jan/rrt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bound multiplayer profile-key callback flow

Browse source
This commit is contained in:
Jan Petykiewicz 2026-04-04 09:57:38 -07:00
commit b87a58de45
2 changed files with 36 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

35
artifacts/exports/rt3-1.06/function-map.csv
View file

@ -331,9 +331,20 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x00592d70,77,multiplayer_transport_enqueue_callback_slot12_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that copies a caller-supplied seven-dword block and enqueues it as a 0x20-byte opcode `12` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x179c] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592dc0,72,multiplayer_transport_enqueue_callback_slot13_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `13` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a0] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592e10,72,multiplayer_transport_enqueue_callback_slot14_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x10-byte opcode `14` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a4] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00593120,72,multiplayer_transport_enqueue_callback_slot19_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `19` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f560`, which first updates selector-view runtime state through `0x5948f0` and then forwards the same selector-name pair through this owner-callback lane.","objdump + caller xrefs"
0x00592ee0,62,multiplayer_transport_enqueue_callback_slot17_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x08-byte opcode `17` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is the current-selector profile-key callback root at `0x59f8b0`, which submits one profile-key bundle and then forwards the same selector context through this owner-callback lane.","objdump + caller xrefs"
0x00592f20,69,multiplayer_transport_enqueue_callback_slot18_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `18` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b4]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`.","objdump"
0x00592f70,72,multiplayer_transport_enqueue_callback_slot19_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `19` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b8]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f850`, which resets selector-side state and then forwards the same selector-name pair through this owner-callback lane.","objdump + caller xrefs"
0x00592fc0,50,multiplayer_transport_enqueue_callback_slot20_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x04-byte opcode `20` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17bc]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`.","objdump"
0x00593000,69,multiplayer_transport_enqueue_callback_slot21_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `21` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17c0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`.","objdump"
0x00593050,77,multiplayer_transport_enqueue_callback_slot22_record,shell,cdecl,inferred,objdump,3,"Gated callback-slot wrapper that enqueues one 0x10-byte opcode `22` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17c4]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded callers are the per-key profile callback helper at `0x596970`, which forwards one selector name plus the parsed `X...X|%d` marker pair or a zeroed `(END)` sentinel payload, and the same helper's sibling path at `0x596a45`, which republishes the currently armed selector-view probe tuple.","objdump + caller xrefs"
0x005930a0,50,multiplayer_transport_enqueue_callback_slot23_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x04-byte opcode `23` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x178c]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is the callback root at `0x59f5c0`, which first arms deferred-close state at `[this+0x1edc]`.","objdump + caller xrefs"
0x005930e0,62,multiplayer_transport_enqueue_callback_slot24_record,shell,cdecl,inferred,objdump,3,"Gated callback-slot wrapper that enqueues one 0x08-byte opcode `24` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17cc]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is multiplayer_transport_commit_selector_view_refresh_probe_success, which forwards the selector-view entry pointer together with the current averaged probe sample through this owner-callback lane.","objdump + caller xrefs"
0x00593120,72,multiplayer_transport_enqueue_callback_slot25_record,shell,cdecl,inferred,objdump,2,"Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `25` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f560`, which first updates selector-view runtime state through `0x5948f0` and then forwards the same selector-name pair through this owner-callback lane.","objdump + caller xrefs"
0x00592e60,64,multiplayer_transport_enqueue_callback_slot15_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x08-byte opcode `15` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a8] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x00592ea0,64,multiplayer_transport_enqueue_callback_slot16_record,shell,cdecl,inferred,ghidra-headless,2,Gated callback-slot wrapper that enqueues one 0x08-byte opcode `16` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17ac] is set. The record is built around the callback-side state rooted near [this+0x17f8].,ghidra + rizin + llvm-objdump
0x0059f2e0,64,multiplayer_transport_is_selector_control_line,shell,cdecl,inferred,objdump,2,"Small selector-text classifier used in the second callback descriptor lane. It returns true only when the caller string is at least four bytes long and begins with `@@@` but not `@@@ `, which makes it the current gate between control-line handling and the ordinary selector-name callback lanes.","objdump + caller xrefs + strings"
0x0059f320,131,multiplayer_transport_split_selector_payload_token_and_tail,shell,cdecl,inferred,objdump,2,"Splits one selector payload string at the first space into the two shared scratch buffers `0x00db9dd0` and `0x00db9dd8`. Current grounded callers are the mode-`3/4` selector callback helpers at `0x59f650` and `0x59f720`, which use that token-plus-tail pair as the payload for callback slots `14` and `10`.","objdump + caller xrefs + strings"
