find_pending_template_node and dispatches the matching node through multiplayer_transport_dispatch_pending_template_node with a minimal descriptor. When neither node exists it falls back to multiplayer_transport_find_pending_template_kind0c_by_key and completes that node with an empty descriptor instead.,llvm-objdump
0x0059b000,103,multiplayer_transport_dispatch_kind1_string_template_record_mode6,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `6` and the original string payload.,llvm-objdump
0x0059b070,103,multiplayer_transport_dispatch_kind1_string_template_record_mode2,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `2` and the original string payload.,llvm-objdump
0x0059b0e0,103,multiplayer_transport_dispatch_kind1_string_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `3` and the original string payload.,llvm-objdump
0x0059b150,103,multiplayer_transport_dispatch_kind1_string_template_record_mode4,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `4` and the original string payload.,llvm-objdump
0x0059b1c0,103,multiplayer_transport_dispatch_kind1_string_template_record_mode5,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `5` and the original string payload.,llvm-objdump
0x0059b230,103,multiplayer_transport_dispatch_kind1_string_template_record_mode8,shell,cdecl,inferred,llvm-objdump,3,Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `8` and the original string payload.,llvm-objdump
0x0059b2a0,1,multiplayer_transport_noop_cleanup_callback,shell,cdecl,inferred,llvm-objdump,2,Trivial no-op cleanup callback that returns immediately. Current grounded role is as a placeholder callback target in the transport cleanup layer.,llvm-objdump
0x0059b2b0,17,multiplayer_transport_release_optional_callback_binding,shell,cdecl,inferred,llvm-objdump,2,Small cleanup helper that checks the optional callback binding stored at `[this+0x04]` and when present forwards it into multiplayer_transport_dispatch_or_release_callback_binding with mode `1`.,llvm-objdump
0x0059b2d0,8,multiplayer_transport_free_template_entry_owner_string,shell,cdecl,inferred,llvm-objdump,3,Small element cleanup helper that releases the owner string pointer stored at `[entry+0x14]` through tracked_heap_free_with_header. The companion pending-template container uses it as the per-element cleanup callback when destroying its flat vector.,llvm-objdump
0x0059b2e0,1239,multiplayer_transport_destroy_pending_template_dispatch_record,shell,cdecl,inferred,llvm-objdump,3,Type-switched destructor for one pending-template dispatch record. It reads the record kind at `[record+0x00]` and frees the owned payload graph under `[record+0x08]` through tracked_heap_free_with_header including nested string arrays and paired pointer vectors for the more complex template kinds before finally releasing the top-level payload block itself.,llvm-objdump
0x0059b710,40,multiplayer_transport_init_pending_template_dispatch_store,shell,thiscall,inferred,llvm-objdump,3,Initializes the companion flat pending-template dispatch store at `[this+0x55c]` by allocating a stride-0x18 contiguous vector through 0x0059e0b0 and installing multiplayer_transport_free_template_entry_owner_string as the per-element cleanup callback. Returns true on success.,llvm-objdump
0x0059b740,74,multiplayer_transport_destroy_pending_template_dispatch_store,shell,thiscall,inferred,llvm-objdump,3,Destroys the companion flat pending-template dispatch store at `[this+0x55c]`. It walks every live element through multiplayer_transport_destroy_pending_template_dispatch_record and then releases the backing vector through generic_vector_destroy.,llvm-objdump
0x0059c220,458,multiplayer_transport_dispatch_pending_template_dispatch_record,shell,unknown,inferred,rizin,3,Switch-driven dispatcher for one flat pending-template dispatch-store record after the store manager has removed it from the vector. It reads the record kind at `[record+0x00]` invokes the record-owned callback at `[record+0x04]` with a payload tuple rooted at `[record+0x08]` and the owner string or selector at `[record+0x0c]` and then destroys the record through multiplayer_transport_destroy_pending_template_dispatch_record. Case `16` also resolves the registered-name dirty flag through 0x0059d9c0 before invoking the callback.,rizin + llvm-objdump
