jan/rrt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Deepen multiplayer transport and selector-view map

Browse source
This commit is contained in:
Jan Petykiewicz 2026-04-04 01:22:39 -07:00
commit 4b0318fe9e
2 changed files with 35 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

32
artifacts/exports/rt3-1.06/function-map.csv
View file

@ -83,7 +83,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x00469410,56,multiplayer_init_session_event_transport_state,shell,unknown,inferred,ghidra-headless,3,Initializes the Multiplayer.win session-event transport state rooted at `0x006cd970`. The helper latches the incoming mode or state into `0x006cd978`; when that value is nonzero it zeroes the large scratch block at `0x006ae4d8` resets `0x006cd97c` and registers the cached-line callback block rooted at `0x004693b0` through multiplayer_transport_register_selector_callback before returning.,ghidra + rizin + llvm-objdump
0x00469450,97,multiplayer_teardown_session_event_transport,shell,unknown,inferred,ghidra-headless,3,Tears down the active session-event transport object at `0x006cd970`. When the latched mode at `0x006cd978` is nonzero and the multiplayer session object at `0x006cd920` exists it first switches the transport back to status route `0` through multiplayer_transport_select_status_route clears the status pump through multiplayer_transport_clear_status_pump disconnects through multiplayer_transport_disconnect shuts the object down through multiplayer_transport_shutdown and finally clears `0x006cd970`.,ghidra + rizin + llvm-objdump
0x004694c0,57,multiplayer_publish_session_event_fixed_token,shell,unknown,inferred,ghidra-headless,3,Small session-event transport helper that publishes one fixed token through the active transport object when the latched mode and multiplayer session object are both present. It first switches the transport to status route `1` through multiplayer_transport_select_status_route and then sends the fixed token at `0x005c87a8` plus flag `1` through multiplayer_transport_publish_fixed_token_message. The current grounded caller is the Multiplayer.win branch at `0x0046c3c0`.,ghidra + rizin + llvm-objdump + strings
0x00469500,27,multiplayer_flush_session_event_transport,shell,unknown,inferred,ghidra-headless,3,Lightweight session-event transport flush wrapper. When the active transport object at `0x006cd970` exists it first forces a status flush through multiplayer_transport_force_status_flush and then tail-calls multiplayer_transport_flush_and_maybe_shutdown on that same object.,ghidra + rizin + llvm-objdump
0x00469500,27,multiplayer_flush_session_event_transport,shell,unknown,inferred,ghidra-headless,3,"Lightweight session-event transport flush wrapper. When the active transport object at `0x006cd970` exists it first forces a status flush through multiplayer_transport_force_status_flush and then tail-calls multiplayer_transport_flush_and_maybe_shutdown on that same object. Current grounded callers include the top-level Multiplayer.win service loop and neighboring preview-reset or initializer branches, which makes this the shell-side cadence bridge into the deeper transport pump.",ghidra + rizin + llvm-objdump
0x00469520,94,multiplayer_register_session_event_cache_fields,shell,unknown,inferred,ghidra-headless,3,Registers the session-event cache-field subscription set for the active Multiplayer.win object. When no multiplayer session object is present it marks `[this+0x8f18]` armed and subscribes callback `0x00469200` through multiplayer_transport_subscribe_field_callback_set with the fixed field-id list `3 1 4 8 10 11 19 5` rooted at `[this+0x10]`.,ghidra + rizin + llvm-objdump
0x00469580,65,multiplayer_begin_session_event_line_iteration,shell,unknown,inferred,ghidra-headless,4,Primes iteration over the cached session-event line store at `0x006ae4d8`. When the multiplayer session object at `0x006cd920` is absent it sets `[this+0x9874]` armed clears the cached line slots and line index at `0x006cd97c` and re-registers the line callback `0x004693b0` through multiplayer_transport_register_selector_callback before returning.,ghidra + rizin + llvm-objdump
0x004695d0,66,multiplayer_next_session_event_cached_line,shell,unknown,inferred,ghidra-headless,4,Returns the next non-empty cached session-event line from the fixed store at `0x006ae4d8`. On first use after multiplayer_begin_session_event_line_iteration it resets `0x006cd97c` and clears `[this+0x9874]`; afterwards it returns the current 0x100-byte slot pointer when the first byte is nonzero and advances `0x006cd97c` or returns null when no further cached lines remain.,ghidra + rizin + llvm-objdump
@ -268,9 +268,21 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x005570b0,80,intrusive_queue_clear_and_release,support,cdecl,inferred,ghidra-headless,4,Clears and releases every node in one intrusive queue container. When [this+0x14] is present it routes through intrusive_queue_clear_owned_nodes; otherwise it walks the linked nodes directly releases them zeroes the head iterator and tail slots and resets the queued-node count at [this+0x0c].,ghidra + rizin + llvm-objdump
0x00559520,166,surface_init_rgba_pixel_buffer,support,thiscall,inferred,ghidra-headless,3,Initializes or refreshes a small 0xec-byte RGBA pixel-buffer object from caller-supplied image data and dimensions. On first use it allocates the backing object through 0x0053b070 stores width and height at [this+0xa2] and [this+0xa6] seeds the inner surface through 0x00543980 and 0x00541970 then copies width*height*4 bytes from the source buffer before finalizing through 0x005438d0. Current callers use it from the PaintTerrain preview path and the Multiplayer.win map-preview branch.,ghidra + rizin + llvm-objdump + strings
0x00565110,600,shell_rebuild_layout_state_and_optional_texture_report,shell,thiscall,inferred,ghidra-headless,3,Rebuilds the active shell layout-state branch when the current mode requires a deeper reset and optionally publishes the texture budget report through 0x00527650. The routine checks the current layout mode through 0x00545e00 tears down and recreates layout-state services through 0x0055dd80 and 0x0055e2b0 optionally notifies global shell services and when the caller flag is set emits the report then commits one layout refresh step through 0x00545d60.,ghidra + rizin + llvm-objdump + strings
0x0058bc90,23,multiplayer_gamespy_route_set_extended_payload_callback,shell,thiscall,inferred,objdump,3,"Tiny callback-slot helper for one GameSpy-style route object. It stores the caller callback pointer in `[route+0xa0]`, or in the default route singleton at `0x00629948` when `ecx` is null. The current grounded transport-side caller is multiplayer_transport_try_connect_status_route, which patches the status route's validated extended-payload callback slot to `0x597330` after route construction.",objdump
0x0058c9b0,404,multiplayer_gamespy_route_construct_and_seed_callback_vector,shell,thiscall,inferred,objdump,3,"Constructs or replaces one 0x108-byte GameSpy-style route object and seeds its callback vector. The helper allocates the route object when the caller owner slot is non-null, copies two caller strings into the local route buffers at `+0x04` and `+0x44`, stores the supplied callback table across `[route+0x88]` through `[route+0x9c]`, records the owner context at `[route+0x104]`, initializes the route cookie state and recent-cookie ring, and explicitly zeroes the secondary callback slots `[route+0xa0]`, `[route+0xa4]`, and `[route+0xd4]` before any later patch-up. Current grounded callers are multiplayer_transport_try_connect_status_route and multiplayer_transport_try_connect_live_route through the wrapper at `0x58cc40` or the constructor directly.","objdump"
0x0058d7a0,55,multiplayer_transport_set_local_name,shell,thiscall,inferred,ghidra-headless,3,Updates the local identity string stored in the session-event transport object. When the transport is already configured through [this+0x44] and the incoming name pointer is non-null and non-empty it copies up to 0x40 bytes into [this+0x04] clears byte [this+0x43] and then forwards the same name into the lower transport update path through 0x0058f330.,ghidra + rizin + llvm-objdump
0x0058d830,40,multiplayer_transport_disconnect,shell,thiscall,inferred,ghidra-headless,3,Disconnects the session-event transport object from its current live route. The helper flips the internal active state through 0x005965d0 and 0x005961b0 calls the shared teardown block at 0x0058d810 and finally clears byte [this+0x60] and the copied local name at [this+0xaf4].,ghidra + rizin + llvm-objdump
0x0058d860,59,multiplayer_transport_release_worker_and_reset_runtime_state,shell,cdecl,inferred,rizin,3,Small runtime-reset wrapper for the outer session-event transport object. When the owned worker pointer at [this] is present it first tears that worker down through multiplayer_transport_worker_shutdown_gracefully then clears the worker pointer the configured flag byte at [this+0x04] the text-stream owner slots at [this+0x44] and [this+0x48] reruns 0x00593370 and the shared reset block at 0x0058d810 and finally clears the live route and deferred-runtime fields at [this+0x180c] [this+0x1810] and [this+0x1edc].,rizin + llvm-objdump
0x0058d8d0,143,multiplayer_transport_service_frame,shell,cdecl,inferred,objdump + caller xrefs,3,"Recurring service pump for the outer session-event transport object. When the transport is configured through `[this+0x44]` or `[this+0x48]` it first services one worker step through multiplayer_transport_service_worker_once on the owned worker at `[this]`; if deferred reset is armed at `[this+0x1edc]` and the outstanding-work count has reached zero it falls straight into the common reset path at `0x0058de50`. Otherwise it conditionally emits the keepalive text at `0x005e1c24` after roughly `0x493e0` ms of inactivity, services the deeper selector or route helpers through `0x00596210` and `0x00597380`, finalizes deferred reset when the work count at `[this+0x1808]` reaches zero, and finishes by forwarding the caller selector through `0x00592800`. Current grounded callers reach it through multiplayer_transport_flush_and_maybe_shutdown and the immediate-drain submission paths, which places it at the center of the shell-owned multiplayer transport cadence.","objdump + caller xrefs + strings"
0x0058c340,144,multiplayer_gamespy_decode_triplet_control_payload,shell,cdecl,inferred,objdump,3,"Decodes one length-coded three-part GameSpy control payload and re-emits it through the shared packet-field builder at `0x58c0c0`. The helper reads up to three bounded variable-length slices from the caller payload, then packages them as field classes `0`, `1`, and `2`. The current grounded caller is subtype `0` of multiplayer_gamespy_route_dispatch_inbound_packet's `0xfe 0xfd` switch.",objdump
0x0058c5c0,60,multiplayer_gamespy_build_backslash_query_response,shell,cdecl,inferred,objdump + strings,3,"Builds one backslash-delimited GameSpy query reply into the caller buffer. It seeds the leading `\\`, emits three callback-driven field groups through `0x58c3e0` for selectors `0`, `1`, and `2`, appends the fixed terminator token at `0x005e1b6c`, and leaves the result ready for immediate send. The current grounded caller is the backslash-packet branch inside multiplayer_gamespy_route_dispatch_inbound_packet.",objdump + strings