0x0059f5e0,111,multiplayer_transport_sync_selector_view_nfo_r_flag,shell,cdecl,inferred,objdump,3,"Local `@@@NFO` helper shared by the selector callback lanes at `0x59f650` and `0x59f720`. It only accepts control lines ending in the literal tail `X\\`, searches the same line for the field marker `\\$flags$\\`, and then sets or clears bit `0x2` in the selector-view entry flag word at `[entry+0x64]` depending on whether the following flag segment contains the letter `r` before the next backslash. The current grounded entry gate is `[entry+0x48]`, so this path is specific to selector entries that participate in the third selector slot.","objdump + caller xrefs + strings"
0x00593460,87,multiplayer_transport_mark_selector_slot_records_stale,shell,cdecl,inferred,ghidra-headless,3,Scans the queued transport request collection at [this+0x1780] for records of type `1` or `2` whose selector-slot field at +0x1c matches the requested slot id. Matching records are marked stale by setting byte or dword field +0x38 to one. Current grounded caller is multiplayer_transport_reset_selector_slot.,ghidra + rizin + llvm-objdump
0x00593790,351,multiplayer_transport_handle_names_query_response,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_names_query_with_callback. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can update route-binding state through multiplayer_transport_is_route_mode_active_nonterminal and multiplayer_transport_try_connect_status_route_once seeds selector slot `2` through multiplayer_transport_init_selector_slot upserts returned name records through multiplayer_transport_upsert_selector_name_entry publishes `TOPIC` and `MODE` lines through multiplayer_transport_publish_topic_status_line and multiplayer_transport_publish_mode_level_status_line and may promote one deferred route binding into [this+0x1ec8]. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump + strings
0x005938f0,145,multiplayer_transport_handle_bound_route_request,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_bound_route_request. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can publish [req+0x24] through multiplayer_transport_publish_mode_key_status_line and then schedules multiplayer_transport_handle_names_query_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump
@ -342,6 +353,24 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x005949a0,80,multiplayer_transport_ensure_selector_view_store,shell,thiscall,inferred,objdump,3,"Ensures the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it allocates a `0xac`-byte keyed container through `0x58faf0`, stores the resulting root at `[this+0xab4]`, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport setup and reset path around `0x58d7ee`.","objdump + caller xrefs"
0x005949f0,56,multiplayer_transport_release_selector_view_store,shell,thiscall,inferred,objdump,3,"Releases the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it frees the root at `[this+0xab4]` through `0x58f8b0`, clears that root, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport teardown path around `0x58d81a`.","objdump + caller xrefs"
0x00594a40,80,multiplayer_transport_find_selector_view_entry_by_name,shell,cdecl,inferred,objdump,3,"Looks up one selector-view entry by its bounded name string. It copies up to `0x40` bytes of the caller key into a local buffer, then probes the keyed selector-view store rooted at `[this+0xab4]` through `0x58f9c0` and returns the matching entry pointer or null. Current grounded callers include multiplayer_transport_set_selector_slot_flags, multiplayer_transport_merge_selector_mode_mask, multiplayer_transport_upsert_selector_name_entry, and several later selector-view formatting helpers.","objdump + caller xrefs"
0x00594d50,28,multiplayer_transport_selector_view_entry_slot_has_presence_mask,shell,cdecl,inferred,objdump,3,"Small selector-view predicate over one slot-local flag dword. When the requested slot has a live pointer at `[entry+0x40+slot*4]`, it returns whether the paired slot flag word at `[entry+0x5c+slot*4]` carries either presence bit `0x20` or `0x40`. Current grounded caller is multiplayer_transport_filter_insert_refreshable_selector_view_entry, which uses slot `2` to bias entry ordering and dedupe inside the periodic refreshable-entry collector.","objdump + caller xrefs"
0x00594d70,21,multiplayer_transport_selector_view_entry_has_gml_disconnect_gate,shell,cdecl,inferred,objdump,3,"Tiny selector-view predicate used only in the current grounded `GML` control path. It returns nonzero only when the selector-view entry participates in the third selector slot through `[entry+0x48]` and bit `0x20` is set in the entry flag word at `[entry+0x64]`. The current grounded caller is multiplayer_transport_handle_gml_or_png_selector_control, where it gates the `GML Disconnected` branch before the transport forces one status-pump pass, emits callback slot `16`, and re-enters route mode `5`.","objdump + caller xrefs + strings"
0x0059f5c0,20,multiplayer_transport_callback_arm_deferred_close_and_enqueue_slot23,shell,cdecl,inferred,objdump,2,"Small callback-root helper installed through the transport-side callback descriptor table at `0x59f5c0`. It takes the owner transport pointer from the first stack argument, sets deferred-close latch `[this+0x1edc]` to one, and then forwards into multiplayer_transport_enqueue_callback_slot23.","objdump + caller xrefs"
0x00594150,65,multiplayer_transport_schedule_selector_view_entry_refresh_probe,shell,cdecl,inferred,objdump,3,"Arms one deferred refresh probe for a selector-view entry when no probe is already pending at `[entry+0x74]`. It schedules callback `0x594110` after `0x1388` ms, latches the pending flag at `[entry+0x74]`, stores the current tick count at `[entry+0x68]`, and clears the entry-local transient field at `[entry+0xa8]`. The current grounded caller is the periodic selector-view service path at `0x594540`.","objdump + caller xrefs"
0x005941a0,376,multiplayer_transport_filter_insert_refreshable_selector_view_entry,shell,cdecl,inferred,objdump,3,"Store-walk callback used by the periodic selector-view service path. It filters one selector-view entry before insertion into a temporary refresh list: the entry must have local backing at `[entry+0xa0]`, live state at `[entry+0x58]`, no pending probe at `[entry+0x74]`, and no blocker at `[entry+0x4c]`; if slot pointers `[entry+0x40]`, `[entry+0x44]`, or `[entry+0x48]` are present, the corresponding slot flag words `[entry+0x5c]`, `[entry+0x60]`, and `[entry+0x64]` must not carry mask `0x0c`, which matches the `g`/`a` bits produced by multiplayer_transport_parse_selector_mode_letters. Eligible entries then pass slot-aware retry timing based on `[entry+0x68]`, `[entry+0x6c]`, `[entry+0x78]`, and `[entry+0x7c]`, after which the helper inserts the entry into the caller list while biasing third-slot entries through multiplayer_transport_selector_view_entry_slot_has_presence_mask and name comparisons.","objdump + caller xrefs + existing slot-flag map"