0x0059c470,203,multiplayer_transport_service_pending_template_dispatch_store,shell,unknown,inferred,rizin,3,"Services the flat pending-template dispatch store at `[this+0x55c]`. It walks every live 0x18-byte entry; entries whose owner string at `[entry+0x14]` no longer resolves through multiplayer_transport_has_registered_name are destroyed and erased immediately, while surviving entries are dispatched only when their registered-name dirty flag is nonzero and the optional filter value in EDX is zero or matches `[entry+0x10]`. Dispatching copies the 0x18-byte record to stack storage, erases the vector slot, and forwards the copied record into multiplayer_transport_dispatch_pending_template_dispatch_record.",rizin + llvm-objdump
0x0059c540,70,multiplayer_transport_find_pending_template_dispatch_record_index,shell,unknown,inferred,rizin,4,Searches the flat pending-template dispatch store at `[this+0x55c]` for the first record whose selector or request field at `[entry+0x10]` matches the caller key. It returns the zero-based vector index on success or `-1` when no record matches.,rizin + llvm-objdump
0x0059c590,21,multiplayer_transport_has_pending_template_dispatch_record,shell,unknown,inferred,rizin,4,Boolean wrapper over multiplayer_transport_find_pending_template_dispatch_record_index. It returns true when the flat pending-template dispatch store currently contains one record for the caller key and false otherwise.,rizin + llvm-objdump
0x0059c5b0,40,growable_text_buffer_init,support,unknown,inferred,rizin,3,"Initializes one heap-backed growable text buffer structure. It clears the used-length field at `[buf+0x04]`, seeds the initial capacity at `[buf+0x08]` to `0x2000`, allocates a `0x2001`-byte NUL-terminated backing block through tracked_heap_alloc_with_header, stores that pointer at `[buf+0x00]`, and returns true on success.",rizin + llvm-objdump
0x0059c5e0,3,growable_text_buffer_free,support,unknown,inferred,rizin,4,Small wrapper that frees the heap-backed buffer pointer stored at `[buf+0x00]` through tracked_heap_free_with_header.,rizin + llvm-objdump
0x0059c5f0,65,growable_text_buffer_reserve_append,support,unknown,inferred,rizin,4,Ensures that one growable text buffer has room to append the requested byte count in ECX while preserving a trailing NUL terminator. When `[buf+0x04] + requested` would exceed capacity `[buf+0x08]` it rounds the new capacity up in 0x2000-byte chunks resizes the backing block through tracked_heap_resize_with_header stores the new pointer at `[buf+0x00]` and updates `[buf+0x08]` before returning success or failure.,rizin + llvm-objdump
0x0059c670,76,multiplayer_transport_text_stream_init,shell,thiscall,inferred,rizin,3,Initializes one multiplayer transport text-stream object. It zeroes the 0x350-byte state block seeds socket `[this+0x00]` to `-1` and allocates two growable text buffers at `[this+0x108]` and `[this+0x114]` through growable_text_buffer_init. Failure to allocate the second buffer frees the first and returns false.,rizin + llvm-objdump
0x0059c790,194,multiplayer_transport_text_stream_destroy,shell,thiscall,inferred,rizin,4,"Destroys one multiplayer transport text-stream object. If socket `[this+0x00]` is live it shuts it down with `shutdown(..., 2)` and `closesocket`, marks state `[this+0x04]` as closed, frees the two growable text buffers at `[this+0x108]` and `[this+0x114]`, releases the fixed pointer fields at `[this+0x328]` through `[this+0x344]`, then walks and frees the pointer vector rooted at `[this+0x348]` before freeing that vector itself.",rizin + llvm-objdump
0x0059c860,300,multiplayer_transport_select_socket_ready_flags,shell,cdecl,inferred,rizin,4,"Small `select` wrapper for one transport socket. It takes the socket on the stack plus up to three optional out-pointers for read write and exception readiness, builds the requested `fd_set` structures on the stack, calls `select(0x40, ...)` with a null timeout, and stores `1` or `0` into each requested out-slot depending on whether `__WSAFDIsSet` reports that socket as ready.",rizin + llvm-objdump