0x0058c600,142,multiplayer_gamespy_dispatch_natneg_or_raw_callback,shell,cdecl,inferred,objdump + strings,3,"Dispatches one validated extended GameSpy payload into route-owner callbacks. When the payload begins with the six-byte magic `fd fc 1e 66 6a b2` it treats bytes `[payload+6..+9]` as a little-endian value, materializes a small wrapper object through `0x5b31f8`, and forwards it through the route callback at `[route+0xa0]`; otherwise it falls back to the raw payload callback at `[route+0xa4]`. Both slots are optional: the helper tests them for null and returns without dispatch when the selected callback is absent. The current grounded caller is subtype `6` of multiplayer_gamespy_route_dispatch_inbound_packet.",objdump + strings
0x0058c690,58,multiplayer_gamespy_route_dedupe_recent_cookie,shell,cdecl,inferred,objdump,3,Maintains a small ring of the last ten 32-bit route cookies or packet ids under `[route+0xd8]` and `[route+0x100]`. It returns `1` when the caller id is already present and otherwise inserts it into the rotating slot table and returns `0`. The current grounded caller is subtype `6` of multiplayer_gamespy_route_dispatch_inbound_packet before dispatching the validated extended payload.,objdump
0x0058c6d0,606,multiplayer_gamespy_route_dispatch_inbound_packet,shell,cdecl,inferred,objdump + strings,3,"Main inbound packet parser for one GameSpy-style route object. It sends semicolon-prefixed lines through the route callback at `[route+0xd4]`, but only when that slot is non-null; otherwise the semicolon branch returns without additional work. It treats backslash-prefixed packets as query requests and answers them by building a reply through multiplayer_gamespy_build_backslash_query_response, and otherwise requires at least seven bytes plus the `0xfe 0xfd` header before entering a subtype switch on byte `2`. The grounded subtype branches are now tighter: subtype `0` decodes a three-slice control payload through multiplayer_gamespy_decode_triplet_control_payload; subtype `1` copies one bounded NUL-terminated string through `0x58c030`; subtype `2` copies up to `0x20` raw bytes into the local packet builder as field class `5`; subtype `4` validates the four-byte route cookie at `[route+0x84]`, clears `[route+0xb0]`, and dispatches the remaining payload through the validated route callback at `[route+0x9c]`, which the transport-owned status and live routes seed to `0x5972c0`; subtype `6` validates the same cookie, emits a field-class `7` record with the next dword, dedupes that dword through multiplayer_gamespy_route_dedupe_recent_cookie, and then dispatches the trailing payload through multiplayer_gamespy_dispatch_natneg_or_raw_callback. In the currently grounded transport-owned status route, that extended callback layer is patched after construction so `[route+0xa0]` points at `0x597330`; the raw fallback slot `[route+0xa4]` remains unresolved and currently no-ops when null. Subtypes `3` and `5` currently fall through without additional work. The current grounded caller is multiplayer_gamespy_route_drain_inbound_packets.","objdump + strings"
0x0058cfd0,107,multiplayer_gamespy_route_release_and_free,shell,thiscall,inferred,objdump,3,"Common teardown helper for one GameSpy-style route object. When the route still looks live through `[route+0xb4]` it first sends the mode-`2` control frame through `0x58cd70`, closes the current route handle at `[route]` when needed through `0x58bc4e`, resets the handle and last-send timestamp fields, and finally frees the route object through `0x58f3c0` when it is not the default singleton at `0x00629840`. Current grounded callers are multiplayer_transport_release_status_route, multiplayer_transport_release_live_route, and the status-route reconnect path.","objdump"
0x0058ccd0,107,multiplayer_gamespy_route_drain_inbound_packets,shell,cdecl,inferred,objdump + strings,3,"Inbound packet drain for one GameSpy-style route object. While the route receive queue remains non-empty it pulls one datagram through `0x58bc7e`, routes the payload into `multiplayer_gamespy_route_dispatch_inbound_packet`, and then repeats. The parser accepts semicolon-prefixed lines through the route callback at `[route+0xd4]`, backslash-delimited key bundles, and `0xfe 0xfd` GameSpy control packets. The current grounded caller is the lower route-service helper at `0x58d040`.","objdump + strings"
0x0058cee0,164,multiplayer_gamespy_route_service_retry_and_keepalive_timers,shell,cdecl,inferred,objdump + strings,3,"Timer and retry side of one GameSpy-style route object. It checks the active route handle and challenge or retry fields around `[route+0xa8]`, `[route+0xac]`, and `[route+0xb0]`, emits outbound control traffic through the local send helper when the `master.gamespy.com` challenge or state flow stalls, raises the `No challenge value was received from the master server.` callback through `[route+0x9c]` after repeated failures, and periodically refreshes the auxiliary timestamp through `0x58c950`. The current grounded caller is the lower route-service helper at `0x58d040`, which makes this the timer or retry half of the recurring GameSpy route cadence.","objdump + strings"
0x0058d040,37,multiplayer_gamespy_route_service_frame,shell,cdecl,inferred,objdump + strings,3,"Low-level recurring service step for one GameSpy-style route object. When the route handle state at `[route+0xb4]` is live it first services retry and keepalive timers through `multiplayer_gamespy_route_service_retry_and_keepalive_timers` and then drains inbound packets through `multiplayer_gamespy_route_drain_inbound_packets`. Current grounded callers are `multiplayer_transport_service_status_and_live_routes`, which uses the same helper for both the auxiliary status route at `[transport+0xaf0]` and the current live route at `[transport+0x1ecc]`.","objdump + strings"
0x0058d960,7,multiplayer_transport_select_status_route,shell,thiscall,inferred,ghidra-headless,3,Thin route-selector wrapper for the session-event transport. It forwards the requested small route id in EDX into multiplayer_transport_set_mode_q_flag which updates [this+0x560] formats the underlying `MODE %s -q` or `MODE %s +q` command text and reconfigures the transport-side callback plumbing.,ghidra + rizin + llvm-objdump
0x0058d970,89,multiplayer_transport_subscribe_field_callback_set,shell,thiscall,inferred,ghidra-headless,3,Registers one field-subscription callback set on the session-event transport. When the transport is active byte [this+0x60] is set it stores the caller metadata at [this+0x176c] and [this+0x1770] then forwards the field-id list string callback and context into multiplayer_transport_register_field_subscription_bundle; on failure it falls back through multiplayer_transport_enqueue_field_snapshot_record.,ghidra + rizin + llvm-objdump
0x0058d9e0,55,multiplayer_transport_send_selector_text,shell,thiscall,inferred,ghidra-headless,3,Sends one caller-supplied text pointer through a selector-specific transport slot. The helper looks up the selector entry from the handler table rooted at [this+0x390] and when both the text pointer and slot are valid forwards the string plus caller flag into the lower send helper at 0x0058e7e0 using the descriptor block at [this+0x80+selector*0x101].,ghidra + rizin + llvm-objdump
@ -288,6 +300,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x0058e370,33,multiplayer_transport_is_request_pending,shell,cdecl,inferred,ghidra-headless,3,Returns true while the caller transport request still appears in either the queued request collection at [this+0x550] or the secondary active-work collection checked through 0x0059c540. Immediate-drain callers use it as the loop predicate after pumping queued text and sleeping for 10 ms.,ghidra + rizin + llvm-objdump
0x0058e3f0,137,multiplayer_transport_drain_request_text_queue,shell,cdecl,inferred,ghidra-headless,3,Immediate-drain helper for one transport request. When request kind [req+0x20] is `1` it walks queued transport text lines under [this+0x1c] republishes them through 0x0059b790 and notifies the small observer table through 0x0058e310 until the queue is empty. When request kind `2` drains it also publishes `Disconnected`. Both paths refresh timeout state through 0x00598030 and finish by forwarding the request into 0x0059c470.,ghidra + rizin + llvm-objdump + strings
0x0058e480,105,multiplayer_transport_worker_shutdown_gracefully,shell,cdecl,inferred,rizin,3,"Graceful shutdown wrapper for one multiplayer transport worker. If the callback object at `[this+0x538]` and its owner slot `[this+0x544]` are present it first emits a final owner notification through the callback vtable using fallback text at `0x005c87a8`. When the owned text-stream socket at `[this+0x1c]` is still live it appends `QUIT :Later!` through multiplayer_transport_text_stream_append_crlf_line and services one I/O step through multiplayer_transport_text_stream_service_io before destroying the registered-name store at `[this+0x548]`, the pending-template dispatch store at `[this+0x54c]`, the text-stream object at `[this+0x1c]`, and finally the worker backing block itself.","rizin + llvm-objdump + strings"
0x0058e4f0,12,multiplayer_transport_service_worker_once,shell,cdecl,inferred,objdump,3,"Very small bridge from the outer session-event transport object into its owned worker. It forwards the worker pointer in `[this]` into multiplayer_transport_drain_request_text_queue with a null request pointer, making it the one-step worker service helper used by the recurring transport pump.",objdump
0x0058e650,80,multiplayer_transport_sanitize_identifier,shell,cdecl,inferred,ghidra-headless,4,Normalizes a caller-supplied identifier string into the destination buffer by replacing leading punctuation and any later disallowed characters with underscores while preserving acceptable bytes from the source. Current grounded callers use it for the randomized `RT3Player%d` retry name and for locally submitted session-event text records.,ghidra + rizin + llvm-objdump + strings
0x0058e6b0,98,multiplayer_transport_set_mode_q_flag,shell,thiscall,inferred,ghidra-headless,4,Updates the transport mode-q flag tracked at [this+0x560]. When the requested value changes it formats either `MODE %s -q` or `MODE %s +q` against the active name buffer at [this+0x36c] stores the new flag and for mode `0` refreshes the downstream callback plumbing through 0x0059e070 and 0x0059de00 using helper 0x0058e6a0.,ghidra + rizin + llvm-objdump + strings
0x0058e8c0,37,multiplayer_transport_publish_topic_status_line,shell,thiscall,inferred,ghidra-headless,3,Formats and publishes one `TOPIC %s :%s` status line through the active transport text buffer at [this+0x1c]. When the caller text is null it falls back to the shared empty sample at 0x005c87a8. Current grounded caller is multiplayer_transport_handle_names_query_response.,ghidra + rizin + llvm-objdump + strings
@ -318,12 +331,17 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x00592d70,77,multiplayer_transport_enqueue_callback_slot12_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that copies a caller-supplied seven-dword block and enqueues it as a 0x20-byte opcode `12` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x179c] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592dc0,72,multiplayer_transport_enqueue_callback_slot13_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `13` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a0] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592e10,72,multiplayer_transport_enqueue_callback_slot14_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x10-byte opcode `14` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a4] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00593120,72,multiplayer_transport_enqueue_callback_slot19_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `19` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f560`, which first updates selector-view runtime state through `0x5948f0` and then forwards the same selector-name pair through this owner-callback lane.","objdump + caller xrefs"