0x00594320,115,multiplayer_transport_collect_refreshable_selector_view_entries,shell,cdecl,inferred,objdump,3,"Collects a bounded list of refreshable selector-view entries from the keyed selector-view store rooted at `[this+0xab4]`. It clears the caller count to at most `0x0c` entries, walks the store through callback `0x5941a0`, and returns the finished temporary entry pointer list. The current grounded caller is the periodic selector-view service path at `0x594540`, which then schedules deferred refresh probes for the collected entries.","objdump + caller xrefs"
0x005940d0,61,multiplayer_transport_finish_selector_view_refresh_probe_if_matching,shell,cdecl,inferred,objdump,3,"Probe-completion callback used by the deferred selector-view refresh path. When the entry still has a pending probe at `[entry+0x74]`, live selector-view state at `[entry+0x58]`, and the callback request id matches `[entry+0x50]`, it clears the pending latch. Result `-1` increments the consecutive-failure counter at `[entry+0x7c]`; any other result forwards the returned payload pointer into multiplayer_transport_commit_selector_view_refresh_probe_success.","objdump + caller xrefs"
0x00594110,48,multiplayer_transport_dispatch_selector_view_refresh_probe_result,shell,cdecl,inferred,objdump,3,"Deferred callback shim for selector-view refresh probes. It walks the keyed selector-view store at `[transport+0xab4]` and runs multiplayer_transport_finish_selector_view_refresh_probe_if_matching against each entry using the completed request descriptor on the stack. Current grounded caller is multiplayer_transport_schedule_selector_view_entry_refresh_probe.","objdump + caller xrefs"
0x00593f00,171,multiplayer_transport_commit_selector_view_refresh_probe_success,shell,cdecl,inferred,objdump,3,"Success path for one selector-view refresh probe. It increments the probe-success generation at `[entry+0x78]`, clears the consecutive-failure counter at `[entry+0x7c]`, stamps the last-success tick at `[entry+0x6c]`, writes the returned sample value into the rolling history at `[entry+0x84..]`, grows the bounded sample-count at `[entry+0x94]` up to four, computes the current average into `[entry+0x80]`, increments total-success count `[entry+0x98]`, and publishes the averaged sample through multiplayer_transport_enqueue_callback_slot24_record.","objdump + caller xrefs"
0x00594b60,104,multiplayer_transport_arm_selector_view_probe_tracking,shell,cdecl,inferred,objdump,3,"Resolves one selector-view entry by name and arms its fast probe-tracking fields. It stores the parsed marker request id at `[entry+0x50]`, stores the parsed companion value at `[entry+0x54]`, sets the live probe gate at `[entry+0x58]`, and refreshes the per-slot dirty gates at `+0xa0/+0xa4/+0xa8` for any active selector slots through multiplayer_transport_mark_selector_slot_views_dirty. Current grounded callers are the profile-key callback-table lanes around `0x596a18` and `0x59f929`, both after parsing one `X...X|%d` marker through `0x5977b0`.","objdump + caller xrefs"
0x005943a0,231,multiplayer_transport_stage_selector_view_progress_snapshot,shell,cdecl,inferred,objdump,3,"Slow selector-view sidecar helper reached from multiplayer_transport_service_selector_view_refresh_cycle after multiplayer_transport_select_stale_selector_view_progress_entry picks one candidate. It requires the entry-local progress gate at `[entry+0xa4]`, formats one `PNG %s %d` line around the selector-view sample string rooted at `[entry+0x80]`, appends up to three selector-slot-specific `PNG` fragments when the corresponding slot pointers and generation counters are live, then marks the entry progress snapshot in-flight at `[entry+0x9c]` and stamps both `[entry+0x70]` and the transport-wide throttle tick `[transport+0xaec]`.","objdump + caller xrefs + strings"
0x00594490,83,multiplayer_transport_pick_stale_selector_view_progress_entry,shell,cdecl,inferred,objdump,3,"Store-walk callback used by multiplayer_transport_select_stale_selector_view_progress_entry. It only considers selector-view entries whose slow progress gate `[entry+0xa4]` is set, blocker `[entry+0x4c]` is clear, total-success count `[entry+0x98]` is nonzero, and in-flight progress latch `[entry+0x9c]` is clear; among those, it requires at least `0x1388` ms since the last progress tick `[entry+0x70]` and keeps the stalest candidate in the caller scratch slot.","objdump + caller xrefs"
0x005944f0,69,multiplayer_transport_select_stale_selector_view_progress_entry,shell,cdecl,inferred,objdump,3,"Walks the keyed selector-view store at `[transport+0xab4]` through callback `0x594490` and returns the stalest eligible selector-view entry for the slow progress-snapshot lane, or null when none qualify. Current grounded caller is multiplayer_transport_service_selector_view_refresh_cycle.","objdump + caller xrefs"
0x00594540,214,multiplayer_transport_service_selector_view_refresh_cycle,shell,thiscall,inferred,objdump,3,"Recurring selector-view maintenance pass beneath the multiplayer transport frame owner. When the selector-view layer is enabled and not blocked by the `g`/`a` route gates at `[this+0xb44]` and `[this+0x180c]`, it first rate-limits and runs the fast probe lane by collecting refreshable entries through multiplayer_transport_collect_refreshable_selector_view_entries and scheduling deferred probes through multiplayer_transport_schedule_selector_view_entry_refresh_probe. It then runs a slower sidecar lane every `0x7d0` ms by selecting one stale progress entry through multiplayer_transport_select_stale_selector_view_progress_entry and staging a progress snapshot through multiplayer_transport_stage_selector_view_progress_snapshot before falling into the shared timer service at `0x5a05d0`.","objdump + caller xrefs"
0x0059f3c0,498,multiplayer_transport_handle_gml_or_png_selector_control,shell,cdecl,inferred,objdump,3,"Small control-token handler reached from the slot-`25` selector-view callback lane after multiplayer_transport_split_selector_payload_token_and_tail. When the token is `GML` and the tail is `Disconnected`, it requires the current selector-view entry to pass multiplayer_transport_selector_view_entry_has_gml_disconnect_gate, then forces one status-pump pass, emits callback slot `16` with the tail text, and re-enters route mode `5`. Its sibling `PNG` branch resolves a named selector-view entry from the tail text and, when that entry overlaps the active selector-slot ownership, refreshes selector-view runtime state through `0x5948f0` and republishes callback slot `25`.","objdump + caller xrefs + strings"
