jan/rrt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Split input/save/load atlas and update references

Browse source
This commit is contained in:
Jan Petykiewicz 2026-04-12 10:12:10 -07:00
commit 81316e6e49
13 changed files with 5301 additions and 4113 deletions
Download patch file Download diff file Expand all files Collapse all files

472
artifacts/exports/rt3-1.06/function-map.csv
View file

@ -315,6 +315,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x0045f6d0,334,shell_input_register_action_binding_with_mode_specific_defaults,shell,cdecl,inferred,objdump + caller inspection + registry correlation,4,"Shared registration helper over the shell input-binding registry rooted at `0x006acd78..0x006ad960`. The helper first selects one mode-specific `(binding_code, companion_value)` pair from the caller's four fallback pairs according to shell mode dword `0x006d3c84`; when the selected binding code is not `0xff`, it re-enters `0x0045ed90` to resolve or create the target registry bucket, optionally updates an existing entry for the same companion discriminator `[entry+0x94]` through `0x0045f8a0`, or allocates and links a fresh entry from the pool owner at `0x006acd6c` and the monotonic id source `0x006acd68`. The new or updated record stores the action id, mode flags, callback pointer, localized label string, and the selected default pair before it is linked back into the per-action bucket family. Current grounded callers include the camera-view command registration block at `0x00460903..0x00460cac` and the world-view keyboard registration block at `0x00460720..0x004608e7`, which makes this the current shared action-binding registration helper rather than a camera-specific leaf.","objdump + caller inspection + registry correlation + allocation-pool correlation + mode-specific-default correlation"
0x0045f8a0,315,shell_input_binding_registry_replace_existing_entry_by_action_bucket_and_mode_mask,shell,cdecl,inferred,objdump + local disassembly + caller inspection + registry correlation,4,"Updates one existing binding entry for a specific action bucket plus mode-mask discriminator. The helper first scans the requested live bucket at `0x006acd78..0x006ad960` for an entry whose stored mode mask `[entry+0x94]` matches the caller value in `EDX`; when found it copies the full record to a local stack frame, unlinks and releases the live record from both its bucket and the pool owner at `0x006acd6c`, then re-enters `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0` with the preserved callback pointer, localized label pointer, default-pair payload, and the copied companion values while forcing the binding-code selector to `0xff`. Current grounded caller is the registration helper `0x0045f6d0`, which uses this path when a same-bucket same-mode entry already exists for the target action. This is therefore the safest current read for the existing-entry replacement helper rather than a generic free-and-realloc wrapper.","objdump + local disassembly + caller inspection + registry correlation + preserved-payload correlation"
0x0045f9e0,598,shell_input_seed_default_binding_registry_entries_from_static_table,shell,cdecl,inferred,objdump + local disassembly + static-table inspection,4,"Seeds the shell input-binding registry from the static default table rooted at `0x005ecadc`. The helper walks `0x71` eight-byte rows, localizes each row label id at `+0x04`, decodes the packed row policy word at `+0x06` into the mode-specific default tuple expected by `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`, and installs each resulting binding into the live registry. After the fixed table pass it appends a smaller manual post-table strip for adjacent shell commands such as the wrappers at `0x00441a00`, `0x00441940`, `0x00441980`, `0x00482b00`, `0x004408b0`, `0x00441ac0`, `0x004408d0`, and `0x00441af0`, using localized ids `0x0d4a` through the neighboring `0x0d53` band. Current grounded caller is the registry initializer `0x00461120`, which runs this helper after rebuilding the pool and queue roots. This is therefore the safest current read for the default binding seeder rather than a generic command-registration batch.","objdump + local disassembly + static-table inspection + post-table registration-strip correlation"
0x00460fe0,52,shell_input_register_localized_binding_command_id_0xdb5_to_action_0x6b,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db5`, then installs one default binding row with action id `0x6b`, callback `0x00441cb0`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits immediately beside the paired `0x0db6` half-step registration. The exact user-facing command name is still open, so the current annotation stays at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation"
0x00461000,52,shell_input_register_localized_binding_command_id_0xdb6_to_action_0x6d,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db6`, then installs one default binding row with action id `0x6d`, callback `0x00441d20`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The exact user-facing command name is still open, so the current annotation stays at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation"
0x00461040,40,shell_input_register_localized_binding_command_id_0xdb7_to_action_0x6a,shell,cdecl,inferred,objdump + local disassembly + installer correlation,2,"Tiny registration wrapper above `shell_input_register_action_binding_with_mode_specific_defaults` `0x0045f6d0`. The helper localizes command label id `0x0db7`, then installs one default binding row with action id `0x6a`, callback `0x004413e0`, zero modifier defaults, and no explicit fallback override pairs. Current grounded caller is the broader registry setup strip at `0x00460769..0x00461168`, where it sits beside the other fixed shell input command registrations. The exact user-facing command name is still open, so the current annotation stays at the concrete localized-id plus action-id level.","objdump + local disassembly + installer correlation + registration-strip correlation"
0x00461070,170,shell_input_binding_registry_destroy_all_roots_and_reset_globals,shell,cdecl,inferred,objdump + local disassembly + global-field correlation,4,"Destroys the live shell input-binding registry and clears all of its global roots. The helper first re-enters `shell_input_write_hotkeys_report_file` `0x0045f550` when the main pool owner at `0x006acd6c` is present, then releases the main pool owner `0x006acd6c`, the companion owner at `0x006acd70`, zeroes every bucket head/tail/count triple across `0x006acd78..0x006ad974`, and finally releases the temporary report queue owner at `0x006acd74` if it is still live. Current grounded caller is the setup helper `0x00461120`, which uses this as the hard reset before rebuilding the registry state. This is therefore the safest current read for the binding-registry teardown and global reset owner rather than a one-off file export command.","objdump + local disassembly + global-field correlation + teardown correlation + hotkey-report correlation"
@ -324,6 +325,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x00420030,578,city_connection_bonus_exists_matching_peer_site,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Reusable placed-structure scan beneath the city-connection bonus note family. The helper walks the live placed-structure collection at `0x006cec20`, first requiring each candidate peer to match one site-class token from the caller's local six-byte class table through `0x0042b2d0`, then applying four bounded caller-controlled filters before returning success on the first matching peer. Current filter roles are tighter now: the first stack flag enables the station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the linked-instance class-byte test through `0x0047de00 -> 0x0040c990 == 1`; the third stack flag enables the deeper route or peer-reachability sweep through `0x0047f310` and `0x0048e3c0`; and the fourth stack dword is an optional owning-company id that is matched through `placed_structure_query_linked_company_id` at `0x0047efe0`. Current grounded callers include the adjacent city bonus or status formatter around `0x004207d0`, where the helper's boolean combinations choose localized ids `3868` through `3873`, plus wider world-side sweeps at `0x00404d66`, `0x004221ea`, `0x00422264`, `0x00435930`, and `0x00435944`. This now looks like the common city-connection peer probe rather than a generic anonymous scan.","objdump + caller xrefs + callsite inspection + city-bonus note correlation + filter-role decoding"
0x00420280,204,city_connection_bonus_select_first_matching_peer_site,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Companion selector beside `city_connection_bonus_exists_matching_peer_site`. The helper walks the live placed-structure collection at `0x006cec20`, requires each candidate peer to match one site-class token from the caller's six-byte class table through `0x0042b2d0`, and then applies two caller-controlled filters before returning the first matching placed-structure id from the collection instead of a boolean. The first stack flag enables the same station-or-transit site-type gate through `0x0047fd50`; the second stack flag enables the stricter linked-instance class-byte requirement through `0x0047de00 -> 0x0040c990 == 1`; when either flag is zero the corresponding predicate becomes permissive. Current grounded callers are the city bonus or status formatter at `0x004207d0`, which uses the selected peer to recover linked-company context after the boolean note checks, and the earlier world-side branch at `0x004046f5`, which passes both flags as `1` before sampling the selected peer's derived coordinates through `0x0047df30` and `0x0047df50`. This now reads as the first-match peer selector paired with the broader existence probe rather than as a second generic scan.","objdump + caller xrefs + callsite inspection + filter-role decoding + peer-selector correlation"
0x004207d0,1053,city_site_format_connection_bonus_status_label,map,thiscall,inferred,objdump + caller inspection + RT3.lng strings,4,"Adjacent city-site label formatter above the city-connection peer helpers at `0x00420030` and `0x00420280`. When the preview-global `0x0062be84` is armed or the city-side subtype field `[this+0x23e]` is nonzero the function falls back into the neighboring virtual-style formatter at `0x00455860`; otherwise it builds one visible text block from the base city label at `[this+0x356]`, optionally appends the numeric value in `[this+0x276]`, and can append localized id `207` `(Connected)` when the active linked world object and city class checks succeed. If `[this+0x276]` is nonzero it then chooses one of the city-connection bonus note strings `3868` through `3873` by calling `city_connection_bonus_exists_matching_peer_site` at `0x00420030` with three meaningful filter combinations: a deeper peer-reachability pass, an active-company-only pass using `scenario_state_get_selected_chairman_company_record` at `0x004337a0`, and a broader any-company pass. After those boolean note checks it also re-enters `city_connection_bonus_select_first_matching_peer_site` at `0x00420280` to recover one representative matching peer site, resolves that peer's linked company through `placed_structure_query_linked_company_id` at `0x0047efe0`, and uses the selected company record when formatting the follow-on company-oriented text lane. That current grounded split is enough to tie `3869` `Connected By Another Station`, `3870` `Already Connected`, `3871` `Connected By Another Company`, `3872` `Already Connected by Another Company`, and `3873` `Not Connected` to this formatter boundary rather than to the station-detail overlay body. The helper also writes one caller-owned color field and label-priority scalar before returning style code `3`, so it currently reads as a world-label or hover-summary formatter for city connection-bonus state rather than a generic text helper.","objdump + caller inspection + RT3.lng strings + city-bonus note correlation + filter-combination decoding + peer-selector correlation"
0x0043f610,13,world_clear_station_detail_candidate_service_preview_pair_globals,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Tiny shared reset for the two preview globals at `0x005ee4fc` and `0x005ee500`. The helper writes `-1` into both lanes and returns. Current grounded callers are the shell-side preview clear and teardown paths in `StationDetail.win` at `0x00504a90` and `0x00505bf0`, where those globals hold the active `(station id, candidate id)` pair used by the world-side overlay scanner `0x0043f640`. This is the safest current read for the direct candidate-service preview-pair reset helper.","objdump + caller inspection + local disassembly + preview-pair correlation"
0x0043f620,20,world_store_station_detail_candidate_service_preview_pair_globals,map,cdecl,inferred,objdump + caller inspection + local disassembly,1,"Tiny shared setter for the same preview globals at `0x005ee4fc` and `0x005ee500`. The helper stores its two caller dwords into those lanes unchanged and returns. Current grounded caller is `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, where the pair is the active `(station id, candidate id)` selection later consumed by `world_render_station_candidate_service_map_overlay` `0x0043f640`. This is the safest current read for the direct candidate-service preview-pair setter.","objdump + caller inspection + local disassembly + preview-pair correlation"
0x0043f640,3797,world_render_station_candidate_service_map_overlay,render,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Renders the world-side map overlay behind the active `StationDetail.win` candidate-service preview. The helper reads the currently previewed `(station id, candidate id)` pair from `0x005ee4fc` and `0x005ee500`, rejects early when shell preview mode or cargo-economy gates are inactive, re-enters `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`, and then scans the placed-structure collection at `0x006cec20` through either the direct local-service path or the heavier route-side helper at `0x0047e690`. The candidate byte at `[candidate+0x46]` now looks like the key legend split: when it is nonzero the overlay formats the directional route rows `3874` `Coming To %1` and `3875` `Going From %1`; when it is zero the same two legend lanes instead format `3876` `Current Supply @ < %1` and `3877` `Current Demand @ > %1`. Empty directional lanes collapse to `3878` `--None--`, and the title lane falls back to literal `All` when no specific candidate label is active. The neighboring connection-state notes `3872` `Already Connected by Another Company` and `3873` `Not Connected` no longer look like direct overlay-body emits; current grounded disassembly keeps them in the adjacent city bonus or status formatter `city_site_format_connection_bonus_status_label` at `0x004207d0`, which reuses `city_connection_bonus_exists_matching_peer_site` at `0x00420030` plus `placed_structure_query_linked_company_id` at `0x0047efe0` before choosing those strings. `3879` `Out of Sync` is also outside this function body and belongs to the multiplayer preview dataset path at `0x0046b780`. This now looks like the first grounded world-side owner above the shell preview pair armed by `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` rather than a generic hidden scanner.","objdump + RT3.lng strings + caller inspection + preview-overlay correlation + legend-branch correlation + adjacent-formatter boundary check"
0x00439140,1086,simulation_frame_accumulate_and_step_world,simulation,cdecl,inferred,objdump + analysis-context,4,"Frame-owned simulation cadence after world bring-up and still directly called from shell_service_pump_iteration at 0x00483f70 rather than a separately grounded outer gameplay loop. The routine samples elapsed time through 0x0051d890 mixes shell and mode scalars into a simulation quantum keeps leftover fractional time in [this+0x4c80] and when enough time has accumulated repeatedly calls simulation_advance_to_target_calendar_point at 0x0040ab50 using the current step quantum from 0x005f2b38. Around those simulation steps it refreshes shell-facing presentation helpers under 0x006d4024 and 0x006d0818 updates multiple world collections and transport or scenario side structures and services the recurring GameMessage.win branch through `game_message_window_service_if_present` `0x004e0720` before later follow-up work. The shell-owned cadence evidence is tighter here now too: one direct frame-side branch at `0x0043970f` opens or focuses `LoadScreen.win` through `shell_open_or_focus_load_screen_page` `0x004e4ee0`, and the post-step shell-window ladder then services several sibling shell windows by presence-probe plus dirty-latch pairs instead of any detached gameplay-only owner. Current grounded members of that ladder now include the shared custom modal through `shell_has_live_custom_modal_dialog` `0x004c8680` plus `shell_mark_custom_modal_dialog_dirty` `0x004c8670`, the file-options dialog through `shell_has_file_options_dialog` `0x004dc7d0` plus `shell_mark_file_options_dialog_dirty` `0x004dc7e0`, `LoadScreen.win` through `shell_has_live_load_screen_window` `0x004e1f50` plus `shell_mark_load_screen_window_dirty` `0x004e1f60`, `SettingsWindow.win` through `shell_has_settings_window` `0x004fe120` plus `shell_mark_settings_window_dirty` `0x004fe130`, `Overview.win` through `shell_has_live_overview_window` `0x004f2e80` plus `shell_mark_overview_window_dirty` `0x004f2e90`, `BuildingDetail.win` through `shell_has_live_building_detail_window` `0x004b9d70` plus `shell_mark_building_detail_window_dirty` `0x004b9d80`, and now `Trainbuy.win` through `shell_has_live_trainbuy_window` `0x0050f740` plus `shell_mark_trainbuy_window_dirty` `0x0050f750`. One deeper world-mode sidecar inside the same frame path now looks grounded too: after delegating to world_view_service_shell_input_pan_and_hover at 0x0043db00 the frame compares the active controller-view pointer at [0x006d4024+0x18]+0x366e against the latched world object at [this+0x66a2], releases the previous object through vtable slot +0x64, and when the new object passes its own availability test at slot +0x1c plus shell-detail control gate 0x07d6 on 0x006d0818 it latches the new object and calls slot +0x60. That makes the frame owner the first grounded non-camera world-input coordinator for hover or focus-target transitions beneath the shell-fed camera stack, even though click or command semantics are still unresolved. This is the strongest grounded owner so far for the recurring gameplay simulation cadence that follows world_entry_transition_and_runtime_bringup.","objdump + analysis-context + caller xrefs + callsite inspection + frame-disassembly correlation"
0x00433a40,82,shell_can_open_company_list_or_detail_panel_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,4,"Shared availability gate above the shell-side company-list and selected-company-detail lanes. The helper reads scenario toggle `[0x006cec78+0x4aef]`; when that dword is nonzero it raises the shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0` and returns `0`, otherwise it returns `1`. Current grounded callers are the direct shell command branches `0x004405b3` and `0x0044062c`, plus the broader shell-strip and page-side handlers `0x004de2e3` and `0x004de3ae`, all of which open company-list or selected-company-detail panels only on success. This is therefore the safest current read for the company list/detail availability gate rather than a generic scenario-action blocker.","objdump + caller inspection + shell-detail correlation + modal-path correlation"
@ -332,6 +335,15 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x00434db0,91,shell_can_open_detail_panel_mode_0x0b_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,3,"Shared availability gate above one still-unresolved shell detail-panel mode `0x0b`. The helper first re-enters `shell_can_open_company_list_or_detail_panel_or_warn` `0x00433a40`; only when that broader company-family gate succeeds does it consult the additional scenario toggle `[0x006cec78+0x4a7f]`. When that second toggle is nonzero it raises the shared shell modal rooted at localized id `334` through `0x005193f0 -> 0x004c98a0` and returns `0`; otherwise it returns `1`. Current grounded callers are the direct shell command branch `0x00440543` and the page-side launcher `0x004de4a0`, both of which immediately open detail-panel mode `0x0b` on success. This is therefore the safest current read for the mode-`0x0b` availability gate rather than a tighter family name we have not yet recovered.","objdump + caller inspection + shell-detail correlation + modal-path correlation"
0x00434e20,128,shell_can_open_detail_panel_mode_0x06_or_warn,shell,thiscall,inferred,objdump + caller inspection + shell-detail correlation,3,"Shared availability gate above one still-unresolved shell detail-panel mode `0x06`. The helper first checks the three scenario toggles `[0x006cec78+0x4ab3]`, `[+0x4ab7]`, and `[+0x4abf]`; only when all three are nonzero does it raise the shared shell modal rooted at localized id `334` and return `0`. Otherwise it checks editor-map mode `[0x006cec74+0x68]`; outside editor mode it also requires a nonzero selected-company id at `[scenario+0x21]`, raising the sibling shell modal rooted at localized id `336` when that company selection is absent. Only the success path returns `1` to the callers at `0x004406a3` and `0x004de280`, both of which immediately open detail-panel mode `0x06`. This is therefore the safest current read for the mode-`0x06` availability gate rather than a tighter family name we have not yet grounded.","objdump + caller inspection + shell-detail correlation + modal-path correlation + editor-mode gating correlation"
0x00433b80,69,scenario_state_run_optional_collection_refresh_hooks_when_mutation_depth_zero,map,thiscall,inferred,objdump + local disassembly + caller correlation,2,"Runs a small dispatcher of optional collection-side refresh hooks, but only when global mutation depth `0x0062be40` has fallen back to zero. On the active path it conditionally refreshes four live collection families through shell-state-controlled gates: the placed-structure collection at `0x006cec20` through `0x00481430`, the sibling placed-structure helper family at `0x0062b26c` through `0x00413860`, the train-side collection at `0x006cfcbc` through `0x004b2a90`, and the route-entry collection at `0x006cfca8` through `0x004931e0`. Current grounded callers include the periodic maintenance branch at `0x0040a914`, the placed-structure finalize path at `0x0040f6b4` after it decrements `0x0062be40`, and several shell or editor mutation branches around `0x0049d3a8` and `0x00508f97/0x0050900a`. This is therefore the safest current read for the zero-depth optional collection-refresh dispatcher rather than a single collection owner.","objdump + local disassembly + caller correlation + zero-depth-dispatch correlation + collection-refresh correlation"
0x00433da0,367,shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay,shell,cdecl,inferred,objdump + caller inspection + overlay-control correlation,3,"Shared owner beneath the paired shell commands `0x00441260` and `0x004412a0` for the mode-`0x19` overlay family. The helper takes one caller-supplied presenter-state boolean and one variant selector, restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across the detail-panel control band `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and then forwards the same variant into world helper `0x0043a0a0`. Current grounded callers are the two registered shell commands that derive the presenter-state boolean from `[0x006d4024+0x114216] == 1` and pass variant `0` or `1`, which makes this the safest current read for the shared mode-`0x19` variant-open and overlay-refresh owner rather than another anonymous control restyler.","objdump + caller inspection + overlay-control correlation + mode-0x19 correlation + detail-panel transition correlation"
0x00439820,91,world_view_sample_local_clearance_ring_clamp_eye_height_and_optionally_republish_triplet,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared world-view helper beneath the local controller strip. The function samples five nearby heights through `0x00534490` at the current eye X/Z pair `[this+0x1c/+0x24]` and four axis-offset probes, keeps the highest sampled clearance, rounds and expands that limit through `0x0052d0c0` plus fixed scalar margins, and then compares the result against current eye height `[this+0x20]`. When the smoothed or clamped target exceeds the current eye height it republishes the eye triplet through `0x0052d1e0`; when local smoothing latch `[this+0x60]` is live it also uses gain `[this+0x34e]` and cached scalar `[this+0x34a]` before that republish. Current grounded callers are the shell-input controller path `0x0043a1d4`, the camera-restore and step buckets at `0x0043c967`, `0x0043cdd4`, `0x0043d0a6`, and the neighboring motion branches `0x0043e4d5` and `0x0043f427`, so this is the safest current read for the local clearance-ring clamp and republish helper rather than a generic terrain-height query.","objdump + caller inspection + local disassembly + world-view correlation + local-clearance correlation + eye-triplet correlation"
0x0043a0a0,76,world_view_set_mode_0x19_variant_latch_seed_controller_blend_and_mark_dirty,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small world-view owner reached directly from the mode-`0x19` shell strip. The helper stores the inverse of its caller-supplied variant selector into presenter dword `[0x006d4024+0x114216]`, seeds four controller scalars through `0x0052d140` on the live world-view root `0x0062be68`, calls that same object's vtable slot `+0x00`, and then sets dirty byte `[world_view+0x65] = 1`. The seeded scalar quadruple is either `(1.0, 1.0, 0.0, 0.0)` or `(0.7, 1.0, 0.0, 0.0)` depending on the selected mode-`0x19` variant. Current grounded caller is `shell_open_detail_panel_mode_0x19_variant_and_refresh_game_uppermost_overlay` `0x00433da0`, so this is the safest current read for the world-view-side variant latch plus controller-blend seed owner rather than a generic shell flag setter.","objdump + caller inspection + local disassembly + world-view correlation + mode-0x19 correlation + controller-band correlation"
0x0043a1a0,61,world_view_store_two_scaled_controller_inputs_and_mark_projection_dirty,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small world-view helper over the same local controller strip. The helper scales its two caller floats by `100.0`, forwards them together with current controller dword `[this+0x0c]` into `0x0052d180`, forces controller scalar `[this+0x34e] = 1.0`, and then re-enters `0x00439820` to refresh the dependent view-projection state. Current grounded caller is `shell_world_view_apply_one_normalized_input_pair_from_shell_frame` `0x00516837`, which makes this the safest current read for the two-input controller setter plus projection-dirty publish rather than a higher-level camera mode owner.","objdump + caller inspection + local disassembly + world-view correlation + controller-input correlation + projection-refresh correlation"
0x0043a1e0,890,world_view_service_controller_transient_offsets_and_selection_handle,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader world-view-side service owner above the same controller strip. When activation dword `[this+0x38e]` is nonzero, the helper derives time-varying transient offsets into `[this+0x3a6/+0x3aa/+0x3ae]` from the current timer fields `[+0x392/+0x396]` and several fixed scalar thresholds, updates or clears one selection-like handle at `[this+0x3b2]` through `0x00531790` and `0x005317b0`, and can drop the activation dword plus all three offsets back to zero when the transient expires. On the live path it also republishes the accumulated offset-adjusted controller position through `0x0052d180` and restores controller gain `[this+0x34e] = 1.0`. Current grounded callers are the recurring simulation-frame path `0x0043916c`, the selection-side refresh strip at `0x0043bd1a`, and the neighboring motion branch at `0x0043e2a4`, so this is the safest current read for the controller transient-offset and selection-handle service owner rather than a static constructor or one-shot callback.","objdump + caller inspection + local disassembly + world-view correlation + transient-offset correlation + selection-handle correlation"
0x0043a560,64,world_view_release_controller_selection_handle_and_reset_embedded_controller_base,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Teardown-side sibling for the same world-view controller family. The helper temporarily restores one local vtable root at `[this]`, releases selection-like handle `[this+0x3b2]` through `0x005317b0(0)` when it is still live, clears the matching presenter-side owner slot through `0x0052d3e0`, and then tail-jumps into the embedded controller-base reset at `0x0052d570`. This is the safest current read for the controller-family release and base-reset helper rather than a generic shell singleton destructor.","objdump + local disassembly + caller inspection + world-view correlation + controller-reset correlation + selection-handle correlation"
0x0043a5a0,421,world_view_construct_reset_controller_state_and_seed_keyboard_bindings,shell,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Broader world-view constructor or reset owner above the same controller strip. The helper first resets the embedded controller base through `0x0052d5a0`, clears a large local scalar and handle band rooted at `[this+0x8a..+0x38e]`, seeds a few fixed defaults such as `[this+0x38a] = -999.0f` and `[this+0x34e] = 1.0f`, and then tail-jumps into `world_view_seed_keyboard_binding_slot_pairs` `0x00439e40`. The resulting boundary is strong enough to treat this as the real world-view reset and keyboard-binding seed owner rather than a small camera-only helper.","objdump + local disassembly + caller inspection + world-view correlation + reset-owner correlation + keyboard-binding correlation"
0x0043ac30,235,world_view_load_camera_snapshot_release_pending_helper_and_reseed_blend_scalars,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Load-side world-view owner above the embedded controller snapshot loader. The helper first releases any pending helper handle from `[this+0x3b2]` through `0x005317b0`, clears presenter owner slot through `0x0052d3e0`, and resets the local controller strip through `0x0043a5a0`. It then loads one stored camera-view snapshot from the caller stream through `0x0052d750`, conditionally reads either `8` or `10` extra `0x30`-byte rows into `[this+0x10e]` according to startup-side scalar `[0x006cec78+0x46c34]`, consumes one trailing `0x14`-byte block, reseeds the four controller blend scalars through `0x0052d140(0, 0, 1.0, 0.7)`, calls vtable slot `+0x10`, and finally normalizes the heading lane `[this+0x10]`. Current evidence is strongest for a camera-snapshot load owner with one optional extra-row band rather than a generic stream-reader wrapper.","objdump + caller inspection + local disassembly + world-view correlation + stream-load correlation + controller-base correlation"
0x0043bde0,2037,world_view_refresh_dependent_projection_visibility_and_presentation_scalars,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader dependent-refresh owner beneath the same world-view family. After re-entering `0x00439be0`, the helper derives one large band of projection, visibility, and presentation-side scalars from the current focus and eye triplets `[this+0x04..+0x24]`, current controller defaults `[+0x38/+0x3c/+0x40/+0x44/+0x4c]`, world-side mode gates, and several fixed threshold tables. Along that path it calls `0x0052cec0`, `0x00484af0`, `0x00533100`, `0x0043a940`, and repeated world-cell validity checks through `0x00534e50`, and can set dirty byte `[this+0x65]` when the resulting bounds or visibility envelopes move outside tolerated ranges. Current grounded callers are the camera-restore path `0x0043caee`, the heading and zoom-step paths `0x0043cb1d/0x0043cddb`, the shell-input controller service `0x00516842`, and several neighboring motion branches, so this is the safest current read for the world-view dependent projection and presentation refresh owner rather than a smaller math helper.","objdump + caller inspection + local disassembly + world-view correlation + projection-refresh correlation + presentation-scalar correlation"
0x0050f740,6,shell_has_live_trainbuy_window,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Tiny presence probe for the shell-side `Trainbuy.win` singleton rooted at `0x006d3ac8`. The helper returns the live-flag dword at `0x006d3ae4`, which is set during `shell_open_or_focus_trainbuy_window` at `0x00512c50` and cleared after that family tears the singleton down. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where it sits beside the sibling overview, building-detail, load-screen, settings, custom-modal, and file-options probes.","objdump + caller inspection + strings correlation + singleton correlation"
0x0050f750,11,shell_mark_trainbuy_window_dirty,shell,cdecl,inferred,objdump + caller inspection + nearby-family correlation,4,"Tiny dirty-latch setter paired with `shell_has_live_trainbuy_window`. The helper stores `1` into `0x006d3adc`, which current nearby call patterns treat as the `Trainbuy.win` refresh or service request latch once the live singleton family rooted at `0x006d3ac8` exists. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, and the same latch is consumed on the message-`0` service path inside the family handler at `0x00512202` through the `0x00512c09` branch.","objdump + caller inspection + nearby-family correlation + singleton correlation + service-path inspection"
0x0050f760,45,shell_trainbuy_window_query_selected_locomotive_id,shell,cdecl,inferred,objdump + caller inspection + strings correlation,4,"Returns the currently selected locomotive id or `0` when the shell-side `Trainbuy.win` family has no valid active selection. The helper first checks whether the live singleton at `0x006d3ac8` exists and whether control resource `0x2afe` exposes one nonnegative selected row through `0x0055fba0`; on success it returns that selected locomotive id. Current grounded callers include the route, upgrade-cost, and purchase-confirmation branches inside `shell_trainbuy_window_handle_message`, where this value is then resolved through the locomotive collection at `0x006ada84`.","objdump + caller inspection + strings correlation + selected-row correlation"
@ -387,8 +399,13 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x004a5280,1664,aux_route_entry_tracker_query_route_entry_pair_metric_via_weighted_recursive_search,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavier weighted search branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates tracker membership, can require endpoint-capable entry type byte `[entry+0x216] == 2` when the caller's looser gate is clear, and on top-level entry initializes one global prune threshold at `0x006cfcb0` plus one per-tracker best-cost cache at `0x006cfcac`. It then evaluates up to four candidate continuations: one direct paired-side route entry plus adjacent links `+0x206`, `+0x20a`, and `+0x20e`. For each surviving candidate it resolves route-entry coordinates through `0x0048a170`, computes one float heuristic through `0x0051dbb0`, orders the candidates by that heuristic, accumulates integer step and mismatch penalties, and recursively re-enters itself while pruning against the current best threshold and the per-tracker cache. On success it writes the best integer metric back through one out pointer, the paired companion metric through another, and returns one chosen downstream route-entry id; top-level calls free the temporary cache block before returning. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the weighted recursive route-entry-pair metric search rather than a generic tracker walk.","objdump + caller xrefs + callsite inspection + tracker-family correlation + weighted-search correlation + heuristic-ordering correlation + recursive-search correlation"
0x004a5900,1728,aux_route_entry_tracker_query_route_entry_pair_metric_via_recursive_neighbor_walk,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Alternate recursive neighbor-walk metric branch beneath the auxiliary tracker pair-metric family. Starting from one source route-entry id and one target route-entry id, the helper validates top-level endpoint eligibility in the same broad way as `0x004a5280`, initializes the same global prune threshold and per-tracker cache on top-level entry, and then recursively explores neighboring route entries through the `+0x206`, `+0x20a`, and `+0x20e` link family. The search stays within compatible tracker-component context through `aux_route_entry_tracker_query_tracker_component_labels_match` `0x004a62c0`, applies optional boolean-class and company gates through tracker latch byte `+0x1c` and `0x00424010`, and accumulates one integer route-step count plus one mismatch penalty count, adding extra cost when route-entry signature word `+0x22e` differs from the caller-supplied filter. The best surviving branch writes the minimal metric and companion penalty back through out pointers, and top-level calls free the temporary per-tracker cache block before returning one chosen downstream route-entry id or one adjacent fallback entry when no recursive hit survives. Current grounded direct callers are the mode-switched dispatcher `0x004a65b0` and internal recursive self-calls. This now looks like the simpler recursive neighbor-walk metric query beneath the weighted branch rather than a generic collection scan.","objdump + caller xrefs + callsite inspection + tracker-family correlation + recursive-neighbor-walk correlation + component-label correlation"
0x004a6630,892,aux_route_entry_tracker_query_best_route_entry_pair_metric_with_endpoint_fallbacks,map,thiscall,inferred,objdump + caller xrefs + callsite inspection,3,"Heavier chooser above the auxiliary route-entry tracker pair-metric dispatcher. Given two route-entry ids plus several out slots and optional gates, the helper validates both route entries and their tracker ids, rejects one caller-requested boolean-class mismatch when the source route-entry byte `+0x44` stays clear, and then has two bounded modes. When both entries pass `0x0048b870`, it directly re-enters `aux_route_entry_tracker_dispatch_route_entry_pair_metric_query` `0x004a65b0` for that fixed pair. Otherwise it resolves the current tracker endpoint slots `+0x04/+0x08` for both sides, derives up to four endpoint-pair combinations from those two tracker groups, and invokes `0x004a65b0` on each surviving combination while keeping the smallest non-`-1` returned metric. The winning route-entry id and companion peer id are written back through out pointers, and current grounded callers reuse the chooser beneath the initial candidate route sweep `0x0049bd40`, the company linked-transit peer-cache builder `0x004093d0`, and the train route validator `0x004b2c10`. This now looks like the best route-entry-pair metric chooser with tracker-endpoint fallbacks rather than a generic sweep.","objdump + caller xrefs + callsite inspection + tracker-family correlation + endpoint-fallback correlation + pair-chooser correlation"
0x004a77b0,24,train_resolve_linked_route_object_or_null,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Tiny train-side resolver over linked route-object id `[train+0x41]`. The helper treats `-1` as empty, otherwise resolves that id through collection `0x0062ba84` via `0x00518140` and returns the live linked route object pointer. Current grounded callers are broad and consistent: the whistle command `0x00441870`, the multiplayer train-apply and callback families at `0x0046d780`, `0x0046e250`, and `0x00470bb0`, the train list renderers around `0x004e7670`, and many neighboring simulation-side train helpers. This is therefore the safest current read for the shared train-to-linked-route-object resolver rather than a metrics-owner-only helper.","objdump + local disassembly + caller inspection + linked-route-object correlation + train-family correlation"
0x004a77d0,51,train_query_linked_route_object_metric_pair_or_default_10f,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small train-side wrapper above the linked route-object metric helper `0x0041add0`. When linked route-object id `[train+0x41]` is live, the helper resolves that route object through collection `0x0062ba84` and tail-calls `0x0041add0` with the original two out-float pointers. When the train has no linked route object, it instead writes `10.0f` to both caller out-float slots and returns. Current evidence is strongest for a generic two-float linked-route metric pair rather than a narrower semantic name, but the default path and ownership boundary are now explicit.","objdump + local disassembly + caller inspection + linked-route-object correlation + two-float-out-parameter correlation"
0x004a7810,183,train_refresh_linked_route_object_steam_emitter_enable_flags,simulation,thiscall,inferred,objdump + local disassembly + caller inspection + effect-family correlation,3,"Iterates the linked route-object row band rooted at `[route+0x316]` / count `[route+0x31a]` after resolving the train's linked route object through `[train+0x41]`. For each `0xc0`-stride row it probes the optional emitter definition at `[row+0x60]`, uses `effect_name_matches_literal_steam` `0x004749a0` to separate the literal `steam` family, and then either clears row byte `[row+0x1d8]`, resets scalar `[row+0xcc]` to `1.0f`, and re-enters `0x00554920`, or sets `[row+0x1d8] = 1` on the non-steam or missing-emitter branch. This is the safest current read for the linked-route-object steam-emitter enable-state refresh rather than a broader train visual owner.","objdump + local disassembly + caller inspection + effect-family correlation + linked-route-object correlation + row-band correlation"
0x004a9460,65,train_current_route_context_uses_strict_reachability_mode,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Small boolean gate keyed off the train's current linked route object at `[this+0x41]`. The helper resolves that route object through `0x0062ba84`, follows its class or profile reference through `0x0041adb0`, uses the resulting id at `[profile+0x126]` to query the small class table rooted at `0x006ada84`, and returns `1` only when the final type field at `[entry+0x10]` equals `2`. Current grounded callers include the local and multiplayer route-entry insertion success paths at `0x00515430` and `0x004718fe`, where a true result triggers the stricter second `train_route_list_validate_reachability_and_station_pair` pass before mode `0x13` is selected, and several neighboring simulation branches such as `0x004ad5e2` and `0x004b1ec5` that use the same gate before re-entering the stronger route-state path. Current evidence is therefore tight enough to treat this as a shared current-route-context gate for the stricter reachability or operating-mode family even though the player-facing meaning of class type `2` remains open.","objdump + caller xrefs + callsite inspection + route-context correlation"
0x004a94b0,381,train_finalize_aux_route_entry_buffer_preserving_subflags,simulation,thiscall,inferred,objdump + caller xrefs + route-entry inspection,3,"One train-side cleanup or finalize helper over the auxiliary route-entry wrapper at `[this+0x1c6]`. When that wrapper is present, the helper walks the embedded `0x33`-stride route-entry list rooted at `[aux+0x0c]`, rewrites one bounded payload band back into the selected entries, and explicitly preserves route-entry flag bits `0x40`, `0x20`, and `0x10` in byte `+0x28` across the rewrite. It then frees the auxiliary wrapper through `0x005a1145` and clears `[this+0x1c6]`. Current grounded caller is the larger train-side route-state branch at `0x004b0cf0`, where this helper sits behind the scenario-state gate at `0x00434050` and ahead of the later current-route-entry resolution path. Current evidence is therefore strong enough to treat this as an auxiliary route-entry buffer finalize step that preserves the lower route-entry subflags even though the exact player-facing meaning of those bits remains open.","objdump + caller xrefs + route-entry inspection + auxiliary-buffer correlation"
0x004ad7a0,595,train_trigger_crash_state_effects_and_optional_owner_notifications,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng strings,3,"Broader train-side crash owner reached both from the cheat-code selector branch in `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` `0x00437d70` and from the direct shell command strip around `0x00441810`, where localized id `365` warns `There is no train available to crash!` when no candidate train survives. The helper first enforces the usual crash-side global gates: it rejects when shell byte `[0x006cec78+0x4c8e]` is already set, when world or shell latches under `0x006cec74` block the action, or when the train already carries a nonzero operating mode at `[train+0xe8]`. On the active path it resolves the current linked route object through `[train+0x41]`, marks route field `[route+0x33e]`, enables the shared three-selector and selector-`5` train-visual effect families through `train_visual_toggle_three_selector_effect_slots_and_reseed_shared_anchors` `0x0045cc90(1)` and its selector-`5` sibling `0x0045d1e0(1)`, clears several transient train fields `[+0x55/+0x59/+0x5d/+0x1a7]`, and then walks the linked route-object chain to drive byte `[train+0xf4]` plus the paired visual refresh lane through `0x0052fb70`, `0x0045c8d0`, and `0x004a8100`. It finishes by writing crash mode `0x11` into `[train+0xe8]`, seeding scalar `[train+0xec] = 0x46924000`, rebuilding the local event payload through `0x004a9360`, and, when the crashing train belongs to the currently selected company, publishing both a shell-side notice through `0x004554e0` and the follow-on company update through `0x00423fd0`. Current neighboring caller `0x004af9e8` also treats this body as the crash-side branch opposite `0x004ada00`, so the safest current read is the shared train crash-state, effect, and owner-notification owner rather than a generic operating-mode setter.","objdump + caller xrefs + local disassembly + RT3.lng strings + train-visual correlation + crash-command correlation + route-state correlation"
0x004ada00,543,train_trigger_breakdown_state_effects_and_optional_owner_notifications,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly + RT3.lng strings,3,"Breakdown-state sibling of `train_trigger_crash_state_effects_and_optional_owner_notifications` `0x004ad7a0`. The helper is reached from the direct shell command strip around `0x004418a0`, where localized id `366` warns `There is no train available to break down!`, and from the neighboring train-state branch at `0x004af9f7`. It enforces the same crash-side global gates and the same `[train+0xe8] == 0` requirement, but on the active path it marks route field `[route+0x342]`, enables the selector-`5` and selector-`2` train-visual effect families through `0x0045cf40(1)` and `0x0045d1e0(2)`, clears the same transient train fields `[+0x55/+0x59/+0x5d/+0x1a7]`, and drives the same linked route-object byte `[train+0xf4]` plus refresh lane through `0x0052fb70`, `0x0045c8d0`, and `0x004a8100`. It then writes breakdown mode `0x12` into `[train+0xe8]`, seeds the same scalar `[train+0xec] = 0x46924000`, rebuilds the local event payload through `0x004a9360`, and, when the affected train belongs to the currently selected company, publishes the shell-side notice through `0x004554e0` and the paired company follow-on through `0x00423fe0`. Current neighboring caller `0x004af9f7` uses this body as the direct opposite branch of `0x004ad7a0`, so the safest current read is the shared train breakdown-state, effect, and owner-notification owner rather than another generic operating-mode setter.","objdump + caller xrefs + local disassembly + RT3.lng strings + breakdown-command correlation + train-visual correlation + route-state correlation"
0x004ab980,760,train_set_route_operating_mode_and_scalar,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Shared train-side mode setter beneath route editing and adjacent operating-state transitions. The helper clears several transient route-state fields at `[this+0x55]`, `[this+0x59]`, `[this+0x5d]`, and `[this+0x1a7]`, optionally rounds the caller-supplied scalar argument to an integer when the scenario-state gate at `0x00434050` is active, dispatches over mode ids `0..0x13`, and in several branches toggles the train byte at `[this+0xf4]` across the linked route-object chain rooted at `[this+0x41]` before notifying follow-on state refresh helpers `0x004a8100` or `0x004a81b0`. Every successful path writes the chosen mode id to `[this+0xe8]` and the final scalar to `[this+0xec]`. Current grounded callers include the local and multiplayer route-entry insertion success path at `0x004718a0` and `0x00515450`, which select mode `0x13` after the stricter post-insertion validation succeeds and mode `0x0a` after the looser fallback path. Current evidence is therefore tight enough to treat this as the shared train route operating-mode and scalar setter even though the player-facing names of the individual mode ids remain open.","objdump + caller xrefs + callsite inspection + mode-write correlation + route-edit correlation"
0x004b2b80,29,train_route_list_count_live_site_reference_entries,simulation,thiscall,inferred,objdump + caller xrefs + route-entry inspection,4,"Counts the subset of entries in the same train-owned `0x33`-stride route-entry list whose flag byte at `+0x28` is nonnegative. Current grounded callsites make that sign-bit split meaningful: sign bit clear entries are the live placed-structure-backed family, while sign bit set entries use the direct route-node payload side instead. Current callers include the shell-side formatter branches at `0x004be50c` and `0x004be53c`, plus the train purchase or readiness path at `0x005126c2`, where the count must reach at least `2` before the deeper route validation lane is allowed to continue. Current evidence is therefore tight enough to treat this as the shared count of live site-reference route entries rather than a generic row counter.","objdump + caller xrefs + route-entry inspection + callsite inspection"
0x004b2c10,656,train_route_list_validate_reachability_and_station_pair,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + RT3.lng strings,4,"Shared route validator above the train route-entry insertion and edit family. The helper walks the same train-owned `0x33`-stride route-entry list and splits on route-entry flag byte `+0x28`: sign bit clear entries resolve live placed-structure ids from field `+0x29` through the placed-structure collection at `0x006cec20` before mapping those structures into the route-node collection at `0x006cfca8`, while sign bit set entries take one direct route-node payload from field `+0x2b`. It then re-enters `0x004a6630` for each successive route step and one optional caller-supplied external target. While scanning, it also tracks up to two distinct station-like placed-structure ids through `0x0047fd50`; the final result fails when any placed structure or route node cannot be resolved, when any `0x004a6630` sweep leaves the output marker at `-1`, or when the scan never accumulates both ends of that station pair. Current grounded callers include the local and multiplayer insertion paths at `0x004718a0` and `0x00515450`, where failure leads to localized route warnings `3089` `At least one station on the route is not connected to the others.`, `3090` `This train cannot reach the station you've selected.`, and `3091` `This train cannot reach the track waypoint you've selected.`. Current evidence is therefore tight enough to treat this as the shared route reachability and terminal-station-pair validator rather than a generic list scan.","objdump + caller xrefs + callsite inspection + RT3.lng strings + placed-structure correlation + route-warning correlation + route-entry flag split"
@ -457,6 +474,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x004768c0,53,chairman_profile_owns_all_company_shares,simulation,thiscall,inferred,objdump + caller inspection,4,"Boolean ownership predicate over one chairman profile and company id. The helper resolves the requested company through the live company collection at `0x0062be10`, reads the company's full outstanding-share count from `[company+0x47]`, and compares it against the current profile's holding slot for that same company at `[profile + company_id*4 + 0x15d]`. It returns `1` only when the profile holds the full outstanding-share band and `0` otherwise. Current grounded caller is the CompanyDetail section-0 overview formatter at `0x004e5cf0`, where this is the decision point between the wholly-owned text family `3046/3047` and the investor-attitude text family `3048/3049`.","objdump + caller inspection + ownership-predicate correlation"
0x00436710,163,scenario_state_sum_issue_opinion_terms_raw,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection,4,"Raw additive companion to `scenario_state_compute_issue_opinion_multiplier` on the active scenario or shell state rooted at `0x006cec78`. The helper starts from the base issue term at `[this + issue*4 + 0x8a]`, then optionally adds the company override term at `[company + issue*4 + 0x35b]`, the chairman-profile override term at `[profile + issue*4 + 0x2ab]`, and the territory override term at `[territory + issue*4 + 0x3b5]` without normalizing or clamping the result into a multiplier. When the profile argument is omitted but a valid company is supplied, it implicitly reuses that company's linked chairman id from `[company+0x3b]`. Current grounded callers include the city-connection bonus lane through `company_compute_issue39_opinion_bias_scalar` at `0x00424580` and several neighboring policy or setup branches that treat the returned integer as one raw issue-opinion total rather than a finished probability or vote scalar.","objdump + caller xrefs + callsite inspection + issue-table correlation + raw-sum correlation"
0x00437a60,41,world_toggle_pause_or_restore_game_speed,simulation,thiscall,inferred,objdump + strings,3,"Pause or resume toggle over the world game-speed fields. When the current mode at `[this+0x19]` is above zero it re-enters world_set_game_speed_mode with target `0` to pause; otherwise it restores the saved nonzero resume mode from `[this+0x1d]`. This matches the player-facing speed-control family rooted in `Paused` through `Very Fast` and their tooltips in `RT3.lng` ids `1795..1800`.","objdump + RT3.lng strings"
0x00437d70,736,shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats,shell,thiscall,inferred,objdump + local disassembly + static-table decode + RT3.lng strings,4,"Broader shell-side cheat owner reached from the registered command wrapper `shell_command_dispatch_scenario_followon_0x437d70_if_active` `0x00441340`. After the usual single-profile gate through `0x004349a0`, the helper increments shell counter `[0x006d401c+0xc60]`, opens the callback-driven modal rooted at `RT3.lng` id `2922` `Do I detect a cheater in the house?\\n\\nEnter code (or <ESC> to cancel):` through `0x005193f0 -> 0x004c98a0`, and then scans the fixed 26-entry cheat table at `0x005ee2c8`. Current grounded case coverage is real: selector `0` dispatches winner or loss outcome modes through `0x004367c0` using labels `3618/3619/3620/3622`; selector `1` jumps out to `0x004d676c`, where it clears the selected-company stat bands rooted at `[company+0x0cfb]`, `[company+0x0d7f]`, and `[company+0x1c47]`; selector `2` posts one caller-supplied float delta into the selected company through `company_add_delta_into_stat_series_current_slot_and_optional_cash_totals` `0x0042a080`; selector `3` posts one signed integer delta into the selected chairman profile through `profile_entry_add_signed_integer_delta_into_qword_field_0x154` `0x00476050`; selector `4` resolves one locomotive record by primary or alias stem through `0x00461c00` and applies it to every train owned by the selected company through `0x004aefb0`; selector `5` walks the live territory collection and forces access-rights byte `1` through `company_set_territory_access_rights_byte` `0x00424030`; selector `6` toggles scenario byte `[state+0x4c8f]`; selector `7` runs the train-wide branch through `0x004ad7a0(1)`; and selectors `8/9/10` toggle scenario bytes `[state+0x4c8e/+0x4c8d/+0x4c8c]`. The same table also contains later labeled rows `3634` `Orca` and alias-only names `Katie..Seymour`, but their selector values lie above the visible jump-table bound `0x0a`, so current evidence only supports treating them as unreached or separately handled tail entries rather than active cases in this owner.","objdump + local disassembly + static-table decode + RT3.lng strings + cheat-table correlation + selected-company/profile mutation correlation"