0x00592e60,64,multiplayer_transport_enqueue_callback_slot15_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x08-byte opcode `15` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a8] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592ea0,64,multiplayer_transport_enqueue_callback_slot16_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x08-byte opcode `16` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17ac] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00593460,87,multiplayer_transport_mark_selector_slot_records_stale,shell,cdecl,inferred,ghidra-headless,3,Scans the queued transport request collection at [this+0x1780] for records of type `1` or `2` whose selector-slot field at +0x1c matches the requested slot id. Matching records are marked stale by setting byte or dword field +0x38 to one. Current grounded caller is multiplayer_transport_reset_selector_slot.,ghidra + rizin + llvm-objdump
0x00593790,351,multiplayer_transport_handle_names_query_response,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_names_query_with_callback. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can update route-binding state through multiplayer_transport_is_route_mode_active_nonterminal and multiplayer_transport_try_connect_status_route_once seeds selector slot `2` through multiplayer_transport_init_selector_slot upserts returned name records through multiplayer_transport_upsert_selector_name_entry publishes `TOPIC` and `MODE` lines through multiplayer_transport_publish_topic_status_line and multiplayer_transport_publish_mode_level_status_line and may promote one deferred route binding into [this+0x1ec8]. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump + strings
0x005938f0,145,multiplayer_transport_handle_bound_route_request,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_bound_route_request. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can publish [req+0x24] through multiplayer_transport_publish_mode_key_status_line and then schedules multiplayer_transport_handle_names_query_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump
0x00594690,76,multiplayer_transport_mark_selector_slot_views_dirty,shell,cdecl,inferred,ghidra-headless,2,Marks one selector slot dirty in the transport-side view state rooted at [this+0xac8]. It sets slot-specific dirty bits at +0xa0 and +0xa4 when backing arrays at [this+0xad0] or [this+0xadc] are populated and also sets +0xa8 for selector slot `2`. Current grounded callers are multiplayer_transport_set_selector_slot_flags and multiplayer_transport_upsert_selector_name_entry.,ghidra + rizin + llvm-objdump
0x00594620,106,multiplayer_transport_reset_selector_view_entry_runtime_state,shell,cdecl,inferred,objdump,2,"Clears the extended runtime fields of one selector-view entry. When the transport-side selector-view layer is present through `[this+0xac8]` it zeroes the entry block from `+0x68` through `+0xa8`, including the dirty or refresh flags at `+0xa0`, `+0xa4`, and `+0xa8`, then returns success. Current grounded caller is the selector-view snapshot export path at `0x594ee0`.","objdump"
0x00594690,76,multiplayer_transport_mark_selector_slot_views_dirty,shell,cdecl,inferred,ghidra-headless,2,"Marks one selector slot dirty in the transport-side selector-view layer rooted at `[this+0xab4]` with backing arrays around `[this+0xad0]..[this+0xae4]`. It sets slot-specific dirty bits at `+0xa0` and `+0xa4` when the matching backing arrays are populated and also sets `+0xa8` for selector slot `2`. Current grounded callers are multiplayer_transport_set_selector_slot_flags and multiplayer_transport_upsert_selector_name_entry.","ghidra + rizin + llvm-objdump"
0x005949a0,80,multiplayer_transport_ensure_selector_view_store,shell,thiscall,inferred,objdump,3,"Ensures the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it allocates a `0xac`-byte keyed container through `0x58faf0`, stores the resulting root at `[this+0xab4]`, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport setup and reset path around `0x58d7ee`.","objdump + caller xrefs"
0x005949f0,56,multiplayer_transport_release_selector_view_store,shell,thiscall,inferred,objdump,3,"Releases the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it frees the root at `[this+0xab4]` through `0x58f8b0`, clears that root, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport teardown path around `0x58d81a`.","objdump + caller xrefs"
0x00594a40,80,multiplayer_transport_find_selector_view_entry_by_name,shell,cdecl,inferred,objdump,3,"Looks up one selector-view entry by its bounded name string. It copies up to `0x40` bytes of the caller key into a local buffer, then probes the keyed selector-view store rooted at `[this+0xab4]` through `0x58f9c0` and returns the matching entry pointer or null. Current grounded callers include multiplayer_transport_set_selector_slot_flags, multiplayer_transport_merge_selector_mode_mask, multiplayer_transport_upsert_selector_name_entry, and several later selector-view formatting helpers.","objdump + caller xrefs"
0x00594bd0,97,multiplayer_transport_set_selector_slot_flags,shell,cdecl,inferred,ghidra-headless,3,Updates one selector-slot flag dword at [entry+0x5c] after resolving the current selector entry through 0x00594a40. When selector index `2` flips bit `1` it forwards the new bit value through multiplayer_transport_enqueue_callback_slot15_record and then notifies the shared selector-change callback path through 0x00593250 with selector id old flags and new flags.,ghidra + rizin + llvm-objdump
0x00594c40,103,multiplayer_transport_parse_selector_mode_letters,shell,cdecl,inferred,ghidra-headless,3,Parses one selector-mode letter string into a small bitmask by probing for the letters `s` `r` `g` `a` and `h`. Current grounded callers merge this mask into the selector-slot flags that live at [entry+0x5c].,ghidra + rizin + llvm-objdump + strings
0x00594cb0,65,multiplayer_transport_merge_selector_mode_mask,shell,cdecl,inferred,ghidra-headless,3,Resolves one selector entry through 0x00594a40 parses the caller mode-letter string through multiplayer_transport_parse_selector_mode_letters preserves the current presence bits 0x20 and 0x40 from [entry+0x5c] and commits the merged result through multiplayer_transport_set_selector_slot_flags.,ghidra + rizin + llvm-objdump + strings
@ -336,7 +354,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x00595440,98,multiplayer_transport_init_selector_slot,shell,cdecl,inferred,ghidra-headless,3,Initializes one selector slot under [this+0x384] and [this+0x390]. It copies caller text or the default sample at 0x005c87a8 into the fixed selector buffer at [slot+0x39c] clears byte [slot+0x59b] reruns multiplayer_transport_service_status_pump and then notifies multiplayer_transport_submit_profile_key_query_bundle_default for the refreshed selector slot.,ghidra + rizin + llvm-objdump + strings
0x005954b0,238,multiplayer_transport_reset_selector_slot,shell,cdecl,inferred,ghidra-headless,3,Resets one selector slot under [this+0x384] and [this+0x390]. When the slot is active it tears the current selector object down through 0x593460 optionally republishes caller text through 0x58e7a0 refreshes selector bookkeeping through 0x5950a0 and clears the active and present flags before returning.,ghidra + rizin + llvm-objdump
0x00595620,35,multiplayer_transport_release_route_binding,shell,cdecl,inferred,ghidra-headless,3,Releases the current route binding stored at [this+0x1ec8]. It detaches the binding from the descriptor object at [this+0x1ed0] through 0x58f3c0 unlinks it through 0x5933a0 and clears [this+0x1ec8].,ghidra + rizin + llvm-objdump
0x00595650,688,multiplayer_transport_set_route_mode,shell,cdecl,inferred,ghidra-headless,3,Main route-mode state machine for the session-event transport. It latches the requested small mode at [this+0x18b8] and dispatches modes `0` through `5` across live-route teardown selector-slot init or reset am-rating route seeding live-route connect and route-binding release paths. The branch uses multiplayer_transport_release_live_route multiplayer_transport_try_seed_am_rating_route_table multiplayer_transport_try_connect_live_route and multiplayer_transport_release_route_binding to converge on the next stable mode.,ghidra + rizin + llvm-objdump + strings
0x00595650,688,multiplayer_transport_set_route_mode,shell,cdecl,inferred,ghidra-headless,3,Main route-mode state machine for the session-event transport. It latches the requested small mode at [this+0x18b8] and dispatches modes `0` through `5` across live-route teardown selector-slot init or reset am-rating route seeding live-route connect and route-binding release paths. The currently grounded mode transitions converge by tearing live routes down through multiplayer_transport_release_live_route and rebuilding them through multiplayer_transport_try_connect_live_route rather than mutating the live route object's callback slots in place. The branch uses multiplayer_transport_release_live_route multiplayer_transport_try_seed_am_rating_route_table multiplayer_transport_try_connect_live_route and multiplayer_transport_release_route_binding to converge on the next stable mode.,ghidra + rizin + llvm-objdump + strings
0x005958e0,156,multiplayer_transport_try_stage_route_callback_payload,shell,cdecl,inferred,ghidra-headless,2,Builds one staged route-callback payload from the caller route object and transport-local text buffer at [this+0x60]. It extracts several caller fields through the 0x58d1f0 0x58d240 0x58d220 and 0x58d250 or 0x58d200 helpers packs them through multiplayer_transport_format_gsp_payload submits the staged text through multiplayer_transport_submit_selector_text_route_request and on success stores the cloned callback payload returned by multiplayer_transport_clone_staged_callback_payload at [this+0xb50].,ghidra + rizin + llvm-objdump + strings
0x00595980,84,multiplayer_transport_handle_route_status_result,shell,cdecl,inferred,ghidra-headless,2,Completion callback used by multiplayer_transport_submit_route_status_request. When the callback result is nonzero it compares the live status counters at [this+0xac0] and [this+0xb48] and advances the route-mode state machine through mode `2` or modes `3` or `4`. When the callback result is zero it sets [this+0x1ed8] and re-enters multiplayer_transport_set_route_mode using the current am-rating route state at [this+0x1ed4].,ghidra + rizin + llvm-objdump
0x005959e0,81,multiplayer_transport_submit_route_status_request,shell,cdecl,inferred,ghidra-headless,3,Submits one route-status request for the current binding at [this+0x1ec8]. It gathers the binding fields at +0x2c and +0x30 together with the local counter at [this+0xb48] and default sample text at 0x005c87a8 then sends that request through 0x593980 using multiplayer_transport_handle_route_status_result as the completion callback. Failure sets [this+0x1ed8] so the route-mode setter can fall back immediately.,ghidra + rizin + llvm-objdump
@ -358,6 +376,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x00596060,48,multiplayer_transport_reset_am_rating_route_state,shell,cdecl,inferred,ghidra-headless,3,Small reset helper for the active `gsi_am_rating` route state. When [this+0xba0] is set it clears the route callback table at [this+0x18bc] resets [this+0x1ec4] to zero and clears the auxiliary route cache at [this+0x1e7c].,ghidra + rizin + llvm-objdump + strings