0x0059f650,193,multiplayer_transport_callback_dispatch_selector_name_payload_lane,shell,cdecl,inferred,objdump,3,"Main selector-name branch in the second transport-side callback descriptor lane. It first classifies the incoming payload through multiplayer_transport_is_selector_control_line. `@@@NFO` control lines resolve one selector-view entry through multiplayer_transport_find_selector_view_entry_by_name and forward into multiplayer_transport_sync_selector_view_nfo_r_flag; non-control mode-`3/4` payloads split through multiplayer_transport_split_selector_payload_token_and_tail and publish callback slot `14`; and the remaining non-control payloads publish callback slot `13`.","objdump + caller xrefs + strings"
0x0059f720,289,multiplayer_transport_callback_dispatch_current_selector_payload_lane,shell,cdecl,inferred,objdump,3,"Sibling callback root that first resolves the current selector through `0x5951a0` and then dispatches one payload against that active selector context. It reuses multiplayer_transport_is_selector_control_line, the `@@@GML` and `@@@NFO` control tokens, and the shared token-tail splitter at `0x59f320`: `@@@NFO` lines flow into multiplayer_transport_sync_selector_view_nfo_r_flag, `@@@GML` lines plus mode-`3/4` payloads feed callback slot `10`, and the remaining non-control payloads feed callback slot `9`.","objdump + caller xrefs + strings"
0x0059f850,87,multiplayer_transport_callback_reset_selector_and_enqueue_slot19,shell,cdecl,inferred,objdump,2,"Callback-root helper from the second transport-side descriptor lane. It resolves the current selector slot through `0x5951a0`, resets that selector text path through `0x5954b0`, forwards the supplied selector-name pair through multiplayer_transport_enqueue_callback_slot19, and when the resolved selector is `2` plus route mode is still active it re-enters multiplayer_transport_set_route_mode with mode `1`.","objdump + caller xrefs"
0x00594bd0,97,multiplayer_transport_set_selector_slot_flags,shell,cdecl,inferred,ghidra-headless,3,Updates one selector-slot flag dword at [entry+0x5c] after resolving the current selector entry through 0x00594a40. When selector index `2` flips bit `1` it forwards the new bit value through multiplayer_transport_enqueue_callback_slot15_record and then notifies the shared selector-change callback path through 0x00593250 with selector id old flags and new flags.,ghidra + rizin + llvm-objdump
0x00594c40,103,multiplayer_transport_parse_selector_mode_letters,shell,cdecl,inferred,ghidra-headless,3,Parses one selector-mode letter string into a small bitmask by probing for the letters `s` `r` `g` `a` and `h`. Current grounded callers merge this mask into the selector-slot flags that live at [entry+0x5c].,ghidra + rizin + llvm-objdump + strings
0x00594cb0,65,multiplayer_transport_merge_selector_mode_mask,shell,cdecl,inferred,ghidra-headless,3,Resolves one selector entry through 0x00594a40 parses the caller mode-letter string through multiplayer_transport_parse_selector_mode_letters preserves the current presence bits 0x20 and 0x40 from [entry+0x5c] and commits the merged result through multiplayer_transport_set_selector_slot_flags.,ghidra + rizin + llvm-objdump + strings
@ -360,6 +389,8 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x005959e0,81,multiplayer_transport_submit_route_status_request,shell,cdecl,inferred,ghidra-headless,3,Submits one route-status request for the current binding at [this+0x1ec8]. It gathers the binding fields at +0x2c and +0x30 together with the local counter at [this+0xb48] and default sample text at 0x005c87a8 then sends that request through 0x593980 using multiplayer_transport_handle_route_status_result as the completion callback. Failure sets [this+0x1ed8] so the route-mode setter can fall back immediately.,ghidra + rizin + llvm-objdump
0x00596270,70,multiplayer_transport_clone_staged_callback_payload,shell,cdecl,inferred,ghidra-headless,3,Clones one staged route-callback payload block by allocating a same-sized object through 0x58d5b0 copying the first nine dwords and then registering a cleanup callback through 0x58fa00 with shim 0x596260. Current grounded caller is multiplayer_transport_try_stage_route_callback_payload.,ghidra + rizin + llvm-objdump
0x00597720,96,multiplayer_transport_format_gsp_payload,shell,cdecl,inferred,ghidra-headless,3,Formats one transport text payload with the `#GSP!%s!%c%s%c` template at 0x005e2358. Depending on whether the global formatter state at 0x00dba4c4 is present it builds either a 0x58-byte or 0x4d-byte intermediate fragment through 0x597590 or 0x5976c0 and then emits the final string through 0x5a19c4. Current grounded callers are multiplayer_transport_submit_bound_route_request and multiplayer_transport_try_stage_route_callback_payload.,ghidra + rizin + llvm-objdump + strings
0x005977b0,127,multiplayer_transport_parse_selector_view_probe_marker,shell,cdecl,inferred,objdump,3,"Parses one selector-view probe marker in the local `X%sX|%d` family. It requires a length of at least `0x0c`, accepts the marker only when byte `0` or byte `9` is `X`, decodes the wrapped request-id fragment through `0x597630`, parses the decimal tail after the `|` through `0x5a1ea5`, and returns those two values through caller output pointers. Current grounded callers are the profile-key callback lanes at `0x596a01` and `0x59f912`, which forward the parsed request id and companion value into multiplayer_transport_arm_selector_view_probe_tracking.","objdump + caller xrefs + format string"
0x00597840,30,multiplayer_transport_format_selector_view_probe_marker,shell,cdecl,inferred,objdump,3,"Formats one selector-view probe marker in the local `X%sX|%d` family. It encodes the caller request id through `0x597590`, then wraps the result with sentinel `X` bytes and a trailing `|%d` suffix into the destination buffer. Current grounded caller is multiplayer_transport_stage_selector_view_progress_snapshot, which uses `[entry+0x50]` as the marker id when building `PNG %s %d` progress lines.","objdump + caller xrefs + format string"
0x00593980,382,multiplayer_transport_submit_bound_route_request,shell,cdecl,inferred,ghidra-headless,3,Builds and submits one bound-route request using the current transport text buffers and a caller-supplied binding id or fallback route id. It formats the request payload through multiplayer_transport_format_gsp_payload allocates a type `1` transient request record through 0x5934e0 stores route and callback metadata on that record publishes selector `2` text through multiplayer_transport_set_selector_name and finally submits the request through 0x58e720 using multiplayer_transport_handle_bound_route_request. A nonempty caller text sample sets [this+0xb4c].,ghidra + rizin + llvm-objdump + strings