0x00448aa0,28,world_sample_companion_float_grid_value_by_cell,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Tiny float-raster sampler over the companion world grid rooted at `[this+0x1605]`. The helper uses width field `[this+0x15d9]`, flattens the caller-supplied cell coordinates with an extra `+1` row stride, reads one `float` from that raster, and returns it in `st(0)`. Current grounded callers include `world_compute_transport_and_pricing_grid` `0x0044fb70`, the flagged-cell sample collector `world_grid_count_flagged_cells_and_collect_float_samples` `0x00414fa0`, the projected-rectangle helper `world_grid_refresh_projected_rect_sample_band_and_flag_mask` `0x00418610`, and several neighboring shell or presentation branches, so this is the safest current read for the shared companion float-grid sampler rather than a transport-only helper.","objdump + caller inspection + field correlation + float-raster correlation"
0x00448af0,206,world_query_compact_grid_flag_bitset_membership_by_mode,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Boolean compact-bitset query over three neighboring world-grid flag banks. The helper uses dimensions `[this+0x215d/+0x2161]` to flatten the caller-supplied cell coordinates into one bit index, rejects out-of-bounds cells, and then checks one or more compact bitset banks depending on the caller mode argument: mode `0` checks both `[this+0x2139]` and `[this+0x213d]`, mode `1` checks `[this+0x213d]` only, mode `2` checks `[this+0x2139]` only, and mode `3` checks `[this+0x2141]` only. It returns `1` when any selected bank contains the bit and `0` otherwise. Current grounded callers include the post-load `319` cleanup lane inside `world_run_post_load_generation_pipeline` `0x004384d0`, the placement validator `placed_structure_validate_projected_candidate_placement` `0x004197e0`, the projected-runtime scratch builder `placed_structure_build_projected_runtime_scratch_from_candidate_and_coords` `0x00416ec0`, several neighboring world-scan or presentation branches around `0x004512b5..0x00451393`, and later world-side routes or scenario handlers, so this is the safest current read for the shared compact grid-flag-bitset membership query rather than one specific road- or route-only gate.","objdump + caller inspection + field correlation + compact-bitset correlation + post-load-cleanup correlation"
0x00448c20,132,world_secondary_raster_reclass_cell_to_low3bit_1_or_4_and_clear_primary_companion_plane,map,thiscall,inferred,objdump + caller inspection + field correlation,3,"Small secondary-raster mutator over one world cell. After rejecting cells whose current secondary class already lies in subset `1/4` through `world_secondary_raster_query_cell_class_in_set_1_4` `0x00534e50`, the helper clears the primary companion byte plane at `[this+0x1655]` for that cell and rewrites the low 3 class bits of the packed secondary record at `[this+0x165d]` to `4` when the old class was `2`, or to `1` otherwise. It then notifies the shell-side world presentation through `0x00534270` with mode `6`. Current grounded callers are the `.smp` restore path inside `world_load_saved_runtime_state_bundle` `0x00446d40` and several shell-side map-editing or painting branches around `0x004f9c17` and `0x004fbcc9`, so this is the safest current read for the shared class-`1/4` demotion helper rather than a more player-facing terrain brush.","objdump + caller inspection + field correlation + secondary-raster correlation"
@ -524,12 +542,76 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x00440c10,12,shell_select_camera_view_8,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `8` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460bb7` ties this wrapper to localized command id `3488`, the `Select Camera View 8` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440c20,12,shell_select_camera_view_9,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `9` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460c19` ties this wrapper to localized command id `3490`, the `Select Camera View 9` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440c30,9,shell_select_camera_view_0,shell,cdecl,inferred,objdump + command-registration correlation + wrapper inspection,2,"Tiny wrapper over `shell_select_camera_view_slot_or_publish_unassigned_warning` `0x004409c0`. It fixes slot selector `0` in `ECX` before tail-jumping into the shared selection owner. The command-registration block at `0x00460c7b` ties this wrapper to localized command id `3492`, the `Select Camera View 0` slot.","objdump + command-registration correlation + wrapper inspection"
0x00440e00,274,shell_command_step_active_window_subject_forward_or_publish_contextual_notice,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,3,"Paired shell command owner for the forward-step action registered at `0x45ffae` with action id `0x22` and localized label id `0x0d65`. The helper first prefers live `StationDetail.win` singleton `0x006d16d8`, where it re-enters `shell_station_detail_cycle_to_next_station_preserving_owner_and_station_site_class` `0x00505e30`. Failing that it prefers the live building-detail singleton `0x006cfd04` and re-enters `0x004b6fc0`, then the live company-detail singleton `0x006cfe4c` when no custom modal is active through `shell_has_live_custom_modal_dialog` `0x004c8680`, where it re-enters `shell_company_detail_select_next_active_company` `0x004c3540`, and finally the sibling live singleton `0x006d3b20`, where it re-enters `0x00514880`. When no supported live window family is active but scenario state `0x006cec78` exists, it builds one contextual notice through localized ids `0x017a/0x017b`, validates the modal path through `0x0045f3d0`, and publishes that notice through `0x004554e0`. This is therefore the broad forward-step shell command above several live detail-window families rather than another StationDetail-only helper.","objdump + command-registration correlation + local disassembly + caller inspection + live-window-priority correlation"
0x00440f20,274,shell_command_step_active_window_subject_backward_or_publish_contextual_notice,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,3,"Backward-step sibling of `shell_command_step_active_window_subject_forward_or_publish_contextual_notice` `0x00440e00`, registered at `0x45ffdf` with action id `0x21` and localized label id `0x0d66`. The helper walks the same live window-family priority chain: `StationDetail.win` through `shell_station_detail_cycle_to_previous_station_preserving_owner_and_station_site_class` `0x00505e40`, then the building-detail singleton `0x006cfd04` through `0x004b6fd0`, then the company-detail singleton `0x006cfe4c` through `shell_company_detail_select_previous_active_company` `0x004c3550` when no custom modal is active, and finally the sibling singleton `0x006d3b20` through `0x00514890`. When none of those families is live but scenario state `0x006cec78` exists, it builds and conditionally publishes the paired contextual notice through localized ids `0x017c/0x017d`, `0x0045f3d0`, and `0x004554e0`. This is therefore the broad reverse-step shell command above several live detail-window families rather than another StationDetail-only helper.","objdump + command-registration correlation + local disassembly + caller inspection + live-window-priority correlation"
0x00441040,131,shell_open_or_focus_train_detail_for_current_or_first_owned_train,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,4,"Direct shell command branch registered at `0x45ff1b` with action id `0x54` and localized label id `0x0d62`. The helper first requires active scenario state `0x006cec78` and the live detail-panel controller `0x006d0818`, then reads the current train-subject id from `[detail+0x78]` and validates it against the live train collection `0x006cfcbc`. When that current subject is invalid it resolves the selected chairman company through `scenario_state_get_selected_chairman_company_record` `0x00434870`, counts that company's owned trains through `company_count_owned_trains` `0x004264c0`, and falls back to the first owned-train id through `0x00426520`. Once a valid train id survives it forwards `(train_id, 2)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. This is therefore the direct train-detail opener or refresher for the current subject with first-owned-train fallback, not a generic collection query.","objdump + command-registration correlation + local disassembly + caller inspection + train-detail correlation + first-owned-train fallback correlation"
0x004410d0,138,shell_open_or_focus_station_detail_for_current_or_first_owned_linked_station,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,4,"Direct shell command branch registered at `0x45ff7d` with action id `0x53` and localized label id `0x0d64`. The helper first requires active scenario state `0x006cec78` and the live detail-panel controller `0x006d0818`, then reads the current station-subject id from `[detail+0x80]` and validates it against the live placed-structure collection `0x006cec20`. When that current subject is invalid it resolves the selected chairman company through `scenario_state_get_selected_chairman_company_record` `0x00434870`, counts that company's owned linked stations through `company_count_linked_transit_sites` `0x00426590(0)`, and falls back to the first owned linked-station id through `0x00426620(1, 0)`. Once a valid station id survives it forwards `(station_id, 5)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. This is therefore the direct station-detail opener or refresher for the current subject with first-owned-station fallback, not a generic collection query.","objdump + command-registration correlation + local disassembly + caller inspection + station-detail correlation + first-owned-station fallback correlation"
0x00441160,50,shell_command_dispatch_live_world_followon_by_query_0x450150,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly,2,"Small registered shell command sibling beneath the same command table. The helper requires active scenario state `0x006cec78` plus the live world root `0x0062c120`, re-enters query helper `0x00450150`, and then dispatches one of two world-root follow-ons: `0x00453370` when that query returns zero, or `0x00453780` when it returns nonzero. The registration block at `0x460286` ties this body to localized label id `0x0d73` and command id `0x47`. Current evidence is strong enough for the dispatch shape and owner level, but not yet for a tighter user-facing verb.","objdump + command-registration correlation + local disassembly + world-root followon correlation"
0x004411a0,52,shell_command_dispatch_live_route_store_followon_by_query_0x4934a0_zero,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly,2,"Small registered shell command sibling over the live route-store root `0x006cfca8`. The helper requires active scenario state `0x006cec78` plus a live route-store owner, re-enters `0x004934a0(0)`, and then dispatches one of two route-store follow-ons: `0x00491880` when that query returns nonzero, or `0x004932a0` when it returns zero. The registration block at `0x4602b7` ties this body to localized label id `0x0f01` and the same command id `0x47` family. Current evidence is strong enough for the dispatch shape and owner level, but not yet for a tighter user-facing verb.","objdump + command-registration correlation + local disassembly + route-store followon correlation"
0x00441240,21,shell_command_toggle_shared_world_preview_global_0x62be84,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + global-state correlation,2,"Tiny registered shell command that flips global dword `0x0062be84` between `0` and `1`. The same global is already grounded on the station-detail candidate-service preview side and on the city-site connection-bonus label formatter, so this command currently reads as a shared world-preview-global toggle rather than a detail-window-local helper. The registration block at `0x4602e8` ties it to action id `0x4e` and localized label id `0x0d74`.","objdump + command-registration correlation + local disassembly + global-state correlation + shared-preview-global correlation"
0x00441260,49,shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + overlay-control correlation,3,"Registered shell command beneath action id `0x09` and localized label id `0x0d70`. The helper first rejects while sibling singleton `0x006d3b4c` is live, then requires active scenario state `0x006cec78` and the main shell presenter root `0x006d4024`. It derives one boolean from presenter field `[root+0x114216] == 1`, passes that boolean together with variant selector `0` into `0x00433da0`, and that shared helper in turn restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across detail-panel controls `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and forwards the variant into world helper `0x0043a0a0`. Current evidence is strong enough for the mode-`0x19` variant-open owner shape, but not yet for a tighter user-facing label.","objdump + command-registration correlation + local disassembly + overlay-control correlation + mode-0x19 correlation"
0x004412a0,49,shell_command_open_detail_panel_mode_0x19_variant_1_via_game_uppermost_overlay,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + overlay-control correlation,3,"Variant-`1` sibling of `shell_command_open_detail_panel_mode_0x19_variant_0_via_game_uppermost_overlay` `0x00441260`, registered under the same action id `0x09` family with localized label id `0x0d71`. The helper enforces the same `0x006d3b4c` / scenario-state / presenter-root gates, derives the same presenter boolean from `[0x006d4024+0x114216] == 1`, and then re-enters `0x00433da0` with variant selector `1`, which restyles `GameUppermost.win` controls `0x7923..0x7925`, mirrors the chosen variant across controls `0x07db..0x0837`, transitions the detail manager into mode `0x19`, and forwards the selected variant into world helper `0x0043a0a0`. Current evidence is strong enough for the paired mode-`0x19` variant-open owner shape, but not yet for a tighter user-facing label.","objdump + command-registration correlation + local disassembly + overlay-control correlation + mode-0x19 correlation"
0x004412e0,85,shell_command_enable_shell_state_band_0x1df_and_refresh_derived_year_thresholds,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + shell-state correlation,3,"Registered shell command beneath action id `0x45` and localized label id `0x0d75`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then accepts either when shell-state probe `0x00435480` succeeds or when shell flag `[0x006cec74+0x1df]` is already nonzero through `0x00482840`. On the active path it re-enters `scenario_state_rebuild_derived_year_threshold_band` `0x004351c0` with stack flag `1` and then writes shell dwords `[0x006cec74+0x1df/+0x1e3] = 0/0` through `0x00482850`, which also triggers the follow-on refresh helper `0x004354a0`. Current evidence is strong enough for the shell-state-band and year-threshold refresh owner shape, but not yet for a tighter user-facing command name.","objdump + command-registration correlation + local disassembly + shell-state correlation + year-threshold-band correlation"
0x004411e0,31,shell_command_toggle_presenter_flag_0x114276_if_present,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + presenter-root correlation,2,"Small registered shell command beneath action id `0x48` and localized label id `0x0d79`. The helper probes the main shell presenter root at `0x006d4024` and, when that root is live, flips the dword at `[presenter+0x114276]` between `0` and `1`. Current evidence is only strong enough for the direct toggle and owner boundary, not for a tighter user-facing semantic name for that presenter-side latch.","objdump + command-registration correlation + local disassembly + presenter-root correlation + toggle-latch correlation"
0x00441200,52,shell_command_send_message_0xcb_to_control_0x9858_if_active_scenario,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + shell-message correlation,2,"Small registered shell command beneath action id `0x5a` and localized label id `0x0d7b`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then forwards shell message `0xcb` with control id `0x9858` plus three zero trailing arguments into the shared shell runtime at `0x006d401c` through `0x00538e00`. Current evidence is strong enough for the message-injection owner shape, but not yet for a tighter user-facing command name for control `0x9858`.","objdump + command-registration correlation + local disassembly + shell-message correlation + active-scenario correlation"
0x00441340,15,shell_command_dispatch_cheat_code_modal_if_active_scenario,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + cheat-owner correlation,2,"Tiny registered shell command beneath action id `0x00be` and localized label id `0x0d7c`. The helper requires active scenario state `0x006cec78` and then tail-calls `shell_open_cheat_code_modal_and_dispatch_named_runtime_or_company_cheats` `0x00437d70`. This is therefore the direct command-table entry for the cheat-code modal owner rather than a generic scenario follow-on.","objdump + command-registration correlation + local disassembly + cheat-owner correlation"
0x00441360,68,shell_command_focus_subject_from_collection_0x62b244_via_selector_0x40b2d0,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + focus-handoff correlation,3,"Registered shell command beneath action id `0x47` and localized label id `0x0db3`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, requires live collection root `0x0062b244`, then queries selector `0x0040b2d0(0, 1)`. When that selector returns a nonzero subject id, the helper forwards `(1, 3, subject_id)` into `shell_world_focus_selected_subject_kind_and_id` `0x00437a90`. Current evidence is strong enough for the focus-handoff owner shape, but not yet for a tighter user-facing verb or subject family name.","objdump + command-registration correlation + local disassembly + focus-handoff correlation + selector-correlation"
0x00441790,111,shell_resolve_focused_or_fallback_train_owned_by_selected_company,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Shared current-train resolver beneath the shell-side train command strip. The helper first probes the live world-view owner at `0x0062be68`, and when a focused subject exists through `[view+0x60]` plus vtable slot `+0x6c`, it resolves the corresponding live train from collection `0x006cfcbc` by id `[subject+0x390]`. It then requires that train's owner company id `[train+0x51]` to match the current scenario-selected company through `scenario_state_get_selected_chairman_company_id` `0x004337a0`; otherwise it falls back to `0x005130f0` and repeats the same ownership test on that fallback train. Success returns the live train pointer; failure returns null. Current grounded callers are the adjacent shell command leaves `0x00441810`, `0x00441870`, and `0x004418a0`, so this is the safest current read for the focused-or-fallback owned-train resolver rather than a broader world-view query.","objdump + local disassembly + caller inspection + world-view correlation + selected-company correlation + train-command-strip correlation"
0x00441810,79,shell_command_crash_current_or_fallback_owned_train_or_warn,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + RT3.lng strings,3,"Registered shell command beneath action id `0x43` and localized label id `0x0d77` `Current train crashes`. The helper requires active scenario state `0x006cec78`, rejects when the active chairman-profile count from `0x004349a0` exceeds `1`, and then resolves one owned train through `shell_resolve_focused_or_fallback_train_owned_by_selected_company` `0x00441790`. When no train survives it opens the simple shell modal rooted at localized id `365` `There is no train available to crash!` through `0x005193f0 -> 0x004c98a0`. Otherwise it forwards the resolved train into `train_trigger_crash_state_effects_and_optional_owner_notifications` `0x004ad7a0(1)`.","objdump + command-registration correlation + local disassembly + RT3.lng strings + crash-owner correlation"
0x00441870,34,shell_command_mark_current_or_fallback_owned_train_whistle_request,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + RT3.lng strings,2,"Registered shell command beneath action id `0x57` and localized label id `0x0d76` `Current train whistles`. The helper resolves one owned train through `shell_resolve_focused_or_fallback_train_owned_by_selected_company` `0x00441790`; when that succeeds it resolves the train-side visual owner through `0x004a77b0` and writes request dword `1` into `[owner+0x33a]`. Failure is silent and returns `0`. Current evidence is strong enough for the whistle-request owner shape even though the deeper user-facing meaning of `[owner+0x33a]` remains open.","objdump + command-registration correlation + local disassembly + RT3.lng strings + train-visual-owner correlation"
0x004418a0,79,shell_command_break_down_current_or_fallback_owned_train_or_warn,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + RT3.lng strings,3,"Registered shell command beneath action id `0x42` and localized label id `0x0d78` `Current train breaks down`. The helper enforces the same active-scenario and single-profile gate as the crash sibling `0x00441810`, resolves one owned train through `shell_resolve_focused_or_fallback_train_owned_by_selected_company` `0x00441790`, and when no train survives opens the simple shell modal rooted at localized id `366` `There is no train available to break down!` through `0x005193f0 -> 0x004c98a0`. Otherwise it forwards the train into the sibling failure-state owner `0x004ada00(1)`. Current evidence is strongest for the breakdown-command wrapper above that sibling train-state body rather than a generic shell modal leaf.","objdump + command-registration correlation + local disassembly + RT3.lng strings + failure-state sibling correlation"
0x00441900,53,shell_command_toggle_overview_window_page_0_or_close_if_already_active,shell,cdecl,inferred,objdump + local disassembly + detail-manager correlation,3,"Small shell command-style helper in the `Overview.win` page-toggle strip. The helper probes the shell detail-panel controller at `0x006d0818`; when current mode `[detail+0x8c]` already equals `9` and current overview page `[detail+0x90]` already equals `0`, it closes that page by forwarding `(-1, 0)` into `shell_detail_panel_transition_manager` `0x004ddbd0`. Otherwise it requests mode `9`, page `0` through the same owner. Current evidence is strong enough for the page-toggle shape, but I have not grounded the exact registration row for this specific wrapper yet.","objdump + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
0x00441940,52,shell_command_toggle_overview_window_page_1_or_close_if_already_active,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + detail-manager correlation,3,"Registered shell command beneath action id `0x73` and localized label id `0x0d4b`. The helper mirrors `0x00441900`, but it tests for `Overview.win` mode `9` page `1` at `[0x006d0818+0x90]`; a same-page hit closes through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)`, otherwise it requests mode `9`, page `1`. This is the safest current read for the second `Overview.win` page-toggle command rather than another anonymous detail-manager wrapper.","objdump + command-registration correlation + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
0x00441980,52,shell_command_toggle_overview_window_page_2_or_close_if_already_active,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + detail-manager correlation,3,"Registered shell command beneath action id `0x74` and localized label id `0x0d4c`. The helper mirrors the adjacent page-toggle siblings, but it tests for `Overview.win` mode `9` page `2`; same-page hits close through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)`, while every other case requests mode `9`, page `2`. This is the safest current read for the third `Overview.win` page-toggle command rather than another generic shell leaf.","objdump + command-registration correlation + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
0x004419c0,52,shell_command_toggle_overview_window_page_3_or_close_if_already_active,shell,cdecl,inferred,objdump + local disassembly + detail-manager correlation,3,"Small shell command-style helper in the same `Overview.win` page-toggle strip. The helper tests the live detail manager for mode `9`, page `3`, closes that exact page through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)` when already active, and otherwise requests mode `9`, page `3`. Current evidence is strong enough to keep this as the fourth overview-page toggle, but I have not grounded the exact registration row for this specific wrapper yet.","objdump + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
0x00441a00,52,shell_command_toggle_overview_window_page_4_or_close_if_already_active,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + detail-manager correlation,3,"Registered shell command beneath action id `0x72` and localized label id `0x0d4a`. The helper tests the live detail manager for mode `9`, page `4`, closes that exact page through `shell_detail_panel_transition_manager` `0x004ddbd0(-1, 0)` when already active, and otherwise requests mode `9`, page `4`. This is the current safest read for the fifth overview-page toggle command rather than a more semantic page-name claim.","objdump + command-registration correlation + local disassembly + detail-manager correlation + Overview.win same-mode correlation"
0x00441ac0,39,shell_command_invoke_map_file_entry_coordinator_flags_0_0_0_if_scenario_active_and_shell_idle,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + map-file-coordinator correlation,2,"Small registered shell command beneath action id `0x77` and localized label id `0x0d4f`. The helper requires active scenario state `0x006cec78`, rejects when shell counter `[0x006d401c+0xc64]` is already positive, and then forwards three zero stack arguments into `shell_map_file_entry_coordinator` `0x00445ac0`. Current evidence is strong enough for the wrapper shape and gate conditions, but not yet for the exact player-facing verb mapped onto that zero-triplet coordinator call.","objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + shell-idle-gate correlation"
0x00441af0,39,shell_command_invoke_map_file_entry_coordinator_flags_0_1_0_if_scenario_active_and_shell_idle,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + map-file-coordinator correlation,2,"Small registered shell command beneath action id `0x77` and localized label id `0x0d51`. The helper mirrors `0x00441ac0`, but forwards stack flags `(0, 1, 0)` into `shell_map_file_entry_coordinator` `0x00445ac0` after the same active-scenario and shell-idle gate. Current evidence is strong enough for the wrapper shape and flag triplet, but not yet for the exact user-facing command name for this coordinator variant.","objdump + command-registration correlation + local disassembly + map-file-coordinator correlation + shell-idle-gate correlation"
0x00441b20,39,shell_command_clamp_world_dword_0x168d_not_below_0x1689_if_world_live,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + world-root correlation,2,"Small registered shell command beneath action id `0x48` and localized label id `0x0d72`. The helper requires live world root `0x0062c120`, compares dwords `[world+0x1689]` and `[world+0x168d]`, and rewrites `[world+0x168d]` so it is never below `[world+0x1689]`. Current evidence is only strong enough for that direct clamp and owner boundary, not for a tighter semantic name for this world-side scalar pair.","objdump + command-registration correlation + local disassembly + world-root correlation + clamp correlation"
0x00441b50,358,shell_command_toggle_editor_map_mode_with_one_shot_warning_modals,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,3,"Broader registered shell command sibling above the editor-map-mode setter `0x00482e50`. The helper requires active scenario state `0x006cec78` and the live shell-state root `0x006cec74`, then branches on current editor-map mode lane `[shell+0x68]`. When editor-map mode is already active it uses one-shot latch `0x0062be88` to optionally publish localized modal `0x017e` through `0x005193f0 -> 0x004c98a0`; when editor-map mode is inactive it instead opens warning `0x0b6e` if the active-profile-count gate `0x004349a0` exceeds `1`, or uses one-shot latch `0x0062be8c` to optionally publish modal `0x0b24`. After those gates it computes target mode `([shell+0x68] == 0)` and forwards that boolean into `shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects` `0x00482e50`. Current evidence is strong enough to treat this as the real editor-map-mode toggle command with one-shot warning modals rather than another anonymous scenario-side follow-on.","objdump + command-registration correlation + local disassembly + caller inspection + editor-map-mode correlation + warning-modal correlation"
0x00441cb0,111,shell_command_raise_startup_selected_year_scalar_by_half_step_and_refresh_calendar,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + calendar-refresh correlation,3,"Registered shell command beneath action id `0x6b` and localized label id `0x0db5`. The helper requires active scenario state `0x006cec78`, rejects when the active-profile-count gate `0x004349a0` exceeds `1`, clears shell dwords `[0x006cec74+0x233]` and `[+0x124]`, adds `0.5` to startup-side scalar `[0x006cec78+0xbfa]`, then re-enters `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute counter `[0x006cec78+0x15]` before refreshing the live view owner at `0x0062be68` through `0x00439a80`. Current evidence is strongest for a paired half-step raise on the startup selected-year presentation scalar rather than a tighter player-facing command name.","objdump + command-registration correlation + local disassembly + calendar-refresh correlation + startup-scalar correlation"
0x00441d20,111,shell_command_lower_startup_selected_year_scalar_by_half_step_and_refresh_calendar,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + calendar-refresh correlation,3,"Registered shell command beneath action id `0x6d` and localized label id `0x0db6`. The helper mirrors `0x00441cb0`, but subtracts `0.5` from startup-side scalar `[0x006cec78+0xbfa]` before re-entering `world_set_selected_year_and_refresh_calendar_presentation_state` `0x00409e80` with absolute counter `[0x006cec78+0x15]` and refreshing the live view owner through `0x00439a80`. It shares the same active-scenario gate, active-profile-count gate, and shell dword clears `[0x006cec74+0x233]` and `[+0x124]`. This is the current safest read for the paired half-step lower command rather than a stronger user-facing label claim.","objdump + command-registration correlation + local disassembly + calendar-refresh correlation + startup-scalar correlation"
0x00441d90,135,shell_build_percent_status_payload_clamped_0_to_100,shell,cdecl,inferred,objdump + local disassembly + caller inspection + status-publisher correlation,3,"Shared percentage-status payload builder used by the save or load progress strip. The helper divides one caller float by one caller integer, multiplies by fixed scalar `100.0f`, rounds through `0x005a10d0`, clamps the result to at most `100`, and then packages that percentage into the small status payload built through `0x0051b700`, `0x005193f0`, and `0x00518de0`, returning the final shell text handle rooted at `0x0062c0d8`. Current grounded callers include the repeated progress-notice loop inside `shell_map_file_world_bundle_coordinator` `0x00445de0` and the adjacent throttled progress callback `0x00441e20`, so this is best read as the shared percent-status payload builder rather than a one-off modal helper.","objdump + local disassembly + caller inspection + status-publisher correlation + save-load-progress correlation"
0x00441e20,155,shell_progress_callback_publish_incremental_percent_status_until_target,shell,cdecl,inferred,objdump + caller inspection + local disassembly + progress-callback correlation,3,"Shared incremental progress callback above `shell_build_percent_status_payload_clamped_0_to_100` `0x00441d90`. The helper first checks global progress latches `0x0062bec8`, `0x0062becc`, and `0x0062c118`; when the caller target count has not advanced it returns immediately, and when the target equals `0x64` it instead advances `0x0062becc` by `0x14` and clears `0x0062c118`. Otherwise it increments `0x0062c118`, derives one intermediate percentage from the caller target divided by `3`, scaled by `100.0`, offset by current base `0x0062becc`, and then re-enters `shell_build_percent_status_payload_clamped_0_to_100` before publishing the resulting status through `0x00538c70` and servicing the shell frame through `0x00482160`. Current grounded owner correlation is the callback installation at `0x00442960`, which writes this function into global `0x00d93988` before entering a longer staged work loop, plus the same save or load progress family around `0x00445de0`. This is the safest current read for the throttled percent-status callback rather than another direct shell command leaf.","objdump + caller inspection + local disassembly + progress-callback correlation + staged-work correlation + shell-status correlation"
0x00441ec0,107,shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2,map,cdecl,inferred,objdump + local disassembly + caller inspection + tagged-bundle correlation,2,"Small tagged-bundle helper in the adjacent map-bundle and companion-image strip. On the save-side branch it writes one caller dword through `global_indexed_slot_table_write_bytes` `0x00531030` and then emits tagged headers `0x2ee0`, `0x03c2`, and `0x2ee1` through `0x00531340`; on the load-side branch it mirrors the same triplet through `0x005a276f` after opening the incoming staged object. Current grounded callers are the two companion-image file siblings `0x00441f70` and `0x004420f0`, where it serializes the selector byte at `[record+0x09]`, the payload size lane `[record+0x04]`, and the copied dword at `[record+0x00]` beside the external `_A.tga/_A.jpg` file path. This is the safest current read for the shared companion-image tag strip rather than a generic slot-table header helper.","objdump + local disassembly + caller inspection + tagged-bundle correlation + companion-image correlation"
0x00441f70,384,shell_map_bundle_load_companion_image_file_into_global_staging_buffer_and_sync_tags,map,cdecl,inferred,objdump + local disassembly + caller inspection + literal inspection,3,"Broader companion-image load helper paired with `0x004420f0`. The helper derives an extensionless stem from the caller path through `support_copy_string_stem_before_first_dot` `0x0051dde0`, appends either `_A.tga` or `_A.jpg` according to selector byte `[record+0x09]`, opens the resulting path in mode `r+b`, streams the file through `0x005a1b05` into a temporary `0x200`-byte loop buffer, and then mirrors the loaded bytes through `0x005a276f` before writing the companion-image selector tags through `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`. Current grounded caller is the broader save or load coordinator strip around `0x00445983`, and the sibling overlay-surface owner `0x00535430` later consumes the same global fallback descriptor rooted at `0x0062bed4/0x0062bed8`. This is the safest current read for the companion-image file import path rather than a generic external file loader.","objdump + local disassembly + caller inspection + literal inspection + companion-image correlation + global-fallback-buffer correlation"
0x004420f0,476,shell_map_bundle_write_global_staging_buffer_to_companion_image_file_and_return_path,map,cdecl,inferred,objdump + local disassembly + caller inspection + literal inspection,3,"Write-side sibling of `0x00441f70` for the same companion-image family. The helper derives an extensionless stem from the caller destination path, appends either `_A.tga` or `_A.jpg` by selector byte `[record+0x09]`, tries to open that file in mode `r+b`, and when no existing file is present allocates or reuses the global staging buffer rooted at `0x0062bed4/0x0062bed8` before streaming bytes from the source handle in `0x200`-byte chunks. On the existing-file path it writes the same chunks through `0x005a276f`; on completion it clears the temporary typed cache through `0x0053c900`, copies the final companion path into the caller out-buffer, and returns. Current grounded caller is the save-side branch at `0x00443d1c`, which immediately follows this helper by writing the paired tagged headers `0x2ee0/0x2ee1`. The later world-presentation fallback path `0x00535430` also consumes the same global staging descriptor, so this is the safest current read for the companion-image export path rather than a generic file-copy helper.","objdump + local disassembly + caller inspection + literal inspection + companion-image correlation + global-fallback-buffer correlation"
0x00450150,7,world_query_preview_mode_0x15_latch_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny getter for the shared world-side preview-mode latch byte `[this+0x21c5]`. The helper returns that byte unchanged as a boolean-like integer. Current grounded callers are the shell command strip at `0x00441173`, which chooses between the enter and exit siblings `0x00453370` and `0x00453780`, and the TrackLay destructor path at `0x0050db8d`, which only re-enters `0x00453510` when this latch is clear while world mode `[world+0x2175]` still equals `0x15`. This is therefore the safest current read for the direct mode-`0x15` preview-latch query rather than a broader world-mode predicate.","objdump + caller inspection + local disassembly + mode-0x15 correlation + preview-latch correlation"
0x00450160,816,world_recompute_mode3_preview_normalization_window_0x2195_0x2199,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Mode-`3` prepass beneath the shared world preview rebuild owner `0x00450520`. The helper walks the live secondary-grid cells rooted at `[this+0x2129]` across world dimensions `[+0x2145/+0x2149]`, skips blocked class lanes when cell byte `[cell+0xe6]` carries bit `0x01` without `0x04`, and scores each surviving cell either with fixed `200.0f` or with `0x0042c960(remainder(id, 0x35))` against the current primary preview id `[this+0x2179]`. It tracks min, max, average, and one farther qualifying score through `0x0042b350`, then writes the resulting float window into `[this+0x2195]` and `[this+0x2199]`, clamping the final scale lane to at least `1.0f`. Current grounded caller is the shared active preview or tool overlay rebuild owner `0x00450520`, which invokes this prepass only when current world preview mode `[this+0x2175]` equals `3`. This is the safest current read for the mode-`3` normalization-window recompute helper rather than a broader map-load statistic pass.","objdump + caller inspection + local disassembly + mode-3 correlation + normalization-window correlation"
0x00450490,144,world_query_mode3_preview_cell_best_matching_six_byte_list_color,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small per-cell query beneath the same mode-`3` world preview family. The helper indexes one secondary-grid cell from `(x, y)` through `[this+0x2129]`, reads the six-byte entry list described by count dword `[cell+0xeb]` and pointer `[cell+0xef]`, and searches for the strongest matching entry when the caller-supplied selector id matches the row's leading `u16` or when that selector id is `0`. When any match is found it returns the shared tagged color lane `[0x006cec78+0x66ba] | 0x2c000000`; otherwise it returns zero. Current grounded callers are the mode-`3` pixel cases inside `world_rebuild_active_preview_or_tool_overlay_surface_and_publish_normalized_bounds` `0x00450520`, where this helper acts as the local linked-site or service-list color query rather than as a top-level roster scan.","objdump + caller inspection + local disassembly + mode-3 correlation + per-cell list correlation + tagged-color correlation"
0x00450520,4074,world_rebuild_active_preview_or_tool_overlay_surface_and_publish_normalized_bounds,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Broader shared rebuild owner for the world-side preview or tool-mode family rooted at `[this+0x2175]`, `[+0x2179..+0x2191]`, and transient surface root `[this+0x478]`. The helper first rejects when no active mode is set, runs the mode-`3` normalization prepass `world_recompute_mode3_preview_normalization_window_0x2195_0x2199` `0x00450160` when required, derives the current world-cell rectangle and float scale from the active mode table at `0x005ee5e0/0x005ee5e4`, clamps the active sub-rectangle against the live world dimensions and shell presentation caps, reuses or rebuilds the transient overlay surface through `0x00532490`, `0x00534f80`, and `0x005323f0`, then fills that surface by switching over the active mode and computing one packed color per cell. The per-mode pixel cases mix checkerboard fallbacks with several grounded world queries, including mode-`3` helper `world_query_mode3_preview_cell_best_matching_six_byte_list_color` `0x00450490`, the secondary-grid and overlay classifiers `0x00534e10/0x00534e50/0x00534e90/0x00534ec0/0x00534f00/0x00534f40`, terrain and grid queries `0x00448af0`, `0x00448f00`, `0x00448f30`, and one scalar ramp through `0x0051dfc0`. After rasterizing the active rectangle it publishes the active mode byte through `0x00532510`, refreshes the overlay live flag through `0x00532460`, and pushes the normalized preview bounds back through `0x00532520` and `0x005324e0`. Current grounded callers include the shared wrappers `0x00452d80`, `0x00452db0`, `0x00452f20`, `0x00452f60`, and `0x00452fa0`, plus the mode-`0x15` entry or clear siblings `0x00453370` and `0x00453510`. This is therefore the safest current read for the shared active preview or tool overlay rebuild owner rather than any one window family's private raster pass.","objdump + caller inspection + local disassembly + active-mode correlation + overlay-surface correlation + normalized-bounds correlation + paint-tool correlation"
0x00452d30,68,world_clear_aux_preview_mode_0x2171_and_overlay_companion_live_flag,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small shared clear path inside the world-side preview or tool-mode family. When auxiliary preview mode dword `[this+0x2171]` equals `1`, the helper also clears optional flag dword `[this+0x219d]` and decrements the paired shell-presenter counters `[0x006d4024+0x114272/+0x114266]` when flag `[this+0x21a1]` is still set. It then zeroes `[this+0x2171]` unconditionally and tail-jumps into `world_presentation_clear_overlay_companion_block_live_flag` `0x00532360`. Current grounded callers are the mode-`0x15` entry or clear owners `0x00453370` and `0x00453510`, plus the shell-side cleanup paths in `BuildingDetail.win` at `0x004bc1f1` and `StationDetail.win` at `0x00504a90/0x00505bf0`. This is therefore the safest current read for the auxiliary preview-mode clear helper rather than a generic overlay reset.","objdump + caller inspection + local disassembly + auxiliary-preview correlation + overlay-companion correlation"
0x00452ca0,137,world_set_aux_preview_mode_0x2171_and_reseed_overlay_companion_grid,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small shared setter beside the same world-side preview family. The helper stores the caller mode into auxiliary preview dword `[this+0x2171]`, conditionally arms optional companion flag `[this+0x219d]` when the caller mode is `1`, and increments the paired shell-presenter counters `[0x006d4024+0x114272/+0x114266]` when live flag `[this+0x21a1]` is already set at that moment. It then chooses one of three coarse tile-size lanes (`0x40`, `4`, or `1`) from the auxiliary preview mode and forwards those dimensions plus live world size `[0x0062c120+0x2155/+0x2159]` into `0x00532310` to reseed the local overlay-companion grid. Current grounded callers are `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which passes mode `1`, and `shell_change_height_window_construct` `0x004bcb50`, which passes mode `6`. This is therefore the safest current read for the auxiliary preview-mode setter and companion-grid reseed helper rather than a station-detail-only preview latch.","objdump + caller inspection + local disassembly + auxiliary-preview correlation + companion-grid correlation"
0x00452d80,33,world_store_preview_scalar_0x217d_and_refresh_active_mode_if_nonzero,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny setter in the same world-side preview family. The helper stores one caller dword into `[this+0x217d]` and, when current mode `[this+0x2175]` is already nonzero, re-enters `0x00450520(0)` to rebuild the active preview or tool state. Current grounded caller is `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which forwards the current station-detail row through this helper after staging the candidate id. This is the safest current read for the direct scalar setter plus active-mode refresh rather than a more semantic station-only helper.","objdump + caller inspection + local disassembly + preview-scalar correlation"
0x00452db0,88,world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared linked-site id setter beneath the same world-side preview family. The helper first unregisters the previous linked site through `0x00413620` when current mode `[this+0x2175]` equals `3` and old id `[this+0x2181]` is nonzero, stores the caller id into `[this+0x2181]`, then registers the new id through `0x00413750` when mode `3` is still active and the new id is nonzero. When any preview or tool mode is already active it finally re-enters `0x00450520(0)` to rebuild that mode. Current grounded callers are the linked-peer action branches at `0x0040e5b1`, `0x0040e65d`, and `0x0040e97d`, plus `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which uses it while arming the current station preview. This is therefore the safest current read for the preview-family linked-site setter and mode-3 rebind owner rather than a plain id store.","objdump + caller inspection + local disassembly + linked-site correlation + mode-3 rebind correlation"
0x00452e10,136,placed_structure_collection_dispatch_virtual_slot_0x0c_or_0x10_by_optional_subject_and_linked_peer_gate,map,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Collection-side dispatch helper over every live placed structure in `0x0062b26c`. For each record it chooses between vtable slot `+0x0c` and `+0x10`. When the caller mode arg is not `-1`, slot `+0x0c` is chosen if either the optional subject id resolves through vtable slot `+0x80` plus `0x004129d0` or the structure already satisfies `placed_structure_has_linked_station_or_transit_peer` `0x0040d230`; otherwise the helper falls back to slot `+0x10`. Current grounded callers are the world preview-mode owners `0x00453370`, `0x00453510`, and the broader mode-switch body `0x00452fa0`, which use this helper while entering, leaving, or changing the same site-aware preview states. This is the safest current read for the collection-wide virtual dispatch gate rather than a narrower route-builder helper.","objdump + caller inspection + local disassembly + placed-structure-collection correlation + linked-peer gate correlation"
0x00452ea0,117,world_refresh_preview_flag_0x21a1_from_world_view_float_and_presenter_counters,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small flag-refresh helper in the same world-side preview family. The helper samples float `[0x0062be68+0x20]` from the live world-view owner against one fixed threshold, normalizes the result to boolean flag `[this+0x21a1]`, and only mutates the paired shell-presenter counters `[0x006d4024+0x114272/+0x114266]` when companion enable dword `[this+0x219d]` is already nonzero and the sampled boolean changed. Current grounded caller is the nearby world-view follow-on at `0x0043c5f6`, which invokes this helper before the later local owner refresh path at `0x0043b350`. This is the safest current read for the view-scalar-driven preview-flag updater rather than a broader camera or zoom-mode owner.","objdump + caller inspection + local disassembly + world-view correlation + preview-flag correlation + presenter-counter correlation"
0x00452f20,48,world_refresh_active_preview_mode_from_four_dword_parameter_block,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small active-mode refresh wrapper over the same preview or tool-mode family. The helper copies four caller dwords into a local parameter block and forwards that block into `0x00450520`, leaving the current mode selector unchanged. Current grounded callers are the world-facing preview publish tails at `0x00436164`, `0x004f7958`, `0x004fb4c4`, `0x004fc4a0`, `0x004fc61a`, and `0x004fd4dc`, where it is used as the parameter-block refresh step rather than a top-level mode switch. This is the safest current read for the four-dword active-mode refresh wrapper.","objdump + caller inspection + local disassembly + parameter-block correlation"
0x00452f60,51,world_store_preview_primary_id_0x2179_dispatch_mode3_collection_and_refresh_if_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared primary-id setter in the same world-side preview family. The helper stores one caller dword into `[this+0x2179]`; when current mode `[this+0x2175]` equals `3` it first re-enters `0x00452e10` with that same id to update the placed-structure collection dispatch, and when any mode is active it then re-enters `0x00450520(0)` to rebuild the current preview state. Current grounded caller is `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0`, which uses this helper to stage the candidate id before syncing the station row and linked-site id. This is the safest current read for the primary-id setter plus mode-3 dispatch refresh rather than a station-only helper.","objdump + caller inspection + local disassembly + primary-id correlation + mode-3 collection correlation"
0x00452fa0,704,world_switch_preview_or_tool_mode_and_seed_parameter_block,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Broader shared mode-switch owner for the world-side preview or tool family rooted at `[this+0x2171..+0x2191]`. The helper first releases transient surface root `[this+0x478]` through `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, reconciles the current mode's presenter counters and placed-structure bindings for the grounded families `3`, `6`, and `7`, and then seeds the caller-supplied parameter block into `[this+0x217d/+0x2181/+0x2185/+0x2189/+0x218d/+0x2191]` together with primary scalar `[this+0x2179]` and target mode `[this+0x2175]`. It finishes by re-entering `0x00450520` on that new state and then replaying the mode-specific side binds such as `0x00413750` for mode `6` and `0x00413620/0x00413750/0x00452e10` for mode `3`. Current grounded callers include `PaintRegion.win`, `PaintSound.win`, and `PaintTerritory.win` constructors and message handlers at `0x004f539f`, `0x004f549e`, `0x004f5784`, `0x004fcd10`, and `0x004fcf30`, plus the linked-peer action branches around `0x0040e60a`, `0x0040e9c2`, and `0x00464f8f`. This is therefore the safest current read for the shared world-side preview or tool mode switch owner rather than a single window-family helper.","objdump + caller inspection + local disassembly + mode-switch correlation + parameter-block correlation + paint-tool correlation + linked-peer action correlation"
0x00453370,405,world_enable_preview_mode_0x15_latch_and_enter_if_idle,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared world-side owner for entering the preview-capable mode `0x15`. The helper first rejects when latch byte `[this+0x21c5]` is already nonzero; otherwise it sets that latch and only continues when current mode `[this+0x2175]` is still `0`. On the active path it releases transient surface root `[this+0x478]` through `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, reconciles prior shell-presenter counters for the neighboring mode families `3` and `7` plus optional flag pair `[this+0x219d/+0x21a1]`, adjusts the shared presenter count lane `[0x006d4024+0x11426e]` from the mode table at `0x005ee5e8/0x005ee6e4`, seeds mode `0x15` into `[this+0x2175]`, clears the local scalar band `[+0x2179..+0x2189]`, seeds both timeout-like dwords `[+0x218d/+0x2191] = 0x1869f`, and re-enters `0x00450520` before tailing through `0x00452d30` according to shell field `[0x006cec74+0x12c]`. Current grounded caller is the shell command strip at `0x00441182`, which dispatches here when active scenario plus world state exist and the same preview latch is still clear. This is the safest current read for the mode-`0x15` preview-latch entry owner rather than a generic world reset.","objdump + caller inspection + local disassembly + mode-0x15 correlation + presenter-counter correlation + preview-latch correlation"
0x00453510,621,world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Shared teardown-or-reseed owner for the same world-side preview-mode family rooted at mode byte `[this+0x2175]` and latch `[this+0x21c5]`. The helper first reconciles the auxiliary preview byte `[this+0x2171]` through the small clear tail at `0x00452d30`, then tears down the current mode state through `0x00532360`, `0x00532500`, and `world_presentation_release_transient_surface_handle_0x478_and_clear_flag_0x159b` `0x00534f80`, clears the current mode dword `[this+0x2175]`, and decrements the same shell-presenter counter families used by the entry sibling for prior modes `3` and `7` plus optional flags `[this+0x219d/+0x21a1]`. When preview latch byte `[this+0x21c5]` is still set, it then replays the same mode-`0x15` reset strip against the live world root `0x0062c120`, re-seeding `[world+0x2175] = 0x15`, the scalar band `[+0x2179..+0x2191]`, and the later `0x00450520 -> 0x00452d30` tail. When that latch is clear it returns with the mode fully torn down. Current grounded callers include the shell-side linked-peer action branch at `0x0040e94c`, the route or preview wrappers at `0x00449467` and `0x00464f2d`, many shell tool-window destructors such as `0x004f3b50`, `0x004f50fa`, `0x004f5784`, and `0x0050db9c`, plus the explicit latch-clear sibling `0x004537a0`. This is therefore the safest current read for the shared preview-mode clear-or-reseed owner rather than a one-window destructor helper.","objdump + caller inspection + local disassembly + mode-0x15 correlation + presenter-counter correlation + preview-latch correlation + tool-window teardown correlation"
0x00453780,38,world_disable_preview_mode_0x15_latch_and_clear_if_active,map,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Tiny paired exit helper for the same world-side preview-mode family. When latch byte `[this+0x21c5]` is nonzero the helper clears that latch and, if current mode `[this+0x2175]` still equals `0x15`, tail-jumps into `world_clear_current_preview_mode_and_reseed_mode_0x15_if_latched` `0x00453510`; otherwise it returns immediately. Current grounded callers are the shell command strip at `0x0044118a` and the neighboring settings-side wrapper at `0x004ff90c/0x004ff94a`, which use it as the direct preview-mode unlatch path when the same mode-`0x15` latch is already active. This is the safest current read for the paired latch-clear helper rather than another generic world-mode toggle.","objdump + caller inspection + local disassembly + mode-0x15 correlation + preview-latch correlation"
0x004422d0,96,shell_status_stack_push_four_shell_dwords_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack push helper rooted at the local ring or stack `0x0062be90` with depth index `0x0062bedc`. The helper snapshots five live status lanes into one `5`-byte slot selected by the current depth: shell dwords `[0x006cec74+0x140]`, `[+0x13c]`, `[+0x138]`, and `[+0x144]`, plus startup byte `[0x006cec78+0x4c74]`, then increments the depth. Current grounded callers include the heavier wrappers `0x004423a0`, the live-world save path inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring save-load branch at `0x00446d40`, so this is the safest current read for the shared shell or startup status-band push beneath save-load and world-tool choreography rather than a file-family-specific helper.","objdump + caller xrefs + local disassembly + status-stack correlation"
0x00442330,112,shell_status_stack_pop_restore_four_shell_dwords_and_startup_byte,shell,cdecl,inferred,objdump + caller xrefs + local disassembly,3,"Small status-stack pop helper paired with `shell_status_stack_push_four_shell_dwords_and_startup_byte` `0x004422d0`. The helper decrements stack depth `0x0062bedc`, restores the same five status lanes from the selected `0x0062be90` slot back into shell dwords `[0x006cec74+0x140/+0x13c/+0x138/+0x144]` and startup byte `[0x006cec78+0x4c74]`, and returns. Current grounded callers include the higher wrapper `0x004423d0`, the live-world save path inside `world_entry_transition_and_runtime_bringup` `0x00443a50`, and one neighboring save-load branch at `0x00446d40`, so this is the safest current read for the shared status-band restore beneath save-load and world-tool choreography rather than an ordinary shell-mode setter.","objdump + caller xrefs + local disassembly + status-stack correlation"