0x00596090,272,multiplayer_transport_init_route_callback_tables,shell,cdecl,inferred,ghidra-headless,3,Initializes route callback tables at [this+0xba4] [this+0x1724] [this+0x1164] [this+0x18bc] and [this+0x1e7c]. Installs handlers 0x00595a40 0x00595b60 0x00595bc0 0x00595e10 and multiplayer_transport_dispatch_am_rating_route_callback seeds default selector text from static tables and sets [this+0xba0].,ghidra + rizin + llvm-objdump
0x005961b0,92,multiplayer_transport_teardown_route_callback_tables,shell,cdecl,inferred,ghidra-headless,4,Clears progress and capacity caches destroys the callback tables at [this+0xba4] [this+0x1164] and [this+0x18bc] clears the related caches at [this+0x1724] and [this+0x1e7c] and resets [this+0x1ec4] to zero.,ghidra + rizin + llvm-objdump
0x00596210,71,multiplayer_transport_service_route_callback_tables,shell,cdecl,inferred,objdump,3,"Recurring service sweep for the transport-owned callback tables and field caches. When route callback plumbing is enabled at `[this+0xba0]` it services the callback tables at `[this+0xba4]`, `[this+0x1164]`, and `[this+0x18bc]` through the shared table-service helper `0x591290`, services the cache blocks at `[this+0x1724]` and `[this+0x1e7c]` through `0x5a0c80`, and otherwise returns immediately. The current grounded caller is multiplayer_transport_service_frame, which makes this the callback-table side of the recurring multiplayer transport cadence.",objdump
0x005962e0,583,multiplayer_transport_register_field_subscription_bundle,shell,cdecl,inferred,ghidra-headless,3,Builds one field-subscription bundle from the field-id list optional suffix text and selector-name table. Rebuilds the callback table at [this+0xba4] seeds the local field cache at [this+0x1724] installs the subscription block through 0x590ed0 sets [this+0x1774] on success and enqueues an immediate mode-3 field snapshot through multiplayer_transport_enqueue_field_snapshot_record.,ghidra + rizin + llvm-objdump
0x00596530,101,multiplayer_transport_try_seed_am_rating_route_table,shell,cdecl,inferred,ghidra-headless,2,Used by the larger route-mode setter around 0x595650. It first calls multiplayer_transport_reset_am_rating_route_state then rebuilds one mode `4` route entry in the callback table at [this+0x18bc] from the stored descriptor at [this+0x1ed0]. Success clears [this+0x1ed4] sets [this+0x1ec4] to one and failure reverts through multiplayer_transport_reset_am_rating_route_state before setting [this+0x1ed4].,ghidra + rizin + llvm-objdump + strings
0x005965a0,44,multiplayer_transport_try_connect_status_route_once,shell,cdecl,inferred,ghidra-headless,3,Single-shot wrapper for the auxiliary status-route object at [this+0xaf0]. When the in-flight latch at [this+0xb40] is already set it returns false immediately. Otherwise it sets that latch and forwards the caller route id into multiplayer_transport_try_connect_status_route then booleanizes the result. Current grounded caller is multiplayer_transport_handle_names_query_response.,ghidra + rizin + llvm-objdump
@ -365,10 +384,13 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x00596fa0,19,multiplayer_transport_submit_profile_key_query_bundle_with_context,shell,cdecl,inferred,rizin,2,Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector or route context in `edx` and forwards the stack-supplied context pointer as the extra bundle argument. Current grounded use is through the local callback table rooted at 0x0059f8b0.,rizin + llvm-objdump
0x00596fc0,14,multiplayer_transport_submit_profile_key_query_bundle_default,shell,cdecl,inferred,rizin,3,Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector slot in `edx` and forces a null extra-context argument. Current grounded caller is multiplayer_transport_init_selector_slot and the same wrapper is also installed through the local callback table rooted at 0x0059fb60.,rizin + llvm-objdump
0x00596fd0,441,multiplayer_transport_dispatch_status_route_event,shell,cdecl,inferred,rizin,3,Main local callback dispatcher for the auxiliary status-route object. It gates on [this+0x398] [this+0xb44] and flag bits in [this+0xb38] then maps route event ids through the local table at 0x005970c4 into selector text publication openstaging publication boolean status publication and callback forwarding paths. The dispatcher publishes through multiplayer_transport_send_selector_text and multiplayer_transport_publish_fixed_token_message and can also invoke the owner callback at [this+0x17dc] with payload [this+0x17f8].,rizin + llvm-objdump + strings
0x005972c0,97,multiplayer_transport_handle_validated_route_cookie_event,shell,cdecl,inferred,objdump,3,"Validated subtype-`4` callback for the transport-owned GameSpy route family. The route constructor seeds this helper into `[route+0x9c]`; after multiplayer_gamespy_route_dispatch_inbound_packet validates the current route cookie it forwards the event id in `ecx`, the remaining payload pointer in `edx`, and the owner transport context from `[route+0x104]`. When multiplayer_transport_is_route_mode_active_nonterminal succeeds it marks `[this+0x1ed8]` and re-enters multiplayer_transport_set_route_mode with a mode-selection bit derived from `[this+0x1ed4]` and `[this+0x18b8]`; otherwise it falls back to the owner callback at `[this+0x17f0]` using context `[this+0x17f8]`.","objdump"
0x00597330,28,multiplayer_transport_forward_validated_extended_route_payload,shell,cdecl,inferred,objdump,3,"Small forwarding callback used for the transport-owned status route's validated extended-payload slot. It treats `edx` as the owner transport object, checks the owner callback pointer at `[this+0x17f4]`, and when present forwards the validated payload wrapper in `ecx` together with owner context `[this+0x17f8]`. Current grounded caller is the status-route connect helper through multiplayer_gamespy_route_set_extended_payload_callback.","objdump"
0x00597350,30,multiplayer_transport_release_status_route,shell,cdecl,inferred,ghidra-headless,3,Releases the auxiliary status-route object stored at [this+0xaf0] through 0x58cfd0 and clears the owner slot afterward. Status-pump cleanup fixed-token publishing and the auxiliary route connect helper use this before rebuilding status-route state.,ghidra + rizin + llvm-objdump
0x005973d0,170,multiplayer_transport_try_connect_status_route,shell,cdecl,inferred,ghidra-headless,3,Attempts to connect or rebuild the auxiliary status-route object at [this+0xaf0]. It first tears any existing status route down through multiplayer_transport_release_status_route then builds a callback table from the local handler set rooted at multiplayer_transport_dispatch_status_route_event through 0x5972c0 chooses either the default route id `0x1964` or the caller route id and connects through 0x58cc40 or 0x58c9b0. On success it copies [this+0x9a8] into [this+0xb3c] wires the created route object through 0x58bc90 using callback 0x597330 and clears [this+0xb38].,ghidra + rizin + llvm-objdump + strings
0x00597380,34,multiplayer_transport_service_status_and_live_routes,shell,cdecl,inferred,objdump,3,"Recurring route-object sweep for the session-event transport. It services the auxiliary status-route object at `[this+0xaf0]` through the shared low-level route tick helper `0x58d040` when present and then services the current live route at `[this+0x1ecc]` through that same helper. The current grounded caller is multiplayer_transport_service_frame, which makes this the route-object side of the recurring multiplayer transport cadence.",objdump
0x005973d0,170,multiplayer_transport_try_connect_status_route,shell,cdecl,inferred,ghidra-headless,3,"Attempts to connect or rebuild the auxiliary status-route object at [this+0xaf0]. It first tears any existing status route down through multiplayer_transport_release_status_route then builds a callback table from the local handler set rooted at multiplayer_transport_dispatch_status_route_event through multiplayer_transport_handle_validated_route_cookie_event chooses either the default route id `0x1964` or the caller route id and connects through `0x58cc40` or multiplayer_gamespy_route_construct_and_seed_callback_vector. On success it copies [this+0x9a8] into [this+0xb3c] patches the created route object's extended-payload callback slot through multiplayer_gamespy_route_set_extended_payload_callback using callback `0x597330` and clears [this+0xb38].","ghidra + rizin + llvm-objdump + strings"
0x005973b0,30,multiplayer_transport_release_live_route,shell,cdecl,inferred,ghidra-headless,4,Releases the current live route object stored at [this+0x1ecc] through 0x58cfd0 and clears the owner slot afterward. The route-mode setter and connect helper use it before rebuilding or switching live route state.,ghidra + rizin + llvm-objdump
0x00597480,261,multiplayer_transport_try_connect_live_route,shell,cdecl,inferred,ghidra-headless,3,Attempts to connect or rebuild the current live route object at [this+0x1ecc]. It first clears any existing live route through multiplayer_transport_release_live_route then formats a local identifier from [this+0x60] and 0x005dccfc chooses either the default route id `0x1964` or the binding-specific id and connects through 0x58cc40 or 0x58c9b0. On success it updates [this+0x1ed8] and preserves the new live route state for the route-mode setter.,ghidra + rizin + llvm-objdump + strings
0x00597480,261,multiplayer_transport_try_connect_live_route,shell,cdecl,inferred,ghidra-headless,3,"Attempts to connect or rebuild the current live route object at [this+0x1ecc]. It first clears any existing live route through multiplayer_transport_release_live_route then formats a local identifier from [this+0x60] and 0x005dccfc chooses either the default route id `0x1964` or the binding-specific id and connects through 0x58cc40 or multiplayer_gamespy_route_construct_and_seed_callback_vector. In the currently grounded connect path it does not patch `[route+0xa0]`, `[route+0xa4]`, or `[route+0xd4]` after construction the way the status-route helper patches `[route+0xa0]`; on success it only updates [this+0x1ed8] and preserves the new live route state for the route-mode setter.","ghidra + rizin + llvm-objdump + strings"
0x00598230,67,multiplayer_transport_enqueue_names_query_record,shell,cdecl,inferred,ghidra-headless,3,Allocates one 0x10-byte transient names-query work item zeroes its four dword fields and submits it through 0x5980f0 as request kind `3` using the caller-provided sample or callback context pointer. The helper returns the allocated work item on success and null on allocation or submit failure. Current grounded caller is multiplayer_transport_submit_names_query_with_callback.,ghidra + rizin + llvm-objdump
0x0058f0a0,99,multiplayer_transport_append_user_and_optional_nick_commands,shell,cdecl,inferred,rizin,3,Builds the initial identity command bundle for one multiplayer transport worker. It appends `USER %s %s %s :%s` to the owned text stream using worker text fields at [this+0x3ac] [this+0x42c] and [this+0x4b0] together with the fallback host `127.0.0.1` then checks the current nick through multiplayer_transport_is_valid_nick_string and either falls through multiplayer_transport_dispatch_or_release_callback_binding with mode `1` or appends `NICK %s` directly through the same text-stream path.,rizin + llvm-objdump + strings
0x0058f920,72,hashed_entry_table_upsert,support,cdecl,inferred,rizin,4,Generic hashed-entry-table upsert over a bucket array of contiguous vectors. It computes the bucket index through the table hash callback at [this+0x0c] looks for an existing matching entry through hashed_entry_table_lookup and when found overwrites that slot through generic_vector_overwrite_with_callback; otherwise it appends the caller record into the selected bucket vector through 0x0059e4d0.,rizin + llvm-objdump