0x0059c990,113,multiplayer_transport_text_stream_send_pump,shell,thiscall,inferred,rizin,4,"Attempts to flush queued bytes from the transport text-stream send buffer at `[this+0x114]`. While buffered length `[this+0x118]` remains nonzero it probes writability through multiplayer_transport_select_socket_ready_flags, sends up to `min(len, 0x400)` bytes with `send`, slides any remaining buffered bytes down through `0x0059c640`, and continues until the socket is no longer writable or the buffer is empty.",rizin + llvm-objdump
0x0059ca10,190,multiplayer_transport_text_stream_recv_pump,shell,thiscall,inferred,rizin,3,Receives available socket text into the transport text-stream receive buffer at `[this+0x108]`. It first probes readability through multiplayer_transport_select_socket_ready_flags then repeatedly reserves 0x1000 bytes through growable_text_buffer_reserve_append calls `recv` into the free tail of the buffer optionally applies the stream-cipher helper at 0x005a0f70 when `[this+0x120]` is armed advances the used-length field at `[this+0x10c]` NUL-terminates the buffer and loops while readability remains set. Socket errors store closed-state value `2` into `[this+0x04]`.,rizin + llvm-objdump
0x0059cad0,25,multiplayer_transport_text_stream_service_io,shell,thiscall,inferred,rizin,4,Services one multiplayer transport text-stream I/O step unless state `[this+0x04]` is already closed. It first flushes queued outbound bytes through multiplayer_transport_text_stream_send_pump and then pumps inbound socket text through multiplayer_transport_text_stream_recv_pump.,rizin + llvm-objdump
0x0059caf0,216,multiplayer_transport_text_stream_append_crlf_line,shell,thiscall,inferred,rizin,4,"Appends one caller text line plus `\\r\\n` to the transport text-stream send buffer at `[this+0x114]`. It ignores requests when state `[this+0x04]` is already closed, reserves `strlen(text) + 2` bytes through growable_text_buffer_reserve_append, copies the bytes into the current tail tracked by `[this+0x118]`, appends CRLF, and updates the used-length field. When the stream-cipher gate at `[this+0x120]` is armed it post-processes the newly appended span through 0x005a0f70 using the send-side cipher state rooted at `[this+0x226]`.",rizin + llvm-objdump
0x00597880,159,multiplayer_transport_find_pending_template_node,shell,cdecl,inferred,rizin,4,Searches the linked pending-template list rooted at `[this+0x550]` for the first node whose caller-provided query tuple array matches the node kind and its primary and secondary string selectors. When it finds a match it refreshes the node timeout field at `[node+0x04]` from GetTickCount plus 0xea60 and returns that node pointer otherwise it returns null.,rizin + llvm-objdump
0x005979d0,1164,multiplayer_transport_dispatch_pending_template_node,shell,cdecl,inferred,rizin,3,Consumes one pending-template node and one caller dispatch descriptor. Depending on the node kind it emits one or more transport notifications through 0x0059b790 using the node-owned strings arrays and callback state then releases the node-owned heap strings arrays and child lists before unlinking the node from the pending-template list. Higher-level registered-name wrappers reuse it as the common completion path after multiplayer_transport_find_pending_template_node succeeds.,rizin + llvm-objdump
0x005996c0,304,multiplayer_transport_handle_pending_template_record_mode3,shell,cdecl,inferred,llvm-objdump,3,Structural mode-3 wrapper over the pending-template path for registered-name updates. It normalizes the caller selector string against the shared default token at 0x005e1e1c builds a four-way pending-template query and dispatches the matched node through multiplayer_transport_dispatch_pending_template_node. Depending on the matched node kind it can mark the registered-name entry dirty through multiplayer_transport_mark_registered_name_dirty or forward the node-owned payload fields into the dispatch descriptor.,llvm-objdump