0x004423a0,48,shell_status_stack_push_and_service_active_tracklay_and_stationplace_tools,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared higher wrapper over the same shell/startup status-band stack. It first re-enters `shell_status_stack_push_four_shell_dwords_and_startup_byte` `0x004422d0`, then, when the live TrackLay.win tool object at `0x006d1a8c` is present, calls `0x0050e070`, and when the live StationPlace.win tool object at `0x006d1720` is present, tail-jumps into `0x00507a50`. Current grounded callers include the city-connection route builder `0x00402cb0`, the periodic simulation-side tool wrapper `0x0040a9c0`, the live `.smp` serializer `0x00446240`, and the neighboring collection-side world branch `0x0046b9f0`, so this is the safest current read for pushing the shared status band and then bracketing active world-tool windows rather than another generic shell transition helper.","objdump + caller xrefs + local disassembly + tool-window correlation + status-stack correlation"
0x004423d0,48,shell_status_stack_pop_restore_and_service_active_stationplace_and_tracklay_tools,shell,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared higher restore wrapper paired with `0x004423a0`. It first re-enters `shell_status_stack_pop_restore_four_shell_dwords_and_startup_byte` `0x00442330`, then, when the live StationPlace.win tool object at `0x006d1720` is present, calls `station_place_window_service_frame` `0x0050a530`, and when the live TrackLay.win tool object at `0x006d1a8c` is present, tail-jumps into `track_lay_window_service_frame` `0x0050e1e0`. Current grounded callers include the periodic simulation-side tool wrapper `0x0040a9c0`, the live `.smp` serializer `0x00446240`, the neighboring save-load path `0x00446d40`, and the collection-side world branch `0x0046b9f0`, so this is the safest current read for restoring the shared shell/startup status band and then servicing active world-tool windows rather than a generic post-frame notifier.","objdump + caller xrefs + local disassembly + tool-window correlation + status-stack correlation"
0x00442400,930,shell_setup_load_selected_profile_bundle_into_payload_record,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Setup-side payload loader beneath `shell_setup_window_publish_selected_profile_labels_and_preview_surface` `0x00502220`. The helper takes one staged profile-path seed in `ECX`, one destination payload record in `EDX`, and one small caller flag on the stack; clears the full `0x100f2`-byte payload record; builds one rooted input path from either the default setup file-root query at `0x004839e0` or the caller's alternate root override; opens that bundle through `0x00530c80`; and then branches on `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0` to read the structured chunk families through `0x00531150` and `0x00531360`. The ordinary saved-profile side reads the smaller startup payload and preview-surface chunks rooted at ids `0x0001` and `0x03c2`, while the map-style side reads the larger setup payload chunks rooted at ids `0x0004`, `0x2ee0`, and `0x2ee1`, with the exact chunk mix gated by the parsed bundle-header word in the local scratch. Current grounded caller is `0x00502220`, which immediately follows this helper by copying payload fields `+0x14/+0x3b2/+0x3ba/+0x20` into the staged runtime profile through `0x0047be50`.","objdump + local disassembly + caller inspection + chunk-family correlation"
0x004425d0,139,shell_setup_validate_selected_profile_bundle_and_stage_launch_profile,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Validated setup-profile launch helper above shell request `0x0cc`. It allocates one large local scratch block, re-enters `shell_setup_load_selected_profile_bundle_into_payload_record` `0x00442400` on the caller path seed, and only proceeds when the loaded payload carries a nonzero leading byte. On success it force-stages runtime-profile byte `[0x006cec7c+0xc5] = 1`, copies payload byte `+0x22` into profile `+0xc4`, copies payload byte `+0x33` into profile `+0x7d`, mirrors the payload token block `+0x23..+0x32` into profile `+0xc6..+0xd5`, and then issues shell request `0x0cc` through `0x0054e790`. Current grounded callers are the validated setup launch controls inside `shell_setup_window_handle_message` `0x005033d0`, where selector-`3` and selector-`5` siblings share this same staging bridge before the later startup-profile owner runs.","objdump + local disassembly + caller inspection + setup-launch correlation + runtime-profile-staging correlation"
0x00442660,209,shell_publish_progress_sample_notice_from_byte_delta_and_elapsed_ticks,shell,cdecl,inferred,objdump + caller inspection + local disassembly + status-notice correlation,2,"Shared progress-sample notice helper in the surrounding save or load strip. The helper measures the current byte counter through `0x00530b70`, derives one rounded kilobyte delta against previous counter `0x0062c11c`, formats that delta through `%5d`, measures elapsed ticks against `0x0062bed0` through `0x0051d890`, formats the elapsed field through `% 4d`, and then packages both fields plus the caller-supplied status stem into the shared shell text builder `0x005193f0 -> 0x00518de0 -> 0x0051d680`. It finally updates `0x0062c11c` to the current byte counter. Current grounded callers include the bundle-service strip at `0x00413469/0x004134b4` and the save-side progress path inside `shell_map_file_world_bundle_coordinator` around `0x00445098`, so this is the safest current read for the shared byte-delta and elapsed-time progress notice helper rather than a one-off formatter.","objdump + caller inspection + local disassembly + status-notice correlation + save-load-progress correlation"
0x00442740,128,shell_build_temp_surface_from_payload_preview_pixels_and_query_named_resource_field_0x46,shell,cdecl,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Short companion helper in the same save or export strip. The function allocates a temporary `0x40000`-byte RGBA copy of the embedded preview pixel block rooted at `[record+0x03c2]`, constructs one temporary `0xec`-byte surface-like owner through `0x0053b070 -> 0x00543980( pixels, 0x100, 0x100, 0 )`, and then forwards the caller path seed plus fixed selector `0x46` into `0x00542f50`, storing the returned dword into payload field `[record+0x18]`. It finally releases the temporary owner through `0x00542c90 + 0x0053b080`. Current grounded caller is the save-side bundle branch at `0x00445925`, immediately after tagged setup-preview payload export and before the shared progress notice path, so this is the safest current read for the temporary-surface query helper rather than a generic image copier.","objdump + caller inspection + local disassembly + surface-family correlation + save-side bundle correlation"
0x004427c0,624,shell_map_bundle_rewrite_companion_payload_file_via_tmp_path_and_progress_callback,shell,cdecl,inferred,objdump + caller inspection + local disassembly + companion-image correlation,3,"Broader companion-payload rewrite owner in the same save or export strip. The helper copies the caller path into a local buffer, strips its extension through `support_strip_extension_in_place` `0x0051df90`, appends the fixed `%1.tmp` suffix, opens the source file, allocates one full-size heap buffer, and reads the file body through `0x005a1b05`. It then installs `shell_progress_callback_publish_incremental_percent_status_until_target` `0x00441e20` into global `0x00d93988`, forwards the source tail plus destination tail rooted at `+0x03ce` into `0x00553000`, and writes the rewritten output back through `0x005a276f`, preserving the leading `0x03ce` bytes and the trailing untouched source bands around the transformed middle region. On completion it updates payload dword `[record+0x18]`, re-enters `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`, frees the temporary buffers, and clears `0x00d93988` again. Current grounded caller is the save-side branch at `0x00443cd3`, which enters this helper only when payload byte `[record+0x66c9]` is set before deriving the external `_A.tga/_A.jpg` companion path. This is the safest current read for the temporary-path companion-payload rewrite owner rather than a generic file copy helper.","objdump + caller inspection + local disassembly + companion-image correlation + tmp-path correlation + progress-callback correlation"
0x00442900,304,shell_map_bundle_rewrite_companion_payload_file_from_record_offsets_and_sync_tags,shell,cdecl,inferred,objdump + caller inspection + local disassembly + companion-image correlation,3,"Sibling companion-payload rewrite owner in the same save or export strip. The helper takes the live payload record in `EAX` plus one caller path on the stack, reads the whole source file into a temporary heap buffer, installs progress callback `0x00441e20` in `0x00d93988`, and then rewrites the middle payload band through `0x00553000` using the stored file offsets in `[record+0x18/+0x1c]`. It writes the rebuilt output in four spans through `0x005a276f`: the leading `0x03ce` bytes, the transformed middle payload, the untouched interval `[record+0x18 .. record+0x1c)`, and the remaining tail. On completion it stores the caller path back into `[record+0x18]`, re-enters `shell_map_bundle_serialize_companion_image_selector_and_payload_key_tags_0x2ee0_0x2ee1_0x3c2` `0x00441ec0`, frees the temporary buffers, and clears `0x00d93988` again. Current grounded caller is the save-side branch at `0x004459dd`, reached after companion-image import `0x00441f70` when payload byte `[record+0x66c9]` is set, so this is the safest current read for the offset-driven companion-payload rewrite sibling rather than another generic file copier.","objdump + caller inspection + local disassembly + companion-image correlation + progress-callback correlation + save-side bundle correlation"
0x00442a40,31,locomotive_policy_issue_id_is_in_primary_engine_family_band,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save-load correlation,3,"Small range-membership predicate in the locomotive-policy strip. The helper returns true only for issue ids in the two disjoint bands `0x0f1..0x15f` and `0x1c9..0x1da`, and false everywhere else. Current grounded callers are the stream-load path `0x0042ddd0`, the stream-save inverse path `0x00430feb`, the scenario availability-owner path `0x0043160b`, the setup-side terrain or candidate branch `0x004d6125`, and the neighboring primary forward mapper `0x00442a85`, so this is the safest current read for the primary locomotive-engine-family issue-band membership test rather than a generic range helper.","objdump + caller xrefs + local disassembly + stream-save-load correlation + locomotive-policy correlation"
0x00442a5f,38,locomotive_policy_issue_id_is_in_secondary_engine_family_band,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save-load correlation,3,"Sibling range-membership predicate in the same locomotive-policy strip. The helper returns true only for issue ids in the disjoint bands `0x160..0x1c4` and `0x1db..0x1f6`, and false everywhere else. Current grounded callers are the same stream-load and stream-save pair `0x0042ddde` and `0x00431000`, plus the neighboring secondary forward mapper `0x00442aac`, so this is the safest current read for the secondary locomotive-engine-family issue-band membership test rather than another anonymous range check.","objdump + caller xrefs + local disassembly + stream-save-load correlation + locomotive-policy correlation"
0x00442a85,23,locomotive_policy_map_primary_engine_family_index_to_issue_id,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + editor-policy correlation,3,"Primary forward mapper in the locomotive-policy strip. The helper treats the caller value as one compact engine-family or policy index, leaves `0` unchanged, maps `1..0x6f` into issue ids `0x0f1..0x15f`, maps `0x70..` into issue ids `0x1c9..0x1da` by inserting a fixed gap `0x69`, and then bounds the result against the upper limit `0x1db`. Current grounded callers are `locomotive_era_and_engine_type_pass_company_policy_gate` `0x0041d550`, the stream-load branch `0x0042de19`, and the neighboring primary row resolver `0x00442a9c`, so this is the safest current read for the forward map from the primary locomotive engine-family index space into raw issue ids rather than a plain arithmetic shim.","objdump + caller xrefs + local disassembly + editor-policy correlation + locomotive-policy correlation"
0x00442a9c,16,locomotive_policy_resolve_primary_issue_row_ptr_from_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + table-layout correlation,3,"Primary row resolver over the fixed issue table rooted at `0x00610398`. The helper first maps the caller through `locomotive_policy_map_primary_engine_family_index_to_issue_id` `0x00442a85`, then multiplies that issue id by stride `0x6e`, adds the table base `0x00610398`, stores the resulting row pointer in `EDI`, and returns it in `EAX`. Current grounded caller is the shell-side formatter strip at `0x00462449`, which uses the returned row to resolve the primary localized issue-name path. This is the safest current read for the primary issue-row resolver rather than a generic table indexer.","objdump + caller xrefs + local disassembly + table-layout correlation + issue-row correlation"
0x00442aac,23,locomotive_policy_map_secondary_engine_family_index_to_issue_id,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + caller correlation,3,"Secondary forward mapper in the same locomotive-policy strip. The helper leaves index `0` unchanged, maps `1..0x65` into issue ids `0x15f..0x1c4`, maps higher indices into issue ids `0x1db..0x1f6` by inserting fixed gap `0x16`, and bounds the result against the upper limit `0x1f7`. Current grounded callers are the stream-load branch `0x0042de19`, the locomotive scalar owner `0x00461a06`, and the neighboring secondary row resolver `0x00442ac3`, so this is the safest current read for the secondary locomotive-engine-family index-to-issue-id map rather than another plain arithmetic helper.","objdump + caller xrefs + local disassembly + caller correlation + locomotive-policy correlation"
0x00442ac3,16,locomotive_policy_resolve_secondary_issue_row_ptr_from_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + table-layout correlation,3,"Secondary row resolver over the same fixed issue table rooted at `0x00610398`. The helper maps the caller through `locomotive_policy_map_secondary_engine_family_index_to_issue_id` `0x00442aac`, multiplies the resulting issue id by stride `0x6e`, adds the base `0x00610398`, stores the row pointer in `EDI`, and returns it in `EAX`. Current grounded caller is the sibling shell-side formatter strip at `0x004624ae`, where it resolves the alternate localized issue-name row. This is the safest current read for the secondary issue-row resolver rather than a generic pointer arithmetic stub.","objdump + caller xrefs + local disassembly + table-layout correlation + issue-row correlation"
0x00442ad3,14,locomotive_policy_map_primary_issue_id_to_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save correlation,3,"Inverse sibling of `0x00442a85` in the same locomotive-policy strip. The helper subtracts base issue id `0x0f0`, and when the resulting compact index rises above `0x6f` it removes the inserted gap `0x69` to recover the original primary engine-family or policy index. Current grounded caller is the stream-save path `0x00430ff2`, which uses this inverse map when serializing the primary issue band back into the compact save-side index space. This is the safest current read for the primary issue-id-to-index inverse rather than a free-standing subtractive helper.","objdump + caller xrefs + local disassembly + stream-save correlation + locomotive-policy correlation"
0x00442ae1,14,locomotive_policy_map_secondary_issue_id_to_engine_family_index,simulation,cdecl,inferred,objdump + caller xrefs + local disassembly + stream-save correlation,3,"Inverse sibling of `0x00442aac` in the same locomotive-policy strip. The helper subtracts base issue id `0x15f`, and when the resulting compact index rises above `0x65` it removes the inserted gap `0x16` to recover the original secondary engine-family or policy index. Current grounded caller is the stream-save path `0x00431007`, which uses this inverse map when serializing the secondary issue band back into the compact save-side index space. This is the safest current read for the secondary issue-id-to-index inverse rather than another subtractive arithmetic stub.","objdump + caller xrefs + local disassembly + stream-save correlation + locomotive-policy correlation"
0x00442ba0,143,shell_export_live_setup_preview_payload_record_and_normalize_pixel_block_0x100x0x100,shell,thiscall,inferred,objdump + caller inspection + local disassembly + payload-export correlation,3,"Concrete live-payload export helper in the setup and map-bundle strip. The helper copies the full live payload record from `[this+0x66be]` into the caller buffer, forces the leading validity byte to `1`, patches the exported world dimensions from `[0x0062c120+0x2155/+0x2159]` into offsets `+0x01/+0x05`, mirrors three shell-side state bytes from `[0x006d4024+0x11471a]`, `[0x006d4024+0x11471e]`, and `0x0062bec4` into offsets `+0x09..+0x0b`, and then normalizes the embedded pixel block at `+0x03c2` through `0x0047a120` with fixed dimensions `0x100 x 0x100`. Current grounded callers are the save-side setup export path at `0x00444f42`, which immediately forwards the resulting record into the companion-image tag strip `0x00441ec0`, and the slot-table bundle serializer at `0x00446312`, which emits the same copied record under tags `0x2ee0/0x03c2/0x2ee1`. This is the safest current read for the live setup-preview payload exporter rather than a generic memcpy wrapper.","objdump + caller inspection + local disassembly + payload-export correlation + companion-image correlation + bundle-tag correlation"
0x00442c30,3600,shell_apply_scenario_name_specific_post_load_world_and_object_fixups,shell,thiscall,inferred,objdump + caller inspection + local disassembly + scenario-string correlation,4,"Broad post-load fixup owner reached from `world_entry_transition_and_runtime_bringup` at `0x00444b50`. The helper compares the caller-supplied scenario title against many fixed `.rdata` names including `Go West!`, `Germany`, `France`, `State of Germany`, `New Beginnings`, `Dutchlantis`, `Britain`, `New Zealand`, `South East Australia`, `Tex-Mex`, `Germantown`, `The American`, `Central Pacific`, and `Orient Express`, with several branches further gated by setup payload byte `[this+0x66de]`. Matching branches then perform targeted live-world and collection edits: they mutate object-state dwords and bytes inside collections rooted at `0x0062be18`, `0x0062bae0`, and `0x006ada80`; retune selected float and scalar fields; copy paired ten-dword record blocks when specific name or class pairs match; patch secondary-raster bits through the fixed table `0x005ee508..0x005ee5cc`; update one later collection at `0x0062b268`; and inject several scenario-specific text lines into the shell-owned band `[this+0x4f30]` through repeated `0x0051e5d0`. This is the safest current read for the scenario-name-specific post-load fixup owner rather than a generic string-dispatch helper.","objdump + caller inspection + local disassembly + scenario-string correlation + live-world mutation correlation + post-load-fixup correlation"
0x0044c450,96,world_rebuild_all_grid_cell_candidate_cargo_service_bitsets,map,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Late world-reactivation sweep inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. The helper walks the full live world grid rooted at `[this+0x2129]` through dimensions `[this+0x2145/+0x2149]`, resolves each cell pointer, and re-enters `placed_structure_rebuild_candidate_cargo_service_bitsets` `0x0042c690` on every cell record. Current grounded caller is the later world-entry tail at `0x444b24`, immediately after `world_clear_and_reseed_region_center_world_grid_flag_bit` `0x0044c4b0` and before the route-style link rebuild at `0x468300`, so this is the current safest read for the world-wide grid-cell cargo-service-bitset refresh wrapper rather than another generic world-grid loop.","objdump + local disassembly + caller inspection + world-grid correlation + cargo-service correlation"
0x0044c4b0,192,world_clear_and_reseed_region_center_world_grid_flag_bit,map,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Late world-reactivation helper inside `world_entry_transition_and_runtime_bringup` `0x00443a50`. The first sweep walks the full live world grid rooted at `[0x0062c120+0x2129]` through dimensions `[+0x2145/+0x2149]` and clears bit `0x10` in each cell byte `[cell+0xe6]`. It then walks the live region collection at `0x0062bae0`, keeps only regions whose class byte `[region+0x23e]` is zero, resolves one representative center cell through `world_region_resolve_center_world_grid_cell` `0x00455f60`, and sets that same bit on the resolved cell. Current grounded caller is the later world-entry tail at `0x444b19`, between the post-bundle runtime refresh phase and the later shell or company-cache follow-ons, so this is the current safest read for the region-center world-grid flag reseed pass rather than another generic grid scrub.","objdump + local disassembly + caller inspection + region-grid correlation"
0x0044c570,256,world_mark_secondary_raster_clear_cell_mask_0x3e_as_class_2_and_cache_bounds,map,thiscall,inferred,objdump + caller xrefs + local disassembly + secondary-raster correlation,3,"Small secondary-raster mutation helper beneath the later marked-cell scan and overlay-cache family. After clamping the caller cell coordinates against the current secondary-grid dimensions, the helper resolves the byte raster rooted at `[this+0x2135]` using row stride `[this+0x2155] + 1` and only proceeds when the target byte has no bits in mask `0x3e` and the parallel class predicate `world_secondary_raster_query_cell_class_in_set_1_3_4_5` `0x00534e10` also reports false. On the admit path it widens cached min/max bounds `[this+0x21c6..+0x21d2]`, increments the marked-cell count `[this+0x21d6]`, and then rewrites the target raster byte with `(byte & 0xc3) | 0x02`, i.e. it preserves the outer two bits and the low bit while forcing the masked class field to `0x02`. Current grounded caller is the later radial mutation branch at `0x0044e8e7`, and the written bounds/count fields are the same ones later scanned by `world_scan_secondary_grid_marked_cell_bounds` `0x0044ce60`, so this is the safest current read for the small secondary-raster cell-marker helper rather than another generic bounds updater.","objdump + caller xrefs + local disassembly + secondary-raster correlation + marked-cell-bound correlation"
@ -763,6 +845,9 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x004614d0,40,runtime_object_vtable_wrapper_query_local_companion_float_relief_score_at_rounded_coords,map,thiscall,inferred,objdump + local disassembly + wrapper correlation,2,"Tiny virtual-style wrapper over `world_query_local_companion_float_relief_score_at_cell_with_distance_and_mode_bias` `0x0044afa0`. It rounds the current object's normalized secondary and primary coordinates through `0x00455810`, `0x00455800`, and `0x005a10d0`, then forwards the resulting cell pair plus world root `0x0062c120` into `0x0044afa0`. Current evidence grounds it only as the table-local wrapper over the heavier world-scalar query, not the owning subtype name.","objdump + local disassembly + wrapper correlation + world-scalar-query correlation"
0x00461500,39,runtime_object_query_flag_byte_0x42_with_class0_true_fallback_when_mode_gate_inactive,map,thiscall,inferred,objdump + local disassembly + mode-gate correlation,2,"Small mode-gated flag query on the same virtual-family boundary as `0x004614d0`. The helper first checks shell mode gate `0x004338c0` on scenario root `0x006cec78`; when that gate is active it returns byte `[this+0x42]` directly. When the gate is inactive it returns literal `1` only for class-0 records with `[this+0x23e] == 0`, and otherwise falls back to the same byte `[this+0x42]`. Current evidence is strong enough only for that structural fallback rule, not for a tighter semantic name for the flag or owning subtype.","objdump + local disassembly + mode-gate correlation + field inspection"
0x00461650,120,map_load_geographic_label_database,map,cdecl,inferred,ghidra-headless,3,Loads the geographic-label database branch inside the broader reference-bundle setup. It stages resource ids 0x5209 through 0x520b binds the selected bundle through 0x517d90 iterates the loaded collection with 0x517cf0 0x518380 and 0x518140 and dispatches each record through vtable slot +0x44 using the current map path context.,ghidra + rizin + llvm-objdump + strings
0x00461c00,126,locomotive_collection_resolve_entry_by_primary_or_alias_stem,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shared string resolver over the live locomotive collection at `0x006ada84`. The helper walks every live locomotive row, first compares the caller text against the primary stem at `[entry+0x34]`, then against the alias or secondary stem at `[entry+0x53]`, and returns the first matching live row pointer through the collection accessors `0x00518380/0x00518140`. Failure returns null. Current grounded caller is the cheat-code owner `0x00437d70`, where selector `4` resolves stems like the hidden locomotive cheat aliases before applying them to every train owned by the selected company through `0x004aefb0`. This is therefore the safest current read for the primary-or-alias locomotive stem resolver rather than a more specific dialog helper.","objdump + local disassembly + caller inspection + locomotive-stem correlation + cheat-branch correlation"
0x00461c80,30,locomotive_entry_query_linked_era_name_ptr,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Small accessor over one live locomotive entry. The helper resolves linked era id `[loco+0x72]` through the era collection at `0x0062ba88` and, on success, returns the raw era-name pointer at `[era+0x45]`; missing era ids return null. Current grounded callers are the locomotives-availability and recipe-side editor families around `0x004cd641`, `0x004cdaf2`, `0x004cf16c`, `0x004cf1f2`, `0x004cf2ed`, `0x004cf3f0`, the world-entry rehydrate lane at `0x004478de`, and the smaller shell-side branch at `0x00438d5f`, so this is the safest current read for the linked-era name-pointer accessor rather than a display-only helper.","objdump + local disassembly + caller inspection + era-collection correlation + locomotive-editor correlation"
0x00461ca0,35,locomotive_entry_format_linked_era_name_or_null,simulation,thiscall,inferred,objdump + local disassembly + caller inspection,2,"Formatting companion to `locomotive_entry_query_linked_era_name_ptr` `0x00461c80`. The helper resolves linked era id `[loco+0x72]` through the same era collection at `0x0062ba88` and, on success, forwards the era-name pointer `[era+0x45]` into `0x0051c920`; missing era ids return null. Current grounded callers are the train-upgrade news formatter `0x00409300` and the neighboring company-side upgrade branch at `0x00409903`, where it supplies the old and new locomotive-era display names embedded in localized news id `2897`.","objdump + local disassembly + caller inspection + era-name formatting correlation + train-upgrade-news correlation"
0x00461cd0,298,locomotive_collection_select_best_era_matched_non_electric_fallback_id,simulation,thiscall,inferred,objdump + caller xrefs + callsite inspection + engine-type correlation,2,"Fallback locomotive chooser beneath `company_select_preferred_available_locomotive_id` `0x004078a0`. The helper walks the live locomotive collection, explicitly skips records whose engine-type dword `[record+0x10]` is `2`, and then scores the remaining records from the linked era record at `[record+0x72]`: the current grounded score uses the absolute distance from the current scenario year to the era start field `[era+0x105]`, adds `500` when the era has not started yet, adds `50` when the current year has passed the era-end field `[era+0x109]`, and adds `2000` when the linked approval helper `0x0041d550` rejects the era or engine family for the current context. The lowest-penalty locomotive id wins, so the current best read is an era-matched non-electric fallback rather than a general preferred-locomotive chooser. Current grounded caller is `company_select_preferred_available_locomotive_id` `0x004078a0`.","objdump + caller xrefs + callsite inspection + engine-type correlation + fallback-choice correlation"
0x00461e00,262,locomotive_collection_refresh_runtime_availability_overrides_and_usage_state,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Collection-wide runtime refresh over the live locomotive pool at `0x006ada84`. The helper guards itself with reentrancy latch `0x006ada88`, walks every live locomotive record, resolves the linked era record through `[loco+0x72]`, and combines the locomotive-side requirement bytes `[loco+0x30/+0x31/+0x32]` with the active scenario-state availability toggles at `[0x006cec78+0x4c97..+0x4c99]`. When the current locomotive or its linked era passes those gates it upserts one boolean availability override through `scenario_state_upsert_named_locomotive_availability_record_and_refresh_runtime_usage` `0x004350b0`; it then immediately queries the resulting named override through `scenario_state_query_named_locomotive_availability_record_value` `0x00435030` and stores that value into `[loco+0x7b]`. When the collection sweep finishes it tails into `0x00436af0` to rebuild the dependent locomotive-side scalar band. Current grounded callers are the world-entry rehydrate tail inside `world_entry_transition_and_runtime_bringup` `0x00443a50` and the startup or restore-side upsert family that also re-enters this helper through `0x004350b0`, so this is the safest current read for the collection-wide locomotive runtime-availability refresh rather than a single dialog-owned toggle helper.","objdump + caller xrefs + local disassembly + locomotive-availability correlation + scenario-state override correlation + reentrancy-latch correlation"
0x00464410,12679,shell_dispatch_ui_command,shell,cdecl,inferred,ghidra-headless,4,Large shell UI command dispatcher reached from shell-side event callbacks and direct command pushes. It switches over many command ids including 0x7530 through 0x7532 graphics-preset commands that route into 0x0051ebc0 0x00484590 and 0x004853c0; 0x7533 through 0x7534 TigerTank viewer actions; and 0x7540 through 0x7543 scenario-text report build and batch-processing commands that route into 0x00489830 0x004886e0 and 0x00489a20.,ghidra + rizin + llvm-objdump + strings
@ -911,6 +996,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x004853c0,740,shell_apply_graphics_preset_bundle,shell,cdecl,inferred,ghidra-headless,4,Applies one table-driven graphics preset bundle to the shell settings object. It derives a preset tier from shell state and runtime capability probes then writes per-setting values through repeated 0x00485060 calls refreshes dependent runtime state through 0x00484d70 optionally saves game.cfg through 0x00484910 and updates several display capability flags under 0x006d4024.,ghidra + rizin + llvm-objdump
0x00485060,635,shell_set_graphics_option_with_fanout,shell,thiscall,inferred,ghidra-headless,4,Writes one graphics option value into the shell settings arrays at [this+0xac] and coordinates grouped fanout updates. Primary preset selectors recursively expand into dependent option ids 1 through 16 using preset remap tables at 0x00621250 through 0x00621358. The function compares the new normalized value against the previous setting invokes 0x00484d70 when a runtime refresh is needed and persists game.cfg through 0x00484910 once the update batch completes.,ghidra + rizin + llvm-objdump
0x00485760,2746,vehicle_visual_init_running_gear_and_smoke_effects,bootstrap,thiscall,inferred,ghidra-headless,4,Builds a larger vehicle visual bundle covering running-gear assets smoke effects and attachment-audio objects. The routine fills indexed road-wheel visual arrays from RoadWheelR and RoadWheelL asset strings creates direct MuzzleSmoke and ExhaustSmoke sprite emitters at [this+0x216] and [this+0x21a] and then creates five fixed attachment objects at [this+0x3cc] through [this+0x3dc] for diesel1 tracks german88 turret and mantlet audio assets before registering them on the owner.,ghidra + rizin + llvm-objdump + strings
0x004858e0,1677,vehicle_visual_build_exhaust_running_gear_track_and_mantlet_attachment_children,bootstrap,thiscall,inferred,objdump + local disassembly + rdata literal inspection,2,"Broader vehicle-side child-builder under `vehicle_visual_init_running_gear_and_smoke_effects` `0x00485760`. The helper formats and allocates one attachment child for `%1_ExhaustSmoke.3dp`, one payload record for `%1_MuzzleFlash.3dp`, then builds and registers a larger running-gear strip including `%1_RoadWheelL%2.3dp`, `%1_RoadWheelR%2.3dp`, `%1_IdlerWheelL.3dp`, `%1_IdlerWheelR.3dp`, `%1_DriveWheelL.3dp`, `%1_DriveWheelR.3dp`, `%1_TrackL.3dp`, `%1_TrackR.3dp`, and `%1_MantletLight1.3dp`. Along that path it publishes child handles through `0x0052d8a0/0x0052d9a0`, derives local triplet bands through `0x0052e780`, and uses `0x0052db10/0x0052dc00` to materialize and threshold-bucket grouped packet rows on the two running-gear child roots at `[this+0x232]` and `[this+0x236]`. Current evidence is strongest for the exhaust, wheel, track, and mantlet attachment-child builder rather than the top-level vehicle visual constructor itself.","objdump + local disassembly + rdata literal inspection + vehicle-visual correlation + grouped-subrecord correlation"
0x004883f0,325,scenario_text_export_append_numbered_entry,scenario,cdecl,inferred,ghidra-headless,4,Formats and appends one numbered translation entry into the scenario-text export buffer. It duplicates the source text applies the export wrapper template through helper formatters and appends the finished block through 0x531030 while updating the running non-comment word count at 0x006cfca0.,ghidra + rizin + llvm-objdump + strings
0x004886e0,3796,scenario_text_export_build_language_file,scenario,cdecl,inferred,ghidra-headless,4,Builds one MAPS\\%s.lng scenario-text export for the active map and returns the non-comment word count. It writes translator guidance and section headers then walks map briefing territory city geographic-label station company and event collections appending numbered entries through 0x004883f0 before finalizing the output buffer.,ghidra + rizin + llvm-objdump + strings
0x00487450,153,shell_open_tiger_tank_viewer,shell,cdecl,inferred,ghidra-headless,3,Allocates and shows the dedicated TigerTank shell viewer object when no viewer is active. It samples shell-owned placement data allocates a 0x434-byte object initializes it through 0x00485760 with the TigerTank title and stores the resulting viewer pointer in 0x006cfc8c.,ghidra + rizin + llvm-objdump + strings
@ -1035,7 +1121,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x00504590,468,shell_station_detail_present_scenario_station_connection_triplet_popup,shell,cdecl,inferred,objdump + local disassembly + caller inspection + format-string correlation,3,"Formats and presents the scenario-latched `StationDetail.win` popup beneath action controls `0xb3b7` and `0xb3b8`. After validating the current station from detail-manager state `0x006d0818+0x90`, the helper walks the selected station's per-destination table rooted at `[station+0x30]`, skips invalid or self station ids, copies each other station name into the local text buffer, and then appends three per-destination scalar lanes from the current station's five-byte-stepped metric arrays. Active lanes format through the local `%1 : ` and ` %5.2f` helpers at `0x005d16f0` and `0x005d16e8`, while missing lanes fall back to `N/C` at `0x005d16e0`; the stacked result is then published through `shell_publish_text_callout_presentation` `0x005519f0` using helper root `0x006d16e8`. Current grounded caller is `shell_station_detail_window_refresh_controls` `0x00506610` when scenario latch `[0x006cec74+0x1db]` is set, so the safest current read is a scenario-side station connection triplet popup rather than an ordinary haul or candidate-service branch.","objdump + local disassembly + caller inspection + format-string correlation + scenario-latch correlation"
0x00504770,786,shell_station_detail_present_to_from_haul_stats_popup,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats and presents the `StationDetail.win` hauled-traffic popup for one of the two `To` or `From` summary widgets. The helper validates the current station from detail-manager state `0x006d0818+0x90`, resolves the selected station record through `0x006cec20`, and then chooses the localized direction strings `676` `...hauled TO this station.` or `679` `...hauled FROM this station.` plus the singular or plural `load` and `loads` labels `677/678` based on the triggering control id `0xb3f6` versus `0xb3f7`. It formats the current-year and lifetime load and value totals through the station haul-stat helpers at `0x0047d7e0` or `0x0047d7f0`, then presents the final popup text through the shell message-box path at `0x00538c70`. Current grounded owner is the neighboring `To` or `From` summary-widget builder at `0x00505150`.","objdump + RT3.lng strings + caller inspection + hauled-traffic popup correlation"
0x00504a90,70,shell_station_detail_clear_active_candidate_service_preview,shell,thiscall,inferred,objdump + caller inspection + state correlation,4,"Clears the active candidate-service preview owned by `StationDetail.win`. The helper first resets the shared `(placed-structure id, candidate id)` pair at `0x005ee4fc` and `0x005ee500` through `0x0043f610`, then tears down the local station-detail preview latch at `[this+0x7c]` and decrements the sibling global refcount `0x0062be84` when that preview was armed. When the live world owner at `0x0062c120` is in the matching preview-capable mode gate rooted at `[+0x2171]` and `[+0x2175]`, it tails into the neighboring world-side clear path at `0x00452d30`. Current grounded callers are the station-detail selection reset branches around `0x00504bca`, `0x00504bda`, and the later cleanup family at `0x00505bff` and `0x00505c0a`.","objdump + caller inspection + world-preview correlation"
0x00504ae0,174,shell_station_detail_set_active_candidate_service_preview,shell,thiscall,inferred,objdump + caller inspection + state correlation,4,"Arms the active candidate-service preview for `StationDetail.win`. The helper begins by clearing the old preview through `shell_station_detail_clear_active_candidate_service_preview` at `0x00504a90`, then when the supplied candidate id is nonzero and the live world owner at `0x0062c120` is in the matching preview-capable mode gate it routes the current detail-panel station id through the world-side preview family at `0x00452f60`, `0x00452d80`, `0x00452db0`, and `0x00452ca0`. On success it latches the preview-active bit at `[this+0x7c]`, increments the sibling global refcount `0x0062be84`, and stores the active `(station id, candidate id)` pair into `0x005ee4fc` and `0x005ee500` through `0x0043f620`. This is the shell-side owner that feeds the broader world scanner rooted at `0x0043f640` with the currently inspected station-detail candidate pair.","objdump + caller inspection + world-preview correlation + global-pair correlation"
0x00504ae0,174,shell_station_detail_set_active_candidate_service_preview,shell,thiscall,inferred,objdump + caller inspection + state correlation,4,"Arms the active candidate-service preview for `StationDetail.win`. The helper begins by clearing the old preview through `shell_station_detail_clear_active_candidate_service_preview` at `0x00504a90`, then when the supplied candidate id is nonzero and the live world owner at `0x0062c120` is in the matching preview-capable mode gate it routes the current detail-panel station id through the world-side preview family at `world_store_preview_primary_id_0x2179_dispatch_mode3_collection_and_refresh_if_active` `0x00452f60`, `world_store_preview_scalar_0x217d_and_refresh_active_mode_if_nonzero` `0x00452d80`, `world_store_preview_linked_site_id_0x2181_rebind_mode3_and_refresh_if_active` `0x00452db0`, and `world_set_aux_preview_mode_0x2171_and_reseed_overlay_companion_grid` `0x00452ca0`. On success it latches the preview-active bit at `[this+0x7c]`, increments the sibling global refcount `0x0062be84`, and stores the active `(station id, candidate id)` pair into `0x005ee4fc` and `0x005ee500` through `0x0043f620`. This is the shell-side owner that feeds the broader world scanner rooted at `0x0043f640` with the currently inspected station-detail candidate pair.","objdump + caller inspection + world-preview correlation + global-pair correlation"
0x00504ba0,796,shell_station_detail_update_candidate_service_entry,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Updates one candidate-service entry inside `StationDetail.win`. With zero in the first stack slot the helper either re-arms the globally remembered candidate through `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` or clears the current preview through `shell_station_detail_clear_active_candidate_service_preview` at `0x00504a90`. On the ordinary nonzero path it validates the current station from detail-manager state `0x006d0818+0x90`, rejects disallowed modifier combinations from `0x006d4018+0xa8c`, resolves the candidate from `0x0062ba8c`, and then either updates the hover anchor at `0x006d16fc/0x006d1700` or re-enters `placed_structure_query_candidate_local_service_metrics` at `0x0047e240` to format the visible entry text. Current grounded text lanes use localized ids `681`, `682`, and `2813` for the loads-available, current-price, and average-profit explanation strings, plus ids `688` and `689` for the nearby-structure jump text. This is the clearest shell-side owner above the active candidate-service preview pair and the station-detail candidate service readout.","objdump + RT3.lng strings + caller inspection + service-preview correlation"
0x00504bea,722,shell_station_detail_format_candidate_local_service_summary,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Formats the candidate-local-service summary lane inside `StationDetail.win`. The helper validates the current station id from the detail manager through collection `0x006cec20`, resolves the candidate record through `0x0062ba8c`, and when the ordinary station-detail path is active it re-enters `shell_station_detail_set_active_candidate_service_preview` at `0x00504ae0` before querying `placed_structure_query_candidate_local_service_metrics` at `0x0047e240`. It then formats the visible candidate text using localized ids `681` `%1: Loads available: %2`, `682` `Current Price: %1`, and the explanatory text `2813` `Prices shown are the average profit per load for delivering %1 from %2 to that station...`; neighboring branches also use localized ids `688` and `689` for the nearby-structure jump affordance. This now looks like the shell-side candidate-service readout above the same local service metric lane used by the station freight and express summaries.","objdump + RT3.lng strings + caller inspection + service-query correlation"
0x00505150,796,shell_station_detail_build_to_from_haul_summary_widget,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Builds one of the two `To` or `From` hauled-traffic summary widgets inside `StationDetail.win`. The helper chooses the localized heading `686` `To` or `687` `From` from its first argument, paints a bounded 10-step summary strip from the supplied float lane and the paired station haul-stat queries at `0x0047d7e0` or `0x0047d7f0`, and formats the one-line direction-specific labels and totals through the same `load` or `loads` family later used by the popup callback. On first build it also registers the matching control id `0xb3f6` or `0xb3f7` through callback `shell_station_detail_present_to_from_haul_stats_popup` at `0x00504770`, so the same widget owns both the visible `To` or `From` strip and the click-through stats popup. Current grounded caller is the larger station-detail refresh pass at `0x00506610`, which constructs the `To` and `From` widgets back to back.","objdump + RT3.lng strings + caller inspection + control registration correlation"
@ -1043,6 +1129,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x00505760,1159,shell_station_detail_refresh_candidate_service_rows,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Refreshes the visible candidate-service row lane inside `StationDetail.win`. The helper counts currently active candidate-service entries through `placed_structure_count_candidates_with_local_service_metrics` at `0x0047e330`, resolves each visible row candidate through the neighboring ordinal helper at `0x0047e620`, and then colors and formats the row from the candidate-local-service metrics, the candidate display name, and the same localized strings `681`, `682`, and `2813` used by `shell_station_detail_update_candidate_service_entry`. It registers the per-row click path through callback `shell_station_detail_update_candidate_service_entry` at `0x00504ba0`, keeps the selected and hovered candidate ids in the globals `0x006d16f8` and `0x006d16f4`, and toggles the current preview highlight as rows are rebuilt. Current grounded caller is the broader station-detail refresh pass at `0x00506610`.","objdump + RT3.lng strings + caller inspection + candidate-service row correlation"
0x00504ec0,644,shell_station_detail_refresh_class_3_or_4_train_service_matrix,shell,thiscall,inferred,objdump + local disassembly + caller inspection + RT3.lng string-id correlation,3,"Alternate `StationDetail.win` refresh branch for selected station classes `3` and `4`. After validating the current station and republishing the station name through helper root `0x006d16e4`, the helper rebuilds a five-row by two-column train-service matrix: the column headers come from localized ids `684` `Trains Serviced` and `685` `Trains Maintained`, the per-row category labels resolve through the world-side lookup table at `0x006cec78+0x46a84` plus `0x0053de00/0x00552560`, and the underlying counts come from the station-side integer lanes at `0x0047d800`. When the detail view is not already marked live it also rebuilds the shared popup-capable haul widget lane and reuses `shell_station_detail_present_to_from_haul_stats_popup` `0x00504770` as the click-through callback. Current grounded caller is `shell_station_detail_window_refresh_controls` `0x00506610`, which routes class-`3/4` stations into this helper instead of the ordinary nearby-structure, haul-summary, and candidate-service strip.","objdump + local disassembly + caller inspection + RT3.lng string-id correlation + class-3-4-branch correlation"
0x00506610,688,shell_station_detail_window_refresh_controls,shell,cdecl,inferred,objdump + local disassembly + caller inspection + child-helper correlation,4,"Broad refresh owner for the shell-side `StationDetail.win` family. The helper first validates the currently selected station id from detail-manager state `[0x006d0818+0x90]`, resolves the live station from collection `0x006cec20`, and publishes the upper summary lane through `shell_publish_text_callout_presentation` `0x005519f0` using helper root `0x006d16ec`. When scenario-side latch `[0x006cec74+0x1db]` is set it re-enters `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` and `shell_station_detail_present_scenario_station_connection_triplet_popup` `0x00504590` for the paired action controls `0xb3b7` and `0xb3b8`; otherwise it checks the resolved candidate class byte `[candidate+0x8c]`, routes classes `3` and `4` into `shell_station_detail_refresh_class_3_or_4_train_service_matrix` `0x00504ec0`, and for the ordinary branch it publishes the station name, rebuilds the nearby-structure jump lane through `shell_station_detail_refresh_nearby_structure_jump_rows` `0x00505470`, rebuilds the `To` and `From` hauled-traffic widgets through `shell_station_detail_build_to_from_haul_summary_widget` `0x00505150`, rebuilds the candidate-service rows through `shell_station_detail_refresh_candidate_service_rows` `0x00505760`, and finally marks the detail view live through `0x006d16f0 = 1`. Current grounded callers are the constructor-side control wiring under `shell_station_detail_window_construct` `0x005068c0` and the paired action-control callbacks on `0xb3b7/0xb3b8`, so this is the safest current read for the main StationDetail refresh owner rather than a narrower popup callback.","objdump + local disassembly + caller inspection + child-helper correlation + StationDetail control correlation"
0x00505e50,766,shell_station_detail_window_handle_message,shell,thiscall,inferred,objdump + local disassembly + caller inspection + control-range correlation,4,"Primary message dispatcher for the shell-side `StationDetail.win` panel rooted at singleton `0x006d16d8`. The helper validates the current selected station from the detail-manager state under `0x006d0818+0x90`, mirrors that station into live world latch `[0x006cec78+0x4cba]` on the message-`0` setup branch, clears or preserves the active candidate-service preview state under `0x006d16f8/0x006d16fc/0x006d1700`, and can leave the panel through `shell_detail_panel_transition_manager` `0x004ddbd0` when the selected station is no longer valid. The message-`0xca` branch owns two concrete row families: candidate-service controls `0xb4dc..0xb5a3`, which either hand off into the `Overview.win` lane through `0x004ddbd0(..., 9, ...)` plus `0x004f4970` when Ctrl is held or else re-arm or clear the world preview through `shell_station_detail_set_active_candidate_service_preview` `0x00504ae0` and `0x00504a90`; and nearby-structure controls `0xb40a..0xb413`, which resolve site ids through `0x0047dc90/0x0047dcb0`, transition the detail manager with mode `0x0a`, and optionally recenter the world view through `0x00433900` plus the target object's vtable `+0x5c` callback when no modal overlay is active. The message-`0x3ea` branch refreshes the dirty dynamic rows through `shell_station_detail_clear_dynamic_rows_and_haul_widgets_if_dirty` `0x005042c0` and `shell_station_detail_refresh_class_gated_action_controls_0xb3bb_to_0xb3bf` `0x005044b0`, then restyles control `0xb3f8` from selected-station byte `[station+0x5c9]` and re-arms the active preview if one is selected. The message-`0xcb` action band owns the paired navigation or selector toggles on `0xb3b3/0xb3b4`, the tutorial-gated back or escape branch beneath localized id `0xe8c`, and the lower `0xb3b5..0xb3bf` class-gated action dispatch that first checks selected-company ownership through `0x00504390/0x005043f0`, then resolves linked site and candidate class state through `0x0047de00`, `0x0040cec0`, and `0x0047fd50` before re-entering the world-side action helper strip under `0x00419590`. This is the current grounded owner above the already-mapped refresh helper `shell_station_detail_window_refresh_controls` `0x00506610`, not just one narrow control callback.","objdump + local disassembly + caller inspection + control-range correlation + StationDetail message-branch correlation"
0x0050c500,426,shell_present_chairmanship_takeover_vote_outcome_dialog,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Single-player chairmanship-takeover outcome presenter used by the special election path. The helper resolves the target company from `0x006d1a0c`, chooses localized title id `626` `New Chairman Takes Over!!!` or `627` `Chairmanship Takeover Fails!!!`, formats the tally labels `628` `Votes in favor` and `629` `Votes Against`, and renders the final result dialog through the shell presentation callback rooted at `0x006d1a34`. Current grounded caller is `shell_resolve_chairmanship_takeover_vote_and_commit_outcome` at `0x0050c940` on the single-player branch.","objdump + RT3.lng strings + caller inspection + takeover-result dialog correlation"
0x0050c940,880,shell_resolve_chairmanship_takeover_vote_and_commit_outcome,shell,cdecl,inferred,objdump + RT3.lng strings + caller inspection,4,"Resolves the special chairman's election, commits the outcome, and records cooldown state. The helper walks the active chairman profile collection at `0x006ceb9c`, computes weighted votes for and against the takeover of company `0x006d1a0c` by chairman profile `0x006d1a0e`, accumulates the affirmative share count into `0x006d1a30`, compares that total against half the target-company value, and then splits by single-player versus multiplayer. In single-player it presents the result through `shell_present_chairmanship_takeover_vote_outcome_dialog` at `0x0050c500`; in multiplayer it formats localized id `3082` `Takeover attempt of '%1' by '%2' has %3.` with result strings `3060` or `3061` and routes the payload through the shell transport. On success it transfers chairmanship through `0x00428a30`; on failure it stamps the current year into `[company+0x289]` as the grounded takeover-cooldown field.","objdump + RT3.lng strings + caller inspection + takeover-vote resolution correlation"
0x0050ccc0,709,shell_company_detail_attempt_chairmanship_takeover_flow,shell,thiscall,inferred,objdump + RT3.lng strings + caller inspection,4,"Runs the `CompanyDetail.win` chairmanship-takeover flow against the currently selected company. The helper reads the caller's current share ownership in the target company, rejects insufficient holdings through localized id `623`, rejects recent failed takeover cooldown cases through id `624`, and otherwise opens the special chairman's election confirmation under id `625`. The grounded single-player path seeds the local takeover-election state at `0x006d1a08..0x006d1a38` and launches the follow-on election helper at `0x0050c940`; when the multiplayer-side shell owner is active it instead packages the same request through the asynchronous shell transport path rooted at `0x006cd8d8`. Current grounded owner is the wider company-detail message dispatcher at `0x004c56a0`.","objdump + RT3.lng strings + caller inspection + takeover-election correlation"
@ -1065,6 +1152,10 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x00507620,656,shell_station_pick_window_construct,shell,thiscall,inferred,objdump + strings + caller inspection,4,"Constructs the shell-side `StationPick.win` helper window. The constructor binds the list control `0x80ea`, the scroll or selector controls `0x80e8` and `0x80e9`, publishes the helper at `0x006d1718`, and then populates the visible station rows from collection `0x006cec20`. The same family feeds the selected station id through `0x00622ae8`, normalizes list and scroll messages through `shell_station_pick_window_rewrite_list_and_scroll_messages_to_primary_select_event` `0x005075c0`, and returns the chosen id to the caller when the modal opener closes. Current grounded callers put this helper under the `StationList.win` selector branch rather than under the startup-company flow.","objdump + strings + caller inspection + helper correlation + StationPick normalization correlation"
0x005076c0,501,shell_station_pick_window_populate_station_rows,shell,cdecl,inferred,objdump + strings + caller inspection,4,"Populates the visible row set for the shell-side `StationPick.win` helper. The helper iterates collection `0x006cec20`, filters entries through `0x0047fd50`, sorts them by the display-name field at `[entry+0x46b]`, and publishes the resulting station names through the helper list control `0x80ea`. It also mirrors the chosen station ids back into the helper-local scratch arrays, updates one status lane through control event `0xaf`, and refreshes the visible row count through control event `0x66`. Current grounded caller is `shell_station_pick_window_construct` at `0x00507620`.","objdump + strings + caller inspection + collection iteration"
0x005078c0,192,shell_station_pick_window_open_modal_and_return_selected_station_id,shell,fastcall,inferred,objdump + caller inspection + local disassembly,3,"Modal StationPick helper opener above `shell_station_pick_window_construct` `0x00507620`. If the live station collection `0x006cec20` is empty the helper returns `-1` immediately. Otherwise it allocates one `0x78`-byte helper object through `0x0053b070`, constructs the `StationPick.win` window, stores the live helper at `0x006d1718`, optionally nudges one presentation float at `[helper+0x05]` when caller flag `CL` is nonzero, brackets the modal show path through `0x00483450`, `0x00538f10`, `0x004834a0`, and `0x005389c0`, then destroys the helper, clears `0x006d1718`, and returns the selected station id from `0x00622ae8`. Current grounded caller is the side-selector branch inside `shell_station_list_window_handle_message` `0x005071e0`.","objdump + caller inspection + local disassembly + modal-helper correlation"