1 address size name subsystem calling_convention prototype_status source_tool confidence notes verified_against
83 0x00469410 56 multiplayer_init_session_event_transport_state shell unknown inferred ghidra-headless 3 Initializes the Multiplayer.win session-event transport state rooted at `0x006cd970`. The helper latches the incoming mode or state into `0x006cd978`; when that value is nonzero it zeroes the large scratch block at `0x006ae4d8` resets `0x006cd97c` and registers the cached-line callback block rooted at `0x004693b0` through multiplayer_transport_register_selector_callback before returning. ghidra + rizin + llvm-objdump
84 0x00469450 97 multiplayer_teardown_session_event_transport shell unknown inferred ghidra-headless 3 Tears down the active session-event transport object at `0x006cd970`. When the latched mode at `0x006cd978` is nonzero and the multiplayer session object at `0x006cd920` exists it first switches the transport back to status route `0` through multiplayer_transport_select_status_route clears the status pump through multiplayer_transport_clear_status_pump disconnects through multiplayer_transport_disconnect shuts the object down through multiplayer_transport_shutdown and finally clears `0x006cd970`. ghidra + rizin + llvm-objdump
85 0x004694c0 57 multiplayer_publish_session_event_fixed_token shell unknown inferred ghidra-headless 3 Small session-event transport helper that publishes one fixed token through the active transport object when the latched mode and multiplayer session object are both present. It first switches the transport to status route `1` through multiplayer_transport_select_status_route and then sends the fixed token at `0x005c87a8` plus flag `1` through multiplayer_transport_publish_fixed_token_message. The current grounded caller is the Multiplayer.win branch at `0x0046c3c0`. ghidra + rizin + llvm-objdump + strings
86 0x00469500 27 multiplayer_flush_session_event_transport shell unknown inferred ghidra-headless 3 Lightweight session-event transport flush wrapper. When the active transport object at `0x006cd970` exists it first forces a status flush through multiplayer_transport_force_status_flush and then tail-calls multiplayer_transport_flush_and_maybe_shutdown on that same object. Lightweight session-event transport flush wrapper. When the active transport object at `0x006cd970` exists it first forces a status flush through multiplayer_transport_force_status_flush and then tail-calls multiplayer_transport_flush_and_maybe_shutdown on that same object. Current grounded callers include the top-level Multiplayer.win service loop and neighboring preview-reset or initializer branches, which makes this the shell-side cadence bridge into the deeper transport pump. ghidra + rizin + llvm-objdump
87 0x00469520 94 multiplayer_register_session_event_cache_fields shell unknown inferred ghidra-headless 3 Registers the session-event cache-field subscription set for the active Multiplayer.win object. When no multiplayer session object is present it marks `[this+0x8f18]` armed and subscribes callback `0x00469200` through multiplayer_transport_subscribe_field_callback_set with the fixed field-id list `3 1 4 8 10 11 19 5` rooted at `[this+0x10]`. ghidra + rizin + llvm-objdump
88 0x00469580 65 multiplayer_begin_session_event_line_iteration shell unknown inferred ghidra-headless 4 Primes iteration over the cached session-event line store at `0x006ae4d8`. When the multiplayer session object at `0x006cd920` is absent it sets `[this+0x9874]` armed clears the cached line slots and line index at `0x006cd97c` and re-registers the line callback `0x004693b0` through multiplayer_transport_register_selector_callback before returning. ghidra + rizin + llvm-objdump
89 0x004695d0 66 multiplayer_next_session_event_cached_line shell unknown inferred ghidra-headless 4 Returns the next non-empty cached session-event line from the fixed store at `0x006ae4d8`. On first use after multiplayer_begin_session_event_line_iteration it resets `0x006cd97c` and clears `[this+0x9874]`; afterwards it returns the current 0x100-byte slot pointer when the first byte is nonzero and advances `0x006cd97c` or returns null when no further cached lines remain. ghidra + rizin + llvm-objdump
268 0x005570b0 80 intrusive_queue_clear_and_release support cdecl inferred ghidra-headless 4 Clears and releases every node in one intrusive queue container. When [this+0x14] is present it routes through intrusive_queue_clear_owned_nodes; otherwise it walks the linked nodes directly releases them zeroes the head iterator and tail slots and resets the queued-node count at [this+0x0c]. ghidra + rizin + llvm-objdump
269 0x00559520 166 surface_init_rgba_pixel_buffer support thiscall inferred ghidra-headless 3 Initializes or refreshes a small 0xec-byte RGBA pixel-buffer object from caller-supplied image data and dimensions. On first use it allocates the backing object through 0x0053b070 stores width and height at [this+0xa2] and [this+0xa6] seeds the inner surface through 0x00543980 and 0x00541970 then copies width*height*4 bytes from the source buffer before finalizing through 0x005438d0. Current callers use it from the PaintTerrain preview path and the Multiplayer.win map-preview branch. ghidra + rizin + llvm-objdump + strings
270 0x00565110 600 shell_rebuild_layout_state_and_optional_texture_report shell thiscall inferred ghidra-headless 3 Rebuilds the active shell layout-state branch when the current mode requires a deeper reset and optionally publishes the texture budget report through 0x00527650. The routine checks the current layout mode through 0x00545e00 tears down and recreates layout-state services through 0x0055dd80 and 0x0055e2b0 optionally notifies global shell services and when the caller flag is set emits the report then commits one layout refresh step through 0x00545d60. ghidra + rizin + llvm-objdump + strings
271 0x0058bc90 23 multiplayer_gamespy_route_set_extended_payload_callback shell thiscall inferred objdump 3 Tiny callback-slot helper for one GameSpy-style route object. It stores the caller callback pointer in `[route+0xa0]`, or in the default route singleton at `0x00629948` when `ecx` is null. The current grounded transport-side caller is multiplayer_transport_try_connect_status_route, which patches the status route's validated extended-payload callback slot to `0x597330` after route construction. objdump
272 0x0058c9b0 404 multiplayer_gamespy_route_construct_and_seed_callback_vector shell thiscall inferred objdump 3 Constructs or replaces one 0x108-byte GameSpy-style route object and seeds its callback vector. The helper allocates the route object when the caller owner slot is non-null, copies two caller strings into the local route buffers at `+0x04` and `+0x44`, stores the supplied callback table across `[route+0x88]` through `[route+0x9c]`, records the owner context at `[route+0x104]`, initializes the route cookie state and recent-cookie ring, and explicitly zeroes the secondary callback slots `[route+0xa0]`, `[route+0xa4]`, and `[route+0xd4]` before any later patch-up. Current grounded callers are multiplayer_transport_try_connect_status_route and multiplayer_transport_try_connect_live_route through the wrapper at `0x58cc40` or the constructor directly. objdump
273 0x0058d7a0 55 multiplayer_transport_set_local_name shell thiscall inferred ghidra-headless 3 Updates the local identity string stored in the session-event transport object. When the transport is already configured through [this+0x44] and the incoming name pointer is non-null and non-empty it copies up to 0x40 bytes into [this+0x04] clears byte [this+0x43] and then forwards the same name into the lower transport update path through 0x0058f330. ghidra + rizin + llvm-objdump
274 0x0058d830 40 multiplayer_transport_disconnect shell thiscall inferred ghidra-headless 3 Disconnects the session-event transport object from its current live route. The helper flips the internal active state through 0x005965d0 and 0x005961b0 calls the shared teardown block at 0x0058d810 and finally clears byte [this+0x60] and the copied local name at [this+0xaf4]. ghidra + rizin + llvm-objdump
275 0x0058d860 59 multiplayer_transport_release_worker_and_reset_runtime_state shell cdecl inferred rizin 3 Small runtime-reset wrapper for the outer session-event transport object. When the owned worker pointer at [this] is present it first tears that worker down through multiplayer_transport_worker_shutdown_gracefully then clears the worker pointer the configured flag byte at [this+0x04] the text-stream owner slots at [this+0x44] and [this+0x48] reruns 0x00593370 and the shared reset block at 0x0058d810 and finally clears the live route and deferred-runtime fields at [this+0x180c] [this+0x1810] and [this+0x1edc]. rizin + llvm-objdump
276 0x0058d8d0 143 multiplayer_transport_service_frame shell cdecl inferred objdump + caller xrefs 3 Recurring service pump for the outer session-event transport object. When the transport is configured through `[this+0x44]` or `[this+0x48]` it first services one worker step through multiplayer_transport_service_worker_once on the owned worker at `[this]`; if deferred reset is armed at `[this+0x1edc]` and the outstanding-work count has reached zero it falls straight into the common reset path at `0x0058de50`. Otherwise it conditionally emits the keepalive text at `0x005e1c24` after roughly `0x493e0` ms of inactivity, services the deeper selector or route helpers through `0x00596210` and `0x00597380`, finalizes deferred reset when the work count at `[this+0x1808]` reaches zero, and finishes by forwarding the caller selector through `0x00592800`. Current grounded callers reach it through multiplayer_transport_flush_and_maybe_shutdown and the immediate-drain submission paths, which places it at the center of the shell-owned multiplayer transport cadence. objdump + caller xrefs + strings
277 0x0058c340 144 multiplayer_gamespy_decode_triplet_control_payload shell cdecl inferred objdump 3 Decodes one length-coded three-part GameSpy control payload and re-emits it through the shared packet-field builder at `0x58c0c0`. The helper reads up to three bounded variable-length slices from the caller payload, then packages them as field classes `0`, `1`, and `2`. The current grounded caller is subtype `0` of multiplayer_gamespy_route_dispatch_inbound_packet's `0xfe 0xfd` switch. objdump
278 0x0058c5c0 60 multiplayer_gamespy_build_backslash_query_response shell cdecl inferred objdump + strings 3 Builds one backslash-delimited GameSpy query reply into the caller buffer. It seeds the leading `\\`, emits three callback-driven field groups through `0x58c3e0` for selectors `0`, `1`, and `2`, appends the fixed terminator token at `0x005e1b6c`, and leaves the result ready for immediate send. The current grounded caller is the backslash-packet branch inside multiplayer_gamespy_route_dispatch_inbound_packet. objdump + strings
279 0x0058c600 142 multiplayer_gamespy_dispatch_natneg_or_raw_callback shell cdecl inferred objdump + strings 3 Dispatches one validated extended GameSpy payload into route-owner callbacks. When the payload begins with the six-byte magic `fd fc 1e 66 6a b2` it treats bytes `[payload+6..+9]` as a little-endian value, materializes a small wrapper object through `0x5b31f8`, and forwards it through the route callback at `[route+0xa0]`; otherwise it falls back to the raw payload callback at `[route+0xa4]`. Both slots are optional: the helper tests them for null and returns without dispatch when the selected callback is absent. The current grounded caller is subtype `6` of multiplayer_gamespy_route_dispatch_inbound_packet. objdump + strings