0x00593b00,161,multiplayer_transport_handle_selector_update_response,shell,cdecl,inferred,ghidra-headless,3,Follow-up callback used by multiplayer_transport_handle_selector_text_route_request. When the callback succeeds it initializes or repopulates selector slot [req+0x1c] through multiplayer_transport_init_selector_slot and multiplayer_transport_upsert_selector_name_entry. When it fails it resets that selector slot. Both paths finish by enqueueing a route record through multiplayer_transport_probe_or_enqueue_route_record and unlinking the request through 0x5933a0.,ghidra + rizin + llvm-objdump
0x00593bb0,144,multiplayer_transport_handle_selector_text_route_request,shell,cdecl,inferred,ghidra-headless,3,Completion callback for multiplayer_transport_submit_selector_text_route_request. If the request is already stale at +0x38 it clears the transient state through 0x5962c0 and unlinks the request. On nonzero result it schedules multiplayer_transport_handle_selector_update_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot [req+0x1c] and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.,ghidra + rizin + llvm-objdump
@ -380,9 +411,11 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x005962e0,583,multiplayer_transport_register_field_subscription_bundle,shell,cdecl,inferred,ghidra-headless,3,Builds one field-subscription bundle from the field-id list optional suffix text and selector-name table. Rebuilds the callback table at [this+0xba4] seeds the local field cache at [this+0x1724] installs the subscription block through 0x590ed0 sets [this+0x1774] on success and enqueues an immediate mode-3 field snapshot through multiplayer_transport_enqueue_field_snapshot_record.,ghidra + rizin + llvm-objdump
0x00596530,101,multiplayer_transport_try_seed_am_rating_route_table,shell,cdecl,inferred,ghidra-headless,2,Used by the larger route-mode setter around 0x595650. It first calls multiplayer_transport_reset_am_rating_route_state then rebuilds one mode `4` route entry in the callback table at [this+0x18bc] from the stored descriptor at [this+0x1ed0]. Success clears [this+0x1ed4] sets [this+0x1ec4] to one and failure reverts through multiplayer_transport_reset_am_rating_route_state before setting [this+0x1ed4].,ghidra + rizin + llvm-objdump + strings
0x005965a0,44,multiplayer_transport_try_connect_status_route_once,shell,cdecl,inferred,ghidra-headless,3,Single-shot wrapper for the auxiliary status-route object at [this+0xaf0]. When the in-flight latch at [this+0xb40] is already set it returns false immediately. Otherwise it sets that latch and forwards the caller route id into multiplayer_transport_try_connect_status_route then booleanizes the result. Current grounded caller is multiplayer_transport_handle_names_query_response.,ghidra + rizin + llvm-objdump
0x00596970,404,multiplayer_transport_handle_profile_key_query_result,shell,cdecl,inferred,objdump,3,"Per-key callback helper for the profile-key query bundle family. It ignores empty selector names, treats a null fallback text as `0x005c87a8`, special-cases the `username` key by parsing one `X...X|%d` marker through multiplayer_transport_parse_selector_view_probe_marker, arming selector-view probe tracking through multiplayer_transport_arm_selector_view_probe_tracking, and optionally publishing callback slot `22` with the selector name plus the parsed marker pair or a zeroed `(END)` sentinel payload. It also special-cases `b_flags` by forwarding the returned mode-letter string into multiplayer_transport_merge_selector_mode_mask, then hashes the selector name, key name, and resolved value text through `0x58f4a0` and upserts that triplet into the caller table through hashed_entry_table_upsert.","objdump + strings + caller context"
0x00596da0,497,multiplayer_transport_submit_profile_key_query_bundle,shell,cdecl,inferred,rizin,2,Wrapper above the transport key-command builders that stages a small named-key query bundle around the strings `username` and `b_flags`. It allocates temporary key-name arrays and callback-entry tables submits the first request through multiplayer_transport_submit_getkey_command_and_wait folds returned key results into transport-owned callback state through 0x0058f8f0 and 0x0058fa00 and then follows with the larger channel-key submission path through multiplayer_transport_submit_setchankey_pair_list_command_and_wait when the staged key set is nonempty.,rizin + llvm-objdump + strings
0x00596fa0,19,multiplayer_transport_submit_profile_key_query_bundle_with_context,shell,cdecl,inferred,rizin,2,Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector or route context in `edx` and forwards the stack-supplied context pointer as the extra bundle argument. Current grounded use is through the local callback table rooted at 0x0059f8b0.,rizin + llvm-objdump
0x00596fc0,14,multiplayer_transport_submit_profile_key_query_bundle_default,shell,cdecl,inferred,rizin,3,Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector slot in `edx` and forces a null extra-context argument. Current grounded caller is multiplayer_transport_init_selector_slot and the same wrapper is also installed through the local callback table rooted at 0x0059fb60.,rizin + llvm-objdump
0x0059f8b0,260,multiplayer_transport_callback_upsert_current_selector_and_request_profile_keys,shell,cdecl,inferred,objdump,3,"Callback-root helper adjacent to the second transport-side descriptor lane. It resolves the current selector through multiplayer_transport_find_selector_name, upserts that selector name into the selector-view store through multiplayer_transport_upsert_selector_name_entry, optionally reuses a cached `username` marker from `0x58eb10` to arm selector-view probe tracking through multiplayer_transport_parse_selector_view_probe_marker and multiplayer_transport_arm_selector_view_probe_tracking, then submits one profile-key query bundle through multiplayer_transport_submit_profile_key_query_bundle_with_context and publishes callback slot `17`. When selector `2` is active, the same helper can also force the route-mode transitions `2 -> 3 -> 4` through multiplayer_transport_set_route_mode after checking the status-route latch at `[this+0xb54]`, route activity, and the generation gate `[this+0xac0] >= [this+0xb48]`.","objdump + caller xrefs + strings"