0x00505bf0,188,shell_station_detail_window_destruct_release_preview_helpers_and_clear_singleton,shell,thiscall,inferred,objdump + vtable scan + local disassembly + helper-root correlation,3,"Primary `StationDetail.win` destructor rooted at vtable `0x005d1748`. The helper first restores that same vtable, clears the active candidate-service preview pair through two calls into the world-side reset helper `0x0043f610`, drops the local preview latch `[this+0x7c]` together with sibling refcount `0x0062be84`, optionally re-enters the world-side preview clear path `0x00452d30` when the live world owner at `0x0062c120` is still in the matching preview-capable mode gate, releases the five shell helper handles at `0x006d16dc`, `0x006d16e0`, `0x006d16e4`, `0x006d16e8`, and `0x006d16ec` through the shared owner `0x006d4020 -> 0x0053c000`, clears singleton `0x006d16d8`, and then tail-jumps into the common shell-window teardown at `0x0053f7d0`. Current grounded caller is the shell detail-panel teardown side at `0x004dd9fa`.","objdump + vtable scan + local disassembly + helper-root correlation + preview-teardown correlation"
0x00505cb0,382,shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class,shell,fastcall,inferred,objdump + local disassembly + caller inspection + collection-walk correlation,3,"Direction-driven station-selection helper beneath the `StationDetail.win` family. The first register argument in `ECX` is a signed step direction, and the helper first validates the current selected station from detail-manager state `0x006d0818+0x90`, resolves that station's owner through `0x0047efe0`, and gets its current live-slot position in collection `0x006cec20`. It then walks the live station collection circularly by the requested direction until it finds another entry that passes the same station-or-transit-site class allowlist `0x0047fd50` and shares the same linked company id. When a match is found it releases the current global iteration root through `record_collection_release_global_iteration_root_0x6acd40_if_present` `0x004557b0`, republishes the selected station into the shell detail-panel family through `0x004dd8a0`, and, when no modal overlay is active under `[0x0062be68+0x60]`, recenters the world view through `shell_world_view_center_on_object_with_mode_specific_zoom_policy` `0x00433900` before tail-calling the target object's vtable `+0x5c` callback. This is the current grounded owner for StationDetail next-or-previous station stepping rather than a generic collection iterator.","objdump + local disassembly + caller inspection + collection-walk correlation + owner-filter correlation"
0x00505e30,10,shell_station_detail_cycle_to_next_station_preserving_owner_and_station_site_class,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper that seeds direction `+1` into `shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class` `0x00505cb0`. Current grounded caller is the broader shell command branch at `0x00440e0f` when `StationDetail.win` is live.","objdump + local disassembly + caller inspection + wrapper correlation"
0x00505e40,8,shell_station_detail_cycle_to_previous_station_preserving_owner_and_station_site_class,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper that seeds direction `-1` into `shell_station_detail_cycle_selected_station_by_direction_preserving_owner_and_station_site_class` `0x00505cb0`. Current grounded caller is the paired shell command branch at `0x00440f2f` when `StationDetail.win` is live.","objdump + local disassembly + caller inspection + wrapper correlation"
0x004d4500,88,shell_ensure_editor_panel_window,shell,cdecl,inferred,objdump + analysis-context,4,Ensures the shell-side EditorPanel.win helper window rooted at 0x006d07b4 exists. When the panel is absent it allocates a 0x7c-byte window object seeds the vtable at 0x005d0cb8 binds the EditorPanel.win resource through 0x0053fa50 publishes the object to the shell runtime through 0x00538e50 event 0x1e and then runs the shared panel-open helper at 0x004d4160.,objdump + analysis-context + strings
0x004dc670,368,shell_file_options_dialog_construct,shell,thiscall,inferred,objdump + strings,4,Constructs the shared shell file-options dialog rooted at fileopt.win. The helper clears the three downstream branch flags at 0x006d07f8 0x006d07ec and 0x006d07f0 binds the fileopt.win resource through 0x0053fa50 publishes the object to the shell runtime and populates several mode-dependent labels and status text before user input is handled.,objdump + strings
0x004dc7d0,14,shell_has_file_options_dialog,shell,cdecl,inferred,objdump + nearby-constructor correlation + frame-caller inspection,4,"Tiny presence probe for the shared shell file-options dialog rooted at `0x006d0800`. The helper returns `1` when the live `fileopt.win` object is present and `0` otherwise. Current grounded callers include the post-step shell-window ladder inside `simulation_frame_accumulate_and_step_world` `0x00439140`, where this check now sits beside the `LoadScreen` and custom-modal probes.","objdump + nearby-constructor correlation + frame-caller inspection + fileopt correlation"
@ -1493,6 +1584,11 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x00482d10,110,runtime_query_cached_local_exe_version_float,simulation,thiscall,inferred,objdump + local disassembly,3,"Returns one cached local executable version as a float-like `major + minor/100` value. On first use the helper queries the version-info resource of the literal stem `RT3.EXE` at `0x005cec18` through `0x0055d9c0`, splits the returned packed dword into low and high 16-bit words, converts them into one float as `hi + lo/100.0`, caches the result at `0x006cec5c`, and returns that cached value on later calls. The sibling formatter `0x00482d80` and the rounded hundredths query `0x00482e00` both consume the same source, which now makes this the clearest current owner for the local `1.03/1.04/1.05/1.06`-style version float rather than a gameplay progress value.","objdump + local disassembly + version-resource correlation"
0x00482d80,128,runtime_query_cached_local_exe_version_string,simulation,thiscall,inferred,objdump + local disassembly + string inspection,3,"Returns one cached local executable version string formatted from the same `RT3.EXE` version-info source used by `0x00482d10`. On first use the helper queries the packed local version dword through `0x0055d9c0`, formats it with the literal pattern `%d.%02d` at `0x005ced5c`, allocates one small shell string object at `0x006cec24`, and returns that cached string on later calls. Current grounded callers include `multiplayer_session_event_publish_registration_field` `0x0046a6c0` and the later shell text path at `0x00503254`, which makes this the clearest current local version-string owner.","objdump + local disassembly + string inspection + caller xrefs + version-resource correlation"
0x00482e00,70,runtime_query_hundredths_scaled_build_version,simulation,thiscall,inferred,objdump + caller xrefs + local disassembly,3,"Shared rounded hundredths-scaled build-version query used by route, company, train, and world-side logic. In the ordinary local path the helper consults the cached local executable version float from `runtime_query_cached_local_exe_version_float` `0x00482d10`, adds the fixed offset `0.0001`, multiplies by `100.0`, and rounds the result through the CRT helper at `0x005a10d0`, which makes the local outputs line up with integer build values such as `0x67/0x68/0x69/0x6a == 1.03/1.04/1.05/1.06`. When the multiplayer-side runtime rooted at `0x006cd8d8` is active, or when the local scenario-state gate at `0x004349a0` reports a later mode, it instead delegates to the multiplayer companion path at `0x0046a4b0`, which can reuse a cached network-side integer at `0x006cd96c` or scan live session-peer version fields before falling back to the same local executable-version path. Current grounded callers include the city-connection route builder `0x00402cb0`, the auxiliary tracker pair-metric dispatcher `0x004a65b0`, and numerous neighboring world-side maintenance branches. This is no longer best-read as a gameplay progress or era index: the recovered threshold pattern is a shared executable or session build-version gate.","objdump + caller xrefs + local disassembly + multiplayer-fallback correlation + version-resource correlation + threshold-correlation"
0x00482e50,271,shell_set_editor_map_mode_and_refresh_detail_panel_world_and_graphics_side_effects,shell,thiscall,inferred,objdump + local disassembly + caller inspection,3,"Shell-state owner beneath `shell_command_toggle_editor_map_mode_with_one_shot_warning_modals` `0x00441b50` and the setup-mode selector `0x00502c00`. The helper writes the caller-supplied boolean into editor-map mode field `[this+0x68]`, then splits its refresh side effects by that target mode. When the target mode is `0` it re-enters `0x004d44a0` and `0x004dfda0` when the detail-panel controller `0x006d0818` is live, refreshes the active world root through `world_compute_transport_and_pricing_grid` `0x0044fb70` when `0x0062c120` exists, and then re-enters `shell_apply_graphics_option_runtime_effects` `0x00484d70` with mask `0x0d` and stack flag `1`. When the target mode is nonzero it instead re-enters `shell_ensure_editor_panel_window` `0x004d4500` before the same `0x00484d70(0x0d, 1)` tail. Current evidence is strong enough to treat this as the real editor-map-mode setter plus dependent detail-panel, world, and graphics refresh owner.","objdump + local disassembly + caller inspection + editor-map-mode correlation + side-effect correlation"
0x00483680,17,shell_command_cycle_display_resolution_forward,shell,cdecl,inferred,objdump + command-registration correlation + local disassembly + caller inspection,2,"Small registered shell command beneath action id `0x78` and localized label id `0x0d52`. The helper fixes forward step `+1` in `ECX` and tail-calls `shell_cycle_display_resolution_and_publish_status` `0x00483780`. Current evidence is strong enough for the command-wrapper role and step direction, but not yet for a tighter player-facing label beyond the display-resolution cycle.","objdump + command-registration correlation + local disassembly + caller inspection + wrapper correlation"
0x00483780,527,shell_cycle_display_resolution_and_publish_status,shell,cdecl,inferred,objdump + local disassembly + caller inspection,3,"Broader display-resolution cycle owner reached from the small forward and backward wrappers at `0x00483680`, `0x00483990`, and `0x004839a0`. The helper requires live shell presenter root `0x006d4024`, reads the current display mode through the active mode table and the paired width-bucket tables at `0x00620e64` and `0x00620e7c`, derives one bounded six-step cycle from the caller-supplied signed step in `ECX`, selects the next supported resolution pair, and applies that requested size through `0x005206b0`. It then formats and publishes a status string through `0x0051b700`, `0x00518de0`, and `0x005386e0`, refreshes dependent presentation state through `0x004625b0`, persists the graphics config through `0x00484910(1)`, and re-enters the neighboring shell follow-on `0x004821d0`. Current evidence is strong enough to treat this as the shared display-resolution cycle-and-apply owner rather than a narrower presenter-only math helper.","objdump + local disassembly + caller inspection + display-mode-table correlation + status-publish correlation"
0x00483990,8,shell_cycle_display_resolution_forward_wrapper,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper over `shell_cycle_display_resolution_and_publish_status` `0x00483780`. The helper fixes step `+1` in `ECX` and tail-jumps into the shared display-resolution cycle owner. Current evidence grounds it as the plain forward wrapper rather than a separate settings owner.","objdump + local disassembly + caller inspection + wrapper correlation"
0x004839a0,8,shell_cycle_display_resolution_backward_wrapper,shell,cdecl,inferred,objdump + local disassembly + caller inspection,2,"Tiny wrapper over `shell_cycle_display_resolution_and_publish_status` `0x00483780`. The helper fixes step `-1` in `ECX` and tail-jumps into the shared display-resolution cycle owner. Current evidence grounds it as the plain backward wrapper rather than a separate settings owner.","objdump + local disassembly + caller inspection + wrapper correlation"
0x004839b0,37,shell_setup_query_file_list_uses_map_extension_pattern,shell,thiscall,inferred,objdump + literal inspection + caller correlation,3,"Returns whether the current `Setup.win` file-list scan should enumerate the map-family extension pattern `*.gm*` instead of the saved-game pattern `*.smp`. The helper checks the live shell state rooted at `0x006cec74`: it requires the broad setup/file gate at `[shell+0x1bf]`, then returns true when either `[shell+0x68]` is nonzero or the current setup-side mode flag at `[this+0x6c]` equals `1`. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, where the result chooses the search literal at `0x005c9d14` versus `0x005c9d1c`.","objdump + literal inspection + caller correlation + setup-file-root correlation"
0x004839e0,37,shell_setup_query_file_list_root_dir_name,shell,thiscall,inferred,objdump + literal inspection + caller correlation,3,"Returns the root directory name used by the current `Setup.win` file-list scan. When `[this+0x6c] == 2` it returns the literal `data\\tutorial` at `0x005ca338`; otherwise it returns `maps` at `0x005ced78` when `[this+0x68]` is nonzero or `[this+0x6c] == 1`, and falls back to `saved games` at `0x005ced80` for the ordinary setup-side load family. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, which formats the returned root through the literal `%s\\` at `0x005c9d10`.","objdump + literal inspection + caller correlation + setup-file-root correlation"
0x00433260,400,shell_setup_filter_candidate_file_by_dataset_and_payload_flags,shell,thiscall,inferred,objdump + local disassembly + caller correlation,3,"Filters one candidate `Setup.win` filename against the current dataset id and the small payload-flag family recovered from the staged bundle. Editor-map mode short-circuits to success immediately through `shell_setup_query_file_list_uses_map_extension_pattern` `0x004839b0`; otherwise the helper builds one rooted path from `shell_setup_query_file_list_root_dir_name` `0x004839e0`, opens the candidate bundle through `0x00530c80`, reads the small chunk family `0x2ee0/0x3c2` through `0x00531150/0x00531360`, and then applies dataset-specific acceptance rules to three recovered flag bytes. The current split is tighter now: dataset `10` requires the sandbox-side payload-flag family, dataset `9` requires a different nonzero payload-flag family, dataset `8` stays on the plain non-sandbox path, and dataset `12` adds one literal stem check through `0x005c9cf8` before the later payload-flag gate. Current grounded caller is `shell_setup_build_file_list_records_from_current_root_and_pattern` `0x004333f0`, which uses this helper as the real extension-and-payload filter beneath the file-backed setup lists.","objdump + local disassembly + caller correlation + setup-dataset correlation + payload-flag gating correlation"
@ -1719,7 +1815,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x00529fd0,793,shell_build_cell_vertex24_sweep,bootstrap,thiscall,inferred,ghidra-headless,4,Builds the animated-quad cell sweep over the grid returned by 0x00533e30 depending on the boolean mode argument. It gates on configuration bytes [this+0x29+0x5f] or [this+0x29+0x60] walks candidate-cell offsets from [this+0x374f] selects the primary list at [cell+0x1c] or alternate list at [cell+0x20] initializes the layout-state vertex24 table once through 0x0054bb70 streams each list through 0x00567c70 or 0x00567ce0 and then commits the accumulated span through 0x00545c50 before restoring presentation state.,ghidra + rizin + llvm-objdump
0x0052a2f0,736,shell_build_ranked_overlay_vertex24_sweep,bootstrap,thiscall,inferred,ghidra-headless,3,Builds a ranked secondary vertex24 overlay pass over the cell grid returned by 0x00533e50 and two object collections at [this+0x85] and [this+0x81]. It computes a per-frame packed tint from the current shell brightness gathers and sorts candidate items by priority field [item+0x1d9] binds the layout-state vertex24 table and emits accepted items through 0x00524780 and 0x00554e70 before committing the span.,ghidra + rizin + llvm-objdump
0x0052a5d0,1784,shell_build_ranked_object_billboard_sweep,bootstrap,thiscall,inferred,ghidra-headless,3,Builds the sibling ranked object-overlay pass gated by config byte [this+0x29+0x5e]. It merges candidates from the object collections at [this+0x85] and [this+0x81] sorts them by priority field [item+0x1d9] prepares billboard basis state through 0x00566670 and emits accepted entries through 0x00554e70 before committing the vertex24 span.,ghidra + rizin + llvm-objdump
0x0052dd00,864,shell_expand_segment_record_triplets,bootstrap,thiscall,inferred,ghidra-headless,4,Expands one active presentation-batch record into three transformed 0x20-byte segment records inside the caller-provided buffer; each output record is two vec3 blocks at +0x00 and +0x0c plus scalar slots at +0x18 and +0x1c. The selected batch record supplies a source-array pointer at +0x04 a source-count at +0x0c and 0x4c-byte packed source entries that carry four point sources plus three scalar pairs for the emitted triplet.,ghidra + rizin
0x0052dd00,864,runtime_object_emit_materialized_group_packet_rows_as_segment_record_window,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared segment-record emitter beneath `runtime_object_emit_selected_grouped_subrecords_into_global_packet_ring` `0x0052f500` in the broader `0x23a` runtime-object family. Starting from the currently selected group header `[this+0x14/+0x3a/+0x21]`, the helper resolves the active materialized row payload at `[row+0x35]`, the current packet source span from `[record+0x04/+0x08/+0x0c]`, and one shell-presenter-derived count through `0x0051f090`, then emits `count*3` transformed `0x20`-byte segment records into the caller-provided buffer while advancing the output-count accumulator. In the nonnegative `[this+0x69]` branch each output record carries two vec3 blocks at `+0x00` and `+0x0c` plus scalar slots at `+0x18` and `+0x1c`; in the negative branch it emits the same triplet family with the reduced scalar form. Current grounded caller is the layout-state presentation owner `0x005490b0`, so this is the safest current read for emitting materialized group packet rows as one segment-record window rather than a shell-only batch expander.","objdump + caller inspection + local disassembly + grouped-subrecord correlation + packet-row correlation + segment-record-window correlation"
0x0053f000,238,mouse_cursor_select_shape_id_load_handle_and_refresh_shell_presentation,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Core `MouseCursor.cpp` selector over one requested cursor-shape id. The helper normalizes negative ids to zero, optionally short-circuits when the requested id already matches `[this+0x04]`, refreshes the local elapsed-tick latch `[this+0x24]` through `0x0051d890`, toggles cursor visibility through `0x0051e810` on the special `0 -> nonzero` and `nonzero -> 0` transitions, lazily loads the corresponding native cursor handle into table `0x00ccba60` through `0x0053ee90`, publishes that handle through the USER32 cursor-set import, resolves one shell presentation payload through `0x0053d110` when the requested id is nonzero, releases the previous payload through `0x0053c000`, and then stores the new payload at `[this+0x00]` plus the selected id at `[this+0x04]`. Current grounded callers include shell modal setup `0x004c98a0`, several detail-panel mode publishers, and the rest of the mouse-cursor owner family, so this is the safest current read for the live cursor-shape selector plus presentation refresh owner.","objdump + caller inspection + local disassembly + source-string correlation + cursor-handle-table correlation"
0x0053f0f0,115,mouse_cursor_enter_hidden_or_captured_mode_and_clear_selection,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Mode-transition branch in the `MouseCursor.cpp` owner family. When local state `[this+0x18]` is still clear, the helper first pings shell work owner `[0x006d4024+0x28]` through vtable slot `+0x1c`, then calls one zero-argument USER32 import, marks `[this+0x18] = 1`, clears `[this+0x14]`, seeds `[this+0x08] = 1`, mirrors shell latch `[0x006d4024+0x11473e] = 1`, and, when a non-`-1` cursor id is active, forces cursor visibility down through `0x0051e810(0)` before re-entering `0x0053f000(-1, 0, 0)`. Current grounded callers are the graphics-backend service branches `0x004ffb64`, the coarse mouse-cursor service `0x0053f400`, and the local constructor sync at `0x0053f330`, so the safest current read is a hidden-or-captured mode entry branch rather than a generic state toggle.","objdump + caller inspection + local disassembly + source-string correlation + shell-latch correlation"
0x0053f170,159,mouse_cursor_begin_pending_release_from_hidden_mode,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Release-side mode-transition branch in the `MouseCursor.cpp` owner family. When `[this+0x14]` is still clear, the helper conditionally forwards the shell window handle through one one-argument USER32 import when graphics mode byte `[0x006d4024+0x114226]` is active, pings shell work owner `[0x006d4024+0x28]` through vtable slot `+0x1c`, re-enters `0x0053f000(0, 0, 0)` to clear the live cursor selection, clears `[this+0x18]`, sets `[this+0x14] = 1`, zeroes shell latches `[0x006d4024+0x11473a/+0x11473e]`, and, when local byte-flag dword `[this+0x08]` is nonzero, raises cursor visibility back through `0x0051e810(1)`. Current grounded callers are the graphics-backend service-and-repaint branch `0x004ffafb`, the coarse mouse-cursor service `0x0053f400`, and the local inside-view watcher `0x0053f450`, so this is the safest current read for the begin-release transition out of the hidden mode.","objdump + caller inspection + local disassembly + source-string correlation + shell-latch correlation"
@ -1732,7 +1828,44 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x0053f400,80,mouse_cursor_service_coarse_global_mode_latches,shell,cdecl,inferred,objdump + caller inspection + local disassembly + family correlation,3,"Coarse service branch over the global `MouseCursor.cpp` mode latches `0x00ccbb18/0x00ccbb1c/0x00ccbb24/0x00ccba58/0x00ccba5c`. The helper decrements countdown `0x00ccbb24`, and when that reaches zero it dispatches either into `0x0053f0f0` or `0x0053f170` from the pending global owners, then mirrors the surviving globals back into shell latches `[0x006d4024+0x11473e/+0x11473a]`. Current grounded caller is the frame updater `0x0053f4e0`.","objdump + caller inspection + local disassembly + family correlation + shell-latch correlation"
0x0053f450,134,mouse_cursor_refresh_inside_active_view_and_toggle_visibility_hint,shell,thiscall,inferred,objdump + caller inspection + local disassembly + source-string correlation,3,"Small view-sensitive refresh in the `MouseCursor.cpp` family. The helper samples the current `cursor inside active view` predicate through `shell_input_cursor_inside_active_view` `0x0054f540`, compares that boolean against local state `[this+0x08]`, and on changes updates the same state plus toggles cursor visibility through `0x0051e810(0/1)` when hidden mode `[this+0x18]` is active. On the fallback path it also consults the global shell-side cursor owner at `0x00ccbb20` and, when the global `ShowCursor` refcount is positive, refreshes the coarse elapsed-tick latch `[this+0x24]` or re-enters `0x0053f000(1, 1, 0)`. Current grounded callers are `mouse_cursor_update_frame_state` `0x0053f4e0` and the shell camera action helper `0x004e0780`, so this is the safest current read for the inside-view watcher plus visibility hint owner.","objdump + caller inspection + local disassembly + source-string correlation + inside-view correlation"
0x0053f4e0,739,mouse_cursor_update_frame_state,shell,thiscall,inferred,ghidra-headless,4,Per-frame MouseCursor.cpp updater for the global cursor controller at 0x00ccbb20. It refreshes elapsed tick state through 0x0051d890 re-arms the active cursor selection through 0x0053f450 and 0x0053f000 when the 150 ms and 15 s idle thresholds trip resets per-frame cursor globals through 0x0054f6c0 and 0x0054f6d0 samples cursor placement and world-relative state through world_anchor_measure_projected_half_width world_anchor_measure_projected_half_height and shell_queue_world_anchor_marker and publishes the resulting cursor presentation state through shell_publish_text_callout_presentation before finalizing through 0x0054f6e0.,ghidra + rizin + llvm-objdump + strings
0x0052e060,537,shell_expand_vertex24_triplets,bootstrap,thiscall,inferred,ghidra-headless,4,Sibling emitter for the same active presentation-batch record family; expands each 0x4c-byte packed source entry into three 0x18-byte vertex24 records in the caller-provided buffer. Each emitted record stores a vec3 at +0x00 a style dword from [this+0x43] at +0x0c and scalar slots at +0x10 and +0x14 while the output-count accumulator advances by count*3.,ghidra + rizin
0x0052e060,537,runtime_object_emit_materialized_group_packet_rows_as_vertex24_window,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Vertex24-emission sibling to `0x0052dd00` beneath `runtime_object_emit_selected_grouped_subrecords_into_global_packet_ring` `0x0052f500` in the broader `0x23a` runtime-object family. The helper resolves the same selected group header, active materialized row payload at `[row+0x35]`, and packet source span from `[record+0x04/+0x08/+0x0c]`, then emits `count*3` transformed `0x18`-byte vertex24 records into the caller-provided buffer while advancing the output-count accumulator. Each emitted record stores one vec3 at `+0x00`, style dword `[this+0x43]` at `+0x0c`, and scalar lanes at `+0x10/+0x14`, with the same nonnegative-versus-negative `[this+0x69]` split used by `0x0052dd00`. Current grounded caller is the shell-side presentation branch `0x00528821`, so this is the safest current read for emitting materialized group packet rows as one vertex24 window rather than a shell-only triplet expander.","objdump + caller inspection + local disassembly + grouped-subrecord correlation + packet-row correlation + vertex24-window correlation"
0x0052cd20,21,embedded_view_controller_copy_eye_triplet_to_out_vec3,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny copy helper over the embedded world-view controller base. The function copies the current eye triplet `[this+0x1c/+0x20/+0x24]` into one caller-supplied contiguous `vec3` buffer. Current grounded caller is the world-view wrapper `0x00527e5e`, which uses it together with the focus-triplet sibling `0x0052cd40`, so this is the safest current read for the packed eye-triplet copy helper rather than a broader serializer.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cd40,21,embedded_view_controller_copy_focus_triplet_to_out_vec3,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Packed focus-triplet sibling to `0x0052cd20` over the same embedded controller base. The helper copies the current focus triplet `[this+0x04/+0x08/+0x0c]` into one caller-supplied contiguous `vec3` buffer. Current grounded caller is the same world-view wrapper `0x00527e6a`, so this is the safest current read for the packed focus-triplet copy helper rather than another generic memcpy leaf.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cd60,28,embedded_view_controller_copy_eye_triplet_to_three_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Split-out eye-triplet copy helper over the embedded world-view controller base. The function writes current eye lanes `[this+0x1c/+0x20/+0x24]` into three separate caller out-pointers. Current grounded callers include the world-view wrappers `0x00524089`, `0x00528226`, `0x00528384`, `0x00529508`, `0x00529c02`, `0x0052a79a`, the local helper strip around `0x0052bb01`, and sibling controller-bridge calls inside `0x00548382/0x005484de`, so this is the safest current read for the split eye-triplet export helper rather than a subtype-specific query.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cd80,28,embedded_view_controller_copy_focus_triplet_to_three_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Split-out focus-triplet sibling to `0x0052cd60` over the same embedded controller base. The function writes current focus lanes `[this+0x04/+0x08/+0x0c]` into three separate caller out-pointers. Current grounded callers include world-side and setup-side branches `0x0042ac39`, `0x0042ad67`, `0x00487483`, `0x0052ad16`, `0x0052bad3`, and sibling controller-bridge calls inside `0x0054836c/0x005484c8`, so this is the safest current read for the split focus-triplet export helper rather than a generic outparam block.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cda0,28,embedded_view_controller_copy_aux_triplet_0x2c_0x34_to_three_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small auxiliary-triplet export helper over the embedded controller base. The function writes lanes `[this+0x2c/+0x30/+0x34]` into three separate caller out-pointers. Current grounded caller is the neighboring layout-state bridge `0x00548398`, so this is the safest current read for exporting the auxiliary cached triplet at `+0x2c..+0x34` rather than a named world coordinate without broader owner evidence.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cdc0,22,embedded_view_controller_store_aux_triplet_0x2c_0x34,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny setter companion to `0x0052cda0` over the same controller base. The helper stores three caller dwords into auxiliary triplet `[this+0x2c/+0x30/+0x34]`. Current grounded callers are the setup-side world-view branches `0x004592ef` and `0x00459b7b`, so this is the safest current read for the auxiliary-triplet store helper rather than a broader camera-mode owner.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cde0,48,embedded_view_controller_set_dirty_latch_0x64_and_optionally_snapshot_focus_eye_heading_distance_band,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Dirty-latch helper over the embedded controller base. The function stores the caller boolean into byte `[this+0x64]`; when the boolean is zero it also snapshots the current heading and pitch lanes `[this+0x10/+0x14]`, focus triplet `[this+0x04/+0x08/+0x0c]`, and distance lane `[this+0x18]` into the cached companion band `[this+0x44/+0x48/+0x38/+0x3c/+0x40/+0x4c]`. Current grounded caller is `0x0052c2ef`, so this is the safest current read for the primary dirty-latch and cached focus-eye-orientation snapshot helper rather than a generic flag setter.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052ce20,54,embedded_view_controller_set_dirty_latch_0x65_and_optionally_snapshot_focus_heading_distance_band_0x72_0x86,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Secondary dirty-latch helper over the same controller base. The function stores the caller boolean into byte `[this+0x65]`; when that boolean is zero it snapshots heading and pitch lanes `[this+0x10/+0x14]`, focus triplet `[this+0x04/+0x08/+0x0c]`, and distance lane `[this+0x18]` into the secondary companion band `[this+0x72/+0x76/+0x7a/+0x7e/+0x82/+0x86]`. Current grounded caller is the later owner branch `0x0052cc5d`, so this is the safest current read for the secondary dirty-latch and cached snapshot helper rather than a generic mode toggle.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052ce60,5,embedded_view_controller_raise_dirty_latch_0x64,shell,thiscall,inferred,objdump + local disassembly,1,"Tiny leaf over the embedded controller base that only sets dirty byte `[this+0x64] = 1`. Current evidence grounds it as a direct dirty-latch raiser and does not yet justify a broader semantic name.","objdump + local disassembly + controller-base correlation"
0x0052ce70,43,embedded_view_controller_refresh_shell_presenter_scalar_0x6a_and_consume_dirty_latch_0x64,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small shell-state synchronization helper over the same controller base. The function compares cached scalar `[this+0x6a]` against current shell presenter dword `[0x006d4024+0x114222]`, raises dirty byte `[this+0x64]` and stores the new shell scalar when they differ, then returns the prior dirty state and clears `[this+0x64]` back to zero. Current grounded caller is `0x0052c29c`, so this is the safest current read for the shell-scalar refresh plus dirty-latch consume helper rather than a generic poll routine.","objdump + caller inspection + local disassembly + controller-base correlation + shell-scalar correlation"
0x0052cea0,19,embedded_view_controller_copy_heading_pitch_pair_to_two_out_dwords,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny heading/pitch export helper over the embedded controller base. The function copies lanes `[this+0x10/+0x14]` into two caller out-pointers. Current grounded caller is the later support branch `0x00566700`, so this is the safest current read for the heading-pitch pair copy helper rather than a broader serializer fragment.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052cec0,49,embedded_view_controller_sample_owner_height_at_current_eye_xz,shell,thiscall,inferred,objdump + local disassembly,1,"Small owner-height query helper beneath the same controller base. The function scales current eye X/Z lanes `[this+0x1c/+0x24]` through the recurring world-unit constants, then forwards the resulting pair into owner handle `[this+0x6e]` through `0x00534490`. Current evidence grounds it as the direct sampled-height query at the controller's current eye X/Z position.","objdump + local disassembly + controller-base correlation + sampled-height correlation"
0x0052cf00,436,embedded_view_controller_query_owner_height_peak_over_clamped_xy_extent_pair,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Broader owner-height extent query over the embedded controller base. The helper clamps the caller-supplied X and Y extent floats against lower bound `2.0` and against owner-derived width and height limits from `0x00533970/0x00533980`, samples an initial owner height through `0x00534490`, and then walks a rectangular neighborhood in repeated world-unit steps to keep the highest sampled height, returning that peak float. Current grounded callers are the current-eye wrapper `0x0052d0dc`, the world-view clamp owner `0x0045211f`, and the later support branch `0x0053037f`, so this is the safest current read for querying the peak sampled owner height across one clamped XY extent pair rather than a generic math loop.","objdump + caller inspection + local disassembly + controller-base correlation + sampled-height correlation"
0x0052d0c0,33,embedded_view_controller_query_owner_height_peak_over_current_eye_xz_extent_pair,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Current-eye wrapper over `0x0052cf00` in the embedded controller base. The helper scales current eye X/Z lanes `[this+0x1c/+0x24]` into owner-space extents and forwards them into the broader peak-height query `0x0052cf00`. Current grounded callers are the world-view clamp owners `0x00439942` and `0x0043ceec`, so this is the safest current read for the current-eye peak-height wrapper rather than a separate terrain query family.","objdump + caller inspection + local disassembly + controller-base correlation + sampled-height correlation"
0x0052d0f0,64,embedded_view_controller_query_normalized_scalar_band_contains_xy_pair,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small range predicate over normalized scalar band `[this+0x50/+0x54/+0x58/+0x5c]` in the embedded controller base. The helper returns `1` only when the caller-supplied XY pair lies inside that stored scalar rectangle and `0` otherwise. Current grounded callers are the world-side branch `0x0045211f` and the later support branch `0x0053037f`, so this is the safest current read for the normalized-band containment predicate rather than a generic compare helper.","objdump + caller inspection + local disassembly + controller-base correlation + normalized-rect correlation"
0x0052d140,29,embedded_view_controller_store_four_blend_scalars_0x50_0x5c,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny setter over the embedded world-view controller base. The helper copies four caller-supplied dwords into scalar lanes `[this+0x50/+0x54/+0x58/+0x5c]` unchanged. Current grounded callers are the mode-`0x19` variant seed owners `0x0043a0a0`, `0x0043ace3`, the setup-side world-view branches `0x00459139`, `0x00459982`, and the later world-side owner `0x005208ad`, so this is the safest current read for the four-scalar controller-blend setter rather than a higher-level mode owner.","objdump + caller inspection + local disassembly + controller-band correlation"
0x0052d180,91,embedded_view_controller_store_focus_triplet_and_mark_dirty_if_changed,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Core focus-triplet setter beneath the embedded world-view controller base. The helper compares the incoming focus XYZ against the current stored triplet `[this+0x04/+0x08/+0x0c]`; when any component moves beyond the small epsilon at `0x005dd1c0` it sets dirty byte `[this+0x64] = 1`. It then stores the new triplet into `[+0x04/+0x08/+0x0c]`. Current grounded callers are the shell-input controller path `0x0043a1c3`, the transient-offset service `0x0043a54b`, the local clamp helper `0x00439820`, setup-side world-view branches `0x004592b8/0x00459b61`, and the runtime-object support strip `0x0052d440/0x0052bf65`, so this is the safest current read for the focus-triplet setter plus dirty-latch update rather than a generic vec3 copy.","objdump + caller inspection + local disassembly + controller-base correlation + dirty-latch correlation"
0x0052d1e0,67,embedded_view_controller_store_eye_triplet_and_refresh_vertical_delta,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Eye-triplet setter beneath the same embedded controller base. The helper stores the caller eye XYZ into `[this+0x1c/+0x20/+0x24]`; when owner handle `[this+0x6e]` is live it also samples the owner's height through `0x00534490` at the new X/Z pair and writes the resulting vertical delta `eye_y - sampled_height` into `[this+0x66]`, otherwise it copies the eye Y lane directly into `[this+0x66]`. Current grounded callers are the local clearance-ring clamp `0x00439820`, the setup-side controller owners `0x00459139/0x004592b8/0x00459afe`, and the helper itself's paired rebuild path `0x0052d440`, so this is the safest current read for storing the eye triplet and refreshing the sampled vertical delta rather than a generic world-position setter.","objdump + caller inspection + local disassembly + controller-base correlation + vertical-delta correlation"
0x0052d230,115,embedded_view_controller_query_focus_to_eye_distance_heading_and_pitch,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Pure query helper over the same controller base. Starting from the current focus triplet `[this+0x04/+0x08/+0x0c]` and eye triplet `[this+0x1c/+0x20/+0x24]`, the function can write the straight-line distance, one heading-like angle, and one pitch-like angle into up to three caller out-pointers. Current grounded caller is the world-side wrapper `0x0052fa59`, which consumes these as a bundled camera-state query, so this is the safest current read for the focus-to-eye distance and angle extractor rather than a standalone math primitive.","objdump + caller inspection + local disassembly + controller-base correlation + polar-query correlation"
0x0052d2b0,178,embedded_view_controller_serialize_focus_eye_and_orientation_triplets,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared serializer for the embedded controller base. The helper writes the current focus triplet `[this+0x04/+0x08/+0x0c]`, distance or view-height lane `[this+0x18]`, heading and pitch lanes `[this+0x10/+0x14]`, and eye triplet `[this+0x1c/+0x20/+0x24]` into the caller stream through repeated `0x00531030` writes, followed by one fixed zeroed `0x14`-byte trailer. Current grounded caller is `world_view_store_camera_view_slot_snapshot` `0x00439ac0`, so this is the safest current read for the controller-base snapshot serializer rather than a generic stream writer.","objdump + caller inspection + local disassembly + camera-view correlation + controller-base correlation"
0x0052d3e0,21,embedded_view_controller_clear_presenter_owner_slot_if_self,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny presenter cleanup leaf beneath the embedded controller base. When the live shell presenter exists and its owner slot `[0x006d4024+0x28]` still points at `this`, the helper clears that slot to null. Current grounded callers are the controller release owners `0x0043a58d` and `0x0043ac5c`, so this is the safest current read for the conditional presenter-owner clear helper.","objdump + caller inspection + local disassembly + presenter-owner correlation"
0x0052d400,69,embedded_view_controller_rebuild_focus_triplet_from_eye_heading_pitch_and_distance,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Inverse rebuild helper for the same embedded controller base. Starting from the current eye triplet `[this+0x1c/+0x20/+0x24]`, heading and pitch lanes `[this+0x10/+0x14]`, and distance or view-height lane `[this+0x18]`, the function reconstructs the implied focus triplet on the stack and then stores that triplet through `0x0052d180`. Current grounded caller is the world-view camera-restore branch `0x0043c960`, which adjusts heading before re-entering this helper, so this is the safest current read for rebuilding focus from eye-orientation-distance rather than another trig primitive.","objdump + caller inspection + local disassembly + controller-base correlation + focus-triplet correlation"
0x0052d450,117,embedded_view_controller_rebuild_eye_triplet_from_focus_heading_pitch_and_distance,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Core rebuild helper for the embedded controller base. Using the stored focus triplet `[this+0x04/+0x08/+0x0c]`, heading and pitch lanes `[this+0x10/+0x14]`, and distance lane `[this+0x18]`, the function recomputes the eye triplet into `[this+0x1c/+0x20/+0x24]` by applying the usual trig decomposition. When owner handle `[this+0x6e]` is live it also samples the owner's height through `0x00534490` at the rebuilt X/Z pair and refreshes vertical delta `[this+0x66]`; otherwise it copies the rebuilt eye Y lane there directly. Current grounded callers are the controller reset or clamp helpers `0x0052d5bf`, `0x0052d646`, and the world-view side branch `0x0043e4ce`, so this is the safest current read for rebuilding the eye triplet from focus, orientation, and distance rather than a generic trig helper.","objdump + caller inspection + local disassembly + controller-base correlation + eye-triplet correlation"
0x0052d4d0,143,embedded_view_controller_materialize_active_display_rect_from_normalized_scalars_0x50_0x5c,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small display-rect materializer beneath the embedded world-view controller base. The helper samples the active shell display width and height pair from `[0x006d4024+0x34 + [0x006d4024+0x11421e]*0x15]`, multiplies those two display metrics by the stored normalized scalar band `[this+0x50/+0x54/+0x58/+0x5c]`, rounds the four products through `0x005a10d0`, and writes the resulting integer rectangle corners through the caller out-pointers. Current grounded caller is the layout-state bridge `0x005482e0`, so this is the safest current read for materializing one active-display rect from the controller's normalized scalar band rather than a generic scaling helper.","objdump + caller inspection + local disassembly + controller-base correlation + display-rect correlation"
0x0052d570,27,embedded_view_controller_rebind_base_vtable_and_clear_presenter_owner_slot,shell,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Tiny base-reset leaf for the embedded controller object. The helper restores the base vtable root `0x005dd1c8` at `[this]` and clears presenter owner slot `[0x006d4024+0x28]` when it still points at `this`. Current grounded callers are the world-view release path `0x0043a595`, the setup-side teardown path `0x00458258`, the world-side cleanup branches `0x00520d43` and `0x0052bfd3`, so this is the safest current read for the base-vtable rebind and presenter-owner clear leaf.","objdump + caller inspection + local disassembly + controller-base correlation"
0x0052d5a0,144,embedded_view_controller_reset_scalar_bands_defaults_and_dirty_latches,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader initializer for the embedded controller base. The helper clears owner handle `[this+0x6e]`, sampled vertical delta `[+0x66]`, heading `[+0x10]`, several transient scalar lanes `[+0x44/+0x48/+0x60]`, focus and eye triplets `[+0x04..+0x0c]` and `[+0x38..+0x40]`, re-enters `0x0052d450`, seeds default scalar lanes such as `[+0x14]=0.2`, `[+0x18]=100.0`, `[+0x28]=100`, `[+0x30/+0x58/+0x5c]=1.0`, `[+0x4c]=100.0`, dirty byte `[+0x64]=1`, and sentinel `[+0x6a]=-1`, then copies the rebuilt heading or pitch defaults into `[+0x72/+0x76]` and `[+0x86]`. Current grounded callers are the world-view reset owner `0x0043a5a3`, the local constructor `0x0052d6d9`, and the later rebuild paths `0x0052d6d9/0x0052d869`, so this is the safest current read for the embedded controller-base reset and default seeding owner rather than a generic constructor stub.","objdump + caller inspection + local disassembly + controller-base correlation + reset-owner correlation"
0x0052d640,131,embedded_view_controller_clamp_distance_against_sampled_eye_height_and_rebuild_eye_triplet,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Distance-clamp helper for the embedded controller base. The function first rebuilds the current eye triplet through `0x0052d450`, compares owner-derived metric `vtable[+0x0c]` against eye height `[this+0x20]`, and when the current distance or view-height lane `[this+0x18]` is too large it computes one reduced value from the current height gap, pitch sine, and the sampled vertical offset, stores the clamped result back into `[this+0x18]`, and rebuilds the eye triplet again through `0x0052d450`. Current grounded callers are the world-view heading and zoom-step paths `0x0043cb16/0x0043cc16`, the controller seed path `0x0043ce3a`, the motion wrapper `0x0043d09f`, and the local constructor `0x0052d744`, so this is the safest current read for the distance clamp and eye-triplet rebuild helper rather than a generic projection recompute.","objdump + caller inspection + local disassembly + controller-base correlation + distance-clamp correlation"
0x0052d6f0,90,embedded_view_controller_seed_focus_distance_owner_and_rebuild_eye_triplet,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Compact constructor-side seed helper for the embedded controller base. The function stores one caller-supplied owner handle into `[this+0x6e]`, seeds the focus triplet into `[this+0x04/+0x08/+0x0c]`, seeds distance or view-height lane `[this+0x18]` plus its copy `[this+0x4c]`, mirrors shell presenter scalar `[0x006d4024+0x114222]` into `[this+0x6a]`, derives one bucket-like value from `0x51f070(1)` into `[this+0x28]`, and then tail-calls `0x0052d640` to rebuild the eye triplet and apply any needed clamp. Current grounded callers are the world-view owner `0x0043ce0e` and the stream-load branches `0x0052d7da/0x0052d889`, so this is the safest current read for the seeded controller-base setup helper rather than a generic stream-load leaf.","objdump + caller inspection + local disassembly + controller-base correlation + seed-owner correlation"
0x0052d750,260,embedded_view_controller_load_focus_eye_and_orientation_snapshot_from_stream,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared stream-load companion to the camera-view snapshot serializer `0x0052d2b0`. The helper first clears presenter owner slot `[0x006d4024+0x28]` when it still points at `this`, then reads the stored focus triplet `[+0x04/+0x08/+0x0c]` and distance lane `[+0x18]` through repeated `0x00531150` calls, resolves one owner handle from that focus or distance tuple through shell presenter helper `0x0051f090`, and re-enters `0x0052d6f0` to seed the controller base. After that it loads heading and pitch lanes `[+0x10/+0x14]`, eye triplet `[+0x1c/+0x20/+0x24]`, and consumes the trailing zeroed `0x14`-byte trailer. Current grounded caller is the world-view stream-load owner `0x0043ac30`, so this is the safest current read for loading one embedded controller snapshot from a stream rather than a generic byte-reader block.","objdump + caller inspection + local disassembly + stream-load correlation + camera-view correlation + controller-base correlation"
0x0052d860,50,embedded_view_controller_construct_reset_and_seed_from_focus_distance_owner,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Compact constructor wrapper for the same embedded controller base. The helper rebinds base vtable `0x005dd1c8`, re-enters `0x0052d5a0` to reset and seed defaults, and then forwards one caller-supplied owner handle, focus triplet, and distance lane into `0x0052d6f0`. Current grounded callers are the placed-structure and world-side builders `0x004581ff` and `0x0052087e`, so this is the safest current read for the reset-plus-seed constructor wrapper rather than another raw allocator tail.","objdump + caller inspection + local disassembly + controller-base correlation + constructor-wrapper correlation"
0x0052d8a0,170,runtime_object_register_relative_child_in_owned_list_field_0x75,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared owned-list registration helper over list root `[this+0x75]` in the broader `0x23a` runtime-object family. The function lazily allocates that list root through `0x00556db0`, optionally rewrites the incoming child object's anchor triplet `[child+0x1e2/+0x1e6/+0x1ea]` into coordinates relative either to current group-anchor `[this+0x14]` or to this object's own anchor when state bit `0x10` is still clear, sets bit `0x10` in the child state byte `[child+0x20]`, and then pushes the child through `0x00556e10`. Current grounded callers include the placed-structure specialization builders `0x0045b6f0`, `0x0045b760`, `0x0045c310`, the vehicle-side branches `0x00485933..0x00485ddb`, and the effect-side builders `0x0045b96b`, `0x0045c39c`, and `0x0045da83..0x0045e305`, so this is the safest current read for registering one relative child object in owned list `[this+0x75]` rather than a subtype-specific builder.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list correlation + relative-anchor correlation"
0x0052d950,71,runtime_object_register_record_in_owned_list_field_0x79_with_group_anchor_copy,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared owned-list registration helper over list root `[this+0x79]` in the broader `0x23a` runtime-object family. The function lazily allocates that list root through `0x00556db0`, copies the current group-anchor triplet from `[this+0x14]` into record fields `[record+0x29/+0x2d/+0x31]`, and then pushes the record through `0x00556e10`. Current grounded callers include the specialization payload publishers `0x00474f3e`, `0x00485f30`, and `0x00486029`, so this is the safest current read for registering one record in owned list `[this+0x79]` with a copied group anchor rather than a bare list append.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list correlation + group-anchor correlation"
0x0052d9a0,79,runtime_object_register_record_in_owned_list_field_0x7d_with_group_anchor_copy,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Sibling owned-list registration helper over list root `[this+0x7d]` in the broader `0x23a` runtime-object family. The function lazily allocates that list root through `0x00556db0`, copies the current group-anchor triplet from `[this+0x14]` into record fields `[record+0x29/+0x2d/+0x31]`, and then pushes the record through `0x00556e10`. Current grounded callers include the placed-structure specialization publishers `0x00456ad4`, `0x00456b80`, `0x00456c5a`, `0x00457047`, `0x0045b141`, `0x0045b14f`, `0x0045e305`, and the vehicle-side helpers `0x0048597a`, so this is the safest current read for registering one record in owned list `[this+0x7d]` with a copied group anchor rather than a subtype-specific payload constructor.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + owned-list correlation + group-anchor correlation"
0x0052da70,32,runtime_object_refresh_dependent_handle_0x0c_if_flag_0x40_and_owner_live,map,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small dependent-handle refresh helper beneath the broader `0x23a` runtime-object family. When owner pointer `[this+0x04]` is live and state byte `[this+0x20]` still carries bit `0x40`, the helper clears that bit, rebuilds one dependent handle through `0x00533bc0`, and stores the result into `[this+0x0c]`. Current grounded callers are the nearby world-side support strips `0x00421415` and `0x00461300`, so this is the safest current read for the `0x40`-bit dependent-handle refresh leaf rather than a generic flag clear.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + dependent-handle correlation"
0x0052daa0,67,runtime_object_select_grouped_subrecord_by_clamped_index,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared grouped-subrecord selector over the broader `0x23a` runtime-object family. When grouped table root `[this+0x14]` is live, the helper clamps the caller-requested index against the current group count from the selected `0x45`-byte group header `[group+0x14]`, stores the resulting cursor into `[this+0x21]`, updates active subrecord pointer `[this+0x18]` to the corresponding `0x45`-byte payload row under `[group+0x0c]`, and returns whether the requested index was already in range. Current grounded callers are the world-side wrappers `0x0042aba0`, `0x00455c73`, `0x00528721`, and `0x0052941f`, so this is the safest current read for the explicit grouped-subrecord select helper rather than a generic array index setter.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + grouped-subrecord correlation"
0x0052db10,224,runtime_object_store_scalar_0x69_mark_transform_dirty_and_materialize_group_packet_rows,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader grouped-subrecord materialization helper beneath the same `0x23a` runtime-object family. The function stores one caller-supplied scalar into `[this+0x69]`, sets dirty bit `0x02` in state byte `[this+0x20]`, raises byte `[this+0x8d]`, resolves the currently selected group header from `[this+0x14]` and group index `[this+0x3a]`, and then walks every `0x45`-byte row in that group. For each row it caches the active row pointer in globals `0x00cc3b58/0x00cc3b6c`, lazily allocates row-local payload storage when `[row+0x35]` is still null, copies the row's packed source span there, zero-fills the trailing companion area, and advances to the next row. Current grounded callers are the vehicle-side visual builders `0x00485a1d` and `0x00485a68` plus the shell-side presentation branch `0x005287af`, so this is the safest current read for storing scalar lane `[+0x69]` and materializing the current group's packet rows rather than a pure allocator helper.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + grouped-subrecord correlation + packet-row correlation"
0x0052dc00,240,runtime_object_bucket_materialized_group_packet_rows_by_four_float_thresholds,map,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Companion grouped-row helper immediately above `0x0052db10` in the same `0x23a` runtime-object family. When byte latch `[this+0x8d]` is live and local bucket byte `[this+0x5b]` is still below `2`, the function increments that bucket, stores one caller float into threshold lane `[this+0x69 + bucket*4]`, resolves the currently selected `0x45`-byte group, and then walks every materialized row payload at `[row+0x35]`. For each copied entry it compares the entry's two stored floats against the four caller-supplied threshold bounds and, on success, writes the current bucket byte into the compact trailing byte band of the copied row payload. Current grounded callers are the vehicle-side visual builders `0x00485a8c`, `0x00485ab0`, `0x00485ad4`, and `0x00485af8`, so this is the safest current read for bucketing the materialized group packet rows by threshold windows rather than a generic float clamp.","objdump + caller inspection + local disassembly + shared-runtime-object correlation + grouped-subrecord correlation + threshold-bucket correlation"
0x0052eb20,51,shell_read_optional_presentation_extents4,bootstrap,thiscall,inferred,ghidra-headless,4,Reads an optional four-float extent block from the active presentation-batch record when byte flag [this+0x25] is set; copies dwords at +0x26 +0x2a +0x2e and +0x32 into caller outparams for the presentation-extents helper at 0x547d10.,ghidra + rizin