280 0x0058c690 58 multiplayer_gamespy_route_dedupe_recent_cookie shell cdecl inferred objdump 3 Maintains a small ring of the last ten 32-bit route cookies or packet ids under `[route+0xd8]` and `[route+0x100]`. It returns `1` when the caller id is already present and otherwise inserts it into the rotating slot table and returns `0`. The current grounded caller is subtype `6` of multiplayer_gamespy_route_dispatch_inbound_packet before dispatching the validated extended payload. objdump
281 0x0058c6d0 606 multiplayer_gamespy_route_dispatch_inbound_packet shell cdecl inferred objdump + strings 3 Main inbound packet parser for one GameSpy-style route object. It sends semicolon-prefixed lines through the route callback at `[route+0xd4]`, but only when that slot is non-null; otherwise the semicolon branch returns without additional work. It treats backslash-prefixed packets as query requests and answers them by building a reply through multiplayer_gamespy_build_backslash_query_response, and otherwise requires at least seven bytes plus the `0xfe 0xfd` header before entering a subtype switch on byte `2`. The grounded subtype branches are now tighter: subtype `0` decodes a three-slice control payload through multiplayer_gamespy_decode_triplet_control_payload; subtype `1` copies one bounded NUL-terminated string through `0x58c030`; subtype `2` copies up to `0x20` raw bytes into the local packet builder as field class `5`; subtype `4` validates the four-byte route cookie at `[route+0x84]`, clears `[route+0xb0]`, and dispatches the remaining payload through the validated route callback at `[route+0x9c]`, which the transport-owned status and live routes seed to `0x5972c0`; subtype `6` validates the same cookie, emits a field-class `7` record with the next dword, dedupes that dword through multiplayer_gamespy_route_dedupe_recent_cookie, and then dispatches the trailing payload through multiplayer_gamespy_dispatch_natneg_or_raw_callback. In the currently grounded transport-owned status route, that extended callback layer is patched after construction so `[route+0xa0]` points at `0x597330`; the raw fallback slot `[route+0xa4]` remains unresolved and currently no-ops when null. Subtypes `3` and `5` currently fall through without additional work. The current grounded caller is multiplayer_gamespy_route_drain_inbound_packets. objdump + strings
282 0x0058cfd0 107 multiplayer_gamespy_route_release_and_free shell thiscall inferred objdump 3 Common teardown helper for one GameSpy-style route object. When the route still looks live through `[route+0xb4]` it first sends the mode-`2` control frame through `0x58cd70`, closes the current route handle at `[route]` when needed through `0x58bc4e`, resets the handle and last-send timestamp fields, and finally frees the route object through `0x58f3c0` when it is not the default singleton at `0x00629840`. Current grounded callers are multiplayer_transport_release_status_route, multiplayer_transport_release_live_route, and the status-route reconnect path. objdump
283 0x0058ccd0 107 multiplayer_gamespy_route_drain_inbound_packets shell cdecl inferred objdump + strings 3 Inbound packet drain for one GameSpy-style route object. While the route receive queue remains non-empty it pulls one datagram through `0x58bc7e`, routes the payload into `multiplayer_gamespy_route_dispatch_inbound_packet`, and then repeats. The parser accepts semicolon-prefixed lines through the route callback at `[route+0xd4]`, backslash-delimited key bundles, and `0xfe 0xfd` GameSpy control packets. The current grounded caller is the lower route-service helper at `0x58d040`. objdump + strings
284 0x0058cee0 164 multiplayer_gamespy_route_service_retry_and_keepalive_timers shell cdecl inferred objdump + strings 3 Timer and retry side of one GameSpy-style route object. It checks the active route handle and challenge or retry fields around `[route+0xa8]`, `[route+0xac]`, and `[route+0xb0]`, emits outbound control traffic through the local send helper when the `master.gamespy.com` challenge or state flow stalls, raises the `No challenge value was received from the master server.` callback through `[route+0x9c]` after repeated failures, and periodically refreshes the auxiliary timestamp through `0x58c950`. The current grounded caller is the lower route-service helper at `0x58d040`, which makes this the timer or retry half of the recurring GameSpy route cadence. objdump + strings
285 0x0058d040 37 multiplayer_gamespy_route_service_frame shell cdecl inferred objdump + strings 3 Low-level recurring service step for one GameSpy-style route object. When the route handle state at `[route+0xb4]` is live it first services retry and keepalive timers through `multiplayer_gamespy_route_service_retry_and_keepalive_timers` and then drains inbound packets through `multiplayer_gamespy_route_drain_inbound_packets`. Current grounded callers are `multiplayer_transport_service_status_and_live_routes`, which uses the same helper for both the auxiliary status route at `[transport+0xaf0]` and the current live route at `[transport+0x1ecc]`. objdump + strings
286 0x0058d960 7 multiplayer_transport_select_status_route shell thiscall inferred ghidra-headless 3 Thin route-selector wrapper for the session-event transport. It forwards the requested small route id in EDX into multiplayer_transport_set_mode_q_flag which updates [this+0x560] formats the underlying `MODE %s -q` or `MODE %s +q` command text and reconfigures the transport-side callback plumbing. ghidra + rizin + llvm-objdump
287 0x0058d970 89 multiplayer_transport_subscribe_field_callback_set shell thiscall inferred ghidra-headless 3 Registers one field-subscription callback set on the session-event transport. When the transport is active byte [this+0x60] is set it stores the caller metadata at [this+0x176c] and [this+0x1770] then forwards the field-id list string callback and context into multiplayer_transport_register_field_subscription_bundle; on failure it falls back through multiplayer_transport_enqueue_field_snapshot_record. ghidra + rizin + llvm-objdump
288 0x0058d9e0 55 multiplayer_transport_send_selector_text shell thiscall inferred ghidra-headless 3 Sends one caller-supplied text pointer through a selector-specific transport slot. The helper looks up the selector entry from the handler table rooted at [this+0x390] and when both the text pointer and slot are valid forwards the string plus caller flag into the lower send helper at 0x0058e7e0 using the descriptor block at [this+0x80+selector*0x101]. ghidra + rizin + llvm-objdump
300 0x0058e370 33 multiplayer_transport_is_request_pending shell cdecl inferred ghidra-headless 3 Returns true while the caller transport request still appears in either the queued request collection at [this+0x550] or the secondary active-work collection checked through 0x0059c540. Immediate-drain callers use it as the loop predicate after pumping queued text and sleeping for 10 ms. ghidra + rizin + llvm-objdump
301 0x0058e3f0 137 multiplayer_transport_drain_request_text_queue shell cdecl inferred ghidra-headless 3 Immediate-drain helper for one transport request. When request kind [req+0x20] is `1` it walks queued transport text lines under [this+0x1c] republishes them through 0x0059b790 and notifies the small observer table through 0x0058e310 until the queue is empty. When request kind `2` drains it also publishes `Disconnected`. Both paths refresh timeout state through 0x00598030 and finish by forwarding the request into 0x0059c470. ghidra + rizin + llvm-objdump + strings
302 0x0058e480 105 multiplayer_transport_worker_shutdown_gracefully shell cdecl inferred rizin 3 Graceful shutdown wrapper for one multiplayer transport worker. If the callback object at `[this+0x538]` and its owner slot `[this+0x544]` are present it first emits a final owner notification through the callback vtable using fallback text at `0x005c87a8`. When the owned text-stream socket at `[this+0x1c]` is still live it appends `QUIT :Later!` through multiplayer_transport_text_stream_append_crlf_line and services one I/O step through multiplayer_transport_text_stream_service_io before destroying the registered-name store at `[this+0x548]`, the pending-template dispatch store at `[this+0x54c]`, the text-stream object at `[this+0x1c]`, and finally the worker backing block itself. rizin + llvm-objdump + strings
303 0x0058e4f0 12 multiplayer_transport_service_worker_once shell cdecl inferred objdump 3 Very small bridge from the outer session-event transport object into its owned worker. It forwards the worker pointer in `[this]` into multiplayer_transport_drain_request_text_queue with a null request pointer, making it the one-step worker service helper used by the recurring transport pump. objdump
304 0x0058e650 80 multiplayer_transport_sanitize_identifier shell cdecl inferred ghidra-headless 4 Normalizes a caller-supplied identifier string into the destination buffer by replacing leading punctuation and any later disallowed characters with underscores while preserving acceptable bytes from the source. Current grounded callers use it for the randomized `RT3Player%d` retry name and for locally submitted session-event text records. ghidra + rizin + llvm-objdump + strings
305 0x0058e6b0 98 multiplayer_transport_set_mode_q_flag shell thiscall inferred ghidra-headless 4 Updates the transport mode-q flag tracked at [this+0x560]. When the requested value changes it formats either `MODE %s -q` or `MODE %s +q` against the active name buffer at [this+0x36c] stores the new flag and for mode `0` refreshes the downstream callback plumbing through 0x0059e070 and 0x0059de00 using helper 0x0058e6a0. ghidra + rizin + llvm-objdump + strings
306 0x0058e8c0 37 multiplayer_transport_publish_topic_status_line shell thiscall inferred ghidra-headless 3 Formats and publishes one `TOPIC %s :%s` status line through the active transport text buffer at [this+0x1c]. When the caller text is null it falls back to the shared empty sample at 0x005c87a8. Current grounded caller is multiplayer_transport_handle_names_query_response. ghidra + rizin + llvm-objdump + strings
331 0x00592d70 77 multiplayer_transport_enqueue_callback_slot12_record shell cdecl inferred ghidra-headless 2 Gated callback-slot wrapper that copies a caller-supplied seven-dword block and enqueues it as a 0x20-byte opcode `12` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x179c] is set. The record is built around the callback-side state rooted near [this+0x17f8]. ghidra + rizin + llvm-objdump
332 0x00592dc0 72 multiplayer_transport_enqueue_callback_slot13_record shell cdecl inferred ghidra-headless 2 Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `13` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a0] is set. The record is built around the callback-side state rooted near [this+0x17f8]. ghidra + rizin + llvm-objdump
333 0x00592e10 72 multiplayer_transport_enqueue_callback_slot14_record shell cdecl inferred ghidra-headless 2 Gated callback-slot wrapper that enqueues one 0x10-byte opcode `14` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a4] is set. The record is built around the callback-side state rooted near [this+0x17f8]. ghidra + rizin + llvm-objdump
334 0x00593120 72 multiplayer_transport_enqueue_callback_slot19_record shell cdecl inferred objdump 2 Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `19` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f560`, which first updates selector-view runtime state through `0x5948f0` and then forwards the same selector-name pair through this owner-callback lane. objdump + caller xrefs