0x00596fd0,441,multiplayer_transport_dispatch_status_route_event,shell,cdecl,inferred,rizin,3,Main local callback dispatcher for the auxiliary status-route object. It gates on [this+0x398] [this+0xb44] and flag bits in [this+0xb38] then maps route event ids through the local table at 0x005970c4 into selector text publication openstaging publication boolean status publication and callback forwarding paths. The dispatcher publishes through multiplayer_transport_send_selector_text and multiplayer_transport_publish_fixed_token_message and can also invoke the owner callback at [this+0x17dc] with payload [this+0x17f8].,rizin + llvm-objdump + strings
0x005972c0,97,multiplayer_transport_handle_validated_route_cookie_event,shell,cdecl,inferred,objdump,3,"Validated subtype-`4` callback for the transport-owned GameSpy route family. The route constructor seeds this helper into `[route+0x9c]`; after multiplayer_gamespy_route_dispatch_inbound_packet validates the current route cookie it forwards the event id in `ecx`, the remaining payload pointer in `edx`, and the owner transport context from `[route+0x104]`. When multiplayer_transport_is_route_mode_active_nonterminal succeeds it marks `[this+0x1ed8]` and re-enters multiplayer_transport_set_route_mode with a mode-selection bit derived from `[this+0x1ed4]` and `[this+0x18b8]`; otherwise it falls back to the owner callback at `[this+0x17f0]` using context `[this+0x17f8]`.","objdump"
0x00597330,28,multiplayer_transport_forward_validated_extended_route_payload,shell,cdecl,inferred,objdump,3,"Small forwarding callback used for the transport-owned status route's validated extended-payload slot. It treats `edx` as the owner transport object, checks the owner callback pointer at `[this+0x17f4]`, and when present forwards the validated payload wrapper in `ecx` together with owner context `[this+0x17f8]`. Current grounded caller is the status-route connect helper through multiplayer_gamespy_route_set_extended_payload_callback.","objdump"

1 address size name subsystem calling_convention prototype_status source_tool confidence notes verified_against
331 0x00592d70 77 multiplayer_transport_enqueue_callback_slot12_record shell cdecl inferred ghidra-headless 2 Gated callback-slot wrapper that copies a caller-supplied seven-dword block and enqueues it as a 0x20-byte opcode `12` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x179c] is set. The record is built around the callback-side state rooted near [this+0x17f8]. ghidra + rizin + llvm-objdump
332 0x00592dc0 72 multiplayer_transport_enqueue_callback_slot13_record shell cdecl inferred ghidra-headless 2 Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `13` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a0] is set. The record is built around the callback-side state rooted near [this+0x17f8]. ghidra + rizin + llvm-objdump
333 0x00592e10 72 multiplayer_transport_enqueue_callback_slot14_record shell cdecl inferred ghidra-headless 2 Gated callback-slot wrapper that enqueues one 0x10-byte opcode `14` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a4] is set. The record is built around the callback-side state rooted near [this+0x17f8]. ghidra + rizin + llvm-objdump
334 0x00593120 0x00592ee0 72 62 multiplayer_transport_enqueue_callback_slot19_record multiplayer_transport_enqueue_callback_slot17_record shell cdecl inferred objdump 2 Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `19` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f560`, which first updates selector-view runtime state through `0x5948f0` and then forwards the same selector-name pair through this owner-callback lane. Gated callback-slot wrapper that enqueues one 0x08-byte opcode `17` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is the current-selector profile-key callback root at `0x59f8b0`, which submits one profile-key bundle and then forwards the same selector context through this owner-callback lane. objdump + caller xrefs
335 0x00592f20 69 multiplayer_transport_enqueue_callback_slot18_record shell cdecl inferred objdump 2 Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `18` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b4]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. objdump
336 0x00592f70 72 multiplayer_transport_enqueue_callback_slot19_record shell cdecl inferred objdump 2 Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `19` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17b8]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f850`, which resets selector-side state and then forwards the same selector-name pair through this owner-callback lane. objdump + caller xrefs
337 0x00592fc0 50 multiplayer_transport_enqueue_callback_slot20_record shell cdecl inferred objdump 2 Gated callback-slot wrapper that enqueues one 0x04-byte opcode `20` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17bc]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. objdump
338 0x00593000 69 multiplayer_transport_enqueue_callback_slot21_record shell cdecl inferred objdump 2 Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `21` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17c0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. objdump
339 0x00593050 77 multiplayer_transport_enqueue_callback_slot22_record shell cdecl inferred objdump 3 Gated callback-slot wrapper that enqueues one 0x10-byte opcode `22` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17c4]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. Current grounded callers are the per-key profile callback helper at `0x596970`, which forwards one selector name plus the parsed `X...X|%d` marker pair or a zeroed `(END)` sentinel payload, and the same helper's sibling path at `0x596a45`, which republishes the currently armed selector-view probe tuple. objdump + caller xrefs
340 0x005930a0 50 multiplayer_transport_enqueue_callback_slot23_record shell cdecl inferred objdump 2 Gated callback-slot wrapper that enqueues one 0x04-byte opcode `23` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x178c]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is the callback root at `0x59f5c0`, which first arms deferred-close state at `[this+0x1edc]`. objdump + caller xrefs
341 0x005930e0 62 multiplayer_transport_enqueue_callback_slot24_record shell cdecl inferred objdump 3 Gated callback-slot wrapper that enqueues one 0x08-byte opcode `24` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17cc]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is multiplayer_transport_commit_selector_view_refresh_probe_success, which forwards the selector-view entry pointer together with the current averaged probe sample through this owner-callback lane. objdump + caller xrefs