0x0052eb60,6,runtime_object_constant_0x46_stub_vtable_5cfd00_slot0,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Tiny constant-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper returns literal `0x46` in `EAX` and exits immediately. Current evidence does not justify a stronger semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly"
0x0052eb70,6,runtime_object_constant_0x46_stub_vtable_5cfd00_slot1,map,thiscall,inferred,objdump + vtable scan + local disassembly,1,"Second tiny constant-return virtual slot in the sibling `Infrastructure`-side table `0x005cfd00`. The helper also returns literal `0x46` in `EAX` and exits immediately. Current evidence does not justify a stronger semantic name beyond that fixed return value.","objdump + vtable scan + local disassembly"
@ -1849,12 +1982,82 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x0053a440,14,shell_set_geographic_label_item_alpha,bootstrap,thiscall,inferred,ghidra-headless,4,Stores an 8-bit alpha input into the high-byte color field at [this+0x5b] for the current geographic-label item before frame or text emission.,ghidra + rizin + llvm-objdump
0x0053a960,723,shell_emit_geographic_label_text_span,bootstrap,thiscall,inferred,ghidra-headless,4,Builds and emits one geographic-label text span for the current cell item. The helper calls the item vtable at +0x10 to materialize a null-terminated display string up to 0x12c bytes computes placement from item float fields and shell service state checks visibility through the shell bundle and forwards the resolved text payload into the presentation path through 0x005519f0. The item family aligns with gpdLabelDB and 2DLabel.imb rather than the parallel city assets.,ghidra + rizin + llvm-objdump
0x00543f10,853,layout_state_bind_presentation_asset_bundle,bootstrap,thiscall,inferred,ghidra-headless,4,Initial bind-time asset loader for the layout state's presentation node at [this+0x25df]; pulls a fixed presentation bundle through the node vtable at +0x5c and +0x60 including standalone assets stored around 0x2643 0x2647 0x264b 0x264f 0x2653 0x265b 0x265f and 0x2663 plus a 64-entry asset bank at 0x31ab while advancing an internal asset-offset cursor at [this+0x2543].,ghidra + rizin
0x00544290,195,layout_state_publish_local_descriptor_0x352f_from_integer_span_pair,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Local descriptor-publish helper in the layout-state family. The helper derives one normalized span scalar from the caller's two integer inputs, combines that value with local scalar lanes `[this+0x25eb/+0x25ef/+0x25f3]`, builds one `0x100`-byte descriptor rooted at `[this+0x352f]` through `0x0056e41a`, stores one derived shell-scaled scalar into `[this+0x36f9]`, and publishes that descriptor through node slot `+0x94` on the bound presentation node `[this+0x25df]` for selector `3`. Current grounded callers are the neighboring rect and span owners `0x00548120`, `0x00548180`, and `0x005482e0`, so this is the safest current read for publishing local descriptor `[+0x352f]` from an integer span pair rather than a generic math helper.","objdump + caller inspection + local disassembly + layout-state correlation + local-descriptor correlation"
0x00544360,208,layout_state_reset_local_descriptor_0x34ef_to_identity_and_publish,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Identity-reset companion to `0x00544290` in the same layout-state family. The helper zeroes the local `0x100`-byte descriptor block rooted at `[this+0x34ef]`, seeds the four diagonal scalar lanes `[+0x34ef/+0x3503/+0x3517/+0x352b]` to `1.0f`, and publishes that block through node slot `+0x94` on the bound presentation node `[this+0x25df]`. Current grounded callers include the neighboring rect and span owners `0x00548120` and a wider set of shell presentation rebuild paths such as `0x00524d05`, `0x00528805`, `0x00529dab`, and `0x0054d93a`, so this is the safest current read for resetting local descriptor `[+0x34ef]` to identity and publishing it rather than a standalone memset wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + local-descriptor correlation"
0x00544cb0,64,layout_state_publish_property_pair_0x0d_0x0e_for_selector3,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small property-pair publisher in the same layout-state family. The helper forwards one caller-supplied byte value into bound-node property groups `0x0d` and `0x0e`, both for selector `3`, through vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural property-pair publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544cf0,48,layout_state_clear_property_pair_0x0d_0x0e_for_selector2,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny clear sibling to `0x00544cb0` in the layout-state family. The helper writes `0` into bound-node property groups `0x0d` and `0x0e` for selector `2` through vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural clear helper description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544d20,96,layout_state_set_property_pair_0x0d_0x0e_for_selector1_to_1,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small arming helper over the same layout-state property strip. The helper first clears bound-node property groups `0x0d` and `0x0e` for selector `1`, then republishes both groups with literal value `1` through vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural selector-`1` property-pair arm description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544d80,32,layout_state_publish_property_0x3c_packed_dword,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny packed-property setter over the bound presentation node `[this+0x25df]`. The helper forwards one caller-supplied dword into property `0x3c` through node vtable slot `+0xc8`. Current evidence only supports this structural packed-dword publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544da0,48,layout_state_publish_property_0x3c_with_cached_rgb_and_alpha_byte,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small color-pack sibling to `0x00544d80` in the layout-state family. The helper reads cached RGB lanes from `[this+0x25a3]`, masks them down to `0x00ffffff`, combines that value with one caller-supplied alpha byte in the high lane, and publishes the packed result into property `0x3c` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural cached-RGB-plus-alpha publisher description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544dd0,32,layout_state_publish_property_group_0x0b_for_selector_with_value,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny grouped-property publisher over the same bound node. The helper forwards its two caller-supplied dwords as selector and value into property group `0x0b` through node vtable slot `+0xfc` on `[this+0x25df]`. Current evidence only supports this structural grouped-property publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00544df0,320,layout_state_apply_capability_and_mode_gated_property_strip_0x1d_0x13_0x14_0x12,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader property-strip owner in the layout-state family. The helper first checks shell capability byte `[0x006d4024+0x11422e]` and publishes property `0x1d` on the bound node `[this+0x25df]`, then conditionally seeds fixed property pair `0x13 = 5` and `0x14 = 6` when state byte `[this+0x83c+0x21]` is live. After that it derives one per-slot mode value from state dword `[this+0x83c+0x29]` and local slot count `[this+0x258f]`, publishes property `0x13` across every active slot, and finally publishes property `0x12` across the same slot span with the derived mode selector. Current grounded caller is the neighboring layout-state owner branch `0x0052bc18`, so this is the safest current read for the capability and mode-gated `0x1d/0x13/0x14/0x12` property-strip owner rather than a named UI action.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation"
0x00544f30,208,layout_state_apply_slot_range_property_strip_0x15_0x1a_0x11_0x10,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Broader slot-range property-strip owner adjacent to `0x00544df0` in the same layout-state family. The helper derives one active slot range from the caller's signed start byte and the current slot count `[this+0x258f]`, optionally clears property `0x15` down to zero and raises property `0x1a = 1` when the caller's boolean flag is set, then walks the active slot range publishing property groups `0x11` and `0x10` with one derived mode value. That derived mode depends on both the caller flag and state byte `[this+0x83c+0x1e]`. Current evidence only supports this structural slot-range property-strip description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00545000,32,layout_state_clear_property_0x89,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny bound-node property clear in the layout-state family. The helper writes literal `0` into property `0x89` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural property clear description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00545020,32,layout_state_publish_property_0x89_from_state_byte_0x22,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small sibling publisher to `0x00545000`. The helper reads byte `[this+0x83c+0x22]` and forwards that value into bound-node property `0x89` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural cached-byte property publish description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00545040,64,layout_state_publish_property_0x89_from_state_byte_0x22_and_notify_slot_0,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Notify-style sibling over the same cached state byte `[this+0x83c+0x22]`. The helper first publishes that byte into property `0x89` through node slot `+0xc8`, then forwards the same value into node slot `+0xb8` with selector `0`. Current evidence only supports this structural publish-plus-notify description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00545080,32,layout_state_clear_property_0x0e,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny bound-node property clear in the same layout-state strip. The helper writes `0` into property `0x0e` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural property clear description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x005450a0,32,layout_state_set_property_0x0e_to_1,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny sibling setter to `0x00545080`. The helper writes literal `1` into property `0x0e` through node vtable slot `+0xc8` on `[this+0x25df]`. Current evidence only supports this structural property-set description.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x005450c0,32,layout_state_copy_cached_local_block_0x24f0_to_out_buffer,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small cached-block exporter in the layout-state family. The helper copies the fixed `0x33`-byte local block rooted at `[this+0x24f0]` into one caller-supplied output buffer through a straight `rep movs` copy. Current evidence only supports this structural cached-block export description.","objdump + local disassembly + layout-state correlation + cached-block correlation"
0x005450e0,80,layout_state_export_negated_local_scalar_triplet_0x2517_0x251b_0x251f_with_mid_clamp,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Three-outparam local scalar exporter in the layout-state family. The helper reads float lanes `[this+0x2517]`, `[this+0x251b]`, and `[this+0x251f]`, negates all three, scales the third lane through the same constant used by neighboring layout-state math, and writes them to three separate outparams. The middle exported scalar is then clamped up to `0.5f` when the negated source would fall below that floor. Current evidence only supports this structural negated-triplet export description.","objdump + local disassembly + layout-state correlation + local-scalar correlation"
0x00545130,80,layout_state_export_negated_local_scalar_triplet_0x2517_0x251b_0x251f_to_vec3_with_mid_clamp,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Packed-output sibling to `0x005450e0` in the same layout-state family. The helper writes the same negated local scalar triplet derived from `[this+0x2517/+0x251b/+0x251f]` into one caller-supplied contiguous three-float buffer, again scaling the third lane and clamping the middle lane up to `0.5f`. Current grounded caller is the neighboring layout-state owner branch `0x0052bbb7`, so this is the safest current read for the packed vec3 export sibling rather than another generic copy helper.","objdump + caller inspection + local disassembly + layout-state correlation + local-scalar correlation"
0x00545180,640,layout_state_build_default_preset_table_0x840_from_angular_sweep,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Default preset-table builder in the same layout-state family. The helper walks `0x90` fixed records of size `0x33` rooted at `[this+0x840]`, deriving one normalized vector pair, several companion float lanes, and three byte-scaled threshold lanes from an angular sweep that starts at `-0xa8c0` and advances by `0x258` per row. Current grounded caller is the default-cache bootstrap path `0x0054be29`, which only invokes this builder when global dirty byte `0x00ccd820` is still clear; otherwise that owner copies preset rows from global cache `0x00ccbb68`. So the safest current read is a generated default preset-table builder rather than a generic trig helper.","objdump + caller inspection + local disassembly + layout-state correlation + preset-table correlation + default-cache correlation"
0x00545400,32,layout_state_store_preset_row_float_0x23_in_table_0x840,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny indexed preset-row setter in the layout-state family. The helper stores one caller-supplied float into offset `0x23` of the selected `0x33`-byte row under preset table `[this+0x840]`. Current evidence only supports this structural preset-row float-store description.","objdump + local disassembly + layout-state correlation + preset-table correlation"
0x00545420,32,layout_state_store_scalar_pair_arrays_0x25f7_0x25ff_by_index,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small paired scalar-array setter adjacent to the preset-table strip. The helper stores two caller-supplied floats into indexed arrays `[this+0x25f7 + index*4]` and `[this+0x25ff + index*4]`. Current evidence only supports this structural paired-array store description.","objdump + local disassembly + layout-state correlation + paired-array correlation"
0x00545440,48,layout_state_query_scalar_pair_arrays_0x25f7_0x25ff_by_index,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small paired scalar-array query sibling to `0x00545420`. The helper conditionally writes indexed floats from `[this+0x25f7 + index*4]` and `[this+0x25ff + index*4]` into up to two caller-supplied outparams. Current evidence only supports this structural paired-array query description.","objdump + local disassembly + layout-state correlation + paired-array correlation"
0x00545470,48,layout_state_store_two_floats_into_preset_row_column_pair,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small indexed preset-row setter adjacent to `0x00545400`. The helper resolves one selected `0x33`-byte row under `[this+0x840]`, then stores two caller-supplied floats into the first and second column bands using the caller's subindex as a `4`-byte lane selector. Current evidence only supports this structural two-float row-store description.","objdump + local disassembly + layout-state correlation + preset-table correlation"
0x005454a0,32,layout_state_query_float_from_preset_row_column_band_0x840,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny indexed preset-row query helper over the same table `[this+0x840]`. The helper resolves one selected `0x33`-byte row and returns the float stored in the first column band at the requested `4`-byte subindex. Current evidence only supports this structural preset-row float-query description.","objdump + local disassembly + layout-state correlation + preset-table correlation"
0x005457c0,224,layout_state_publish_property_0x8b_with_stack_descriptor_and_optional_capability_scaled_scalar,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Stack-descriptor publisher in the layout-state family. The helper zeroes one local descriptor block, optionally seeds one capability-gated scaled scalar from `[this+0x25fb] * [this+0x24f4]` when both the caller flag and shell capability byte `[0x006d4024+0x11422e]` are live, pushes packed color `0xffafafaf` into property `0x8b` on the bound node `[this+0x25df]`, and then forwards the prepared stack descriptor through node slot `+0xa8`. Current grounded callers include nearby layout-state refresh owners `0x00524cd3`, `0x00524e28`, `0x0052a641`, `0x0052ac7a`, `0x0052ae3d`, `0x0052b42f`, `0x0052bbc1`, `0x0054d944`, and later support branches `0x00564c38`, so the safest current read is a property-`0x8b` stack-descriptor publish helper rather than a named UI action.","objdump + caller inspection + local disassembly + layout-state correlation + stack-descriptor correlation"
0x005458a0,48,layout_state_borrow_current_segment_record_window_handle_0x265b_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over current segment-record handle `[this+0x265b]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x2800`-byte window through handle vtable slot `+0x2c`, and returns the borrowed scratch pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + segment-record correlation"
0x005458d0,32,layout_state_release_current_segment_record_window_handle_0x265b_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x005458a0`. The helper decrements global counter `0x00ccd824` and forwards current segment-record handle `[this+0x265b]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + segment-record correlation"
0x005459f0,48,layout_state_release_segment_record_window_handle_0x2643_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to the `0x2643` segment-record window readers. When gate byte `[this+0x254e]` is live, the helper clears that gate, decrements global counter `0x00ccd824`, and forwards handle `[this+0x2643]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + segment-record correlation"
0x00545a20,32,layout_state_release_handle_0x264f_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny release-side wrapper over handle `[this+0x264f]` in the layout-state family. The helper decrements global counter `0x00ccd824` and forwards that handle through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545a40,48,layout_state_borrow_handle_0x264f_window_0x7800_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x264f]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x7800`-byte window through handle vtable slot `+0x2c`, writes the borrowed pointer to local scratch `[this+0x2657]`, and returns that pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545a70,48,layout_state_borrow_handle_0x2653_window_0x3e80_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x2653]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x3e80`-byte window through handle vtable slot `+0x2c`, and returns the borrowed pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545aa0,32,layout_state_release_handle_0x2653_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x00545a70`. The helper decrements global counter `0x00ccd824` and forwards handle `[this+0x2653]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545ac0,48,layout_state_borrow_handle_0x264b_window_0x3e80_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x264b]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x3e80`-byte window through handle vtable slot `+0x2c`, and returns the borrowed pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545af0,32,layout_state_release_handle_0x264b_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x00545ac0`. The helper decrements global counter `0x00ccd824` and forwards handle `[this+0x264b]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545b90,32,layout_state_release_vertex24_window_handle_0x2647_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to the vertex24 window readers over handle `[this+0x2647]`. The helper decrements global counter `0x00ccd824` and forwards that handle through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + vertex24 correlation"
0x00545bb0,48,layout_state_borrow_handle_0x263f_window_0x2ee00_with_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small borrow-side wrapper over handle `[this+0x263f]` in the layout-state family. The helper increments global counter `0x00ccd824`, requests a fixed `0x2ee00`-byte window through handle vtable slot `+0x2c`, and returns the borrowed pointer. Current evidence only supports this structural borrow-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545be0,32,layout_state_release_handle_0x263f_and_drop_global_counter,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Release-side companion to `0x00545bb0`. The helper decrements global counter `0x00ccd824` and forwards handle `[this+0x263f]` through vtable slot `+0x30`. Current evidence only supports this structural release-wrapper description.","objdump + local disassembly + layout-state correlation + handle-wrapper correlation"
0x00545ca0,176,layout_state_clear_first_optional_binding_publish_property_0x9e_and_commit_span_type1,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small commit-side owner in the layout-state family. When gate byte `[this+0x254d]` is still clear and slot count `[this+0x258f]` is positive, the helper clears the first optional slot binding `[this+0x2593][0]` through node slot `+0xf4` when that binding is nonnull, then publishes property `0x9e = 1.0f` on the bound node `[this+0x25df]`, accumulates one derived span count into `[this+0x3711]`, and commits the caller-supplied range through node slot `+0x118` with primitive-type argument `1`. Current evidence only supports this structural clear-plus-commit description.","objdump + local disassembly + layout-state correlation + span-commit correlation"
0x00545d50,16,layout_state_query_accumulated_span_counter_0x3711,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny accessor in the same layout-state family. The helper returns accumulated span counter `[this+0x3711]` unchanged. Current evidence only supports this structural counter-query description.","objdump + local disassembly + layout-state correlation + counter correlation"
0x00545d60,80,layout_state_reset_counters_0x370d_0x3711_and_optionally_reseed_bound_node_mode2,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Reset-side helper adjacent to the span-commit strip. The function zeroes local counters `[this+0x370d]` and `[this+0x3711]`, optionally dispatches the bound node `[this+0x25df]` through vtable slot `+0x90` with selector `2` and one `1.0f` scalar when the caller requests it, and then unconditionally forwards the node through slot `+0x88`. Current evidence only supports this structural reset-and-optional-reseed description.","objdump + local disassembly + layout-state correlation + counter correlation"
0x00545db0,64,layout_state_finalize_bound_node_and_optionally_clear_zero_mode_through_slot_0x3c,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Small finalize-side helper over the bound node `[this+0x25df]`. The helper first dispatches node slot `+0x8c`, then, when the caller's boolean is still zero, clears one four-zero argument lane through node slot `+0x3c`. Current evidence only supports this structural finalize-and-optional-clear description.","objdump + local disassembly + layout-state correlation + bound-node correlation"
0x00545e00,48,layout_state_classify_bound_node_signature_0x88760868_0x88760869_or_other,bootstrap,thiscall,inferred,objdump + local disassembly,1,"Tiny classifier over the bound node `[this+0x25df]`. The helper queries node slot `+0x0c` and returns `1` for signature `0x88760868`, `2` for `0x88760869`, `0` for a null signature, and `3` for any other nonzero result. Current evidence only supports this structural node-signature classifier description.","objdump + local disassembly + layout-state correlation + node-signature correlation"
0x00554830,142,attachment_object_init_named_asset,bootstrap,thiscall,inferred,ghidra-headless,3,Initializes one named attachment object from a caller-supplied asset string and placement parameters. The helper copies the asset name into the local object buffer at [this+0x10] stores attachment selectors at [this+0x130] and [this+0x138] optionally derives a cached scale pair at [this+0x120] and [this+0x124] and then finalizes object state through 0x005545d0.,ghidra + rizin + llvm-objdump
0x00531640,129,shell_audio_service_query_selected_backend_index_by_name,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Queries the currently selected audio backend index from the shell audio service. When service mode dword `[this+0x04]` is `1` and the override gate at `0x00ccb9f4` is clear, the helper pulls the current backend-name stem through `0x569720` on service object `0x00ccb9fc`, iterates candidate names through `0x005314b0`, and returns the first matching backend index. Otherwise it falls back to `0`. Current grounded callers are the `Sound` page refresh and callback paths, which use it to mirror the live backend selector into control `0x7551`.","objdump + settings-window caller correlation + backend-name-match correlation"
0x005316d0,47,shell_audio_service_query_backend_available_flag_by_index,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Returns one availability flag for the requested audio backend index. When service mode dword `[this+0x04]` is `1` and the override gate at `0x00ccb9f4` is clear, the helper resolves the backend-name pointer through `0x005314b0(index)` and forwards it into `0x569730` on service object `0x00ccb9fc`; otherwise it returns `0`. Current grounded callers are the `Sound` page refresh and callback paths, which use the returned flag to republish control `0x7550`.","objdump + settings-window caller correlation + backend-availability correlation"
0x00531e10,48,shell_audio_service_apply_indexed_feedback_event_if_ready,shell,thiscall,inferred,objdump + caller correlation + local disassembly,4,"Small shell-audio-service sink beneath the indexed feedback-nudge helper `0x0045ea20`. The helper only dispatches when service mode dword `[this+0x04]` equals `1`, override gate `0x00ccb9f4` is clear, and the service-side readiness scalar at `[0x00ccb9f8+0x20]` passes the local positive check; on the ready path it tail-jumps into `0x0056ad20` with the caller's table-driven event pair and scalar, otherwise it returns `0`. Current grounded direct caller is `shell_emit_indexed_audio_feedback_nudge_if_live` `0x0045ea20`, which keeps this safely on the shell-audio feedback side rather than the broader backend-selection family.","objdump + caller correlation + local disassembly + readiness-gate correlation"
0x0053ef60,4,graphics_backend_query_primary_status_dword_18,shell,thiscall,inferred,objdump + settings-window caller correlation,3,"Returns graphics-backend dword `[this+0x18]` unchanged. Current grounded callers are the `Graphics` page refresh and graphics-selector callback strip, which pair this value with `graphics_backend_query_both_status_slots_clear` `0x0053ef70` when deciding how controls `0x757c` and `0x759a` should be republished.","objdump + settings-window caller correlation"
0x0053ef70,23,graphics_backend_query_both_status_slots_clear,shell,thiscall,inferred,objdump + settings-window caller correlation,4,"Returns `1` only when both graphics-backend dword `[this+0x18]` and dword `[this+0x14]` are zero; otherwise returns `0`. Current grounded callers are the `Graphics` page refresh and the graphics-selector callback strip, which use this test as the fallback branch when republishing controls `0x757c` and `0x759a`.","objdump + settings-window caller correlation + status-slot correlation"
0x00540e30,283,surface_owner_base_init_and_register_on_global_list,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Base initializer for the `0xec`-byte RGBA surface-owner family. The helper copies one fixed owner label into `[this+0x13]`, seeds capability and mode bytes from the live shell presenter into `[this+0x96/+0x97]`, clears the cached byte-count and pointer bands `[this+0xc0..+0xe8]`, allocates two small companion helper objects through `0x0053b070 -> 0x00556d80`, clears the eight-entry row bands `[this+0x98..+0x9f]` and `[this+0xa0..+0xbc]`, resets selector dword `[this+0x07]`, and finally links the owner into the global intrusive list rooted at `0x00ccbb2c`, incrementing `0x00ccbb30`. Current grounded caller is `surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode` `0x00543980`, so this is the safest current read for base-init plus global registration rather than a generic shell allocator.","objdump + caller inspection + local disassembly + surface-family correlation + global-list correlation"
0x00540fc0,304,surface_owner_refresh_cached_byte_totals_and_release_all_row_buffers,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Two-part maintenance owner in the same surface-owner family. Its first half clears cached byte totals `[this+0xcc/+0xd0]` and then walks the eight row slots `[this+0xa0..+0xbc]`, accumulating active row byte sizes `[row+0x04]` into total bytes when backing pointer `[row+0x22]` is live and into selected bytes when companion byte `[this+0x98 + slot]` is set and selector dword `[this+0x07]` matches the shell mode token `[0x006d4024+0x114222]`. Its second half walks the same slots again and frees row buffers `[row+0x2a/+0x26/+0x2e]`, clears `[row+0x22]`, and resets owner selector `[this+0x07]`. Current grounded callers are the surface constructor `0x00543980` and the cached-surface commit helper `0x005438d0`, so this is the safest current read for the cached-byte refresh plus full row-buffer release owner rather than a narrow query helper.","objdump + caller inspection + local disassembly + surface-family correlation + byte-total correlation + row-release correlation"
0x00541160,88,surface_owner_query_dimension_cap_from_mode_and_quality_band,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Small dimension-cap query in the same surface-owner family. When owner byte `[this+0x05]` is clear it returns the broad fallback cap `0x800`. Otherwise it derives a tighter power-of-two limit from the shell editor or capability gate `[0x006d4024+0x11422f]` and then clamps that base cap against quality-style selector dword `[this+0xd8]`, yielding at most `0x100`, `0x200`, or `0x400`. Current grounded caller is the type-`2` import branch at `0x00542e15`, so this is the safest current read for the shared surface-dimension cap helper rather than a generic scalar accessor.","objdump + caller inspection + local disassembly + surface-family correlation + dimension-cap correlation"
0x005411c0,79,surface_owner_probe_named_file_for_type2_header_signature,shell,cdecl,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Small file-header probe adjacent to the same import seam. The helper opens one caller-supplied path with mode `0x8000`, reads the leading `0x12` bytes, closes the file, and returns `1` only when the checked header byte stays clear and the small type byte at local offset `+0x06` equals `2`; otherwise it returns `0`. Current grounded caller is the shell-side path at `0x005039fb`, so this is the safest current read for probing a named file for the type-`2` header signature rather than a generic file-exists test.","objdump + caller inspection + local disassembly + surface-family correlation + file-header correlation"
0x00541210,709,surface_row_repack_rgba_or_rgb32_into_active_16bit_buffer_with_palette_mode_gate,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Row-side repack owner beneath the same RGBA surface family. When shell capability byte `[0x006d4024+0x114255]` is live and editor-map gate `[0x006d4024+0x11422f]` is clear, the helper requires row backing buffer `[row+0x26]`, ensures one active output buffer at `[row+0x2a]`, seeds row state `[row+0x04/+0x10/+0x1c/+0x22]`, and then repacks the caller pixels into a 16-bit destination. The current split is structural but real: when owner byte `[this+0x96]` is nonzero it computes a palette-like packed color from accumulated channel maxima; otherwise it uses direct nibble-packed conversion from the source dwords. When owner byte `[this+0x97]` is clear it also frees the source backing pointer `[row+0x26]` on exit. Current grounded callers are `surface_owner_commit_backing_rgba_buffer_recompute_size_and_republish` `0x005438d0` and the broader row-type import body at `0x00541c30`, so this is the safest current read for the active 16-bit repack owner rather than a generic blit.","objdump + caller inspection + local disassembly + surface-family correlation + repack correlation + capability-gate correlation"
0x00541970,292,surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Shared query-or-materialize helper in the same `0xec`-byte surface-owner family. For non-type-`2` rows it optionally returns width and height from `[row+0x08/+0x0c]`, then returns active RGBA backing pointer `[row+0x26]` when already live. If that RGBA buffer is still null, the helper allocates `width * height * 4` bytes, expands the current 16-bit source buffer `[row+0x2a]` into nibble-doubled RGBA dwords, stores the result into `[row+0x26]`, and returns that pointer. Current grounded callers include the cached world-presentation strip `0x005323f0/0x00532460`, the staged overlay publisher `0x00534af0`, the secondary-overlay loaders `0x00535430/0x00538060`, and the save/setup preview seam below `0x00542550`, so this is the safest current read for querying or materializing the RGBA backing buffer from the active 16-bit row rather than a generic width or height helper.","objdump + caller inspection + local disassembly + surface-family correlation + RGBA-materialization correlation"
0x00541aa0,48,surface_owner_query_first_row_width_or_one,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Tiny first-row width query in the same surface-owner family. When active-count byte `[this+0x04]`, companion byte `[this+0x98]`, and first row pointer `[this+0xa0]` are all live, the helper returns width dword `[row+0x08]`; otherwise it falls back to `1`. Current grounded callers include the world-presentation math strips at `0x0055238a/0x005523b6` and the later projection-side branch `0x0055f5d0`, so this is the safest current read for the first-row width-or-one helper rather than a generic scalar accessor.","objdump + caller inspection + local disassembly + surface-family correlation + width-query correlation"
0x00541ad0,48,surface_owner_query_first_row_height_or_one,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Height-side sibling to `surface_owner_query_first_row_width_or_one` in the same surface-owner family. When active-count byte `[this+0x04]`, companion byte `[this+0x98]`, and first row pointer `[this+0xa0]` are all live, the helper returns height dword `[row+0x0c]`; otherwise it falls back to `1`. Current grounded callers include the same world-presentation and projection-side strips at `0x0055250e/0x0055253a` and `0x0055f5ed`, so this is the safest current read for the first-row height-or-one helper rather than a generic scalar accessor.","objdump + caller inspection + local disassembly + surface-family correlation + height-query correlation"
0x00541bf0,32,surface_owner_refresh_cached_shell_scalar_0xd4_and_return_bound_handle_0xc0,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Small state-refresh helper in the same surface-owner family. The helper reads the live shell presenter through `0x0051f070`, copies presenter dword `[presenter+0x05]` into cached owner field `[this+0xd4]`, and returns bound handle `[this+0xc0]`. Current grounded caller is the layout-state binding strip at `0x00545566`, so this is the safest current read for refreshing cached shell scalar `0xd4` and returning handle `[+0xc0]` rather than a broader semantic owner.","objdump + caller inspection + local disassembly + surface-family correlation + cached-shell-scalar correlation"
0x00541c10,32,surface_owner_release_selector_handle_0x07_if_present,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Tiny selector-handle release helper in the same surface-owner family. When owner field `[this+0x07]` is nonzero, the helper re-enters `0x00541780` on that handle and then clears `[this+0x07]` back to zero. Current grounded callers include the broader release body `0x00542c90`, the local maintenance strip at `0x0053293c`, and the cache-refresh owner around `0x00543521/0x00543593`, so this is the safest current read for releasing selector handle `+0x07` rather than a generic destructor fragment.","objdump + caller inspection + local disassembly + surface-family correlation + selector-handle correlation"
0x00541b10,132,surface_owner_allocate_first_free_row_slot_0xa0_and_seed_dimensions_and_type,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Slot allocator in the `0xec`-byte RGBA surface-owner family. The helper scans the eight-entry row-pointer band `[this+0xa0 .. +0xbc]` for the first null slot, increments active-count byte `[this+0x04]`, marks companion byte `[this+0x98 + slot] = 1`, allocates one `0x32`-byte row, zeroes it, seeds row fields `[row+0x08]` and `[row+0x0c]` from the caller width and height, mirrors the third caller dword into `[row+0x14/+0x18]`, stores the row into `[this+0xa0 + slot*4]`, and returns the slot index or `-1` when no slot is free. Current grounded caller is `surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode` `0x00543980`, which invokes it as `(..., width, height, 3)`, so this is the safest current read for allocating the first free surface-row slot rather than a generic small object allocator.","objdump + caller inspection + local disassembly + surface-family correlation + row-slot correlation"
0x00541ba0,66,surface_owner_release_row_slot_0xa0_by_index,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Release-side companion to `0x00541b10` in the same surface-owner family. When the caller-supplied slot index is in range and row pointer `[this+0xa0 + slot*4]` is live, the helper decrements active-count byte `[this+0x04]`, releases the row through `0x00540f60`, clears companion byte `[this+0x98 + slot]`, and nulls the stored row pointer. Current evidence grounds it as the indexed row-slot releaser beneath the same temporary-surface and cached-surface owner family.","objdump + caller inspection + local disassembly + surface-family correlation + row-slot correlation"
0x00541c30,1024,surface_row_import_tagged_baba_babb_babe_payload_to_rgba_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Broader type-`4` row-import owner beneath `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50`. After the usual early fast path through `0x00541210`, the helper reads one tagged payload stream, validates the fixed tag sequence rooted at `0xbabe` and the following `0xbaba/0xbabb` alternatives, allocates temporary buffers for the recovered bands, and then reconstructs one RGBA destination buffer from those tagged payload pieces before storing it back into the active row. The current grounded split is structural but real: one branch routes the recovered tagged bands through `0x00553120`, another copies one direct recovered band, and the mismatch branch falls back to an all-`0xff` fill. On success it seeds row fields `[row+0x08/+0x0c/+0x10/+0x14/+0x18/+0x1c/+0x26]` for the type-`4` family and then re-enters `0x00541210` to materialize the live 16-bit buffer. This is the safest current read for the tagged `0xbabe/0xbaba/0xbabb` payload importer rather than a generic stream helper.","objdump + caller inspection + local disassembly + surface-family correlation + tagged-payload correlation"
0x00542030,905,surface_row_import_headered_rgb_or_paletted_payload_to_rgba_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Broader type-`3` row-import owner beneath `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50`. After the same early repack fast path through `0x00541210`, the helper resolves one headered payload through the local stream service, validates recovered width and height against the live shell caps, rejects unsupported header combinations, allocates a full RGBA destination plus one temporary `0x40000` staging buffer, and then decodes the payload into RGBA rows. The current grounded split is structural but real: it accepts direct `0x20`-byte-per-pixel and `0x18`-byte-per-pixel source bands, can reseed an auxiliary table lookup through `0x0053b7c0`, and treats one large-value branch as a staged scanline reader rather than a raw memcpy. On success it seeds row fields `[row+0x08/+0x0c/+0x10/+0x14/+0x18/+0x1c/+0x26]` for the type-`3` family and re-enters `0x00541210` with row flag byte `[row+0x20]` selected from the dimension threshold branch. This is the safest current read for the headered RGB or paletted payload importer rather than another generic buffer copy.","objdump + caller inspection + local disassembly + surface-family correlation + headered-payload correlation"
0x005423d0,380,surface_row_materialize_dxt3_payload_into_active_16bit_buffer,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"DXT3 materializer beneath the same type-`2` row family. When the active output buffer `[row+0x2a]` is still null and compressed payload `[row+0x2e]` is live, the helper builds two temporary codec-side objects through `0x00570691`, forwards the row payload and format tag `0x33545844` (`DXT3`) into the adjacent decode path `0x0057025d`, runs the follow-on materialization step `0x005706f7`, and then allocates the live output buffer `[row+0x2a]`, copies the decoded bytes into it, seeds row state `[row+0x04/+0x10/+0x14/+0x1c/+0x22]`, and releases the temporary codec objects. Current grounded caller is the non-editor tail of `surface_row_import_dds_dxt3_payload_and_optionally_materialize_buffer` `0x00542d50`, so this is the safest current read for materializing the compressed DXT3 row payload into the active output buffer rather than another generic codec wrapper.","objdump + caller inspection + local disassembly + surface-family correlation + DXT3-correlation + decode-materialization correlation"
0x00542550,786,surface_owner_capability_gated_postprocess_non_type2_rows_into_live_16bit_buffers,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Capability-gated row postprocess owner in the same surface family. When shell capability byte `[0x006d4024+0x11422d]` is live and owner byte `[this+0x95]` has not already latched, the helper walks the active row slots, skips type-`2` rows and rows whose processed byte `[row+0x21]` is already set, forces RGBA materialization through `surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row` `0x00541970`, marks the row processed, seeds row state `[row+0x1c] = 0x3c`, discards the previous live 16-bit buffer `[row+0x2a]`, allocates a replacement destination, and then rebuilds `[row+0x22/+0x2a]` from a float-heavy neighbor-difference transform over the RGBA source. For rows whose pixel-size tag `[row+0x10]` equals `0x20`, it halves the stored byte count `[row+0x04]` after the rebuild. Current grounded caller is the world-presentation template seeder `0x005356e0`, which revisits the earlier overlay slot series and runs this helper after clearing byte `[slot+0x05]`, so this is the safest current read for the capability-gated postprocess over non-type-`2` rows rather than a generic buffer conversion.","objdump + caller inspection + local disassembly + surface-family correlation + processed-row correlation + neighbor-difference correlation"
0x00542870,69,surface_owner_release_all_row_slots_0xa0,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Compact full-slot release helper in the same surface-owner family. The function walks all eight row slots `[this+0xa0..+0xbc]`, and for each live slot decrements active-count byte `[this+0x04]`, releases the row through `0x00540f60`, clears companion byte `[this+0x98 + slot]`, and nulls the stored row pointer. Current grounded caller is the broader release owner `surface_owner_release_helpers_unlink_global_entry_and_drop_row_slots` `0x00542c90`, which uses this after unlinking the global owner entry, so this is the safest current read for releasing all row slots rather than a generic loop body.","objdump + caller inspection + local disassembly + surface-family correlation + full-slot-release correlation"
0x005428c0,607,surface_row_encode_active_pixels_and_write_tagged_records_to_open_stream,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Broader file-write owner in the same import/export surface seam. The helper allocates one alpha-sized plane and one `3 * width * height` RGB plane from the active row dimensions, splits current backing pixels `[row+0x26]` into those temporary buffers, seeds a stack image/codec object, and then writes several tagged records into the already-open stream passed by the caller. The current grounded split is structural: when the caller requests the transformed path it forwards the temporary planes through `0x00553000` before writing the tagged records `0xbaba`, `0xbabb`, and `0xbabe`; otherwise it writes the raw split buffers and the same trailing tag family directly. It frees the temporary planes before returning. Current grounded caller is `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50`, which opens the destination path in `a+b` mode and forwards the resulting stream here, so this is the safest current read for encoding the active surface row and writing tagged records to the open stream rather than a generic image copy helper.","objdump + caller inspection + local disassembly + surface-family correlation + tagged-record correlation + open-stream correlation"
0x00542b30,208,surface_owner_write_first_row_rgba_payload_with_0x12_byte_header_to_named_file,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Direct file-write sibling to `surface_owner_open_named_resource_and_dispatch_row_type_import` `0x00542f50` in the same preview-surface seam. The helper opens one caller-supplied path in `wb` mode, builds a compact `0x12`-byte header on the stack with row type `2`, the first-row width and height, fixed pixel-size byte `0x20`, and one optional flag bit `0x20` when the second caller argument is nonzero, then optionally forces RGBA materialization through `surface_owner_query_or_materialize_rgba_buffer_from_active_16bit_row` `0x00541970` and writes the first-row RGBA payload `[row+0x26]` plus the header to the open stream. Current grounded callers are the paired export-side branches at `0x00520cda`, `0x00520f61`, and `0x00534dd6`, each of which uses this as the direct-file alternative to `0x00542f50` before releasing the temporary surface owner through `0x00542c90 + 0x0053b080`, so this is the safest current read for writing the first row plus its `0x12`-byte header to a named file rather than a generic save helper.","objdump + caller inspection + local disassembly + surface-family correlation + direct-file-write correlation"
0x00542c10,114,shell_release_active_global_layout_cache_entries,shell,cdecl,inferred,objdump + caller inspection + local disassembly,2,"Global cache-release sweep in the shell layout-state family. The helper walks the linked list rooted at `0x00ccbb2c`, and for every active entry `[entry+0x07]` releases optional handles `[entry+0xc0]` and `[entry+0xc8]` through vtable slot `+0x08`, refreshes controller-side cached field `[0x006d4024+0x1136ad]` through `0x0051f990`, clears sibling bookkeeping dwords `[entry+0xcc/+0xd0/+0xd4]`, decrements active-count global `0x00ccbb34`, and resets `[entry+0x07]` back to `0`. Current grounded callers are the small and broad layout-state release bodies `0x0055dd80` and `0x0055e060`, so this is the safest current read for releasing the active global layout-cache entries rather than a generic list walk.","objdump + caller inspection + local disassembly + layout-state correlation + global-cache correlation"
0x00542c90,177,surface_owner_release_helpers_unlink_global_entry_and_drop_row_slots,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Primary release body for the same global surface-owner family. The helper releases optional companion helpers `[this+0xdc]` and `[this+0xe4]` through `0x005571d0 + 0x0053b080`, clears sibling field `[this+0xe0]`, unlinks the owner from the intrusive global list rooted at `0x00ccbb2c`, conditionally refreshes the live shell presenter through `0x005271a0` when owner byte `[this+0x93]` is set, re-enters `0x00541780` to drop any active selector-side handle, re-enters `surface_owner_release_all_row_slots_0xa0` `0x00542870`, and finally clears `[this+0x07]` plus `[this+0xc0]`. Current grounded callers include the save-side temporary preview helper `0x00442740`, the world-presentation slot-release strips `0x00532760/0x00532b30/0x00534f80`, and the shell overlay release path `0x0047b320`, so this is the safest current read for releasing helper objects, unlinking the global surface-owner entry, and dropping the row slots rather than a generic destructor stub.","objdump + caller inspection + local disassembly + surface-family correlation + global-list correlation + row-slot-release correlation"
0x00542f50,95,surface_owner_open_named_resource_and_dispatch_row_type_import,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Named-resource import dispatcher in the same temporary-surface and cached-surface family used by the setup/save preview helpers. The function takes one caller path seed, opens or resolves the matching resource file through the neighboring file-open strip, forwards the result into `0x005428c0`, and then dispatches the imported row by embedded type dword `[row+0x18]`: current grounded branches are type `2 -> 0x00542d50`, type `3 -> 0x00542030`, and type `4 -> 0x00541c30`, with the fallback returning `2`. Current grounded caller is `shell_build_temp_surface_from_payload_preview_pixels_and_query_named_resource_field_0x46` `0x00442740`, which uses the returned dword as payload field `[record+0x18]`, so this is the safest current read for the named-resource open-and-import dispatcher rather than a generic file helper.","objdump + caller inspection + local disassembly + surface-family correlation + row-type-dispatch correlation"
0x00542fb0,64,surface_owner_dispatch_row_import_by_embedded_type,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Small row-type selector beneath the same import seam. The helper reads embedded row type dword `[row+0x18]` and dispatches type `2` to `surface_row_import_dds_dxt3_payload_and_optionally_materialize_buffer` `0x00542d50`, type `3` to `surface_row_import_headered_rgb_or_paletted_payload_to_rgba_buffer` `0x00542030`, and type `4` to `surface_row_import_tagged_baba_babb_babe_payload_to_rgba_buffer` `0x00541c30`, returning `2` on the unsupported fallback path. Current grounded caller is the temporary-slot wrapper `0x00543000`, so this is the safest current read for the embedded row-type import selector rather than another file-open helper.","objdump + caller inspection + local disassembly + surface-family correlation + row-type-dispatch correlation"
0x00543000,128,surface_owner_allocate_temp_row_slot_dispatch_import_and_release_on_failure,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,1,"Temporary-slot import wrapper in the same surface-owner family. The helper clears selector field `[this+0x07]`, allocates one fresh slot through `surface_owner_allocate_first_free_row_slot_0xa0_and_seed_dimensions_and_type` `0x00541b10`, dispatches the newly allocated row through `surface_owner_dispatch_row_import_by_embedded_type` `0x00542fb0`, releases the slot again through `0x00541ba0` when the import result is `1` or `2`, and then refreshes cached byte totals and row state through `0x00540fc0` before returning the import status. Current grounded callers are the higher surface-owner service strip immediately above `0x00543080`, so this is the safest current read for allocating a temporary row slot, dispatching the type-specific import, and releasing it on failure rather than a broader constructor.","objdump + caller inspection + local disassembly + surface-family correlation + temp-slot-import correlation"
0x005438d0,173,surface_owner_commit_backing_rgba_buffer_recompute_size_and_republish,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Commit-side publish helper in the same `0xec`-byte RGBA surface-owner family used by `0x00543980`. When the caller supplies a nonnull backing buffer, the helper replaces existing row buffer `[row+0x26]`, freeing the old buffer when it differs. It then resets state byte `[row+0x20]` to `0`, restores state dword `[row+0x1c] = 0x15`, mirrors active backing pointer into `[row+0x22]`, recomputes byte size `[row+0x04] = width * height * 4` from `[row+0x08/+0x0c]`, re-enters `0x00541210`, publishes through `0x005435d0`, and finally clears owner dwords `[this+0xcc/+0xd0]`. Current grounded callers are the surface constructor `0x00543980`, the cached world-presentation surface strip at `0x00532460/0x00534af0`, and the shell overlay raster wrappers `0x0047b3d0/0x0047b470`, so this is the safest current read for committing the active RGBA backing buffer and republishing the live surface row rather than a generic free helper.","objdump + caller inspection + local disassembly + surface-family correlation + republish correlation"
0x00543980,131,surface_owner_init_or_ensure_rgba_surface_from_pixels_dims_and_mode,shell,thiscall,inferred,objdump + caller inspection + local disassembly + surface-family correlation,2,"Constructor or ensure helper for the `0xec`-byte RGBA surface-owner family. The function takes an optional caller pixel buffer, width, height, and one extra mode or flag argument. When the pixel buffer is null it allocates `width * height * 4` bytes itself, then re-enters `0x00540e30`, copies the fixed owner label at `0x005dd924` into `[this+0x13]`, and on first use seeds local bytes `[this+0x94] = 1` and `[this+0x96] = 0`, allocates one slot row through `0x00541b10(width, height, 3)`, and commits the active backing pixels through `0x005438d0`. It finishes by re-entering `0x00540fc0`, clears byte `[this+0x05]`, and returns `this`. Current grounded callers include the save-side temporary preview helper `0x00442740`, the world-presentation cached-surface owners `0x005323f0/0x00535100/0x00535430`, and the shell overlay ensure-surface owner `0x0047b470`, so this is the safest current read for initializing or ensuring one RGBA surface owner from caller pixels and dimensions rather than a world-only allocator.","objdump + caller inspection + local disassembly + surface-family correlation + first-use-slot-allocation correlation"
0x005454c0,82,layout_state_snapshot_current_slot_triplet_table_into_history_list_0x259f,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared slot-table snapshot helper in the broader layout-state presentation family. The function allocates one temporary copy of the current `0x18`-byte-per-slot triplet table `[this+0x2597]`, copies the whole live slot table into that buffer, and then appends the copied buffer into the history-style list rooted at `[this+0x259f]` through `0x00556e10`. Current grounded callers are the tightly clustered probe-side branches `0x0055de10..0x0055df9f`, so this is the safest current read for snapshotting the current slot-triplet table into history list `[+0x259f]` rather than a generic allocator wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + slot-triplet correlation + history-list correlation"
0x00545520,179,layout_state_set_optional_item_binding_in_slot_table_0x2593,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared optional-binding setter over slot table `[this+0x2593]` in the broader layout-state presentation family. When the requested slot index is in range, the helper compares the incoming item pointer against the current slot binding. For nonnull items it first checks item dword `[item+0x07]` against the current shell-side mode token `[0x006d4024+0x114222]`; mismatches are normalized through `0x005435d0(item, [this+0x25df], 0)` before the final bind. Effective changes then publish node property slot `+0xf4` on `[this+0x25df]`, using the derived item-side dword returned from `0x00541bf0` for nonnull bindings or `0` for clears, incrementing local change counter `[this+0x370d]` and mirroring the final pointer back into `[this+0x2593 + slot*4]`. Current grounded callers include the nearby-presentation and layout-state refresh strips `0x005243eb`, `0x0052876a`, `0x00548a24`, and many sibling presentation owners, so this is the safest current read for the optional per-slot item-binding publisher rather than a generic list write.","objdump + caller inspection + local disassembly + layout-state correlation + slot-binding correlation"
0x005455e0,224,layout_state_set_slot_triplet_lo,bootstrap,thiscall,inferred,ghidra-headless,4,Updates the first three cached per-slot presentation scalars in the 24-byte slot table at [this+0x2597+slot*24]. In notify mode it compares against the cached values and forwards only changed fields into the bound presentation node through vtable slot +0xfc with subproperty ids 1 through 3.,ghidra + rizin + llvm-objdump