0x00565c90,208,shell_queue_indexed_world_anchor_marker,shell,cdecl,inferred,ghidra-headless,3,Variant world-anchor marker emitter that selects one indexed entry from the owner table at +0x24 using byte [this+0xd8] derives scale and packed color from the entry fields and enqueues the resulting type-0x01 deferred message through shell_enqueue_deferred_message_type1.,ghidra + rizin + llvm-objdump
0x005662a0,964,shell_emit_sprite_billboard_quad_vertex24,bootstrap,thiscall,inferred,ghidra-headless,4,Expands one sprite billboard into six vertex24 records forming two textured triangles. It derives an alpha byte from item timing flags at [this+0x48] [this+0x4c] and [this+0x5c] combines that alpha with packed color [this+0x70] scales a prepared four-corner basis by [this+0x44] and writes six 24-byte vertices using atlas uv pairs from [this+0x2c..0x38].,ghidra + rizin + llvm-objdump
0x00566670,84,shell_prepare_sprite_billboard_basis,bootstrap,thiscall,inferred,ghidra-headless,3,Builds the temporary four-corner sprite-billboard basis used by 0x005662a0 from the current shell transform state and writes the result into global scratch vectors around 0x00d97ae0 and 0x00d97b98.,ghidra + rizin + llvm-objdump
0x0055e2b0,179,shell_create_layout_state,bootstrap,thiscall,inferred,ghidra-headless,4,Allocates a 0x3715-byte layout-state object for the shell controller stores it at [this+0x2d] seeds the dirty flags invokes 0x0054bc10 with owner state and a template byte from the shell bundle then binds the first presentation asset bundle through 0x00543f10 before later update hooks run.,ghidra + rizin
0x005679b0,569,shell_emit_animated_quad_vertex24,bootstrap,thiscall,inferred,ghidra-headless,4,Expands one cell-list item into four `vertex24` corner records with a time-varying color phase. The helper derives an 8-step brightness cycle from GetTickCount plus item field [this+0x3a] combines that phase with per-corner bytes at +0x35 through +0x38 and mask bytes at +0x31 through +0x34 and writes four 24-byte vertices from the quad corner positions stored across +0x00..+0x2c.,ghidra + rizin + llvm-objdump
0x00567c70,103,shell_stream_primary_cell_quad_list,bootstrap,thiscall,inferred,ghidra-headless,4,Streams the primary quad-item list rooted at [this+0x1c] into the caller's `vertex24` buffer. It seeds the shared color input through 0x00d97bbc iterates each list entry through 0x005679b0 and advances the destination pointer by count*0x90 for four vertices per item.,ghidra + rizin + llvm-objdump
0x00567ce0,105,shell_stream_alternate_cell_quad_list,bootstrap,thiscall,inferred,ghidra-headless,4,Streams the alternate quad-item list rooted at [this+0x20] into the caller's `vertex24` buffer using the same quad writer at 0x005679b0. Unlike the primary path it forwards an extra caller-supplied selector value into each emitted quad before advancing the destination pointer by count*0x90.,ghidra + rizin + llvm-objdump
0x005a644d,81,__heap_init,startup,cdecl,inferred,ghidra-headless,4,Initializes the CRT heap path via ___heap_select and ___sbh_heap_init before later allocations occur.,ghidra + rizin
0x005abd49,111,startup_init_tls_state,startup,unknown,inferred,ghidra-headless,3,Initializes per-thread startup state: mt locks plus TLS slot allocation and current-thread bookkeeping.,ghidra + rizin
0x005abf1b,510,startup_init_file_handle_table,startup,cdecl,inferred,ghidra-headless,4,Allocates and seeds the CRT file descriptor table then consumes STARTUPINFO handles and classifies inherited std handles.,ghidra + rizin
0x005aca5d,61,startup_run_init_callback_table,startup,unknown,inferred,ghidra-headless,3,Walks a startup callback table and invokes non-null entries before continuing the CRT path.,ghidra + rizin
0x005ad12d,199,__setenvp,startup,cdecl,inferred,ghidra-headless,4,Builds the process envp array by counting environment strings and splitting name/value entries around '='.,ghidra + rizin
0x005ad360,162,startup_build_argv,startup,cdecl,inferred,ghidra-headless,3,Initializes the multibyte table and uses a two-pass helper to count and copy argv entries from the process command line.,ghidra + rizin
0x005ad402,290,___crtGetEnvironmentStringsA,startup,cdecl,inferred,ghidra-headless,4,Copies the Windows environment block into CRT-owned storage before envp construction.,ghidra + rizin