342 0x00593120 72 multiplayer_transport_enqueue_callback_slot25_record shell cdecl inferred objdump 2 Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `25` record through multiplayer_transport_enqueue_opcode_record when callback pointer `[this+0x17d0]` is set. The record is built around the callback-side state rooted near `[this+0x17f8]`. The current grounded caller is one selector-view callback-table branch at `0x59f560`, which first updates selector-view runtime state through `0x5948f0` and then forwards the same selector-name pair through this owner-callback lane. objdump + caller xrefs
343 0x00592e60 64 multiplayer_transport_enqueue_callback_slot15_record shell cdecl inferred ghidra-headless 2 Gated callback-slot wrapper that enqueues one 0x08-byte opcode `15` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a8] is set. The record is built around the callback-side state rooted near [this+0x17f8]. ghidra + rizin + llvm-objdump
344 0x00592ea0 64 multiplayer_transport_enqueue_callback_slot16_record shell cdecl inferred ghidra-headless 2 Gated callback-slot wrapper that enqueues one 0x08-byte opcode `16` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17ac] is set. The record is built around the callback-side state rooted near [this+0x17f8]. ghidra + rizin + llvm-objdump
345 0x0059f2e0 64 multiplayer_transport_is_selector_control_line shell cdecl inferred objdump 2 Small selector-text classifier used in the second callback descriptor lane. It returns true only when the caller string is at least four bytes long and begins with `@@@` but not `@@@ `, which makes it the current gate between control-line handling and the ordinary selector-name callback lanes. objdump + caller xrefs + strings
346 0x0059f320 131 multiplayer_transport_split_selector_payload_token_and_tail shell cdecl inferred objdump 2 Splits one selector payload string at the first space into the two shared scratch buffers `0x00db9dd0` and `0x00db9dd8`. Current grounded callers are the mode-`3/4` selector callback helpers at `0x59f650` and `0x59f720`, which use that token-plus-tail pair as the payload for callback slots `14` and `10`. objdump + caller xrefs + strings
347 0x0059f5e0 111 multiplayer_transport_sync_selector_view_nfo_r_flag shell cdecl inferred objdump 3 Local `@@@NFO` helper shared by the selector callback lanes at `0x59f650` and `0x59f720`. It only accepts control lines ending in the literal tail `X\\`, searches the same line for the field marker `\\$flags$\\`, and then sets or clears bit `0x2` in the selector-view entry flag word at `[entry+0x64]` depending on whether the following flag segment contains the letter `r` before the next backslash. The current grounded entry gate is `[entry+0x48]`, so this path is specific to selector entries that participate in the third selector slot. objdump + caller xrefs + strings
348 0x00593460 87 multiplayer_transport_mark_selector_slot_records_stale shell cdecl inferred ghidra-headless 3 Scans the queued transport request collection at [this+0x1780] for records of type `1` or `2` whose selector-slot field at +0x1c matches the requested slot id. Matching records are marked stale by setting byte or dword field +0x38 to one. Current grounded caller is multiplayer_transport_reset_selector_slot. ghidra + rizin + llvm-objdump
349 0x00593790 351 multiplayer_transport_handle_names_query_response shell cdecl inferred ghidra-headless 3 Completion callback for multiplayer_transport_submit_names_query_with_callback. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can update route-binding state through multiplayer_transport_is_route_mode_active_nonterminal and multiplayer_transport_try_connect_status_route_once seeds selector slot `2` through multiplayer_transport_init_selector_slot upserts returned name records through multiplayer_transport_upsert_selector_name_entry publishes `TOPIC` and `MODE` lines through multiplayer_transport_publish_topic_status_line and multiplayer_transport_publish_mode_level_status_line and may promote one deferred route binding into [this+0x1ec8]. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request. ghidra + rizin + llvm-objdump + strings
350 0x005938f0 145 multiplayer_transport_handle_bound_route_request shell cdecl inferred ghidra-headless 3 Completion callback for multiplayer_transport_submit_bound_route_request. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can publish [req+0x24] through multiplayer_transport_publish_mode_key_status_line and then schedules multiplayer_transport_handle_names_query_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request. ghidra + rizin + llvm-objdump
353 0x005949a0 80 multiplayer_transport_ensure_selector_view_store shell thiscall inferred objdump 3 Ensures the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it allocates a `0xac`-byte keyed container through `0x58faf0`, stores the resulting root at `[this+0xab4]`, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport setup and reset path around `0x58d7ee`. objdump + caller xrefs
354 0x005949f0 56 multiplayer_transport_release_selector_view_store shell thiscall inferred objdump 3 Releases the keyed selector-view store used by the multiplayer transport. When the gate at `[this+0xab0]` is clear it frees the root at `[this+0xab4]` through `0x58f8b0`, clears that root, and resets the three per-slot generation counters at `[this+0xab8]`, `[this+0xabc]`, and `[this+0xac0]`. Current grounded callers are the transport teardown path around `0x58d81a`. objdump + caller xrefs
355 0x00594a40 80 multiplayer_transport_find_selector_view_entry_by_name shell cdecl inferred objdump 3 Looks up one selector-view entry by its bounded name string. It copies up to `0x40` bytes of the caller key into a local buffer, then probes the keyed selector-view store rooted at `[this+0xab4]` through `0x58f9c0` and returns the matching entry pointer or null. Current grounded callers include multiplayer_transport_set_selector_slot_flags, multiplayer_transport_merge_selector_mode_mask, multiplayer_transport_upsert_selector_name_entry, and several later selector-view formatting helpers. objdump + caller xrefs
356 0x00594d50 28 multiplayer_transport_selector_view_entry_slot_has_presence_mask shell cdecl inferred objdump 3 Small selector-view predicate over one slot-local flag dword. When the requested slot has a live pointer at `[entry+0x40+slot*4]`, it returns whether the paired slot flag word at `[entry+0x5c+slot*4]` carries either presence bit `0x20` or `0x40`. Current grounded caller is multiplayer_transport_filter_insert_refreshable_selector_view_entry, which uses slot `2` to bias entry ordering and dedupe inside the periodic refreshable-entry collector. objdump + caller xrefs