0x005456d0,240,layout_state_set_slot_triplet_hi,bootstrap,thiscall,inferred,ghidra-headless,4,Updates the second three cached per-slot presentation scalars in the same 24-byte slot table at [this+0x2597+slot*24]. In notify mode it compares against the cached values and forwards only changed fields into the bound presentation node through vtable slot +0xfc with subproperty ids 4 through 6.,ghidra + rizin + llvm-objdump
0x005458f0,169,layout_state_read_segment_record_window,bootstrap,thiscall,inferred,ghidra-headless,4,Gates the 32-byte segment-record table at [this+0x2643]; queries record bounds then copies a start-to-end or wrapped window into scratch storage at [this+0x2657] through vtable slot +0x2c while toggling byte flag [this+0x254e]. The downstream shell path treats each 0x20-byte record as two vec3 blocks plus two trailing scalars.,ghidra + rizin
@ -1862,23 +2065,286 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x00545b10,57,layout_state_read_vertex24_block,bootstrap,thiscall,inferred,ghidra-headless,4,Reads one 24-byte-indexed vertex block from the presentation table at [this+0x2647] through vtable slot +0x2c using index*24 addressing and returns the copied pointer through a stack outparam. The downstream shell emitter treats each record as vec3 plus a style dword plus two trailing scalars.,ghidra + rizin
0x00545b50,59,layout_state_read_vertex24_window,bootstrap,thiscall,inferred,ghidra-headless,4,Copies a window between two 24-byte vertex indices from [this+0x2647] into scratch storage at [this+0x2657] through vtable slot +0x2c using index*24 addressing and a fixed 0x1800-byte transfer span. The downstream shell emitter treats each record as vec3 plus a style dword plus two trailing scalars.,ghidra + rizin
0x00545c50,67,layout_state_commit_vertex24_span,bootstrap,thiscall,inferred,ghidra-headless,4,Converts a start and end vertex index range into a triplet count by dividing the delta by three accumulates that count at [this+0x3711] and notifies the bound presentation node at [this+0x25df] through vtable slot +0x118 with primitive-type argument 4.,ghidra + rizin
0x00545e30,1657,layout_state_query_external_report_and_build_summary_text_0x43c,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader report-summary owner in the layout-state family beneath the release and capability-gated property strip. The helper first queries one external/provider object through `0x0058bc36`; when that lookup fails it formats localized id `0x73` directly into summary buffer `[this+0x43c]` and returns success. On the live path it fetches one capability-style report through vtable slot `+0x10`, clears summary buffer `[this+0x43c]`, and then appends a sequence of localized fragments `0x74..0x7d`, fixed format strings such as `%1(16-bit HW) ` and `%1(8-bit HW) `, and several numeric fields from the returned report before returning. Current grounded caller is the broader setup-side layout-state owner branch `0x0054a12b`, so this is the safest current read for querying the external report and building summary text buffer `0x43c` rather than a generic string formatter.","objdump + caller inspection + local disassembly + layout-state correlation + summary-buffer correlation + external-report correlation"
0x005464d0,105,layout_state_run_four_pass_bound_node_reset_strip,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small four-pass bound-node reset strip in the layout-state family. The helper re-enters node slot `+0x88`, then publishes fixed selector/value pairs through node slot `+0x90` and finally clears slot `+0x3c`, repeating that sequence four times against bound presentation node `[this+0x25df]`. Current grounded caller is the same broader owner strip that invokes `0x00545e30` and then selects shell mode `4` or `5`, so this is the safest current read for the repeated bound-node reset strip rather than a generic loop body.","objdump + caller inspection + local disassembly + layout-state correlation + bound-node correlation"
0x00546540,19,layout_state_set_property_0x17_to_7,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny fixed property setter over the bound presentation node `[this+0x25df]`. The helper simply publishes value `7` into property `0x17`. Current grounded caller is `0x0052cb68`, so this is the safest current read for setting property `0x17` to `7` rather than a broader mode switch.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation"
0x00546560,19,layout_state_set_property_0x17_to_4,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small sibling to `0x00546540` in the same layout-state family. The helper simply publishes value `4` into property `0x17` on bound node `[this+0x25df]`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00546580,19,layout_state_clear_property_0xa8,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny property-clear helper over bound presentation node `[this+0x25df]`. The function publishes `0` into property `0xa8`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x005465a0,19,layout_state_set_property_0xa8_to_0x0f,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small fixed property setter beside `0x00546580` in the same layout-state family. The helper publishes value `0x0f` into property `0xa8` on bound node `[this+0x25df]`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00546a30,333,layout_state_rebuild_variant_asset_cache,bootstrap,thiscall,inferred,ghidra-headless,3,Releases any loaded entries in the 64-slot presentation asset bank rooted at 0x31ab then rebuilds the paired-key metadata table at 0x266b tracking active entries count at [this+0x2667] and sibling or reuse links for later keyed lookups.,ghidra + rizin
0x005467a0,50,layout_state_enable_presentation_gate,bootstrap,thiscall,inferred,ghidra-headless,4,Ensures the presentation node gate property 0x1c is enabled once for the layout state when the template flag at [[this+0x83c]+0x2e] permits it by setting [this+0x2549] and forwarding the toggle into the node at [this+0x25df].,ghidra + rizin
0x005467e0,41,layout_state_disable_presentation_gate,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Clear-side sibling to `0x005467a0` in the same layout-state family. When local gate byte `[this+0x2549]` is live, the helper clears that byte and publishes `0` into property `0x1c` on bound node `[this+0x25df]`.","objdump + local disassembly + layout-state correlation + presentation-gate correlation"
0x00546810,67,layout_state_raise_property_0x16_to_3_when_template_flag_0x1c_permits,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Template-gated property raiser in the layout-state family. When local mode byte `[this+0x254a]` is not already `2` and template byte `[[this+0x83c]+0x1c]` is nonzero, the helper publishes value `3` into property `0x16` on bound node `[this+0x25df]` and stores mode byte `[this+0x254a] = 2`.","objdump + local disassembly + layout-state correlation + template-gate correlation + property-strip correlation"
0x00546850,30,layout_state_set_property_0x16_to_2_and_store_mode1,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small sibling to `0x00546810` in the same layout-state family. The helper publishes value `2` into property `0x16` on bound node `[this+0x25df]` and stores mode byte `[this+0x254a] = 1`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x00546890,41,layout_state_clear_property_0x16_and_reset_mode_byte_0x254a,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Clear-side sibling to `0x00546810/0x00546850` in the same layout-state family. When local mode byte `[this+0x254a]` is nonzero, the helper publishes value `1` into property `0x16` on bound node `[this+0x25df]` and resets `[this+0x254a]` back to `0`.","objdump + local disassembly + layout-state correlation + property-strip correlation"
0x005463e0,149,layout_state_release_midband_bound_handles_with_notice_0x9b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Midband handle-release strip in the layout-state family. The helper walks a five-handle band rooted at `[this+0x260f]`, `[this+0x2617]`, `[this+0x261f]`, `[this+0x2627]`, and `[this+0x262f]`, releasing each live entry through vtable slot `+0x08`, clearing the corresponding field back to `0`, and emitting localized notice `0x9b` when the release reports success. Current grounded callers are the repeated layout-state owner branches `0x00549f1c..0x0054a1c2`, including the broader bound-presentation release body `0x0054a190`, so this is the safest current read for the midband bound-handle cleanup strip rather than a generic field reset.","objdump + caller inspection + local disassembly + layout-state correlation + handle-band correlation"
0x005465c0,284,layout_state_release_variant_bank_and_late_bound_handles_with_notice_0x9b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Late cleanup strip in the layout-state family beneath the broader bound-presentation release path. The helper first walks the 64-entry variant-bank table rooted at `[this+0x31ab]`, releasing every live entry through vtable slot `+0x08` with localized notice `0x9b` on successful release, then performs the same release-and-clear pattern on the later bound-handle band `[this+0x263f/+0x2643/+0x264f/+0x265b/+0x265f/+0x2663]`. Current grounded caller is the broader bound-presentation release body `0x0054a190`, so this is the safest current read for releasing the variant bank and late bound handles rather than a generic array clear.","objdump + caller inspection + local disassembly + layout-state correlation + variant-bank correlation + handle-band correlation"
0x00546d40,712,layout_state_publish_transform_descriptor_from_local_scalars_and_seeded_handle_0x36fd,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader descriptor-publish helper in the layout-state family. The helper builds one large stack descriptor from local scalar bands `[this+0x2517/+0x251b/+0x251f/+0x25f7/+0x25ff]`, scale factors `[this+0x24f0/+0x24f8]`, the seeded handle `[this+0x36fd]`, and a local side buffer at `[this+0x35af]`, then forwards that descriptor into the bound presentation node `[this+0x25df]`. Current grounded caller is the three-slot batch owner `0x0054ab20`, so this is the safest current read for publishing one transform-style descriptor from local scalars and seeded handle `0x36fd` rather than a generic math helper.","objdump + caller inspection + local disassembly + layout-state correlation + descriptor-publish correlation"
0x005471f0,176,layout_state_bind_table_0x112_or_0x142_and_optionally_publish_property_0x154,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Generalized table-bind helper in the layout-state family beneath the local `0x2643/0x2647/0x264f` wrapper strip. When the caller-supplied table pointer differs from cached field `[this+0x2637]`, the helper binds that table onto the bound presentation node `[this+0x25df]`, choosing property `0x112` for `0x20`-byte records or property `0x142` for `0x18`-byte records through node slots `+0x130/+0x14c`, then caches the new table pointer. It also optionally forwards one caller dword through node slot `+0x154` and mirrors that value into `[this+0x263b]`. Current grounded callers are the small wrappers `0x0054bbd0` and `0x0054bbf0`, so this is the safest current read for the shared table-bind plus optional property-`0x154` publish helper rather than a single table-specific owner.","objdump + caller inspection + local disassembly + layout-state correlation + table-bind correlation + bound-node correlation"
0x005472a0,20,layout_state_clear_property_0x1b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny property-clear helper over the bound presentation node `[this+0x25df]`. The function simply publishes `0` into property group `0x1b` through node slot `+0xc8`. Current grounded callers include layout-state owner branches `0x0052888d`, `0x0052b93b`, `0x0052bebc`, `0x0052caf4`, `0x00564d58`, and `0x0056507e`, so this is the safest current read for clearing property `0x1b` rather than a broader state reset.","objdump + caller inspection + local disassembly + layout-state correlation + property-strip correlation"
0x00547300,31,layout_state_publish_property_0x1b_from_template_flag_bit0,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small property publisher beside `0x005472a0` in the same layout-state family. The helper reads template byte bit `0` from `[[this+0x83c]+0x21]` and forwards that one-bit value into property group `0x1b` on the bound presentation node `[this+0x25df]` through node slot `+0xc8`. Current grounded callers include layout-state owners `0x00524c3c`, `0x0052889d`, `0x005289a0`, `0x0052ae55`, `0x0052b89c`, `0x0052cb4e`, and later shell-side presentation branches, so this is the safest current read for publishing property `0x1b` from the template bit rather than a generic flag copy.","objdump + caller inspection + local disassembly + layout-state correlation + template-flag correlation + property-strip correlation"
0x00547320,96,layout_state_apply_capability_gated_property_0x0f_0x18_0x19_strip,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Capability-gated three-property strip in the layout-state family. When shell capability byte `[0x006d4024+0x114252]` is live, the helper publishes `1` into property `0x0f`, forwards the caller dword into property `0x18`, and then publishes fixed value `7` into property `0x19` on the bound node `[this+0x25df]`. Current grounded callers include layout-state owners `0x005243c1`, `0x00524cc9`, `0x0052873c`, `0x00529995`, `0x0052a1c9`, `0x0052a50c`, `0x0052ae5f`, `0x0052b8a6`, `0x0052c824`, and later shell-side branches, so this is the safest current read for the capability-gated `0x0f/0x18/0x19` property strip rather than an isolated scalar setter.","objdump + caller inspection + local disassembly + layout-state correlation + capability-gate correlation + property-strip correlation"
0x00547380,64,layout_state_clear_capability_gated_property_0x0f_0x18_strip,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small clear-side sibling to `0x00547320` in the same layout-state family. When capability byte `[0x006d4024+0x114252]` is live, the helper clears property `0x0f` and property `0x18` on the bound node `[this+0x25df]` by publishing zero into both groups. Current grounded callers include layout-state owner branches `0x00528895` and `0x0052b940`, so this is the safest current read for clearing the capability-gated `0x0f/0x18` strip rather than a generic branch reset.","objdump + caller inspection + local disassembly + layout-state correlation + capability-gate correlation + property-strip correlation"
0x00547610,48,layout_state_publish_bound_node_pair_0x2607_0x260b_once,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small one-shot publisher over the bound presentation node `[this+0x25df]` in the layout-state family. When local gate byte `[this+0x254c]` is still clear, the helper forwards dwords `[this+0x2607]` and `[this+0x260b]` into node vtable slot `+0x7c`, then marks the gate byte live. Current grounded callers are the setup-side owner `0x0052c032`, the small and broad release bodies `0x0055dd57/0x0055dd87/0x0055e07b`, and sibling rebuild paths such as `0x0052cc7d` and `0x0055e978`, so this is the safest current read for publishing the cached bound-node pair once rather than a generic setter.","objdump + caller inspection + local disassembly + layout-state correlation + bound-node correlation"
0x00547640,7,layout_state_clear_bound_node_pair_0x2607_0x260b_publish_gate,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny gate-clear sibling to `0x00547610` in the same layout-state family. The helper only resets byte `[this+0x254c]` back to `0`, allowing the next `0x00547610` call to republish dwords `[this+0x2607/+0x260b]` into the bound node. Current grounded callers are nearby presentation owners such as `0x0052bc20` and `0x0052bdd3`, so this is the safest current read for clearing the one-shot publish gate rather than a broader state reset.","objdump + caller inspection + local disassembly + layout-state correlation + publish-gate correlation"
0x00547650,578,layout_state_apply_capability_gated_presentation_property_strip_and_bind_aux_handles,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Capability-gated presentation property owner over the bound node `[this+0x25df]` in the layout-state family. When shell capability byte `[0x006d4024+0x11422d]` is live, the helper seeds one fixed property strip through repeated node slot `+0xfc` writes over property groups `0x0b`, `0x18`, `0x0d`, and `0x0e`, then binds auxiliary handles `[this+0x2623]` and `[this+0x2633]` through node slots `+0x130` and `+0x160`. When the first gate is clear but capability byte `[0x006d4024+0x114250]` is live, it instead builds one stack descriptor rooted at local handle `[this+0x36fd]`, publishes that block through node slot `+0x94` on property `0x11`, and then applies the reduced `0x0d/0x0e` property pair. Both branches finish by clearing the `0x0d/0x0e` property lane for selector `3`. Current grounded callers are the neighboring layout-state owner paths `0x0054abd1`, `0x0054b0e1`, and `0x0054b5de`, so this is the safest current read for the capability-gated presentation property strip and auxiliary-handle bind rather than a small scalar setter.","objdump + caller inspection + local disassembly + layout-state correlation + capability-gate correlation + bound-node correlation"
0x005478a0,680,layout_state_apply_trig_derived_presentation_property_strip_and_bind_aux_handles_0x261b_0x262b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Alternate property-strip sibling to `0x00547650` in the same layout-state family. After one external timing or state query, the helper applies the same initial `0x0b/0x18` property band on the bound node `[this+0x25df]`, then publishes trig-derived scalar pairs into property groups `0x07..0x0a` for selectors `2` and `3`, sets both `0x0d/0x0e` groups for selector `2`, clears those groups for selector `3`, and finally binds auxiliary handles `[this+0x261b]` and `[this+0x262b]` through node slots `+0x130` and `+0x160`. Current grounded callers are the batch owners `0x0054abca` and `0x0054b0da`, so this is the safest current read for the trig-derived alternate property strip rather than a generic sine-cosine helper.","objdump + caller inspection + local disassembly + layout-state correlation + trig-strip correlation + bound-node correlation"
0x00547c30,224,layout_state_store_four_local_scalars_0x36df_0x36eb_and_publish_property_0x07_block,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared four-scalar publisher beneath the trig-derived layout-state strip. The helper stores four caller dwords into local scalar fields `[this+0x36df/+0x36e3/+0x36e7/+0x36eb]`, validates them against the zero-threshold path, and then publishes either one identity-like `(0,0,1,1)` block or one block using the negated first pair plus the unmodified second pair into property group `0x07` on the bound presentation node `[this+0x25df]` through node slot `+0x13c` with notify flag `1`. Current grounded callers are the neighboring owner branches `0x0052c701` and `0x0052c77e`, so this is the safest current read for storing the local four-scalar band and publishing the derived property-`0x07` block rather than a generic math helper.","objdump + caller inspection + local disassembly + layout-state correlation + four-scalar correlation + property-strip correlation"
0x00547d10,288,layout_state_apply_presentation_extents4,bootstrap,thiscall,inferred,ghidra-headless,4,Applies a four-float extent or quad block onto presentation property 0x18 for the bound node at [this+0x25df]. If all four inputs are nonpositive it clears the property through vtable slot +0xfc; otherwise it builds a 0x10-field stack block with the four caller values and a unit scalar then commits it through node slots +0xfc and +0x94.,ghidra + rizin + llvm-objdump
0x00547f20,177,layout_state_apply_gamma_ramp_scalar,bootstrap,thiscall,inferred,ghidra-headless,4,Builds a 256-entry three-channel gamma-ramp buffer from the caller scalar and uploads it through vtable slot +0x48 on the bound presentation node at [this+0x25df]. The helper clamps each 16-bit ramp entry stores the accepted scalar in the subordinate state block at [[this+0x83c]+0x2f] and respects shell capability guards under 0x006d4024 before touching the display device.,ghidra + rizin + llvm-objdump
0x00548030,43,layout_state_publish_property_pair_0x13_0x14_as_1_6,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny property-pair setter in the layout-state family. The helper publishes value `1` into property `0x13` and value `6` into property `0x14` on the bound presentation node `[this+0x25df]`. Current grounded caller is the neighboring owner branch `0x0052b8ae`, so this is the safest current read for the fixed `0x13/0x14 = 1/6` publish pair rather than a broader mode switch.","objdump + caller inspection + local disassembly + layout-state correlation + property-pair correlation"
0x00548060,43,layout_state_publish_property_pair_0x13_0x14_as_5_6,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small sibling to `0x00548030` in the same layout-state family. The helper publishes value `5` into property `0x13` and value `6` into property `0x14` on the bound presentation node `[this+0x25df]`. Current grounded caller is the neighboring owner branch `0x0052b91c`, so this is the safest current read for the fixed `0x13/0x14 = 5/6` publish pair rather than a generic wrapper.","objdump + caller inspection + local disassembly + layout-state correlation + property-pair correlation"
0x00548120,92,layout_state_reset_local_descriptor_identity_ensure_fallback_block_0x25e3_and_refresh_current_span,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small rect-strip owner in the layout-state family. The helper resets local descriptor `[this+0x34ef]` to identity through `0x00544360`, lazily allocates fallback block `[this+0x25e3]` and registers it on the bound node `[this+0x25df]` through slot `+0xa4`, then refreshes the sibling local descriptor `[this+0x352f]` from the current integer span pair `[this+0x25c7/+0x25cb]` by tail-calling `0x00544290`. Current grounded caller is `shell_commit_layout_updates` `0x00523d90`, so this is the safest current read for the identity-reset plus fallback-block ensure path rather than a generic constructor fragment.","objdump + caller inspection + local disassembly + layout-state correlation + rect-strip correlation"
0x00548180,350,layout_state_store_normalized_local_rect_0x2523_0x252f_publish_dynamic_or_fallback_block_and_refresh_span,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader rect update owner immediately above `0x00548120` in the same layout-state family. The helper lazily allocates fallback block `[this+0x25e3]`, stores four normalized local rect scalars into `[this+0x2523/+0x2527/+0x252b/+0x252f]` from the caller's integer rectangle corners and current span pair `[this+0x25c7/+0x25cb]`, publishes either that derived dynamic block through node slot `+0xa0` or the fallback block when the rectangle is too small, and then refreshes sibling descriptor `[this+0x352f]` by re-entering `0x00544290` with the resulting width and height deltas. Current grounded caller is the neighboring bridge `0x005482e0`, so this is the safest current read for storing the normalized local rect, publishing the dynamic-or-fallback block, and refreshing the current span rather than a generic rectangle math helper.","objdump + caller inspection + local disassembly + layout-state correlation + rect-strip correlation + fallback-block correlation"
0x005482e0,109,layout_state_apply_display_rect_or_delta_span_from_controller_normalized_scalars,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Bridge between the embedded view-controller scalar band and the layout-state rect-strip owners. The helper first materializes one active-display rectangle from controller scalar band `[controller+0x50..+0x5c]` through `embedded_view_controller_materialize_active_display_rect_from_normalized_scalars_0x50_0x5c` `0x0052d4d0`; when that resolved rectangle is nondegenerate it forwards the four corners into `0x00548180`, and otherwise it computes simple width and height deltas and refreshes descriptor `[this+0x352f]` directly through `0x00544290`. Current grounded callers are shell presentation branches `0x0052c108` and `0x0052ccd8`, so this is the safest current read for applying a controller-derived display rect or fallback delta span into the layout-state family rather than a generic clamp helper.","objdump + caller inspection + local disassembly + layout-state correlation + controller-bridge correlation + rect-strip correlation"
0x00548820,116,layout_state_seed_all_slot_triplets_to_1_2_1_pattern,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,1,"Small slot-table seed helper in the broader layout-state presentation family. The function walks every live slot in `[this+0x2597]` and writes the same six-scalar pattern into both triplet halves of each `0x18`-byte slot record: `(1, 2, 1)` at `+0x00/+0x04/+0x08` and again at `+0x0c/+0x10/+0x14`. Current grounded caller is the capability-side `TextureForTests` probe strip at `0x0055dfaa`, so this is the safest current read for seeding all slot triplets to the fixed `1,2,1` pattern rather than a general reset helper.","objdump + caller inspection + local disassembly + layout-state correlation + slot-triplet correlation"
0x005488a0,157,layout_state_snapshot_current_slot_triplet_table_into_seeded_list_and_optionally_apply,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared slot-table snapshot helper in the broader layout-state presentation family. The function allocates one temporary copy of the current `0x18`-byte-per-slot triplet table `[this+0x2597]`, pushes that copied table into the seeded-record list rooted at `[this+0x259b]` through `0x00557150`, and, when the caller requests it, immediately re-applies the copied low and high triplet halves to every live destination slot through `0x005455e0` and `0x005456d0` with notify flag `1`. Current grounded callers include several nearby-presentation builders `0x00524393`, `0x00524cca`, `0x005288ec`, `0x00528a20`, the broader probe path `0x00548a3b`, and later sibling presentation owners, so this is the safest current read for snapshotting the current slot-triplet table into the seeded list with an optional immediate re-apply rather than a generic memcpy helper.","objdump + caller inspection + local disassembly + layout-state correlation + seeded-list correlation + slot-triplet correlation"
0x005489f0,237,layout_state_run_texture_for_tests_binding_probe,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly + rdata string decode,2,"Capability-style probe owner in the broader layout-state presentation family. The helper allocates one temporary payload from literal `TextureForTests` through `0x0053c1c0(0, 0, 0x7f)`, binds that payload across every live optional item slot through `0x00545520`, snapshots or reapplies the current slot-triplet state through `0x005488a0`, queries the bound presentation node at `[this+0x25df]` through vtable slot `+0x100`, re-applies the first seeded slot-triplet pair through `0x00548940(1)`, clears the live optional slot bindings back to null through `0x00545520`, releases the temporary payload through `0x0053c000`, and returns the resulting boolean-like probe outcome. Current grounded callers are the later capability-setting branch `0x0055dfc1/0x0055dfe0/0x0055e004/0x0055e047`, which mirror that result into shell capability bytes `[0x006d4024+0x114250/+0x114251]`, so this is the safest current read for the `TextureForTests` binding probe rather than a generic presentation refresh owner.","objdump + caller inspection + local disassembly + rdata string decode + layout-state correlation + capability-probe correlation"
0x00548940,167,layout_state_apply_first_n_seeded_slot_triplet_pairs_from_list_0x259b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Shared slot-triplet apply helper over the seeded record list rooted at `[this+0x259b]` in the broader layout-state presentation family. The function clamps the caller-requested record count against list count `[[this+0x259b]+0x0c]`, iterates that many seeded `0x18`-byte records through `0x00556e50`, and for each destination slot index writes the first and second triplet blocks into the cached slot table `[this+0x2597]` through `0x005455e0` and `0x005456d0` with notify flag `1`. After the pass it releases the temporary seeded-list cursor through `0x005a1145`. Current grounded callers include the nearby-presentation sweeps `0x00524521`, `0x00524e32`, `0x00529998`, the broader layout-state owner `0x00548a71`, and several sibling presentation rebuild paths, so this is the safest current read for applying the first N seeded slot-triplet pairs from list `[+0x259b]` rather than a generic list walk.","objdump + caller inspection + local disassembly + layout-state correlation + slot-triplet correlation"
0x00548c50,342,layout_state_release_history_seeded_lists_and_clear_optional_slot_bindings,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Pre-release cleanup owner in the layout-state presentation family. When live slot count `[this+0x258f]` is positive, the helper drains and frees every record in the history list `[this+0x259f]` and the seeded-record list `[this+0x259b]`, releases the two list owners themselves, clears both fields back to `0`, and then walks the optional slot-binding table `[this+0x2593]` to publish null bindings through bound-node slot `+0xf4` before zeroing each slot entry. Current grounded caller is the broader bound-presentation release body `0x0054a190`, so this is the safest current read for releasing the history and seeded lists plus clearing optional slot bindings rather than a narrow list helper.","objdump + caller inspection + local disassembly + layout-state correlation + seeded-list correlation + optional-binding correlation"
0x00548da0,1328,layout_state_refresh_presentation_batches,bootstrap,thiscall,inferred,ghidra-headless,4,Walks the active presentation-batch list and refreshes the bound node state for each selected item. The routine applies batch extents through 0x00547d10 pushes style and gate properties including packed color property 0x3c updates per-slot triplets through 0x005455e0 and 0x005456d0 and emits segment-record or vertex24 spans from the current batch family before advancing to the next record.,ghidra + rizin + llvm-objdump
0x005492d0,3747,layout_state_probe_d3d8_capabilities,bootstrap,thiscall,inferred,ghidra-headless,4,Creates a Direct3D8 probe object and walks adapter or device capability queries for the layout-state presentation path. The routine caches probed texture-memory style fields into shell globals under 0x006d4024 including the values later reported as Texture SRAM and Texture VRAM consults the shell memory-budget helpers 0x0051fa40 and 0x0051fa60 refreshes the gamma ramp through 0x00547f20 when needed and assigns a local renderer capability tier at [this+0x04].,ghidra + rizin + llvm-objdump + strings
0x0054a0c0,176,layout_state_bind_external_source_rebuild_summary_reset_bound_node_and_select_mode_4_or_5,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader setup-side owner in the layout-state family above the newly grounded summary and reset strips. The helper binds one caller-supplied external source onto the bound presentation node `[this+0x25df]` through node slot `+0x12c`, falls back to the midband-handle cleanup strip `0x005463e0` when that bind reports failure, conditionally reapplies the cached gamma-ramp scalar from template field `[[this+0x83c]+0x2f]` through `0x00547f20`, seeds optional handle `[this+0x33ab]` through `0x00570fbd`, rebuilds summary buffer `[this+0x43c]` through `0x00545e30`, runs the repeated bound-node reset strip `0x005464d0`, clears local byte `[this+0x254d]`, and finally selects layout-state mode dword `[this+0x04]` as `4` or `5` from shell dimensions `[0x006d4024+0x11423b/+0x11423f]`. Current grounded caller is the surrounding setup-side branch that prepares the subordinate layout state before later property application, so this is the safest current read for binding the external source, rebuilding the summary/reset strip, and selecting mode `4` or `5` rather than a generic constructor fragment.","objdump + caller inspection + local disassembly + layout-state correlation + bound-node correlation + summary-buffer correlation + resolution-tier correlation"
0x0054a190,228,layout_state_release_bound_presentation_handles_and_clear_controller_slot_0x08,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broad bound-presentation release body in the layout-state family. The helper first re-enters `0x00548c50`, then releases optional handles `[this+0x33ab]`, `[this+0x25e3]`, `[this+0x25e7]`, `[this+0x25df]`, and `[this+0x25db]`, emitting shell notices through localized ids `0x9b` or `0x9c` when the bound-node release paths report success. It also re-enters the two adjacent cleanup helpers `0x005463e0` and `0x005465c0`, clears local presentation pointers `[this+0x2643/+0x25df/+0x25db]`, and finally clears shell controller dword `[0x006d4024+0x08]` back to `0`. Current grounded callers are the direct layout-state branches `0x0054bd64` and `0x0054be7f`, so this is the safest current read for releasing the bound presentation handles and controller slot rather than a generic object destructor.","objdump + caller inspection + local disassembly + layout-state correlation + presentation-release correlation"
0x0054a280,626,layout_state_apply_presentation_properties,bootstrap,thiscall,inferred,ghidra-headless,4,Pushes visibility color and mode-dependent scalar properties from the layout state into the bound presentation node at [this+0x25df]; toggles gate property 0x1c writes packed color property 0x22 from bytes 0x2510..0x2512 updates mode properties 0x23 through 0x26 from template flags and caller-supplied scalars and caches the leading scalar at [this+0x25b3].,ghidra + rizin
0x0054a500,1568,layout_state_refresh_variant_bank_batches_from_handle_0x2663_or_local_descriptor_set,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader batch owner in the layout-state family above the newly grounded `0x00547c30` strip. The helper requires active batch count `[this+0x2667]`, clears the local visited-byte strip `[this+0x254f..]`, pulses property groups `0x89` and `0x0e`, derives two normalized shell-scalars from the current shell presentation size through `0x0051f090 -> 0x00533970/0x00533980`, and then branches on midband handle `[this+0x260f]`. On the null-handle path it snapshots the current slot-triplet state through `0x005488a0`, seeds one fixed triplet pair, binds handle `[this+0x2663]` as one `0x18`-byte table on property `0x142`, reads that table through vtable slot `+0x2c`, rescales the resulting rows by local scalar band `[this+0x36df/+0x36e3/+0x36e7/+0x36eb]`, and commits the resulting batch ranges through variant-bank entries `[this+0x31ab + batch*4]` into node slot `+0x11c`. On the live-handle path it instead binds current segment-record handle `[this+0x265b]`, publishes the local descriptor rooted at `[this+0x35af]`, pushes two fixed property blocks `5` and `6`, and then commits the same visited batch ranges. Current grounded caller is the neighboring owner branch `0x0052c73d`, so this is the safest current read for refreshing the variant-bank batches from handle `0x2663` or the local descriptor set rather than a generic layout rebuild body.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + variant-bank correlation"
0x0054ab20,1262,layout_state_refresh_presentation_batches_with_three_slot_binding_candidates,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader batch-refresh owner in the layout-state family with three optional slot-binding candidates. The helper clears the visited-byte strip `[this+0x254f..]`, rebinds current segment-record handle `[this+0x265b]` onto node property `0x112` when needed, chooses between the capability-gated property strips `0x00547650` and `0x005478a0`, applies one descriptor publish through `0x00546d40`, and then walks the active `0x2d`-stride batch records rooted at `[this+0x266f]`. During that walk it compares previous/current/next candidate values, updates optional slot bindings through `0x00545520` for slots `0`, `1`, and `2`, emits batch ranges through variant-bank entry `[this+0x31ab + batch*4]` into node slot `+0x11c`, marks visited batch bytes under `[this+0x254f]`, and follows the per-batch next-link selectors at `+0x267b/+0x2683/+0x2687`. Current grounded callers are the setup-side layout-state owner branches `0x0052c4d6`, `0x0052c50c`, and `0x0052c53d`, so this is the safest current read for the three-slot candidate batch-refresh owner rather than a generic batch loop.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + slot-binding correlation"
0x0054b030,1159,layout_state_refresh_presentation_batches_with_two_slot_binding_candidates,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Two-slot sibling to `0x0054ab20` in the same layout-state batch family. The owner clears the visited-byte strip `[this+0x254f..]`, rebinds current segment-record handle `[this+0x265b]` when needed, chooses between `0x00547650` and `0x005478a0`, and then walks the same `0x2d`-stride batch records rooted at `[this+0x266f]`. Its candidate-comparison and rebinding phase only manages slots `0` and `1` through `0x00545520`, then commits the selected ranges through variant-bank entry `[this+0x31ab + batch*4]` into node slot `+0x11c`, marks visited bytes, and follows the same per-batch next-link selectors. Current grounded callers are the setup-side owner branches `0x0052c578`, `0x0052c5e5`, `0x0052c63c`, and `0x0052cb2f`, so this is the safest current read for the two-slot candidate batch-refresh owner rather than another generic batch loop.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + slot-binding correlation"
0x0054b4e0,1465,layout_state_refresh_handle_0x265f_backed_batches_with_capability_variant_switch,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Capability-switched batch-refresh owner in the same layout-state family. The helper clears the visited-byte strip `[this+0x254f..]`, ensures current segment-record handle `[this+0x265b]` is rebound, applies a capability-gated pre-strip over properties `0x0f`, `0x18`, and `0x1b`, calls `0x00547650`, and then branches on node slot `+0x128` plus capability byte `[0x006d4024+0x114250]` to choose one of two handle-backed descriptor publishes rooted at `[this+0x265f]`. After that it walks the same `0x2d`-stride batch records and commits them through variant-bank entry `[this+0x31ab + batch*4]`, but the candidate-rebinding phase is narrower and only refreshes slot `0` plus the optional slot-`1` clear path. Current grounded callers are the setup-side layout-state owner branches `0x0052c46c` and `0x0052c49a`, so this is the safest current read for the `0x265f`-backed capability-variant batch owner rather than a generic descriptor upload body.","objdump + caller inspection + local disassembly + layout-state correlation + batch-refresh correlation + capability-variant correlation"
0x0054bab0,89,layout_state_bind_segment_record_table,bootstrap,thiscall,inferred,ghidra-headless,4,Binds the current 32-byte segment-record table at [this+0x2643] onto the presentation node if it changed since the last bind. The helper drives node property 0x112 through vtable slots +0x130 and +0x14c with record size 0x20 and clears the local dirty byte at [this+0x263b].,ghidra + rizin + llvm-objdump
0x0054bb10,90,layout_state_bind_alternate_segment_record_table_0x263f,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small sibling to `0x0054bab0` in the same layout-state family. The helper binds alternate `0x20`-byte segment-record table `[this+0x263f]` onto property `0x112` of the bound presentation node `[this+0x25df]` when that table differs from cached field `[this+0x2637]`, then clears local dirty dword `[this+0x263b]`. Current grounded caller is the nearby owner branch `0x00528885`, so this is the safest current read for the alternate segment-record table bind rather than a broader batch owner.","objdump + caller inspection + local disassembly + layout-state correlation + segment-record correlation"
0x0054bb70,90,layout_state_bind_vertex24_table,bootstrap,thiscall,inferred,ghidra-headless,4,Binds the current 24-byte vertex24 table at [this+0x2647] onto the presentation node if it changed since the last bind. The helper drives node property 0x142 through vtable slots +0x130 and +0x14c with record size 0x18 and clears the local dirty byte at [this+0x263b].,ghidra + rizin + llvm-objdump
0x0054bbd0,22,layout_state_bind_vertex24_table_0x264f_and_publish_property_0x154_from_0x2653,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny wrapper into `0x005471f0` in the layout-state family. The helper binds the `0x18`-byte table `[this+0x264f]` onto the bound presentation node and forwards companion dword `[this+0x2653]` through property `0x154`. Current grounded callers are the neighboring owner branches `0x0052b8be` and `0x0052b94b`, so this is the safest current read for the `0x264f/0x2653` bind-and-publish wrapper rather than a generic thunk.","objdump + caller inspection + local disassembly + layout-state correlation + table-bind correlation"
0x0054bbf0,22,layout_state_bind_vertex24_table_0x2647_and_publish_property_0x154_from_0x264b,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Tiny sibling wrapper into `0x005471f0` in the same layout-state family. The helper binds the `0x18`-byte table `[this+0x2647]` onto the bound presentation node and forwards companion dword `[this+0x264b]` through property `0x154`. Current grounded callers are the nearby owner branches `0x0052ae2b` and `0x0054e30b`, so this is the safest current read for the `0x2647/0x264b` bind-and-publish wrapper rather than a generic thunk.","objdump + caller inspection + local disassembly + layout-state correlation + table-bind correlation"
0x0054bc10,592,shell_init_layout_state_defaults,bootstrap,thiscall,inferred,ghidra-headless,4,Initializes the large subordinate layout-state object allocated by 0x0055e2b0; seeds default float and flag fields points [this+0x83c] at a shell-bundle template block near 0x006d4024+0x11468a optionally copies a 0x72c-byte preset table and notifies the shell bundle service at [0x006d4024+0x28].,ghidra + rizin
0x0054be60,52,layout_state_export_preset_table_0x840_to_global_defaults_and_refresh,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small export-and-refresh helper in the shell layout-state family. The function copies the full `0x72c`-byte preset table from `[this+0x840]` into global default cache `0x00ccbb68`, raises global dirty byte `0x00ccd820`, refreshes the surrounding layout-state side through `0x0054a190`, and clears shell controller pointer field `[0x006d4024+0x0c]` through `shell_controller_store_pointer_field_0x0c` `0x0051eff0(0)`. Current grounded callers are the small and broad layout-state release bodies `0x0055dd9a` and `0x0055e29d`, so this is the safest current read for exporting preset table `0x840` into the global defaults and refreshing the shell-side cache rather than a generic memcpy helper.","objdump + caller inspection + local disassembly + layout-state correlation + default-cache correlation"
0x0054bea0,1399,layout_state_apply_interpolated_pose,bootstrap,thiscall,inferred,ghidra-headless,4,Applies an interpolated pose and palette sample on the subordinate layout-state object using the controller counters passed by callers; clamps the time window blends preset tables at offsets 0x840 through 0x86f updates color bytes at 0x2510 through 0x2512 invokes the bound presentation node at [this+0x25df] and finishes through 0x0054a280.,ghidra + rizin
0x0055ddc0,664,shell_seed_layout_state_probe_snapshot_handles_by_resolution_tier,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Setup-side probe owner for the shell layout-state family. The helper first chooses a small resolution tier, `4` or `5`, from shell dimensions `[0x006d4024+0x11423b/+0x11423f]`, then programs a sequence of fixed slot-triplet patterns into subordinate layout state `[this+0x2d]` through `0x005455e0/0x005456d0`, snapshotting each resulting slot table through `0x005454c0` and storing the returned handles into local probe fields `[this+0x35/+0x39/+0x3d/+0x41/+0x45/+0x49/+0x4d/+0x51/+0x55/+0x59]`. After that it seeds all live slots to the fixed `(1,2,1)` pattern through `0x00548820`, clears shell capability byte `[0x006d4024+0x114251]`, probes several of the stored snapshot handles through `layout_state_run_texture_for_tests_binding_probe` `0x005489f0`, mutates one fallback probe record at `[this+0x4d]` when the first pass fails, and finally mirrors the resulting booleans into shell capability bytes `[0x006d4024+0x114250/+0x114251]`. Current grounded caller is the layout-state constructor `shell_create_layout_state` `0x0055e2b0`, so this is the safest current read for seeding the layout-state probe snapshots by resolution tier rather than a generic table initializer.","objdump + caller inspection + local disassembly + layout-state correlation + capability-probe correlation + resolution-tier correlation"
0x0055dd80,50,shell_release_layout_state_field_0x2d_if_present,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Small layout-state teardown sibling over owner field `[this+0x2d]`. The helper first refreshes and drops the live layout-state side through `0x00547610` and `0x00542c10`, then, when `[this+0x2d]` is nonnull, releases that subordinate layout-state object through `0x0054be60` and `0x0053b080` before clearing the field back to null. Current grounded callers are the broader layout-state rebuild owner `0x00565110` and the local branch at `0x00520008`, so this is the safest current read for the direct layout-state field release helper rather than a generic object free.","objdump + caller inspection + local disassembly + layout-state correlation + teardown correlation"
0x0055e060,587,shell_release_layout_state_owner_resources_and_subordinate_handles,shell,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Broader release body in the same shell layout-state owner family. When activation dword `[this+0x01]` is live, the helper first shuts down subordinate payload `[this+0x5d]`, refreshes and drops layout-state side `[this+0x2d]` through `0x00547610` and `0x00542c10`, and then walks a long owned-handle strip rooted at `[this+0x65]`, `[this+0x79..+0x8d]`, `[this+0x95..+0xa5]`, `[this+0x364d]`, and `[this+0x3651..+0x3665]`, releasing each live entry through the corresponding local family helper plus `0x0053b080` or `0x0053c000`. The tail also clears several cached layout-owned pointers and finally releases the subordinate layout-state object at `[this+0x2d]` through `0x0054be60`. Current grounded caller is the shell-side owner branch at `0x0051ffee`, which frees `[owner+0x18]` through this helper when the higher-level teardown flag is set, so this is the safest current read for the full layout-state owner release body rather than a small field reset.","objdump + caller inspection + local disassembly + layout-state correlation + owner-release correlation"
0x0054e3a0,528,shell_controller_window_message_dispatch,shell,stdcall,inferred,objdump,4,Primary window-message ingress for the active shell controller window. The dispatcher branches over low window lifecycle messages handles `WM_KEYDOWN` and `WM_KEYUP` by first updating the shell controller through 0x0051f0c0 or 0x0051f0d0 and then forwarding the transition into shell_input_apply_window_key_transition at 0x0054f290 on the shell input object rooted at 0x006d4018 routes `WM_COMMAND` through 0x0054eb10 routes mouse messages in the `0x0200..0x0208` family through 0x0054ee50 and falls back to `DefWindowProcA` for unhandled cases. This is the first grounded shell-side input ingest path rather than only a generic message drain.,objdump + import table + callsite inspection
0x0054e5d0,88,shell_drain_pending_window_messages,shell,cdecl,inferred,objdump + analysis-context,4,Shared pending-message drain that loops on `PeekMessageA` with remove mode 1 and feeds each dequeued record through `TranslateMessage` and `DispatchMessageA` until the queue is empty. Shell modal waits layout rebuild paths mouse-cursor frame work and the keyboard-toggle helpers all reuse this routine so it sits below the real input handlers rather than serving as the input dispatcher itself.,objdump + analysis-context + import table
0x0054e710,110,shell_input_state_init,shell,thiscall,inferred,objdump + analysis-context,3,Initializes the standalone shell input-state object later stored at 0x006d4018. It zeroes the 0xaa8-byte state block resets counters and flags under +0xa88 through +0xa9c caches host metrics through `GetSystemMetrics` and `GetDoubleClickTime` and clears the per-key state storage that later window-message handlers update.,objdump + analysis-context + import table
0x0054e880,305,shell_input_service_pointer_proximity_event_record_and_queue_followon,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Processes one queued 12-dword shell-input event record from the ring rooted at `[this+0x128]` as a pointer-proximity or timeout update. The helper classifies input record types `6`, `8`, and `10` into one of three local slot bands under `[this+0x104]`, `[this+0x110]`, and `[this+0x11c]`, measures the absolute pointer delta against the controller-selected view size from `[0x006d4024+0x34 + selector*0x15]`, compares that against the shared radius threshold, and either snapshots the current pointer coordinates plus deadline tick into the chosen slot or clones the record into a follow-on event with rewritten type `0x1e`, `0x20`, or `0x22` before requeueing it through `0x0054e9c0`. Current grounded callers are the queue wrappers `0x0054e9c0`, `0x0054f5b0`, and `0x0054eb10`, so this is the safest current read for the pointer-proximity event service owner rather than another generic ring-buffer helper.","objdump + caller inspection + local disassembly + event-ring correlation + pointer-proximity correlation"
0x0054e9c0,79,shell_input_enqueue_event_record_and_run_pointer_followon,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Small queue wrapper over the shell-input event ring at `[this+0x128]`. The helper appends one caller-supplied 12-dword record into the ring, rewrites ring index `[this+0xa88]` from `0x32` back to `0x31` when needed, increments that index, and immediately tails into `0x0054e880` on the same record. Current grounded callers are `shell_input_apply_window_key_transition` `0x0054f290`, `shell_input_enqueue_window_event_record_and_signal_dispatch` `0x0054f5b0`, and `shell_input_handle_window_command_and_toggle_messages` `0x0054eb10`.","objdump + caller inspection + local disassembly + event-ring correlation"
0x0054ea20,229,shell_input_pop_next_event_record_with_type2_coalescing,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Dequeues the next 12-dword shell-input event record from the same ring at `[this+0x128]` into one caller output buffer. When more than one event is pending and nested dispatch latch `[this+0xa90]` is clear, the helper compacts the ring forward, decrements the event count, and performs one special coalescing pass for adjacent type-`2` records when no key-state byte at `[this+0x100]` is active. Current grounded caller is `shell_input_snapshot_dispatch_state` `0x0054f4d0`, which uses this helper to pull one filtered dispatch record at a time.","objdump + caller inspection + local disassembly + event-ring correlation + coalescing correlation"
0x005708c0,11,refcounted_object_vtable_0x5deba0_query_current_matrix_pointer,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny current-entry pointer helper for the `0x5deba0` object family. The function resolves and returns the current `0x40`-byte matrix entry at `[this+0x08 + [this+0x0c]*0x40]`.","objdump + local disassembly + object-family correlation + matrix-row correlation"
0x005708ce,36,aligned_alloc_with_trailing_pad_byte,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small aligned-allocation helper reused by the `0x5deba0` object family. The function allocates `requested_size + 0x10` bytes through `0x0053b070`, rounds the returned pointer up to the next 16-byte boundary, stores the applied back-offset in byte `[aligned_ptr-1]`, and returns that aligned pointer. Current grounded caller is `0x0057091d`, which uses this helper for `0x40`-byte matrix-row blocks.","objdump + local disassembly + allocation correlation + alignment correlation"
0x005708f2,22,aligned_free_with_trailing_pad_byte,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Free-side sibling to `0x005708ce`. When the incoming aligned pointer is nonnull, the helper reads the stored back-offset byte at `[ptr-1]`, reconstructs the original allocation base, and frees it through `0x0053b080`. Current grounded callers are destructor `0x00570908` and the `0x5deba0` growth path.","objdump + local disassembly + allocation correlation + alignment correlation"
0x00570908,21,refcounted_object_vtable_0x5deba0_destruct_and_release_row_block,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small destructor-side helper for the `0x5deba0` object family. The function reinstalls vtable `0x005deba0`, releases optional row-block pointer `[this+0x08]` through `0x005708f2`, and returns. Current grounded caller is the release wrapper `0x005709da`, so this is the safest current read for destructing the object and dropping its row block rather than a broader owner teardown.","objdump + local disassembly + object-family correlation + row-block correlation"
0x0057091d,108,refcounted_object_vtable_0x5deba0_reserve_0x40_byte_row_capacity,bootstrap,thiscall,inferred,objdump + caller inspection + local disassembly,2,"Reserve owner for the same `0x5deba0` object family. The helper allocates one aligned row block sized as `requested_count << 6`, fills it from fixed `0x40`-byte template `0x0056cd2c`, stores the resulting pointer into `[this+0x08]`, stores requested row capacity into `[this+0x04]`, clears live row count `[this+0x0c]`, and then dispatches one object-specific follow-on through vtable slot `+0x14`. Current grounded caller is the create-and-reserve wrapper `0x00570fbd(0x10)`, so this is the safest current read for reserving `0x40`-byte row capacity rather than a generic allocator.","objdump + caller inspection + local disassembly + object-family correlation + row-capacity correlation"
0x0057098b,77,refcounted_object_vtable_0x5deba0_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for the `0x5deba0` object family. The helper accepts exactly two interface ids: `IUnknown` `{00000000-0000-0000-C000-000000000046}` from `0x005eaaec` and one custom IID rooted at `0x005c8520`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + object-family correlation + COM-correlation"
0x005709da,26,refcounted_object_vtable_0x5deba0_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for the `0x5deba0` object family. The helper re-enters destructor `0x00570908`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`. Current grounded caller is refcount helper `0x00570fa1`, which invokes this path when refcount `[this+0x10]` reaches zero.","objdump + local disassembly + object-family correlation + refcount correlation"
0x005709f6,180,refcounted_object_vtable_0x5deba0_grow_row_capacity_and_append_duplicate_last_row,bootstrap,thiscall,inferred,objdump + local disassembly,2,"First growth owner above `0x0057091d` in the same `0x5deba0` object family. The helper increments live row count `[this+0x0c]`, doubles row capacity `[this+0x04]` and reallocates the `0x40`-byte row block when the new count would exceed capacity, then duplicates the previous `0x40`-byte row into the new last slot. This is the safest current read for growing row capacity and appending a duplicate of the last row rather than a generic vector push.","objdump + local disassembly + object-family correlation + row-capacity correlation + row-block correlation"
0x00570aac,95,refcounted_object_vtable_0x5deba0_set_current_matrix_to_identity,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small current-entry seed helper for the `0x5deba0` object family. The function resolves the current `0x40`-byte entry at `[this+0x08 + [this+0x0c]*0x40]`, zeroes all sixteen float lanes, and then writes `1.0` into offsets `0x00`, `0x14`, `0x28`, and `0x3c`, producing an identity 4x4 matrix. This is the safest current read for seeding the current matrix to identity rather than a generic clear helper.","objdump + local disassembly + object-family correlation + matrix-row correlation"