335 0x00592e60 64 multiplayer_transport_enqueue_callback_slot15_record shell cdecl inferred ghidra-headless 2 Gated callback-slot wrapper that enqueues one 0x08-byte opcode `15` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a8] is set. The record is built around the callback-side state rooted near [this+0x17f8]. ghidra + rizin + llvm-objdump
336 0x00592ea0 64 multiplayer_transport_enqueue_callback_slot16_record shell cdecl inferred ghidra-headless 2 Gated callback-slot wrapper that enqueues one 0x08-byte opcode `16` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17ac] is set. The record is built around the callback-side state rooted near [this+0x17f8]. ghidra + rizin + llvm-objdump
337 0x00593460 87 multiplayer_transport_mark_selector_slot_records_stale shell cdecl inferred ghidra-headless 3 Scans the queued transport request collection at [this+0x1780] for records of type `1` or `2` whose selector-slot field at +0x1c matches the requested slot id. Matching records are marked stale by setting byte or dword field +0x38 to one. Current grounded caller is multiplayer_transport_reset_selector_slot. ghidra + rizin + llvm-objdump
338 0x00593790 351 multiplayer_transport_handle_names_query_response shell cdecl inferred ghidra-headless 3 Completion callback for multiplayer_transport_submit_names_query_with_callback. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can update route-binding state through multiplayer_transport_is_route_mode_active_nonterminal and multiplayer_transport_try_connect_status_route_once seeds selector slot `2` through multiplayer_transport_init_selector_slot upserts returned name records through multiplayer_transport_upsert_selector_name_entry publishes `TOPIC` and `MODE` lines through multiplayer_transport_publish_topic_status_line and multiplayer_transport_publish_mode_level_status_line and may promote one deferred route binding into [this+0x1ec8]. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request. ghidra + rizin + llvm-objdump + strings
339 0x005938f0 145 multiplayer_transport_handle_bound_route_request shell cdecl inferred ghidra-headless 3 Completion callback for multiplayer_transport_submit_bound_route_request. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can publish [req+0x24] through multiplayer_transport_publish_mode_key_status_line and then schedules multiplayer_transport_handle_names_query_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request. ghidra + rizin + llvm-objdump
340 0x00594690 0x00594620 76 106 multiplayer_transport_mark_selector_slot_views_dirty multiplayer_transport_reset_selector_view_entry_runtime_state shell cdecl inferred ghidra-headless objdump 2 Marks one selector slot dirty in the transport-side view state rooted at [this+0xac8]. It sets slot-specific dirty bits at +0xa0 and +0xa4 when backing arrays at [this+0xad0] or [this+0xadc] are populated and also sets +0xa8 for selector slot `2`. Current grounded callers are multiplayer_transport_set_selector_slot_flags and multiplayer_transport_upsert_selector_name_entry. Clears the extended runtime fields of one selector-view entry. When the transport-side selector-view layer is present through `[this+0xac8]` it zeroes the entry block from `+0x68` through `+0xa8`, including the dirty or refresh flags at `+0xa0`, `+0xa4`, and `+0xa8`, then returns success. Current grounded caller is the selector-view snapshot export path at `0x594ee0`. ghidra + rizin + llvm-objdump objdump
341 0x00594690 76 multiplayer_transport_mark_selector_slot_views_dirty shell cdecl inferred ghidra-headless 2 Marks one selector slot dirty in the transport-side selector-view layer rooted at `[this+0xab4]` with backing arrays around `[this+0xad0]..[this+0xae4]`. It sets slot-specific dirty bits at `+0xa0` and `+0xa4` when the matching backing arrays are populated and also sets `+0xa8` for selector slot `2`. Current grounded callers are multiplayer_transport_set_selector_slot_flags and multiplayer_transport_upsert_selector_name_entry. ghidra + rizin + llvm-objdump
342 0x005949a0 80 multiplayer_transport_ensure_selector_view_store shell thiscall inferred objdump 3 Ensures the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it allocates a `0xac`-byte keyed container through `0x58faf0`, stores the resulting root at `[this+0xab4]`, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport setup and reset path around `0x58d7ee`. objdump + caller xrefs
343 0x005949f0 56 multiplayer_transport_release_selector_view_store shell thiscall inferred objdump 3 Releases the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it frees the root at `[this+0xab4]` through `0x58f8b0`, clears that root, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport teardown path around `0x58d81a`. objdump + caller xrefs
344 0x00594a40 80 multiplayer_transport_find_selector_view_entry_by_name shell cdecl inferred objdump 3 Looks up one selector-view entry by its bounded name string. It copies up to `0x40` bytes of the caller key into a local buffer, then probes the keyed selector-view store rooted at `[this+0xab4]` through `0x58f9c0` and returns the matching entry pointer or null. Current grounded callers include multiplayer_transport_set_selector_slot_flags, multiplayer_transport_merge_selector_mode_mask, multiplayer_transport_upsert_selector_name_entry, and several later selector-view formatting helpers. objdump + caller xrefs
345 0x00594bd0 97 multiplayer_transport_set_selector_slot_flags shell cdecl inferred ghidra-headless 3 Updates one selector-slot flag dword at [entry+0x5c] after resolving the current selector entry through 0x00594a40. When selector index `2` flips bit `1` it forwards the new bit value through multiplayer_transport_enqueue_callback_slot15_record and then notifies the shared selector-change callback path through 0x00593250 with selector id old flags and new flags. ghidra + rizin + llvm-objdump
346 0x00594c40 103 multiplayer_transport_parse_selector_mode_letters shell cdecl inferred ghidra-headless 3 Parses one selector-mode letter string into a small bitmask by probing for the letters `s` `r` `g` `a` and `h`. Current grounded callers merge this mask into the selector-slot flags that live at [entry+0x5c]. ghidra + rizin + llvm-objdump + strings
347 0x00594cb0 65 multiplayer_transport_merge_selector_mode_mask shell cdecl inferred ghidra-headless 3 Resolves one selector entry through 0x00594a40 parses the caller mode-letter string through multiplayer_transport_parse_selector_mode_letters preserves the current presence bits 0x20 and 0x40 from [entry+0x5c] and commits the merged result through multiplayer_transport_set_selector_slot_flags. ghidra + rizin + llvm-objdump + strings
354 0x00595440 98 multiplayer_transport_init_selector_slot shell cdecl inferred ghidra-headless 3 Initializes one selector slot under [this+0x384] and [this+0x390]. It copies caller text or the default sample at 0x005c87a8 into the fixed selector buffer at [slot+0x39c] clears byte [slot+0x59b] reruns multiplayer_transport_service_status_pump and then notifies multiplayer_transport_submit_profile_key_query_bundle_default for the refreshed selector slot. ghidra + rizin + llvm-objdump + strings
355 0x005954b0 238 multiplayer_transport_reset_selector_slot shell cdecl inferred ghidra-headless 3 Resets one selector slot under [this+0x384] and [this+0x390]. When the slot is active it tears the current selector object down through 0x593460 optionally republishes caller text through 0x58e7a0 refreshes selector bookkeeping through 0x5950a0 and clears the active and present flags before returning. ghidra + rizin + llvm-objdump
356 0x00595620 35 multiplayer_transport_release_route_binding shell cdecl inferred ghidra-headless 3 Releases the current route binding stored at [this+0x1ec8]. It detaches the binding from the descriptor object at [this+0x1ed0] through 0x58f3c0 unlinks it through 0x5933a0 and clears [this+0x1ec8]. ghidra + rizin + llvm-objdump
357 0x00595650 688 multiplayer_transport_set_route_mode shell cdecl inferred ghidra-headless 3 Main route-mode state machine for the session-event transport. It latches the requested small mode at [this+0x18b8] and dispatches modes `0` through `5` across live-route teardown selector-slot init or reset am-rating route seeding live-route connect and route-binding release paths. The branch uses multiplayer_transport_release_live_route multiplayer_transport_try_seed_am_rating_route_table multiplayer_transport_try_connect_live_route and multiplayer_transport_release_route_binding to converge on the next stable mode. Main route-mode state machine for the session-event transport. It latches the requested small mode at [this+0x18b8] and dispatches modes `0` through `5` across live-route teardown selector-slot init or reset am-rating route seeding live-route connect and route-binding release paths. The currently grounded mode transitions converge by tearing live routes down through multiplayer_transport_release_live_route and rebuilding them through multiplayer_transport_try_connect_live_route rather than mutating the live route object's callback slots in place. The branch uses multiplayer_transport_release_live_route multiplayer_transport_try_seed_am_rating_route_table multiplayer_transport_try_connect_live_route and multiplayer_transport_release_route_binding to converge on the next stable mode. ghidra + rizin + llvm-objdump + strings
358 0x005958e0 156 multiplayer_transport_try_stage_route_callback_payload shell cdecl inferred ghidra-headless 2 Builds one staged route-callback payload from the caller route object and transport-local text buffer at [this+0x60]. It extracts several caller fields through the 0x58d1f0 0x58d240 0x58d220 and 0x58d250 or 0x58d200 helpers packs them through multiplayer_transport_format_gsp_payload submits the staged text through multiplayer_transport_submit_selector_text_route_request and on success stores the cloned callback payload returned by multiplayer_transport_clone_staged_callback_payload at [this+0xb50]. ghidra + rizin + llvm-objdump + strings
359 0x00595980 84 multiplayer_transport_handle_route_status_result shell cdecl inferred ghidra-headless 2 Completion callback used by multiplayer_transport_submit_route_status_request. When the callback result is nonzero it compares the live status counters at [this+0xac0] and [this+0xb48] and advances the route-mode state machine through mode `2` or modes `3` or `4`. When the callback result is zero it sets [this+0x1ed8] and re-enters multiplayer_transport_set_route_mode using the current am-rating route state at [this+0x1ed4]. ghidra + rizin + llvm-objdump
360 0x005959e0 81 multiplayer_transport_submit_route_status_request shell cdecl inferred ghidra-headless 3 Submits one route-status request for the current binding at [this+0x1ec8]. It gathers the binding fields at +0x2c and +0x30 together with the local counter at [this+0xb48] and default sample text at 0x005c87a8 then sends that request through 0x593980 using multiplayer_transport_handle_route_status_result as the completion callback. Failure sets [this+0x1ed8] so the route-mode setter can fall back immediately. ghidra + rizin + llvm-objdump
376 0x00596060 48 multiplayer_transport_reset_am_rating_route_state shell cdecl inferred ghidra-headless 3 Small reset helper for the active `gsi_am_rating` route state. When [this+0xba0] is set it clears the route callback table at [this+0x18bc] resets [this+0x1ec4] to zero and clears the auxiliary route cache at [this+0x1e7c]. ghidra + rizin + llvm-objdump + strings
377 0x00596090 272 multiplayer_transport_init_route_callback_tables shell cdecl inferred ghidra-headless 3 Initializes route callback tables at [this+0xba4] [this+0x1724] [this+0x1164] [this+0x18bc] and [this+0x1e7c]. Installs handlers 0x00595a40 0x00595b60 0x00595bc0 0x00595e10 and multiplayer_transport_dispatch_am_rating_route_callback seeds default selector text from static tables and sets [this+0xba0]. ghidra + rizin + llvm-objdump
378 0x005961b0 92 multiplayer_transport_teardown_route_callback_tables shell cdecl inferred ghidra-headless 4 Clears progress and capacity caches destroys the callback tables at [this+0xba4] [this+0x1164] and [this+0x18bc] clears the related caches at [this+0x1724] and [this+0x1e7c] and resets [this+0x1ec4] to zero. ghidra + rizin + llvm-objdump
379 0x00596210 71 multiplayer_transport_service_route_callback_tables shell cdecl inferred objdump 3 Recurring service sweep for the transport-owned callback tables and field caches. When route callback plumbing is enabled at `[this+0xba0]` it services the callback tables at `[this+0xba4]`, `[this+0x1164]`, and `[this+0x18bc]` through the shared table-service helper `0x591290`, services the cache blocks at `[this+0x1724]` and `[this+0x1e7c]` through `0x5a0c80`, and otherwise returns immediately. The current grounded caller is multiplayer_transport_service_frame, which makes this the callback-table side of the recurring multiplayer transport cadence. objdump
380 0x005962e0 583 multiplayer_transport_register_field_subscription_bundle shell cdecl inferred ghidra-headless 3 Builds one field-subscription bundle from the field-id list optional suffix text and selector-name table. Rebuilds the callback table at [this+0xba4] seeds the local field cache at [this+0x1724] installs the subscription block through 0x590ed0 sets [this+0x1774] on success and enqueues an immediate mode-3 field snapshot through multiplayer_transport_enqueue_field_snapshot_record. ghidra + rizin + llvm-objdump
381 0x00596530 101 multiplayer_transport_try_seed_am_rating_route_table shell cdecl inferred ghidra-headless 2 Used by the larger route-mode setter around 0x595650. It first calls multiplayer_transport_reset_am_rating_route_state then rebuilds one mode `4` route entry in the callback table at [this+0x18bc] from the stored descriptor at [this+0x1ed0]. Success clears [this+0x1ed4] sets [this+0x1ec4] to one and failure reverts through multiplayer_transport_reset_am_rating_route_state before setting [this+0x1ed4]. ghidra + rizin + llvm-objdump + strings
382 0x005965a0 44 multiplayer_transport_try_connect_status_route_once shell cdecl inferred ghidra-headless 3 Single-shot wrapper for the auxiliary status-route object at [this+0xaf0]. When the in-flight latch at [this+0xb40] is already set it returns false immediately. Otherwise it sets that latch and forwards the caller route id into multiplayer_transport_try_connect_status_route then booleanizes the result. Current grounded caller is multiplayer_transport_handle_names_query_response. ghidra + rizin + llvm-objdump
384 0x00596fa0 19 multiplayer_transport_submit_profile_key_query_bundle_with_context shell cdecl inferred rizin 2 Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector or route context in `edx` and forwards the stack-supplied context pointer as the extra bundle argument. Current grounded use is through the local callback table rooted at 0x0059f8b0. rizin + llvm-objdump
385 0x00596fc0 14 multiplayer_transport_submit_profile_key_query_bundle_default shell cdecl inferred rizin 3 Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector slot in `edx` and forces a null extra-context argument. Current grounded caller is multiplayer_transport_init_selector_slot and the same wrapper is also installed through the local callback table rooted at 0x0059fb60. rizin + llvm-objdump
386 0x00596fd0 441 multiplayer_transport_dispatch_status_route_event shell cdecl inferred rizin 3 Main local callback dispatcher for the auxiliary status-route object. It gates on [this+0x398] [this+0xb44] and flag bits in [this+0xb38] then maps route event ids through the local table at 0x005970c4 into selector text publication openstaging publication boolean status publication and callback forwarding paths. The dispatcher publishes through multiplayer_transport_send_selector_text and multiplayer_transport_publish_fixed_token_message and can also invoke the owner callback at [this+0x17dc] with payload [this+0x17f8]. rizin + llvm-objdump + strings
387 0x005972c0 97 multiplayer_transport_handle_validated_route_cookie_event shell cdecl inferred objdump 3 Validated subtype-`4` callback for the transport-owned GameSpy route family. The route constructor seeds this helper into `[route+0x9c]`; after multiplayer_gamespy_route_dispatch_inbound_packet validates the current route cookie it forwards the event id in `ecx`, the remaining payload pointer in `edx`, and the owner transport context from `[route+0x104]`. When multiplayer_transport_is_route_mode_active_nonterminal succeeds it marks `[this+0x1ed8]` and re-enters multiplayer_transport_set_route_mode with a mode-selection bit derived from `[this+0x1ed4]` and `[this+0x18b8]`; otherwise it falls back to the owner callback at `[this+0x17f0]` using context `[this+0x17f8]`. objdump
388 0x00597330 28 multiplayer_transport_forward_validated_extended_route_payload shell cdecl inferred objdump 3 Small forwarding callback used for the transport-owned status route's validated extended-payload slot. It treats `edx` as the owner transport object, checks the owner callback pointer at `[this+0x17f4]`, and when present forwards the validated payload wrapper in `ecx` together with owner context `[this+0x17f8]`. Current grounded caller is the status-route connect helper through multiplayer_gamespy_route_set_extended_payload_callback. objdump
389 0x00597350 30 multiplayer_transport_release_status_route shell cdecl inferred ghidra-headless 3 Releases the auxiliary status-route object stored at [this+0xaf0] through 0x58cfd0 and clears the owner slot afterward. Status-pump cleanup fixed-token publishing and the auxiliary route connect helper use this before rebuilding status-route state. ghidra + rizin + llvm-objdump
390 0x005973d0 0x00597380 170 34 multiplayer_transport_try_connect_status_route multiplayer_transport_service_status_and_live_routes shell cdecl inferred ghidra-headless objdump 3 Attempts to connect or rebuild the auxiliary status-route object at [this+0xaf0]. It first tears any existing status route down through multiplayer_transport_release_status_route then builds a callback table from the local handler set rooted at multiplayer_transport_dispatch_status_route_event through 0x5972c0 chooses either the default route id `0x1964` or the caller route id and connects through 0x58cc40 or 0x58c9b0. On success it copies [this+0x9a8] into [this+0xb3c] wires the created route object through 0x58bc90 using callback 0x597330 and clears [this+0xb38]. Recurring route-object sweep for the session-event transport. It services the auxiliary status-route object at `[this+0xaf0]` through the shared low-level route tick helper `0x58d040` when present and then services the current live route at `[this+0x1ecc]` through that same helper. The current grounded caller is multiplayer_transport_service_frame, which makes this the route-object side of the recurring multiplayer transport cadence. ghidra + rizin + llvm-objdump + strings objdump
391 0x005973d0 170 multiplayer_transport_try_connect_status_route shell cdecl inferred ghidra-headless 3 Attempts to connect or rebuild the auxiliary status-route object at [this+0xaf0]. It first tears any existing status route down through multiplayer_transport_release_status_route then builds a callback table from the local handler set rooted at multiplayer_transport_dispatch_status_route_event through multiplayer_transport_handle_validated_route_cookie_event chooses either the default route id `0x1964` or the caller route id and connects through `0x58cc40` or multiplayer_gamespy_route_construct_and_seed_callback_vector. On success it copies [this+0x9a8] into [this+0xb3c] patches the created route object's extended-payload callback slot through multiplayer_gamespy_route_set_extended_payload_callback using callback `0x597330` and clears [this+0xb38]. ghidra + rizin + llvm-objdump + strings
392 0x005973b0 30 multiplayer_transport_release_live_route shell cdecl inferred ghidra-headless 4 Releases the current live route object stored at [this+0x1ecc] through 0x58cfd0 and clears the owner slot afterward. The route-mode setter and connect helper use it before rebuilding or switching live route state. ghidra + rizin + llvm-objdump
393 0x00597480 261 multiplayer_transport_try_connect_live_route shell cdecl inferred ghidra-headless 3 Attempts to connect or rebuild the current live route object at [this+0x1ecc]. It first clears any existing live route through multiplayer_transport_release_live_route then formats a local identifier from [this+0x60] and 0x005dccfc chooses either the default route id `0x1964` or the binding-specific id and connects through 0x58cc40 or 0x58c9b0. On success it updates [this+0x1ed8] and preserves the new live route state for the route-mode setter. Attempts to connect or rebuild the current live route object at [this+0x1ecc]. It first clears any existing live route through multiplayer_transport_release_live_route then formats a local identifier from [this+0x60] and 0x005dccfc chooses either the default route id `0x1964` or the binding-specific id and connects through 0x58cc40 or multiplayer_gamespy_route_construct_and_seed_callback_vector. In the currently grounded connect path it does not patch `[route+0xa0]`, `[route+0xa4]`, or `[route+0xd4]` after construction the way the status-route helper patches `[route+0xa0]`; on success it only updates [this+0x1ed8] and preserves the new live route state for the route-mode setter. ghidra + rizin + llvm-objdump + strings
394 0x00598230 67 multiplayer_transport_enqueue_names_query_record shell cdecl inferred ghidra-headless 3 Allocates one 0x10-byte transient names-query work item zeroes its four dword fields and submits it through 0x5980f0 as request kind `3` using the caller-provided sample or callback context pointer. The helper returns the allocated work item on success and null on allocation or submit failure. Current grounded caller is multiplayer_transport_submit_names_query_with_callback. ghidra + rizin + llvm-objdump
395 0x0058f0a0 99 multiplayer_transport_append_user_and_optional_nick_commands shell cdecl inferred rizin 3 Builds the initial identity command bundle for one multiplayer transport worker. It appends `USER %s %s %s :%s` to the owned text stream using worker text fields at [this+0x3ac] [this+0x42c] and [this+0x4b0] together with the fallback host `127.0.0.1` then checks the current nick through multiplayer_transport_is_valid_nick_string and either falls through multiplayer_transport_dispatch_or_release_callback_binding with mode `1` or appends `NICK %s` directly through the same text-stream path. rizin + llvm-objdump + strings
396 0x0058f920 72 hashed_entry_table_upsert support cdecl inferred rizin 4 Generic hashed-entry-table upsert over a bucket array of contiguous vectors. It computes the bucket index through the table hash callback at [this+0x0c] looks for an existing matching entry through hashed_entry_table_lookup and when found overwrites that slot through generic_vector_overwrite_with_callback; otherwise it appends the caller record into the selected bucket vector through 0x0059e4d0. rizin + llvm-objdump