0x00570b0d,29,refcounted_object_vtable_0x5deba0_store_current_matrix_from_caller_block,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Direct current-entry store helper for the `0x5deba0` object family. The function copies one caller-supplied `0x40`-byte block into the current entry at `[this+0x08 + [this+0x0c]*0x40]`. This is the safest current read for storing the current matrix from a caller block rather than a generic memcpy wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation"
0x00570b2c,72,refcounted_object_vtable_0x5deba0_compose_current_matrix_with_caller_matrix_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Current-entry composition helper for the `0x5deba0` object family. The function materializes one composed `0x40`-byte matrix through `0x0056d3cd(temp, current, caller)` and writes the resulting block back into the current entry at `[this+0x08 + [this+0x0c]*0x40]`. This is the safest current read for composing the current matrix with one caller matrix on the right-hand side rather than a generic temp-buffer wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + composition correlation"
0x00570b76,72,refcounted_object_vtable_0x5deba0_compose_caller_matrix_with_current_matrix_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling composition helper to `0x00570b2c` in the same `0x5deba0` object family. The function materializes one composed `0x40`-byte matrix through `0x0056d3cd(temp, caller, current)` and writes the result back into the current entry. This is the safest current read for composing the caller matrix with the current matrix on the right-hand side rather than another generic temp-buffer wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + composition correlation"
0x00570bc0,108,refcounted_object_vtable_0x5deba0_build_helper_matrix_56df7d_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Helper-generated composition owner in the `0x5deba0` object family. The function first builds one temporary `0x40`-byte matrix through `0x0056df7d` from the caller pointer plus one float scalar, then composes that helper matrix with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56df7d`-generated right-side composition path rather than a generic stack-buffer owner.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570c2f,108,refcounted_object_vtable_0x5deba0_build_helper_matrix_56df7d_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570bc0` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte helper matrix through `0x0056df7d`, then composes it on the left through `0x0056d3cd(temp, helper, current)` and stores the result back into the current entry. This is the safest current read for the left-side `0x56df7d` composition path rather than another generic stack-buffer owner.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570c9e,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56e1a8_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Three-scalar helper-generated composition owner in the `0x5deba0` object family. The function first builds one temporary `0x40`-byte matrix through `0x0056e1a8` from three caller float scalars, then composes that helper matrix with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56e1a8`-generated right-side composition path rather than a generic float wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570d1a,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56e1a8_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570c9e` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte matrix through `0x0056e1a8` from three caller float scalars, composes it on the left through `0x0056d3cd(temp, helper, current)`, and stores the result back into the current entry. This is the safest current read for the left-side `0x56e1a8` composition path rather than another generic float wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570d96,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dc9a_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Three-scalar helper-generated composition owner in the same `0x5deba0` family, but using helper `0x0056dc9a`. The function materializes one temporary `0x40`-byte matrix from three caller float scalars, then composes it with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56dc9a`-generated right-side composition path rather than a generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570e12,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dc9a_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570d96` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte matrix through `0x0056dc9a`, composes it on the left through `0x0056d3cd(temp, helper, current)`, and writes the result back into the current entry. This is the safest current read for the left-side `0x56dc9a` composition path rather than another generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570e8e,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dd2a_and_compose_current_rhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Three-scalar helper-generated composition owner in the same `0x5deba0` family, but using helper `0x0056dd2a`. The function materializes one temporary `0x40`-byte matrix from three caller float scalars, then composes it with the current matrix through `0x0056d3cd(temp, current, helper)` and writes the result back into the current entry. This is the safest current read for the `0x56dd2a`-generated right-side composition path rather than a generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570f0a,121,refcounted_object_vtable_0x5deba0_build_helper_matrix_56dd2a_and_compose_current_lhs,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Sibling helper-generated composition owner to `0x00570e8e` in the same `0x5deba0` object family. The function builds the same temporary `0x40`-byte matrix through `0x0056dd2a`, composes it on the left through `0x0056d3cd(temp, helper, current)`, and writes the result back into the current entry. This is the safest current read for the left-side `0x56dd2a` composition path rather than another generic math wrapper.","objdump + local disassembly + object-family correlation + matrix-row correlation + helper-generated-composition correlation"
0x00570f86,27,refcounted_object_vtable_0x5deba0_init,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for one 0x14-byte refcounted object family. The helper installs vtable `0x005deba0`, clears dwords `[this+0x04/+0x08/+0x0c]`, and seeds refcount `[this+0x10] = 1`. Current grounded direct caller is the create-and-reserve wrapper `0x00570fbd`, so this is the safest current read for initializing the `0x5deba0` object family rather than a wider bootstrap owner.","objdump + local disassembly + object-family correlation"
0x00570fa1,26,refcounted_object_vtable_0x5deba0_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for the `0x5deba0` object family. The function decrements refcount `[this+0x10]`, returns the remaining count when it stays positive, and otherwise tail-calls release wrapper `0x005709da(1)` to destroy and free the object. This is the safest current read for the direct refcount decrement path rather than a generic counter helper.","objdump + local disassembly + object-family correlation + refcount correlation"
0x00570fbd,86,create_refcounted_object_vtable_0x5deba0_and_reserve_block_0x10,bootstrap,stdcall,inferred,objdump + caller inspection + local disassembly,2,"Small create-and-reserve wrapper for the same `0x5deba0` object family. The helper validates the caller out-pointer, allocates one `0x14`-byte object through `0x0053b070`, initializes it through `0x00570f86`, asks the new object to reserve or materialize one `0x10`-byte block through `0x0057091d(0x10)`, releases the object through vtable slot `+0x08` on failure, and stores the live pointer through the caller outparam on success. Current grounded caller is the setup-side layout-state owner `0x0054a0c0`, which uses this helper to seed optional handle `[layout+0x33ab]`, so this is the safest current read for creating the refcounted `0x5deba0` object and reserving its first `0x10`-byte block rather than a generic allocator.","objdump + caller inspection + local disassembly + object-family correlation + allocation correlation"
0x0057ad20,58,refcounted_object_vtable_0x5def30_destruct_release_resource_fields_and_attached_object,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side owner for sibling object family `0x005def30`. The helper reinstalls vtable `0x005def30`, conditionally tears down resource field `[this+0x48]` through `0x00580bb9/0x00580bdc`, frees optional heap block `[this+0x08]` through import thunk `0x005c8058`, and releases attached object `[this+0x4c]` through its vtable slot `+0x08`. This is the safest current read for destructing the `0x5def30` object family and releasing its owned fields rather than a generic cleanup body.","objdump + local disassembly + object-family correlation + resource-field correlation"
0x0057ad5a,11,refcounted_object_vtable_0x5def30_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny addref helper for object family `0x005def30`. The function increments refcount `[this+0x04]` and returns the new count.","objdump + local disassembly + object-family correlation + refcount correlation"
0x0057ad67,91,refcounted_object_vtable_0x5def30_bind_resource_field_attach_object_and_copy_15_dword_payload,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Primary setup owner for object family `0x005def30`. When both caller inputs are nonnull, the helper initializes resource field `[this+0x48]` through `0x0058123c`, allocates payload block `[this+0x08]` through import thunk `0x005c8054`, stores attached object `[this+0x4c]` with an addref, and copies one `0x0f`-dword payload block into `[this+0x0c]`. Otherwise it returns `0x8876086c`. This is the safest current read for binding the resource field, attaching the sibling object, and copying the fixed payload block rather than a generic constructor fragment.","objdump + local disassembly + object-family correlation + payload-copy correlation"
0x0057add4,21,refcounted_object_vtable_0x5def30_get_attached_object_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for object family `0x005def30`. The helper writes attached object `[this+0x4c]` through the caller outparam and addrefs it through vtable slot `+0x04`, returning `0x8876086c` only when the caller outparam is null.","objdump + local disassembly + object-family correlation + attached-object correlation"
0x0057adfb,18,refcounted_object_vtable_0x5def30_copy_15_dword_payload_out,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small payload-copy helper for object family `0x005def30`. The function copies the fixed `0x0f`-dword payload block from `[this+0x0c]` into the caller destination and returns `0x8876086c` only when the destination pointer is null.","objdump + local disassembly + object-family correlation + payload-copy correlation"
0x0057ae0f,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_5809c7,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny pass-through wrapper over resource field `[this+0x48]` in object family `0x005def30`. The helper forwards directly into `0x005809c7`.","objdump + local disassembly + object-family correlation + resource-field correlation"
0x0057ae1e,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_580a54,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny sibling wrapper to `0x0057ae0f` in the same `0x5def30` family. The helper forwards resource field `[this+0x48]` directly into `0x00580a54`.","objdump + local disassembly + object-family correlation + resource-field correlation"
0x0057ae2d,35,refcounted_object_vtable_0x5def30_dispatch_resource_and_payload_call_580d29_mode0,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Broader pass-through owner for object family `0x005def30`. The helper forwards resource field `[this+0x48]`, payload block `[this+0x08]`, five caller arguments, and fixed mode flag `0` into `0x00580d29`.","objdump + local disassembly + object-family correlation + resource-field correlation + payload-block correlation"
0x0057ae53,35,refcounted_object_vtable_0x5def30_dispatch_resource_and_payload_call_580d29_mode1,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Mode-`1` sibling to `0x0057ae2d` in the same `0x5def30` family. The helper forwards resource field `[this+0x48]`, payload block `[this+0x08]`, five caller arguments, and fixed mode flag `1` into `0x00580d29`.","objdump + local disassembly + object-family correlation + resource-field correlation + payload-block correlation"
0x0057ae79,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_580a84,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny pass-through wrapper over resource field `[this+0x48]` in object family `0x005def30`. The helper forwards directly into `0x00580a84`.","objdump + local disassembly + object-family correlation + resource-field correlation"
0x0057ae88,11,refcounted_object_vtable_0x5def30_forward_resource_field_0x48_query_580aff,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny sibling wrapper to `0x0057ae79` in the same `0x5def30` family. The helper forwards resource field `[this+0x48]` directly into `0x00580aff`.","objdump + local disassembly + object-family correlation + resource-field correlation"
0x0057ae97,66,refcounted_object_vtable_0x5def30_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for object family `0x005def30`. The helper accepts exactly `IUnknown` from `0x005eaaec` plus one custom IID rooted at `0x005c8500`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + object-family correlation + COM-correlation"
0x0057aedb,22,refcounted_object_vtable_0x5def30_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for object family `0x005def30`. The function decrements refcount `[this+0x04]`, returns the remaining count when it stays positive, and otherwise tail-calls release wrapper `0x00571016(1)` to destroy and free the object.","objdump + local disassembly + object-family correlation + refcount correlation"
0x0057aef3,27,refcounted_object_vtable_0x5def30_init,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for object family `0x005def30`. The helper installs vtable `0x005def30`, seeds refcount `[this+0x04] = 1`, and clears optional fields `[this+0x08]`, `[this+0x48]`, and `[this+0x4c]`.","objdump + local disassembly + object-family correlation"
0x0057af0e,64,refcounted_object_vtable_0x5def5c_destruct_release_optional_target_and_two_handles,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side owner for sibling object family `0x005def5c`. The helper reinstalls vtable `0x005def5c`, and when target field `[this+0x08]` is live it conditionally releases optional handles `[this+0x14]` and `[this+0x10]` through target vtable slot `+0xe0` before releasing the target itself through slot `+0x08`. This is the safest current read for destructing the `0x5def5c` object family and releasing its optional target-side handles rather than a generic cleanup body.","objdump + local disassembly + object-family correlation + target-handle correlation"
0x0057af4e,11,refcounted_object_vtable_0x5def5c_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny addref helper for sibling object family `0x005def5c`. The function increments refcount `[this+0x04]` and returns the new count.","objdump + local disassembly + object-family correlation + refcount correlation"
0x0057af5b,115,refcounted_object_vtable_0x5def5c_attach_target_and_derive_cached_flag_pair,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Primary setup owner for sibling object family `0x005def5c`. The helper stores one caller target object into `[this+0x08]` with addref, queries two target-side flag blocks through vtable slots `+0x1c` and `+0x24`, and derives cached booleans `[this+0x1c]` and `[this+0x18]` from the observed flag bits before returning success. When the incoming target pointer is null it returns `0x8876086c`. This is the safest current read for attaching the target and deriving the cached flag pair rather than a generic constructor fragment.","objdump + local disassembly + object-family correlation + target-flag correlation"
0x0057afd0,36,refcounted_object_vtable_0x5def5c_get_target_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for sibling object family `0x5def5c`. The helper writes target field `[this+0x08]` through the caller outparam and addrefs it through vtable slot `+0x04`, returning `0x8876086c` only when the caller outparam is null.","objdump + local disassembly + object-family correlation + target-object correlation"
0x0057aff6,40,refcounted_object_vtable_0x5def5c_release_handle_0x10_once,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small one-shot release helper for sibling object family `0x5def5c`. When live flag `[this+0x0c]` is nonzero, the function asks target `[this+0x08]` to release handle `[this+0x10]` through vtable slot `+0xd8`, then clears `[this+0x0c]` back to `0`; otherwise it returns `0x80004005`. This is the safest current read for releasing handle `0x10` once rather than a generic boolean guard.","objdump + local disassembly + object-family correlation + target-handle correlation"
0x0057b021,61,refcounted_object_vtable_0x5def5c_clear_optional_handles_0x14_and_0x10,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small clear-side sibling to `0x0057aff6` in the `0x5def5c` family. When target field `[this+0x08]` is live, the helper conditionally releases optional handles `[this+0x14]` and `[this+0x10]` through target vtable slot `+0xe0`, then clears both fields back to `0`.","objdump + local disassembly + object-family correlation + target-handle correlation"
0x0057b060,3,refcounted_object_vtable_0x5def5c_return_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Literal zero-return stub in the `0x5def5c` helper strip.","objdump + local disassembly + object-family correlation"
0x0057b065,66,refcounted_object_vtable_0x5def5c_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for object family `0x5def5c`. The helper accepts exactly `IUnknown` from `0x005eaaec` plus one custom IID rooted at `0x005c84f0`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + object-family correlation + COM-correlation"
0x0057b0a9,22,refcounted_object_vtable_0x5def5c_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for sibling object family `0x5def5c`. The function decrements refcount `[this+0x04]`, returns the remaining count when it stays positive, and otherwise tail-calls release wrapper `0x00571032(1)` to destroy and free the object.","objdump + local disassembly + object-family correlation + refcount correlation"
0x0057b0c1,1074,refcounted_object_vtable_0x5def5c_seed_target_handles_publish_property_strip_and_latch_ready,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Broader service owner for sibling object family `0x5def5c`. The helper rejects re-entry when ready latch `[this+0x0c]` is already set, then, when optional handle `[this+0x10]` is still null, queries the target at `[this+0x08]` through slots `+0xd0`, `+0x130`, `+0x94`, `+0xc8`, `+0xfc`, and `+0xd4` to seed the two handle lanes `[this+0x10/+0x14]`, publish one fixed property strip, and optionally build one target-derived matrix when cached flag `[this+0x1c]` is clear. The tail always replays target slot `+0xdc` for `[this+0x10]`, target slot `+0xd8` for `[this+0x14]`, conditionally emits one more target-derived matrix through slot `+0x94`, and finally marks ready latch `[this+0x0c] = 1`. This is the safest current read for seeding target handles, publishing the fixed property strip, and latching the object ready rather than a generic virtual wrapper.","objdump + local disassembly + object-family correlation + target-handle correlation + property-strip correlation"
0x0057b4fd,213,target_object_build_local_transform_block_from_optional_anchor_pairs_angle_and_scale_and_dispatch_slot_0x18,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Broader target-side geometry owner immediately above the `0x5def5c` service strip. The helper conditionally lifts up to three optional caller anchor pairs into local vec2-plus-scalar records, derives one temporary transform block through `0x0056e1bf` from those optional anchors plus caller angle and scale inputs, and then forwards that finished block into the target object through vtable slot `+0x18` with the caller's dispatch pair. This is the safest current read for building one local transform block from optional anchor pairs, angle, and scale before dispatching slot `+0x18`, rather than a generic float wrapper.","objdump + local disassembly + target-object correlation + transform-block correlation"
0x00580867,75,target_service_init_clear_entry_bands_and_aux_fields,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for the target-service object family wrapped by `0x005def30`. The helper seeds refcount `[this] = 1`, clears the target, attached-object, embedded entry-band roots, ready byte, service handles, auxiliary handle roots, and list link at `[this+0xac]`, and leaves the object ready for the later constructor-side owner `0x00580be8`.","objdump + local disassembly + target-service-family correlation + constructor correlation"
0x005808b2,249,target_service_destruct_release_handles_entry_bands_and_unlink_global_cache,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side owner for the same target-service family. The helper releases the two target-bound service handles `[this+0x64/+0x68]` through target slot `+0xe0`, walks and releases the two embedded eight-entry bands rooted at `[this+0x10]` and `[this+0x30]`, drops attached object `[this+0x0c]` and target `[this+0x04]`, tears down the auxiliary handle family rooted at `[this+0x6c]`, `[this+0x98]`, `[this+0x9c]`, and `[this+0xa8]` through the imported `0x005c8030/0x005c803c/0x005c8058` helpers, and finally unlinks the object from the global cache chain rooted at `0x00db89e4`. This is the safest current read for the full target-service destructor rather than a generic cleanup body.","objdump + local disassembly + target-service-family correlation + destructor correlation + global-cache correlation"
0x005809ab,28,target_service_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for the target-service family. The helper re-enters destructor `0x005808b2`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`. Current grounded caller is refcount helper `0x00580bdc`.","objdump + local disassembly + target-service-family correlation + refcount correlation"
0x005809c7,141,target_service_seed_handles_0x64_0x68_and_latch_ready_0x60,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Activation-side owner for the next target-service family beneath the `0x5def30` wrappers. When ready byte `[this+0x60]` is still clear, the helper ensures service handles `[this+0x64]` and `[this+0x68]` through target `[this+0x04]` vtable slots `+0xd0` and `+0xd4`, invokes attached object `[this+0x0c]` through slot `+0x10`, republishes those two handles back into the target through slots `+0xdc` and `+0xd8`, and finally marks `[this+0x60] = 1`. This is the safest current read for seeding the two service handles and latching the service live rather than a generic query helper.","objdump + local disassembly + target-service-family correlation + handle-seed correlation"
0x00580a54,48,target_service_release_handle_0x64_and_clear_ready_0x60,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Clear-side sibling to `0x005809c7` in the same target-service family. When ready byte `[this+0x60]` is nonzero, the helper asks target `[this+0x04]` to release handle `[this+0x64]` through vtable slot `+0xd8`, notifies attached object `[this+0x0c]` through slot `+0x1c`, and clears `[this+0x60]` back to `0`.","objdump + local disassembly + target-service-family correlation + handle-release correlation"
0x00580a84,123,target_service_release_handles_and_reset_embedded_entry_bands,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Broader release owner for the same target-service family. The helper tears down target-side handle state through target `[this+0x04]`, attached object `[this+0x0c]`, and the optional handles rooted at `[this+0x64]` and `[this+0x68]`, then iterates the two embedded eight-entry bands under `[this+0x10]` and `[this+0x30]` to clear their per-entry pointers and counters. This is the safest current read for releasing the bound handles and resetting the embedded entry bands rather than a generic cleanup fragment.","objdump + local disassembly + target-service-family correlation + embedded-entry-band correlation"
0x00580aff,186,target_service_build_embedded_entry_bands_from_mode_variant_and_dispatch_slot_0x3c,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Setup-side owner immediately above the clear strip in the same target-service family. When entry root `[this+0x10]` is still null, the helper branches on local mode byte `[this+0x50]` to choose one of two fixed parameter triples, seeds control scalars `[this+0x54]`, `[this+0x58]`, and `[this+0x5c]` through `0x00570669` and `0x00570691`, iterates the embedded entry bands rooted at `[this+0x10]` and dispatches each live per-entry object through slot `+0x3c`. This is the safest current read for building the embedded entry bands from the mode variant and dispatching their setup slot rather than a generic initializer.","objdump + local disassembly + target-service-family correlation + embedded-entry-band correlation"
0x00580bb9,35,target_service_release_aux_handle_band_if_live,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small auxiliary release helper for the same target-service family. When optional band flag `[this+0x6c]` is live, the helper walks the pointer band rooted at `[this+0xa8]`, releases it through import thunk `0x005c803c`, and clears the associated slots back to `0`.","objdump + local disassembly + target-service-family correlation + auxiliary-handle correlation"
0x00580bdc,12,target_service_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny refcount-drop helper for the same target-service family. The function decrements refcount `[this]` and when it reaches zero tail-calls release wrapper `0x005809ab(1)`.","objdump + local disassembly + target-service-family correlation + refcount correlation"
0x00580be8,321,target_service_init_seed_mode_scalars_build_entry_bands_and_bind_aux_handles,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Constructor-side owner for the target-service family wrapped by the `0x5def30` object. The helper stores caller target `[this+0x04]`, derives mode byte `[this+0x50]` from target-side flags, seeds the fixed scalar triple `[this+0x54] = 0x15`, `[this+0x58] = 0x40`, `[this+0x5c] = 0x10`, invokes embedded-band builder `0x00580aff`, initializes the later service roots under `[this+0x70..]`, and allocates or binds the auxiliary handle family rooted at `[this+0x6c]`, `[this+0x98]`, and `[this+0x9c]`. This is the safest current read for initializing the target-service object, seeding its mode scalars, building the entry bands, and binding the auxiliary handles rather than a generic constructor fragment.","objdump + local disassembly + target-service-family correlation + constructor correlation"
0x00580d29,1299,target_service_dispatch_payload_block_with_mode_variant_and_target_callbacks,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Primary target-service owner beneath the `0x0057ae2d/0x0057ae53` wrappers. The helper accepts the target-service object, the caller payload block, five caller arguments, and a fixed mode variant flag from the wrapper, then branches across local bounds, anchor, and callback conditions while using service handle `[this+0x6c]` plus external callbacks rooted at `0x005c81e4`, `0x005c8248`, and `0x005c824c`. Current static evidence is strong enough to ground this as the main payload-dispatch and layout-style service body for the target-service family, while the exact user-facing meaning of every branch remains open.","objdump + local disassembly + target-service-family correlation + payload-block correlation + callback correlation"
0x0058123c,117,target_service_cache_or_create_for_target_and_return_via_outparam,bootstrap,cdecl,inferred,objdump + local disassembly,2,"Factory-side helper above the target-service family. The function walks the global cache chain rooted at `0x00db89e4` looking for an existing target-service object whose target field `[entry+0x04]` matches the caller target. On a hit it increments the service refcount and returns the cached object through the caller outparam. Otherwise it allocates one `0xb0`-byte object through `0x0053b070`, initializes it through `0x00580867`, runs constructor owner `0x00580be8`, and on failure releases it through `0x005809ab(1)`. This is the safest current read for the cache-or-create factory for the target-service family rather than a generic resource wrapper constructor.","objdump + local disassembly + target-service-family correlation + global-cache correlation + factory correlation"
0x005812b1,16,dword_pointer_vector_reset_4dwords,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny reset helper for one four-dword vector-style record. The function clears fields `[this+0x00]`, `[this+0x04]`, `[this+0x08]`, and `[this+0x0c]` back to zero.","objdump + local disassembly + container-helper correlation"
0x005812c1,14,dword_pointer_vector_release_storage_if_nonnull,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Small release helper for the same four-dword vector record. When storage pointer `[this+0x00]` is nonnull, the helper frees it through `0x0053b080`.","objdump + local disassembly + container-helper correlation"
0x005812cf,110,dword_pointer_vector_push_value_grow_by_0x10,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Growable dword-pointer vector append helper. The function checks count `[this+0x04]` against capacity `[this+0x08]`, grows the backing dword array at `[this+0x00]` by `0x10` entries through `0x0053b070` when full, preserves existing contents, writes the caller dword into the next slot, increments the count, and stores allocation failure `0x8007000e` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + dynamic-array correlation"
0x0058133d,52,dword_pointer_vector_pop_last_optional_outparam,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small pop helper for the same dword-pointer vector. When count `[this+0x04]` is nonzero it decrements the count and optionally writes the removed last dword through the caller outparam; when empty it zeros the outparam if present and stores `0x80004005` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + dynamic-array correlation"
0x00581371,8,dword_pointer_vector_take_and_clear_status,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny status helper for the same dword-pointer vector. The function returns status dword `[this+0x0c]` and then clears that field back to zero.","objdump + local disassembly + container-helper correlation"
0x00581379,19,string_pointer_vector_reset_5dwords,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny reset helper for one five-dword string-pointer vector record. The function clears storage pointer, count, capacity, status, and accumulated-byte counter fields `[this+0x00..+0x10]`.","objdump + local disassembly + container-helper correlation + string-vector correlation"
0x0058138c,49,string_pointer_vector_release_storage_and_owned_strings,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release helper for the string-pointer vector record. When storage `[this+0x00]` is live, the helper walks all counted string pointers, frees each owned string through `0x0053b080`, then frees the pointer array itself through the same allocator shim.","objdump + local disassembly + container-helper correlation + string-vector correlation"
0x005813bd,179,string_pointer_vector_push_copy_or_null_grow_by_0x10,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Growable string-pointer vector append helper. The function grows the pointer array at `[this+0x00]` by `0x10` entries when count reaches capacity, then either stores a null pointer for a null caller string or allocates and copies a private NUL-terminated copy of the caller string, updates accumulated-byte counter `[this+0x10]`, stores the resulting pointer in the next slot, increments the count, and records allocation failure `0x8007000e` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + string-vector correlation"
0x00581470,52,string_pointer_vector_pop_last_optional_outparam,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small pop helper for the same string-pointer vector. When count `[this+0x04]` is nonzero it decrements the count and optionally writes the removed last string pointer through the caller outparam; when empty it zeros the outparam if present and stores `0x80004005` in `[this+0x0c]`.","objdump + local disassembly + container-helper correlation + string-vector correlation"
0x005814a4,8,string_pointer_vector_take_and_clear_status,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny status helper for the same string-pointer vector. The function returns status dword `[this+0x0c]` and then clears that field back to zero.","objdump + local disassembly + container-helper correlation + string-vector correlation"
0x005814ac,232,string_pointer_vector_build_newline_joined_text_object,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Primary owner above the string-pointer vector helper strip. When accumulated-byte count `[this+0x10]` is nonzero, the helper allocates one `0x10`-byte text object through `0x0053b070`, initializes it through `0x00581673`, asks that object to allocate a text buffer sized for total string bytes plus one newline per stored string plus the trailing NUL through vtable slot `+0x18`, and then copies each stored string from the vector into the owned buffer separated by literal `0x0a` bytes before returning the object through the caller outparam. This is the safest current read for building one newline-joined text object from the stored string vector rather than a generic vector wrapper.","objdump + local disassembly + string-vector correlation + text-object correlation"
0x00581594,21,text_object_vtable_0x5e0bd8_destruct_release_owned_buffer,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Destructor-side helper for the small text object family rooted at vtable `0x005e0bd8`. The helper reinstalls that vtable and frees owned text buffer `[this+0x0c]` through `0x0053b080` when it is live.","objdump + local disassembly + text-object correlation"
0x005815a9,38,text_object_vtable_0x5e0bd8_allocate_owned_buffer,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Allocation helper for the same text object family. The function stores the requested byte length in `[this+0x08]`, allocates that many bytes through `0x0053b070`, writes the result to `[this+0x0c]`, and returns either `0` or allocation failure `0x8007000e`.","objdump + local disassembly + text-object correlation"
0x005815cf,11,text_object_vtable_0x5e0bd8_addref,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Tiny addref helper for the same text object family. The function increments refcount `[this+0x04]` and returns the new count.","objdump + local disassembly + text-object correlation + refcount correlation"
0x005815dc,30,text_object_vtable_0x5e0bd8_decrement_refcount_and_release_on_zero,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small refcount-drop helper for the same text object family. The function decrements refcount `[this+0x04]`, and when it reaches zero tail-calls release wrapper `0x00581610(1)`.","objdump + local disassembly + text-object correlation + refcount correlation"
0x005815fc,18,text_object_vtable_0x5e0bd8_get_owned_buffer,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for the same text object family. The function returns owned text buffer pointer `[this+0x0c]`.","objdump + local disassembly + text-object correlation"
0x00581606,8,text_object_vtable_0x5e0bd8_get_buffer_length,bootstrap,stdcall,inferred,objdump + local disassembly,2,"Small getter for the same text object family. The function returns stored buffer length `[this+0x08]`.","objdump + local disassembly + text-object correlation"
0x00581610,26,text_object_vtable_0x5e0bd8_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for the same text object family. The helper re-enters destructor `0x00581594`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + text-object correlation + refcount correlation"
0x0058162c,71,text_object_vtable_0x5e0bd8_query_interface_iunknown_or_custom_iid,bootstrap,stdcall,inferred,objdump + local disassembly + rdata decode,2,"Small `QueryInterface`-style gate for the same text object family. The helper accepts exactly `IUnknown` from `0x005eaaec` plus one custom IID rooted at `0x005c8510`; on either match it returns the original object pointer through the caller outparam and increments the refcount through vtable slot `+0x04`, otherwise it returns `0x80004002`.","objdump + local disassembly + rdata decode + text-object correlation + COM-correlation"
0x00581673,24,text_object_vtable_0x5e0bd8_init,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Tiny constructor-style initializer for the same text object family. The helper installs vtable `0x005e0bd8`, seeds refcount `[this+0x04] = 1`, and clears buffer-length `[this+0x08]` plus owned-buffer pointer `[this+0x0c]`.","objdump + local disassembly + text-object correlation"
0x00581690,64,math_apply_2d_basis_rows_and_translation_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small SSE helper over one caller output buffer, one XY input pair, and one basis or translation block. The function multiplies the input X and Y scalars by the first two 16-byte rows at `[basis+0x00]` and `[basis+0x10]`, adds translation row `[basis+0x30]`, and stores the full 16-byte vector result to the caller output. This is the safest current read for the shared 2D-basis-plus-translation vec4 builder rather than a gameplay-specific transform.","objdump + local disassembly + SSE arithmetic inspection"
0x005816d0,96,math_apply_2d_basis_rows_translation_and_project_xy_by_reciprocal_lane3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Projective sibling to `0x00581690`. The helper builds the same intermediate 4-lane vector from the caller XY pair and basis or translation rows, then derives a reciprocal from lane 3 and uses it to scale the vector before storing only the low 64 bits through the caller output. Current evidence is strongest for a shared transform-plus-project helper that returns projected XY rather than a gameplay-specific projection owner.","objdump + local disassembly + SSE arithmetic inspection"
0x00581730,57,math_apply_2d_basis_rows_to_vec2_without_translation,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small translation-free sibling to `0x00581690`. The helper multiplies the caller XY pair by the first two 16-byte basis rows at `[basis+0x00]` and `[basis+0x10]`, sums the lanes, and stores only the low 64 bits to the caller output. This is the safest current read for the shared 2D basis-to-vec2 helper rather than another owner-specific math body.","objdump + local disassembly + SSE arithmetic inspection"
0x00581770,192,math_apply_3d_basis_rows_to_vec3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small 3D SSE transform helper over one caller output buffer, one XYZ input triple, and one basis block. The function multiplies the input X, Y, and Z scalars by the first three 16-byte rows at `[basis+0x00]`, `[basis+0x10]`, and `[basis+0x20]`, sums the lanes, and stores the resulting XYZ triple through the caller output. It uses a separate fast path when the basis pointer is 16-byte aligned, but both legs preserve the same semantics.","objdump + local disassembly + SSE arithmetic inspection"
0x00581830,192,math_apply_3d_basis_rows_and_translation_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Translation-bearing sibling to `0x00581770`. The helper multiplies the caller XYZ triple by the first three 16-byte basis rows, adds translation row `[basis+0x30]`, and stores the full 16-byte vector result to the caller output. As with the sibling, the body has aligned and unaligned load paths but the same observable transform semantics.","objdump + local disassembly + SSE arithmetic inspection"
0x005818f0,256,math_apply_3d_basis_rows_translation_and_project_vec3_by_reciprocal_lane3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Projective 3D sibling to `0x00581830`. The helper builds the same 4-lane transformed vector from the caller XYZ triple and basis or translation rows, derives a reciprocal from lane 3, scales the vector by that reciprocal, and stores the resulting XYZ triple through the caller output. Both the aligned and unaligned legs preserve the same transform-plus-project semantics.","objdump + local disassembly + SSE arithmetic inspection"
0x005819f0,192,math_apply_4d_basis_rows_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small 4D SSE transform helper over one caller output buffer, one XYZW input vector, and one 4x4 basis block. The function multiplies each input lane by the corresponding 16-byte row at `[basis+0x00]`, `[basis+0x10]`, `[basis+0x20]`, and `[basis+0x30]`, sums the lanes, and stores the full vec4 result through the caller output. The body preserves the same semantics across aligned and unaligned basis-pointer paths.","objdump + local disassembly + SSE arithmetic inspection"
0x00581ab0,336,math_apply_4d_basis_rows_to_four_vec4_rows,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Batch sibling to `0x005819f0`. The helper takes one 4x4 source row block, applies the same 4-row basis block to each of its four input vec4 rows, and writes the four transformed vec4 rows to the caller output block at offsets `+0x00`, `+0x10`, `+0x20`, and `+0x30`. This is the safest current read for the shared four-row 4D basis application helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection"
0x00581c00,208,math_normalize_vec3_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Small vec3 normalization helper. The function computes squared length from the caller XYZ triple, compares it against a tiny epsilon table under `0x00dbc000`, returns a zero vector when the length is too small, and otherwise applies one Newton-refined reciprocal-square-root scale before writing the normalized XYZ result. This is the safest current read for the shared normalize-or-zero vec3 helper rather than a gameplay-specific metric.","objdump + local disassembly + SSE arithmetic inspection"
0x00581cd0,216,math_normalize_vec4_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00581c00`. The helper computes squared length from the caller XYZW tuple, compares it against a nearby epsilon table under `0x00dbc00c`, returns a zero vec4 when the length is too small, and otherwise applies the same Newton-refined reciprocal-square-root scale before writing the normalized XYZW result. This is the safest current read for the shared normalize-or-zero vec4 helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection"
0x00581db0,1008,math_invert_4x4_matrix_and_optionally_store_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Primary 4x4 matrix inversion helper. The function derives the cofactor bands for the caller source matrix, accumulates the determinant, optionally stores that determinant through the caller outparam, returns failure when the determinant is zero, and otherwise scales the cofactor matrix by the reciprocal determinant before writing the inverse to the caller output. This is the safest current read for the shared invert-4x4 helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection"
0x00582070,352,math_apply_4d_basis_rows_to_four_vec4_rows_transposed_output,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-output sibling to `0x00581ab0`. The helper applies one 4-row basis block to each row of a caller 4x4 source block, then repacks the four transformed vec4 rows into a transposed or column-packed output layout before storing them to the caller destination. This is the safest current read for the shared four-row 4D basis application helper with packed transposed output.","objdump + local disassembly + SSE arithmetic inspection"
0x005821d0,164,math_compute_4d_cross_product_from_three_vec4_inputs,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Standalone 4D vector helper over three caller vec4 inputs. The function computes the alternating-sign generalized cross-product style combination of those three vectors and writes the resulting vec4 through the caller output. The final sign flip through mask `0x00627ce0` is part of the same determinant-style construction, so this is the safest current read for the shared 4D cross-product helper rather than a subsystem-specific owner.","objdump + local disassembly + SSE arithmetic inspection"
0x00582280,160,math_normalize_vec4_unchecked,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Unchecked vec4 normalization helper. The function computes squared length from the caller XYZW tuple, derives one reciprocal-square-root scale with Newton refinement, and writes the normalized vec4 without the small-epsilon zeroing guard used by `0x00581cd0`.","objdump + local disassembly + SSE arithmetic inspection"
0x00582320,176,math_sample_cubic_basis_vec3_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Cubic-basis interpolation helper over one scalar parameter and four caller vec3 control points. The function builds four basis weights from the scalar through the constant tables at `0x00627d10..0x00627d40`, multiplies each control point by its corresponding weight, and writes the blended vec3 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x005823e0,136,math_sample_cubic_basis_vec2_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec2 sibling to `0x00582320`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies them to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x00582470,165,math_sample_cubic_basis_vec4_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00582320`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies them to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x00582520,181,math_sample_alternate_cubic_basis_vec3_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Alternate-basis vec3 interpolation sibling. The helper again derives four weights from the caller scalar parameter, but uses the alternate constant tables at `0x00627d50..0x00627d80` before applying those weights to four caller vec3 control points and writing the blended vec3 result. This is the safest current read for the alternate cubic-basis vec3 sampler rather than a subsystem-specific curve owner.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x005825e0,153,math_sample_alternate_cubic_basis_vec4_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00582520`. The helper derives the same alternate cubic-basis weights from the caller scalar parameter, applies them to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x00582680,133,math_sample_alternate_cubic_basis_vec2_from_four_control_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec2 sibling to `0x00582520`. The helper derives the same alternate cubic-basis weights from the caller scalar parameter, applies them to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + SSE arithmetic inspection + interpolation correlation"
0x00582710,89,math_blend_vec3_from_origin_and_two_targets_by_two_scalars,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Two-scalar affine blend helper over three caller vec3 points. The function computes `p0 + s*(p1-p0) + t*(p2-p0)` from the caller origin point, two target points, and scalar weights `s` and `t`, then writes the blended vec3 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + affine-blend correlation"
0x00582770,70,math_blend_vec4_from_origin_and_two_targets_by_two_scalars,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec4 sibling to `0x00582710`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec4 points and two scalar weights, then writes the blended vec4 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + affine-blend correlation"
0x005827c0,79,math_blend_vec2_from_origin_and_two_targets_by_two_scalars,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Vec2 sibling to `0x00582710`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec2 points and two scalar weights, then writes the blended vec2 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + affine-blend correlation"
0x00582820,188,math_intersect_plane_vec4_with_vec3_segment,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Geometric intersection helper over one plane vec4 and two caller vec3 endpoints. The function evaluates the plane against both endpoints, derives the affine parameter along the segment between them, returns null when the denominator collapses to zero, and otherwise writes the intersection point `p0 + t*(p1-p0)` through the caller output. This is the safest current read for the shared plane-versus-segment intersection helper rather than a subsystem-specific query.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation"
0x005828e0,203,math_measure_4x4_matrix_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Standalone 4x4 determinant helper. The function forms the required cofactor combinations from the caller matrix rows, contracts them against the first row, and returns the resulting determinant scalar through the x87 return path. Current evidence is strongest for a shared determinant helper paired with the nearby inversion body `0x00581db0`.","objdump + local disassembly + SSE arithmetic inspection + matrix-correlation"
0x005829b0,226,math_build_plane_vec4_from_three_vec3_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Three-point plane builder over caller vec3 inputs. The function forms two edge vectors from the three points, computes their cross product, normalizes that resulting normal, stores the plane normal through output `[+0x00..+0x08]`, and writes the signed plane constant `-dot(normal, p0)` to `[out+0x0c]`. This is the safest current read for the shared plane-from-three-points helper rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation"
0x00582aa0,392,math_build_4x4_projective_matrix_from_plane_vec4_and_vec4_input,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Shared plane-driven 4x4 matrix builder over one caller plane vec4 and one second vec4 input. The function normalizes the plane against the XYZ-length of its first three lanes, computes one diagonal dot term against the second vec4, combines that term with per-plane outer-product bands, and writes the resulting 4x4 matrix to the caller output. The current formula is tight enough to bound this as a projective plane-and-vec4 matrix helper, but not yet tight enough to overname it as one specific API variant.","objdump + local disassembly + SSE arithmetic inspection + geometry correlation + projective-matrix correlation"
0x00582c30,209,math_build_4x4_rotation_matrix_from_quaternion,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion-to-matrix helper. The function normalizes the caller quaternion-like vec4, applies the standard doubled-product combinations through the constant tables at `0x00627e10..0x00627e80`, and writes a 4x4 rotation matrix to the caller output. This is the safest current read for the shared quaternion-to-4x4 rotation-matrix builder rather than a higher-level owner body.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation"
0x00582d10,130,math_multiply_quaternions,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion product helper over two caller vec4 inputs. The function applies the expected sign-mask and shuffle pattern for Hamilton-product-style quaternion composition and writes the resulting vec4 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation"
0x00582da0,128,math_normalize_quaternion_unchecked,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Unchecked quaternion normalization helper. The function computes the caller quaternion length, derives one reciprocal-square-root scale with Newton refinement, and writes the normalized vec4 without the small-epsilon guard used by the nearby zero-safe normalizers.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation"
0x00582e40,109,math_invert_quaternion_by_conjugate_over_squared_length,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Quaternion inverse helper over one caller vec4. The function flips the sign of the spatial XYZ lanes, preserves the scalar W lane, divides that conjugate by the squared quaternion length, and writes the resulting vec4 through the caller output. This is the safest current read for the shared quaternion-inverse helper rather than a subsystem-specific owner.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation"
0x00582eb0,274,math_build_quaternion_from_3x3_rotation_matrix,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Rotation-matrix-to-quaternion helper over one caller 3x3 row block. The function checks the matrix trace, takes the usual positive-trace fast path when possible, otherwise selects the dominant diagonal lane and rebuilds the remaining quaternion components from the expected off-diagonal differences and sums before writing the resulting vec4 to the caller output. This is the safest current read for the shared 3x3-rotation-matrix-to-quaternion builder.","objdump + local disassembly + x87 arithmetic inspection + quaternion correlation"
0x00582fd0,191,math_build_quaternion_from_three_euler_angles_via_half_angle_trig,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Three-angle quaternion builder over caller scalar inputs. The function packs the three caller angles with one zero lane, scales them by `0.5`, routes that half-angle tuple through packed trig helper `0x0058aa70`, and combines the resulting sine and cosine lanes into one quaternion vec4 before storing it through the caller output. The current evidence is strong enough for a shared Euler-angle-to-quaternion helper, but not yet for a tighter axis-order claim.","objdump + local disassembly + SSE arithmetic inspection + quaternion correlation + packed-trig correlation"
0x005830a0,176,math_apply_packed_3x3_basis_to_vec3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row 3D basis helper over one caller vec3 input and one compact 3x3 basis block. The function multiplies the input X, Y, and Z scalars by three packed matrix rows and stores the resulting XYZ triple through the caller output, with aligned and unaligned load paths that preserve the same semantics.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation"
0x00583160,175,math_apply_packed_3x3_basis_and_translation_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row translation-bearing sibling to `0x005830a0`. The helper multiplies one caller vec3 input by three packed basis rows, adds one packed translation row, and stores the resulting full vec4 through the caller output. Both aligned and unaligned load paths preserve the same transform semantics.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation"
0x00583220,243,math_apply_packed_3x3_basis_translation_and_project_vec3_by_reciprocal_lane3,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Projective packed-row sibling to `0x00583160`. The helper builds the same transformed 4-lane vector from one caller vec3 input plus packed basis and translation rows, derives a reciprocal from lane 3, scales the vector by that reciprocal, and stores the projected XYZ triple through the caller output. The aligned and unaligned legs preserve the same transform-plus-project behavior.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + projection correlation"
0x00583320,184,math_apply_packed_4x4_basis_to_vec4,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row 4D basis helper over one caller vec4 input and one packed 4x4 row block. The function multiplies each input lane by its corresponding packed row, sums the four products, and stores the resulting vec4 through the caller output, again preserving the same behavior across aligned and unaligned load paths.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation"
0x005833e0,324,math_apply_packed_4x4_basis_to_four_vec4_rows,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Batch packed-row sibling to `0x00583320`. The helper applies one packed 4x4 basis block to each of four caller vec4 rows from a source block and writes the four transformed rows back to the caller output block at offsets `+0x00`, `+0x10`, `+0x20`, and `+0x30`.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation"
0x00583530,196,math_normalize_packed_vec3_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row vec3 normalization sibling to `0x00581c00`. The helper computes squared length from the caller XYZ triple, compares it against the nearby epsilon table under `0x00dbc180`, returns a zero vector when the length is too small, and otherwise applies one Newton-refined reciprocal-square-root scale before writing the normalized XYZ result.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + normalization correlation"
0x00583600,216,math_normalize_packed_vec4_or_zero_below_epsilon,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row vec4 normalization sibling to `0x00581cd0`. The helper computes squared length from the caller XYZW tuple, compares it against the nearby epsilon table under `0x00dbc18c`, returns a zero vec4 when the length is too small, and otherwise applies one Newton-refined reciprocal-square-root scale before writing the normalized XYZW result.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + normalization correlation"
0x005836e0,695,math_invert_packed_4x4_matrix_and_optionally_store_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row 4x4 inversion sibling to `0x00581db0`. The helper expands the packed 4x4 source rows, derives the required cofactor bands and determinant scalar, optionally stores that determinant through the caller outparam, returns failure when the determinant collapses to zero, and otherwise scales the cofactor matrix by the reciprocal determinant before writing the packed inverse to the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + matrix-inversion correlation"
0x005839a0,342,math_apply_packed_4x4_basis_to_four_vec4_rows_transposed_output,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-output batch sibling to `0x005833e0`. The helper applies one packed 4x4 basis block to each of four caller vec4 rows from a source block, then repacks the transformed lanes into a transposed or column-packed output layout before storing the four result rows.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + transposed-output correlation"
0x00583b00,164,math_compute_packed_4d_cross_product_from_three_vec4_inputs,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x005821d0`. The helper takes three caller vec4 inputs, forms the same alternating-sign generalized 4D cross-product style combination through shuffle, multiply, and subtract bands, applies the final sign-mask adjustment under `0x00627ee0`, and writes the resulting vec4 through the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + 4d-cross-product correlation"
0x00583cc0,201,math_measure_packed_4x4_matrix_determinant,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row determinant sibling to `0x005828e0`. The helper expands the packed 4x4 row block, forms the same cofactor combinations as the wider determinant strip, contracts them against the first packed row, and returns the resulting determinant scalar through the x87 return path.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + matrix-determinant correlation"
0x00583bb0,121,math_build_single_angle_packed_4x4_axial_rotation_matrix_variant_a,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Single-angle packed 4x4 rotation-matrix helper above interleaved trig worker `0x0058ac60`. The function broadcasts one caller angle, derives one interleaved sine/cosine tuple through `0x0058ac60`, combines that tuple with fixed identity-row constants, and writes one packed 4x4 axial rotation-matrix variant to the caller output. The current evidence is strong enough for a fixed-axis rotation-matrix constructor, but not yet for a tighter axis label.","objdump + local disassembly + caller correlation + packed-matrix correlation + trig correlation"
0x00583c30,128,math_build_single_angle_packed_4x4_axial_rotation_matrix_variant_b,support,cdecl,inferred,objdump + local disassembly + caller correlation,2,"Sibling single-angle packed 4x4 rotation-matrix helper above `0x0058ac60`. Like `0x00583bb0`, it broadcasts one caller angle, derives one interleaved sine/cosine tuple through the shared trig worker, combines that tuple with fixed identity-row constants in a different lane arrangement, and writes one second packed 4x4 axial rotation-matrix variant to the caller output. The safest current read is a second fixed-axis rotation-matrix constructor rather than a tighter axis-specific label.","objdump + local disassembly + caller correlation + packed-matrix correlation + trig correlation"
0x00583d90,226,math_build_plane_vec4_from_three_packed_vec3_points,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row three-point plane builder sibling to `0x005829b0`. The helper forms two edge vectors from three caller vec3 points, computes their cross product, normalizes that resulting normal, stores the plane normal through the caller output, and writes the signed plane constant to `[out+0x0c]`.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + geometry correlation"
0x00583e80,392,math_build_packed_4x4_projective_matrix_from_plane_vec4_and_vec4_input,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x00582aa0`. The helper normalizes the caller plane vec4 against the XYZ length of its first three lanes, computes one diagonal dot term against the second vec4 input, combines that term with per-plane outer-product bands, and writes the resulting packed 4x4 matrix to the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + geometry correlation + projective-matrix correlation"
0x00584010,209,math_build_packed_4x4_rotation_matrix_from_quaternion,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row quaternion-to-matrix sibling to `0x00582c30`. The helper normalizes the caller quaternion-like vec4, applies the same doubled-product combinations through the packed constant tables at `0x00627f70..0x00627fe0`, and writes a packed 4x4 rotation matrix to the caller output.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + quaternion correlation"
0x005840f0,274,math_build_quaternion_from_packed_3x3_rotation_matrix,support,cdecl,inferred,objdump + local disassembly + x87 arithmetic inspection,2,"Packed-row rotation-matrix-to-quaternion sibling to `0x00582eb0`. The helper checks the packed 3x3 trace, takes the positive-trace fast path when possible, otherwise selects the dominant diagonal lane and rebuilds the remaining quaternion components from the expected packed off-diagonal differences and sums before writing the resulting vec4 to the caller output.","objdump + local disassembly + x87 arithmetic inspection + packed-matrix correlation + quaternion correlation"
0x00584210,191,math_build_quaternion_from_three_euler_angles_via_packed_half_angle_trig,support,cdecl,inferred,objdump + local disassembly + SSE arithmetic inspection,2,"Packed-row sibling to `0x00582fd0`. The helper packs three caller angles with one zero lane, scales them by `0.5`, routes that tuple through packed trig helper `0x0058ad50`, and combines the resulting sine and cosine lanes into one quaternion vec4 before storing it through the caller output. Current evidence is strong enough for a shared Euler-angle-to-quaternion helper, but not yet for a tighter axis-order claim.","objdump + local disassembly + SSE arithmetic inspection + packed-matrix correlation + quaternion correlation + packed-trig correlation"
0x005842e0,151,math_multiply_quaternions_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582d10`. The helper loads two caller quaternion-like vec4 inputs, applies the same sign-mask and pairwise multiply-add or subtract pattern used by the SSE quaternion-product strip, and writes the resulting vec4 through the caller output before `femms`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation"
0x00584379,90,math_normalize_vec4_or_zero_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 normalize-or-zero helper. The function computes squared length from the caller vec4, compares it against the nearby epsilon constant at `0x005df610`, and when the length is large enough scales the full vec4 by one reciprocal-square-root refinement before writing it to the caller output; smaller inputs collapse to zero through the same mask path.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation"
0x005843d6,179,math_normalize_vec3_with_optional_length_outparam_and_default_axis_fallback_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec3 normalization helper with two optional outparams. The function computes the squared XYZ length from the caller source block, optionally writes the normalized vec3 through one caller outparam, optionally writes a derived scalar magnitude through another, and when the input collapses below the epsilon threshold falls back to a fixed default-axis vector plus zero magnitude. This is the safest current read for the shared vec3 normalize-with-length helper without overclaiming the exact downstream semantic of the scalar outparam.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation"
0x00584489,1073,math_build_quaternion_from_3x3_rotation_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582eb0`. The helper inspects the same 3x3 rotation-matrix trace and dominant diagonal cases, chooses one of the expected reconstruction branches, and writes the resulting quaternion vec4 through the caller output before `femms`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + matrix-correlation"
0x005848ba,195,math_build_quaternion_from_three_euler_angles_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582fd0`. The helper halves the three caller Euler angles, routes those half angles through scalar trig worker `0x0058b660`, and combines the resulting sine and cosine values into one quaternion vec4 before storing it through the caller output. Current evidence is strong enough for a shared Euler-angle-to-quaternion helper, but not yet for a tighter axis-order claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + trig correlation"
0x0058497f,106,math_build_quaternion_from_axis_vec3_and_angle_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow axis-angle-to-quaternion helper. The function first normalizes one caller axis vec3 through `0x005896d2`, halves the caller angle, routes that half-angle through trig worker `0x0058b660`, scales the normalized axis by the sine-like lane, and writes the resulting quaternion vec4 with the cosine-like scalar lane in `W`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + axis-angle correlation + trig correlation"
0x005849eb,309,math_interpolate_quaternion_slerp_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow quaternion slerp helper over two caller quaternion-like vec4 inputs and one scalar interpolation factor. The function measures the 4D dot product, takes the expected small-angle fast path, otherwise derives one angular term through `0x0058af80` and two sine-weight terms through `0x0058b780`, then writes the weighted combination through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + slerp correlation"
0x00584b22,139,math_blend_three_quaternion_controls_by_two_parameter_nested_slerp_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Two-parameter nested quaternion-slerp helper. The function first forms `u+v`, performs two intermediate slerps from one shared control quaternion to two neighboring controls through `0x005849eb`, derives relative blend weight `v/(u+v)`, and then slerps between those intermediates into the caller output. The safest current read is a barycentric or triangular nested-slerp helper rather than a tighter named spline family.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + nested-slerp correlation"
0x00584baf,144,math_blend_three_quaternion_controls_by_quadratic_nested_slerp_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Quadratic nested quaternion-slerp helper. The function first builds two intermediate slerps at the same parameter `t` through `0x005849eb`, derives the classic quadratic blend scalar `2*t*(1-t)`, and then slerps between those intermediates into the caller output. This is the safest current read for a three-control quaternion curve helper without overclaiming the exact higher-level spline family.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + nested-slerp correlation"
0x00584c41,98,math_invert_quaternion_by_conjugate_over_squared_length_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582e40`. The helper conjugates the caller quaternion by negating `XYZ` while preserving `W`, divides that conjugate by the squared quaternion length, and writes the resulting inverse quaternion through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation"
0x00584ca5,165,math_build_axis_angle_vec4_from_quaternion_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow quaternion-to-axis-angle extractor. The function reads the scalar `W` lane, derives one angular term through `0x0058b080` and `0x0058b780`, conditionally rescales the `XYZ` lanes by the reciprocal sine factor when that angle is not degenerate, and writes the resulting axis-angle-style vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + axis-angle correlation"
0x00584d4c,163,math_build_quaternion_from_scaled_axis_vec3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow scaled-axis-to-quaternion helper. The function measures the length of the caller vec3, routes that magnitude through trig worker `0x0058b660`, conditionally rescales the `XYZ` lanes by the reciprocal magnitude, and writes a quaternion-style vec4 whose `XYZ` lanes hold the scaled axis contribution and whose `W` lane receives the cosine-like scalar result. This is the safest current read for a shared scaled-axis-to-quaternion helper without overclaiming the exact upstream representation.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + axis-angle correlation + trig correlation"
0x00584df1,396,math_build_two_inner_quaternion_spline_controls_from_four_keys_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow quaternion spline-control builder over four caller key quaternions. The helper first aligns neighboring keys onto the same hemisphere by comparing sum-vs-difference norms, then around each interior key converts the two neighboring relative quaternions through the already-grounded inverse, axis-angle, and scaled-axis helpers, averages those tangent-like terms, exponentiates back into a quaternion, and multiplies by the interior key to write two inner control quaternions through the caller output buffer. The safest current read is a four-key inner-control builder for quaternion spline interpolation rather than a tighter spline-family label.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + spline-control correlation"
0x0058584a,559,math_multiply_4x4_matrices_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow 4x4 matrix-multiply owner. The helper first repacks one caller matrix from the split qword row layout used by the neighboring constructors into temporary contiguous rows on the stack, then multiplies a second caller 4x4 matrix by those repacked rows and writes the product through the caller output buffer. The safest current read is a non-alias-staging sibling of the later packed 4x4 multiply family rather than a subsystem-specific API.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + matrix-multiply correlation"
0x00585a7c,207,math_compute_determinant_of_upper_3x3_basis_from_split_4x4_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow scalar determinant helper over one split-layout 4x4 matrix. The function forms the expected 3x3 cofactor bands from the upper basis rows, completes the final cofactor expansion against the remaining basis row, accumulates the result to one scalar lane, and returns that determinant through `st0`. The safest current read is a determinant-of-basis helper rather than a tighter affine-class predicate.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + determinant correlation"
0x00585b4b,80,math_build_4x4_translation_matrix_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow row-major translation-matrix constructor. The helper seeds the three identity rows from `0x005df668` and `0x005df660`, writes the three caller translation scalars into the trailing homogeneous row, and returns the finished 4x4 matrix through the caller output buffer.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation"
0x00585b9b,235,math_build_4x4_projective_matrix_from_plane_vec4_and_vec4_input_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582aa0`. The helper normalizes the caller plane vec4 against the XYZ length of its first three lanes through `0x0058a988`, computes one diagonal dot term against the second vec4 input, combines that dot term with the expected negated outer-product bands, and writes the resulting 4x4 matrix to the caller output. The current formula is tight enough to bound this as the MMX plane-driven projective matrix helper without overclaiming one specific API variant.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + geometry correlation + projective-matrix correlation"
0x00585c86,220,math_build_4x4_reflection_matrix_from_plane_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow plane-reflection matrix helper. The function normalizes the caller plane vec4 through `0x0058a988`, forms the expected `1 - 2*n*n^T` diagonal terms plus the paired `-2*n_i*n_j` off-diagonal bands, and writes the resulting homogeneous 4x4 reflection-style matrix to the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + plane-reflection correlation"
0x00585d62,97,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. The function routes one caller angle through scalar trig worker `0x0058b660`, seeds the fixed identity rows from constants `0x005df668` and `0x005df660`, and writes one axial rotation-matrix variant to the caller output. The current evidence is strong enough for a fixed-axis rotation-matrix constructor, but not yet for a tighter axis label.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation"
0x00585dc5,94,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Sibling MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. Like `0x00585d62`, it routes one caller angle through `0x0058b660`, combines the resulting sine or cosine lanes with the same identity-row constants in a different layout, and writes one second axial rotation-matrix variant to the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation"
0x00585e23,87,math_build_single_angle_4x4_axial_rotation_matrix_mmx_3dnow_variant_c,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Third MMX or 3DNow single-angle 4x4 axial rotation-matrix helper. The function routes one caller angle through `0x0058b660`, seeds the remaining fixed identity rows, and writes one third axial rotation-matrix variant to the caller output. The safest current read is a third fixed-axis rotation-matrix constructor rather than a tighter axis-specific label.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + trig correlation"
0x00585e7c,67,math_build_4x4_scale_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow diagonal scale-matrix constructor. The helper writes the three caller scalar scale lanes onto the homogeneous 4x4 diagonal, clears the off-diagonal lanes, and seeds the trailing homogeneous `1.0f` row or column from `0x005df660`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + scale correlation"
0x00585ec3,110,math_transpose_or_repack_4x4_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Small MMX or 3DNow 4x4 matrix repack helper. It reads the caller matrix in one split qword layout, unpacks the low and high dword pairs across the four rows, and writes the reordered 4x4 matrix to the caller output. The safest current read is a transpose or row-column repack helper rather than a higher-level owner.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + repack correlation"
0x00585f32,57,math_build_identity_4x4_matrix_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly,2,"MMX or 3DNow identity-matrix constructor. The helper seeds the diagonal with `1.0f` from `0x005df590`, clears the off-diagonal lanes, and writes the resulting homogeneous 4x4 identity matrix to the caller output.","objdump + local disassembly + matrix correlation + identity correlation"
0x00585f6b,199,math_build_4x4_rotation_matrix_from_quaternion_mmx_3dnow_variant_a,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow quaternion-to-4x4 rotation-matrix helper. The function doubles the caller quaternion lanes, forms the expected pairwise product bands, combines them with the fixed `1 - 2*...` diagonal terms from `0x005df5a0`, and writes one 4x4 rotation-matrix layout to the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + matrix correlation"
0x0058603d,181,math_build_4x4_rotation_matrix_from_quaternion_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Sibling MMX or 3DNow quaternion-to-4x4 rotation-matrix helper. It uses the same doubled-lane and pairwise-product construction as `0x00585f6b`, but writes the resulting rotation terms in a second lane layout to the caller output. The safest current read is a second quaternion-to-matrix variant rather than a tighter row- or column-major claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + quaternion correlation + matrix correlation"
0x005860f2,1655,math_build_4x4_transform_from_optional_translation_base_rotation_pivoted_post_rotation_and_translation_delta_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow transform-matrix owner over one output matrix, one optional base rotation quaternion, one optional base translation vec3, one optional pivot vec3, one optional post-rotation quaternion, and one optional trailing translation delta vec3. The helper builds identity when no base translation is present, otherwise seeds a pure translation matrix or translation-plus-base-rotation matrix, then optionally applies a second quaternion rotation about the caller pivot by subtracting the pivot from the translation row, multiplying through the post-rotation matrix, and adding the pivot back, and finally adds one trailing translation delta when that last pointer is non-null. The safest current read is a shared affine-transform builder rather than a subsystem-specific pose API.","objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation + quaternion correlation + pivot-rotation correlation"
0x0058728a,421,math_build_4x4_rotation_matrix_from_three_angles_via_half_angle_trig_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection + constant inspection,2,"MMX or 3DNow three-angle 4x4 rotation-matrix builder. The helper halves the three caller angle scalars through the `0.5f` pair at `0x005df630`, routes those half-angles through trig worker `0x0058b660`, combines the resulting sine or cosine lanes through the same doubled-product and `1 - 2*...` bands used by the nearby quaternion-to-matrix helpers, and writes one 4x4 rotation-matrix layout to the caller output. The safest current read is a three-angle rotation constructor via half-angle trig rather than a tighter Euler-order claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + constant inspection + trig correlation + quaternion-formula correlation + matrix correlation"
0x0058742f,308,math_build_4x4_transform_from_uniform_scale_optional_pivoted_rotation_quaternion_and_translation_delta_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + constant inspection,2,"Broader MMX or 3DNow transform-matrix owner over one output matrix, one uniform scalar scale, one optional pivot vec3, one optional rotation quaternion, and one optional trailing translation delta vec3. The helper first seeds a diagonal scale matrix from the caller scalar plus the fixed homogeneous `1.0f` lane at `0x005df580`, then optionally applies one quaternion rotation about the caller pivot by subtracting the pivot from the translation row, multiplying through the rotation matrix, and adding the pivot back, and finally adds one trailing translation delta when that last pointer is non-null.","objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + constant inspection + matrix correlation + scale correlation + quaternion correlation + pivot-rotation correlation"
0x00587963,281,math_build_4x4_rotation_matrix_from_axis_vec3_and_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow axis-angle 4x4 rotation-matrix helper. The function first normalizes one caller axis vec3 through `0x005896d2`, routes the caller angle through trig worker `0x0058b660`, forms the expected Rodrigues-style `axis*axis*(1-c)`, `axis*s`, and diagonal `c + axis*axis*(1-c)` bands, and writes the resulting 4x4 rotation matrix through the caller output buffer.","objdump + local disassembly + caller-shape inspection + MMX-3DNow arithmetic inspection + axis-angle correlation + trig correlation + matrix correlation"
0x00587a7c,4436,math_build_4x4_transform_from_optional_translation_two_optional_pivoted_rotation_quaternions_and_translation_delta_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow transform-matrix owner over one output matrix, one optional first pivot vec3, one optional first rotation quaternion, one optional base translation vec3, one optional second pivot vec3, one optional second rotation quaternion, and one optional trailing translation delta vec3. The helper builds identity when the base translation is absent, otherwise seeds a pure translation matrix or translation-plus-first-rotation matrix, optionally applies that first rotation about the first caller pivot, then optionally applies a second quaternion rotation about the second caller pivot, and finally adds one trailing translation delta when that last pointer is non-null. The safest current read is a broader shared affine-transform builder with up to two pivoted quaternion stages rather than a subsystem-specific pose API.","objdump + local disassembly + branch-structure inspection + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation + quaternion correlation + pivot-rotation correlation"
0x00588eb2,1013,math_multiply_4x4_matrices_with_alias_safe_rhs_staging_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow 4x4 matrix-multiply owner. The helper first repacks one caller source matrix into a temporary contiguous row layout, multiplies those four rows by the second caller 4x4 matrix, and writes the product through the caller output buffer. When the destination aliases the right-hand input matrix it stages the product in temporary storage and copies it back afterward, so the safest current read is an alias-safe packed 4x4 multiply helper rather than a narrower subsystem API.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + matrix-multiply correlation + alias-staging correlation"
0x00588bd0,738,math_invert_4x4_matrix_variant_b_and_optionally_write_determinant_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Alternate MMX or 3DNow 4x4 matrix inverse helper. Like `0x005892aa`, the function expands the caller matrix into cofactor-like bands, optionally writes one determinant scalar through a caller out-parameter when that pointer is non-null, returns early when that determinant collapses to zero, and otherwise writes the reciprocal-determinant-scaled inverse matrix through the caller output buffer. The safest current read is a second inverse helper variant rather than a tighter matrix-class claim.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + inverse correlation + determinant correlation"
0x005892aa,820,math_invert_4x4_matrix_and_optionally_write_determinant_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Broader MMX or 3DNow 4x4 matrix inverse helper. The function expands the caller matrix into the expected cofactor bands, accumulates the determinant into one optional caller scalar out-parameter when that pointer is non-null, returns early when that determinant collapses to zero, and otherwise writes the adjugate scaled by the reciprocal determinant through the caller output buffer.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + inverse correlation + determinant correlation"
0x005895de,28,math_invert_4x4_matrix_and_optionally_write_determinant_mmx_3dnow_wrapper,support,cdecl,inferred,objdump + local disassembly,2,"Tiny FEMMS wrapper around `0x005892aa`. It forwards the three caller parameters unchanged to the broader MMX 4x4 inverse helper and then returns the caller output pointer.","objdump + local disassembly + wrapper correlation"
0x005895fa,112,math_apply_3d_basis_rows_and_translation_to_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581830`. The helper broadcasts the caller XYZ triple, multiplies those broadcasts by the first three rows of one caller 4x4 basis block, adds the translation row at `[basis+0x30]` and `[basis+0x38]`, and stores the resulting full vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation"
0x0058966b,103,math_apply_3d_basis_rows_to_vec3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581770`. The helper broadcasts the caller XYZ triple, multiplies those broadcasts by the first three rows of one caller basis block, sums the three product bands, and stores the resulting XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
0x005896d2,95,math_normalize_vec3_or_zero_below_epsilon_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec3 normalization sibling to `0x00581c00`. The function computes squared length from the caller XYZ triple, compares it against the nearby epsilon constant at `0x005df610`, returns a zero vector when the length is too small, and otherwise applies one reciprocal-square-root refinement before writing the normalized XYZ result.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation"
0x00589731,113,math_blend_vec3_by_two_affine_scalars_from_three_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582710`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec3 control points and two caller scalar weights, then writes the blended XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + affine-blend correlation"
0x005897a2,213,math_sample_cubic_basis_vec3_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582320`. The helper derives four cubic-basis weights from the caller scalar parameter through the same local constant strip, applies those weights to four caller vec3 control points, and writes the blended XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + cubic-basis correlation"
0x00589876,234,math_sample_alternate_cubic_basis_vec3_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582520`. The helper derives the alternate cubic-basis weight family from the caller scalar parameter through the nearby MMX constant strip, applies those weights to four caller vec3 control points, and writes the blended XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + alternate-basis correlation"
0x00589960,140,math_apply_3d_basis_rows_translation_and_project_vec3_by_reciprocal_lane3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005818f0`. The helper builds the same translated four-lane transform result from one caller XYZ triple and one 4x4 basis block, derives a reciprocal from lane `3`, scales the transformed vector by that reciprocal, and stores the resulting XYZ triple through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + projective correlation"
0x005899eb,456,math_apply_4d_basis_rows_to_four_vec4_rows_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581ab0`. The helper applies one caller 4x4 basis block to each of four caller vec4 rows from a source block and writes the four transformed vec4 rows back to the caller output block at offsets `+0x00`, `+0x10`, `+0x20`, and `+0x30`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
0x00589bb2,5,math_apply_3d_basis_rows_translation_and_project_vec3_by_reciprocal_lane3_mmx_3dnow_thunk,support,cdecl,inferred,objdump + local disassembly,2,"Jump thunk into `0x00589960`, the MMX or 3DNow projective vec3 transform helper.","objdump + local disassembly + wrapper correlation"
0x00589bb7,392,math_apply_vec3_through_optional_4x4_chain_and_optional_viewport_map_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection,2,"Broader MMX or 3DNow projective transform owner over one caller vec3, up to three optional 4x4 matrix inputs, and one optional integer viewport-style range block. The helper selects identity, one matrix, or the ordered composition of two or three matrices through `0x005899eb`, applies the resulting chain through `0x00589960`, and when the optional range block is present remaps the projected normalized result into that caller integer range before returning.","objdump + local disassembly + matrix correlation + projective correlation + viewport-range correlation"
0x00589d3f,518,math_apply_vec3_through_optional_inverse_4x4_chain_and_optional_inverse_viewport_map_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection,2,"Inverse-side sibling to `0x00589bb7`. The helper selects identity or the ordered composition of up to three optional 4x4 matrices through `0x005899eb`, inverts the chosen chain through `0x005892aa`, optionally maps one caller integer viewport-style coordinate triple back into the normalized projective range, and then applies the inverse chain through `0x00589960`. The safest current read is an MMX unproject or inverse-projective helper without overclaiming one subsystem-specific API.","objdump + local disassembly + matrix correlation + inverse correlation + projective correlation + viewport-range correlation"
0x00589f67,303,math_apply_vec3_through_optional_inverse_4x4_chain_variant_b_and_optional_inverse_viewport_map_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + caller-shape inspection,2,"Adjacent inverse-side sibling to `0x00589d3f`. The helper selects identity or the ordered composition of up to three optional 4x4 matrices through `0x005899eb`, routes the chosen chain through inverse helper variant `0x00588bd0`, optionally maps one caller integer viewport-style coordinate triple back into the normalized projective range, and then applies the resulting inverse chain through `0x00589960`. The safest current read is a second MMX unproject or inverse-projective helper variant rather than a tighter API claim.","objdump + local disassembly + matrix correlation + inverse correlation + projective correlation + viewport-range correlation"
0x0058a0b8,79,math_apply_2d_basis_rows_and_translation_to_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581690`. The helper broadcasts the caller XY pair, multiplies those broadcasts by the first two rows of one caller 4x4 basis block, adds the translation row at `[basis+0x30]` and `[basis+0x38]`, and stores the resulting full vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + translation correlation"
0x0058a10d,55,math_apply_2d_basis_rows_to_vec2_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00581730`. The helper broadcasts the caller XY pair, multiplies those broadcasts by the first two rows of one caller basis block, sums the two product bands, and stores the resulting vec2 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
0x0058a146,100,math_apply_2d_basis_rows_translation_and_project_vec2_by_reciprocal_lane3_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005816d0`. The helper builds the same translated four-lane transform result from one caller XY pair and one 4x4 basis block, derives a reciprocal from lane `3`, scales the transformed vector by that reciprocal, and stores the resulting vec2 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + projective correlation"
0x0058a1aa,153,math_sample_cubic_basis_vec2_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec2 sibling to `0x005823e0`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies those weights to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + cubic-basis correlation"
0x0058a242,71,math_blend_vec2_by_two_affine_scalars_from_three_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec2 sibling to `0x005827c0`. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec2 control points and two caller scalar weights, then writes the blended vec2 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + affine-blend correlation"
0x0058a28b,65,math_normalize_vec2_or_zero_below_epsilon_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec2 normalization sibling to `0x00582320`'s lower-dimensional normalize helpers. The function computes squared length from the caller XY pair, compares it against the nearby epsilon constant at `0x005df610`, returns a zero vec2 when the length is too small, and otherwise applies one reciprocal-square-root refinement before writing the normalized XY result.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation"
0x0058a2ce,172,math_sample_alternate_cubic_basis_vec2_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x00582680`. The helper derives the alternate cubic-basis weight family from the caller scalar parameter through the nearby MMX constant strip, applies those weights to four caller vec2 control points, and writes the blended vec2 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + alternate-basis correlation"
0x0058a379,130,math_apply_4d_basis_rows_to_vec4_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow duplicate-layout sibling to `0x0058a9ec`. The helper broadcasts the caller XYZW lanes, multiplies those broadcasts by the four rows of one caller 4x4 basis block, sums the four product bands, and writes the resulting vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
0x0058a3fb,95,math_normalize_vec4_or_zero_below_epsilon_mmx_3dnow_variant_b,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow four-lane normalization sibling to `0x00584379`. The function computes squared length across all four caller lanes, compares that magnitude against the nearby epsilon constant at `0x005df610`, returns a zero vec4 when the length is too small, and otherwise applies one reciprocal-square-root refinement before writing the normalized vec4 result.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation"
0x0058a45a,306,math_compute_4d_cross_product_from_three_vec4_inputs_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005821d0`. The helper takes three caller vec4 inputs, forms the same alternating-sign generalized 4D cross-product-style combination through paired multiply-subtract bands, and writes the resulting vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + 4d-cross-product correlation + caller correlation"
0x0058a58c,113,math_blend_vec4_by_two_affine_scalars_from_three_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 sibling to the earlier affine blend strip. The helper computes `p0 + s*(p1-p0) + t*(p2-p0)` from three caller vec4 control points and two caller scalar weights, then writes the blended vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + affine-blend correlation"
0x0058a5fd,200,math_sample_cubic_basis_vec4_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 sibling to `0x00582470`. The helper derives the same four cubic-basis weights from the caller scalar parameter, applies those weights to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + cubic-basis correlation"
0x0058a6c5,223,math_sample_alternate_cubic_basis_vec4_from_four_control_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow vec4 sibling to `0x005825e0`. The helper derives the alternate cubic-basis weight family from the caller scalar parameter through the nearby MMX constant strip, applies those weights to four caller vec4 control points, and writes the blended vec4 result through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + interpolation correlation + alternate-basis correlation"
0x0058a7a3,65,math_build_plane_vec4_from_normal_vec3_and_point_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow plane builder over one caller normal vec3 and one point on that plane. The helper copies the incoming normal into the output `XYZ` lanes, computes the signed plane constant as the negated dot product of that normal with the caller point, and writes the resulting plane vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + geometry correlation + plane-correlation"
0x0058a7e6,229,math_build_plane_vec4_from_three_vec3_points_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005829b0`. The helper forms two edge vectors from three caller vec3 points, computes their cross-product-style normal, normalizes that resulting plane normal, derives the signed plane constant from one source point, and writes the resulting plane vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + geometry correlation + plane-correlation"
0x0058a8ca,190,math_intersect_origin_plane_normal_vec3_with_vec3_segment_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow geometric intersection helper over one plane-normal vec3 and two caller segment endpoints. The function derives the numerator and denominator for the plane-through-origin affine parameter, returns null when the denominator collapses to zero, and otherwise writes the intersection point `p0 + t*(p1-p0)` through the caller output. This is the safest current read for the MMX origin-plane-versus-segment sibling rather than a subsystem-specific query.","objdump + local disassembly + MMX-3DNow arithmetic inspection + geometry correlation + segment-intersection correlation"
0x0058a988,98,math_normalize_vec4_by_xyz_length_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow normalization helper over one caller vec4-like input. The function measures length from the first three lanes only, compares that squared XYZ length against the nearby epsilon constant at `0x005df610`, and when large enough scales the full four-lane payload by one reciprocal-square-root refinement before writing it through the caller output; smaller inputs collapse to zero through the same mask path. Current grounded callers are the broader matrix builders `0x00585b9b` and `0x00585c86`, so this is the safest current read for the shared normalize-by-XYZ-length helper rather than a full XYZW normalizer.","objdump + local disassembly + MMX-3DNow arithmetic inspection + normalization correlation + caller correlation"
0x0058a9ec,124,math_apply_4d_basis_rows_to_vec4_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"MMX or 3DNow sibling to `0x005819f0`. The helper broadcasts each input XYZW lane, multiplies those broadcasts by the corresponding four rows of one caller 4x4 basis block, sums the four product bands, and stores the resulting vec4 through the caller output.","objdump + local disassembly + MMX-3DNow arithmetic inspection + matrix correlation + caller correlation"
0x0058ac60,229,math_compute_interleaved_packed_sine_cosine_lanes_from_angles,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared packed trig helper over one caller vec4 of angles. The function performs sign extraction, range reduction, quadrant selection, and polynomial evaluation through the constant tables at `0x00628320..0x006283f0`, then returns one interleaved sine/cosine-style lane tuple in `xmm0`. Current grounded callers are the single-angle packed axial rotation-matrix builders `0x00583bb0` and `0x00583c30`, so the safest current read is an interleaved packed sine/cosine helper rather than a generic scalar polynomial.","objdump + local disassembly + polynomial-approximation inspection + trig correlation"
0x0058ad50,329,math_compute_packed_sine_and_cosine_vectors_from_angles,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared packed trig helper over one caller vec4 of angles and two caller output buffers. The function performs sign extraction, range reduction, quadrant selection, and dual polynomial evaluation through the constant tables at `0x00628400..0x00628520`, then writes one packed pair of sine/cosine result vectors through the two caller outputs. Current grounded caller is `0x00584210`, the packed Euler-angle-to-quaternion helper, so the safest current read is a packed sin/cos vector generator rather than a subsystem-specific math body.","objdump + local disassembly + polynomial-approximation inspection + trig correlation"
0x0058af80,244,math_compute_scalar_atan2_style_angle_from_y_and_x_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar angle helper over two caller float lanes. The function compares magnitudes, forms one min-over-max style ratio, evaluates a polynomial over that ratio, and then restores quadrant and sign through the constant strip at `0x006285d8..0x00628638`. Current grounded caller is quaternion slerp helper `0x005849eb`, so the safest current read is a scalar `atan2`-style angle worker rather than a narrower subsystem label.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation"
0x0058b080,247,math_compute_scalar_arccos_style_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar inverse-cosine-style helper over one caller float lane. The function clamps or folds the incoming magnitude against the nearby constant strip at `0x006285d8..0x00628638`, evaluates a reciprocal-square-root-assisted polynomial, and restores the correct signed or reflected branch before returning one angle-like scalar in `mm0`. Current grounded caller is quaternion-to-axis-angle helper `0x00584ca5`, so the safest current read is a scalar arccos-style angle worker rather than a tighter half-angle claim.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation"
0x0058b180,226,math_compute_scalar_arccos_style_angle_variant_b_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Adjacent MMX or 3DNow scalar inverse-cosine-style helper over one caller float lane. The body shares the same reciprocal-square-root-assisted polynomial strip as `0x0058b080`, but finishes through a different reflected or complemented angle reconstruction path before returning one scalar in `mm0`. The safest current read is a second arccos-style angle variant rather than a tighter named inverse-trig identity.","objdump + local disassembly + polynomial-approximation inspection + trig correlation"
0x0058b280,233,math_compute_scalar_natural_logarithm_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar logarithm helper over one caller float lane. The function decomposes the input into exponent and mantissa bands, evaluates a polynomial over the reduced mantissa through the constant strip at `0x00628648..0x0062866c`, folds back the exponent contribution, and returns one natural-log-style scalar in `mm0`. The nearby wrapper `0x0058b380` scales this result by `0.434294...`, which is the strongest current evidence for the natural-log interpretation.","objdump + local disassembly + polynomial-approximation inspection + logarithm correlation"
0x0058b380,17,math_compute_scalar_base10_logarithm_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Tiny wrapper over `0x0058b280`. The helper calls the natural-log worker and then scales the result by the float constant at `0x0062868c`, `0.434294...`, before returning; the safest current read is a shared base-10 logarithm helper.","objdump + local disassembly + constant inspection + logarithm correlation"
0x0058b3a0,224,math_compute_scalar_exponential_e_to_x_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection + constant inspection,2,"Shared MMX or 3DNow scalar exponential helper over one caller float lane. The function range-reduces the input through the nearby `log2(e)` and split-`ln(2)` constants at `0x0062863c..0x0062864c`, evaluates the reduced polynomial strip, reconstructs the exponent field by shifting the derived integer part into float-exponent position, and returns one `e^x`-style scalar in `mm0` with the expected overflow and underflow clamps. The safest current read is a scalar natural-exponential worker rather than a subsystem-specific transform helper.","objdump + local disassembly + polynomial-approximation inspection + constant inspection + exponential correlation"
0x0058b480,24,math_compute_scalar_square_root_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + MMX-3DNow arithmetic inspection,2,"Tiny MMX or 3DNow square-root helper over one caller scalar lane. The body seeds one reciprocal-square-root estimate through `pfrsqrt`, refines it with `pfrsqit1` and `pfrcpit2`, multiplies that reciprocal-square-root by the original input, and returns the resulting square-root-style scalar in `mm0`.","objdump + local disassembly + MMX-3DNow arithmetic inspection + square-root correlation"
0x0058b4a0,8,math_clear_scalar_float_sign_bit_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly,2,"Tiny MMX or 3DNow scalar absolute-value helper. The function clears the sign bit of the caller float lane with the mask at `0x00628578` and returns the resulting non-negative scalar in `mm0`.","objdump + local disassembly + constant inspection + absolute-value correlation"
0x0058b4c0,50,math_round_scalar_upward_to_integral_float_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Tiny MMX or 3DNow scalar rounding helper over one caller float lane. The body truncates the input toward zero through `pf2id` and `pi2fd`, detects whether a positive fractional remainder is still present, and adds one low-lane unit from the mixed constant pair at `0x00628558` before returning. The safest current read is a scalar `ceil`-style helper rather than a stricter IEEE-mode claim.","objdump + local disassembly + constant inspection + rounding correlation"
0x0058b500,37,math_round_scalar_downward_to_integral_float_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Tiny MMX or 3DNow scalar rounding helper over one caller float lane. The body truncates the input toward zero through `pf2id` and `pi2fd`, detects whether a negative fractional remainder is still present, and subtracts one low-lane unit from the mixed constant pair at `0x00628558` before returning. The safest current read is a scalar `floor`-style helper rather than a stricter IEEE-mode claim.","objdump + local disassembly + constant inspection + rounding correlation"
0x0058b540,64,math_split_scalar_float_into_normalized_mantissa_and_exponent_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Shared MMX or 3DNow scalar decomposition helper over one caller float lane. The function masks off sign and exponent bits, rebuilds a normalized mantissa lane with fixed exponent bits through the constants at `0x00628540..0x00628588`, derives the unbiased exponent as an integer-float lane, and returns the pair packed in `mm0`. The safest current read is a `frexp`-style mantissa or exponent splitter rather than a tighter ABI claim.","objdump + local disassembly + constant inspection + exponent-mantissa correlation"
0x0058b580,94,math_scale_scalar_float_by_integral_power_of_two_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + constant inspection,2,"Shared MMX or 3DNow scalar scaling helper over one caller float lane and one caller integer-like exponent lane. The function extracts the current exponent field, adds the requested exponent delta, reconstructs the float when the result stays in range, and otherwise returns the expected underflow or signed-overflow infinities through the mask strip at `0x00628568..0x00628580`. The safest current read is an `ldexp`-style scalar multiply-by-`2^n` helper.","objdump + local disassembly + constant inspection + exponent-mantissa correlation + scaling correlation"
0x0058b5de,18,math_split_scalar_float_into_fractional_and_integral_float_lanes_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly,2,"Tiny MMX or 3DNow scalar split helper over one caller float lane. The body truncates the input to integer with `pf2id` or `pi2fd`, subtracts that integral part from the original value, and returns the fractional and integral float lanes packed together in `mm0`. The safest current read is a compact `modf`-style split helper rather than a dedicated subsystem formatter.","objdump + local disassembly + split correlation"
0x0058b600,72,math_compute_scalar_fmod_style_remainder_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + arithmetic inspection,2,"Shared MMX or 3DNow scalar remainder helper over one caller dividend lane and one caller divisor lane. When the divisor is non-zero it multiplies the dividend by the reciprocal divisor, truncates that quotient toward zero, keeps only the fractional remainder, rescales by the divisor, and returns the resulting same-sign remainder in `mm0`; a zero divisor falls back to the constant at `0x00628578`. The safest current read is an `fmod`-style remainder helper rather than a tighter IEEE remainder claim.","objdump + local disassembly + arithmetic inspection + remainder correlation"
0x0058b660,280,math_compute_scalar_cosine_and_sine_pair_from_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar trig helper over one caller angle. The function performs sign extraction, range reduction, quadrant handling, and polynomial evaluation through the constant strip at `0x00628558..0x00628694`, then returns one packed cosine/sine-style lane pair in `mm0`. Current grounded callers are the MMX Euler-angle, axis-angle, scaled-axis, and single-angle rotation-matrix helpers, so the safest current read is a scalar cos/sin pair worker rather than a subsystem-specific helper.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation"
0x0058b780,280,math_compute_scalar_sine_lane_from_angle_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection,2,"Shared MMX or 3DNow scalar trig helper over one caller angle. The body matches `0x0058b660` through the same range-reduction and polynomial path, but duplicates the sine-like result lane before returning. Current grounded callers are quaternion slerp helper `0x005849eb` and quaternion-to-axis-angle helper `0x00584ca5`, so the safest current read is a scalar sine worker with duplicated output lane.","objdump + local disassembly + polynomial-approximation inspection + trig correlation + caller correlation"
0x0058b9e0,408,math_compute_scalar_power_x_to_y_mmx_3dnow,support,cdecl,inferred,objdump + local disassembly + polynomial-approximation inspection + constant inspection,2,"Broader MMX or 3DNow scalar power helper over one caller base lane and one caller exponent lane. The function preserves the sign of negative bases only when the exponent truncates to an integer with odd parity, derives the logarithm-like core from the absolute base through the same exponent or mantissa constants used by the adjacent scalar log worker, multiplies that core by the exponent, and then rebuilds the final result through the same exponential-style polynomial and exponent-field reconstruction family used by `0x0058b3a0`. The safest current read is a shared `pow(x, y)`-style helper rather than a narrower transform-specific claim.","objdump + local disassembly + polynomial-approximation inspection + constant inspection + power correlation"
0x00571016,26,refcounted_object_vtable_0x5def30_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for object family `0x005def30`. The helper re-enters destructor `0x0057ad20`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`. Current grounded caller is refcount helper `0x0057aedb`.","objdump + local disassembly + object-family correlation + refcount correlation"
0x00571032,26,refcounted_object_vtable_0x5def5c_release_and_optionally_free_self,bootstrap,thiscall,inferred,objdump + local disassembly,2,"Release-side wrapper for sibling object family `0x005def5c`. The helper re-enters destructor `0x0057af0e`, and when caller flag bit `0` is set it also frees the object storage through `0x0053b080`.","objdump + local disassembly + object-family correlation + refcount correlation"
0x0054eb10,376,shell_input_handle_window_command_and_toggle_messages,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Processes one shell window-command or toggle-style input message into the shell-input ring. The helper tracks the last packed command or coordinate tuple under `[this+0xa94/+0xa98/+0xa9c]`, iterates eight local branch families, toggles selected state bits in `[this+0xa8c]`, synthesizes 12-dword records with types such as `1`, `2`, `5`, `6`, `7`, `8`, `9`, `10`, and `11`, and enqueues those records through `0x0054e880`. Current grounded caller is the `WM_COMMAND` branch in `shell_controller_window_message_dispatch` `0x0054e3a0`, so this is the safest current read for the shell-input command or toggle message owner rather than a generic control callback.","objdump + caller inspection + local disassembly + event-ring correlation + command-message correlation"
0x0054ee50,544,shell_input_handle_window_mouse_message_and_enqueue_events,shell,thiscall,inferred,objdump + caller inspection + local disassembly,3,"Primary shell mouse-message handler for the `0x0200..0x0208` window-message family. The helper first deduplicates repeated `WM_MOUSEMOVE` coordinates against globals `0x0062545c/0x00625460`, then routes the live message through the shared shell-input command or toggle worker `0x0054eb10` and the surrounding pointer-state branches. Current evidence grounds this as the mouse-message ingress owner beneath `shell_controller_window_message_dispatch` `0x0054e3a0`, with local state updates flowing into the event-ring helpers `0x0054e880`, `0x0054e9c0`, and `0x0054ea20`.","objdump + caller inspection + local disassembly + mouse-message correlation + event-ring correlation"
0x0054f290,480,shell_input_apply_window_key_transition,shell,thiscall,inferred,objdump + analysis-context,4,Normalizes one `WM_KEYDOWN` or `WM_KEYUP` transition for the shell input object at 0x006d4018. The helper samples `GetKeyboardState` optionally derives an ASCII byte through `ToAscii` updates the 256-byte per-key table starting at [this+0x100] and maps selected keyboard scan codes into packed modifier flags at [this+0xa8c]: 0x1d sets or clears bit 0x4 Control 0x2a sets or clears bit 0x2 Left Shift 0x36 sets or clears bit 0x1 Right Shift and 0x38 sets or clears bit 0x20 Alt. It then forwards the synthesized event record through 0x0054e9c0 for later shell consumers. The shell controller window dispatcher at 0x0054e3a0 is the grounded caller.,objdump + analysis-context + import table + callsite inspection

Can't render this file because it is too large.