357 0x00594d70 21 multiplayer_transport_selector_view_entry_has_gml_disconnect_gate shell cdecl inferred objdump 3 Tiny selector-view predicate used only in the current grounded `GML` control path. It returns nonzero only when the selector-view entry participates in the third selector slot through `[entry+0x48]` and bit `0x20` is set in the entry flag word at `[entry+0x64]`. The current grounded caller is multiplayer_transport_handle_gml_or_png_selector_control, where it gates the `GML Disconnected` branch before the transport forces one status-pump pass, emits callback slot `16`, and re-enters route mode `5`. objdump + caller xrefs + strings
358 0x0059f5c0 20 multiplayer_transport_callback_arm_deferred_close_and_enqueue_slot23 shell cdecl inferred objdump 2 Small callback-root helper installed through the transport-side callback descriptor table at `0x59f5c0`. It takes the owner transport pointer from the first stack argument, sets deferred-close latch `[this+0x1edc]` to one, and then forwards into multiplayer_transport_enqueue_callback_slot23. objdump + caller xrefs
359 0x00594150 65 multiplayer_transport_schedule_selector_view_entry_refresh_probe shell cdecl inferred objdump 3 Arms one deferred refresh probe for a selector-view entry when no probe is already pending at `[entry+0x74]`. It schedules callback `0x594110` after `0x1388` ms, latches the pending flag at `[entry+0x74]`, stores the current tick count at `[entry+0x68]`, and clears the entry-local transient field at `[entry+0xa8]`. The current grounded caller is the periodic selector-view service path at `0x594540`. objdump + caller xrefs
360 0x005941a0 376 multiplayer_transport_filter_insert_refreshable_selector_view_entry shell cdecl inferred objdump 3 Store-walk callback used by the periodic selector-view service path. It filters one selector-view entry before insertion into a temporary refresh list: the entry must have local backing at `[entry+0xa0]`, live state at `[entry+0x58]`, no pending probe at `[entry+0x74]`, and no blocker at `[entry+0x4c]`; if slot pointers `[entry+0x40]`, `[entry+0x44]`, or `[entry+0x48]` are present, the corresponding slot flag words `[entry+0x5c]`, `[entry+0x60]`, and `[entry+0x64]` must not carry mask `0x0c`, which matches the `g`/`a` bits produced by multiplayer_transport_parse_selector_mode_letters. Eligible entries then pass slot-aware retry timing based on `[entry+0x68]`, `[entry+0x6c]`, `[entry+0x78]`, and `[entry+0x7c]`, after which the helper inserts the entry into the caller list while biasing third-slot entries through multiplayer_transport_selector_view_entry_slot_has_presence_mask and name comparisons. objdump + caller xrefs + existing slot-flag map
361 0x00594320 115 multiplayer_transport_collect_refreshable_selector_view_entries shell cdecl inferred objdump 3 Collects a bounded list of refreshable selector-view entries from the keyed selector-view store rooted at `[this+0xab4]`. It clears the caller count to at most `0x0c` entries, walks the store through callback `0x5941a0`, and returns the finished temporary entry pointer list. The current grounded caller is the periodic selector-view service path at `0x594540`, which then schedules deferred refresh probes for the collected entries. objdump + caller xrefs
362 0x005940d0 61 multiplayer_transport_finish_selector_view_refresh_probe_if_matching shell cdecl inferred objdump 3 Probe-completion callback used by the deferred selector-view refresh path. When the entry still has a pending probe at `[entry+0x74]`, live selector-view state at `[entry+0x58]`, and the callback request id matches `[entry+0x50]`, it clears the pending latch. Result `-1` increments the consecutive-failure counter at `[entry+0x7c]`; any other result forwards the returned payload pointer into multiplayer_transport_commit_selector_view_refresh_probe_success. objdump + caller xrefs
363 0x00594110 48 multiplayer_transport_dispatch_selector_view_refresh_probe_result shell cdecl inferred objdump 3 Deferred callback shim for selector-view refresh probes. It walks the keyed selector-view store at `[transport+0xab4]` and runs multiplayer_transport_finish_selector_view_refresh_probe_if_matching against each entry using the completed request descriptor on the stack. Current grounded caller is multiplayer_transport_schedule_selector_view_entry_refresh_probe. objdump + caller xrefs
364 0x00593f00 171 multiplayer_transport_commit_selector_view_refresh_probe_success shell cdecl inferred objdump 3 Success path for one selector-view refresh probe. It increments the probe-success generation at `[entry+0x78]`, clears the consecutive-failure counter at `[entry+0x7c]`, stamps the last-success tick at `[entry+0x6c]`, writes the returned sample value into the rolling history at `[entry+0x84..]`, grows the bounded sample-count at `[entry+0x94]` up to four, computes the current average into `[entry+0x80]`, increments total-success count `[entry+0x98]`, and publishes the averaged sample through multiplayer_transport_enqueue_callback_slot24_record. objdump + caller xrefs
365 0x00594b60 104 multiplayer_transport_arm_selector_view_probe_tracking shell cdecl inferred objdump 3 Resolves one selector-view entry by name and arms its fast probe-tracking fields. It stores the parsed marker request id at `[entry+0x50]`, stores the parsed companion value at `[entry+0x54]`, sets the live probe gate at `[entry+0x58]`, and refreshes the per-slot dirty gates at `+0xa0/+0xa4/+0xa8` for any active selector slots through multiplayer_transport_mark_selector_slot_views_dirty. Current grounded callers are the profile-key callback-table lanes around `0x596a18` and `0x59f929`, both after parsing one `X...X|%d` marker through `0x5977b0`. objdump + caller xrefs
366 0x005943a0 231 multiplayer_transport_stage_selector_view_progress_snapshot shell cdecl inferred objdump 3 Slow selector-view sidecar helper reached from multiplayer_transport_service_selector_view_refresh_cycle after multiplayer_transport_select_stale_selector_view_progress_entry picks one candidate. It requires the entry-local progress gate at `[entry+0xa4]`, formats one `PNG %s %d` line around the selector-view sample string rooted at `[entry+0x80]`, appends up to three selector-slot-specific `PNG` fragments when the corresponding slot pointers and generation counters are live, then marks the entry progress snapshot in-flight at `[entry+0x9c]` and stamps both `[entry+0x70]` and the transport-wide throttle tick `[transport+0xaec]`. objdump + caller xrefs + strings
367 0x00594490 83 multiplayer_transport_pick_stale_selector_view_progress_entry shell cdecl inferred objdump 3 Store-walk callback used by multiplayer_transport_select_stale_selector_view_progress_entry. It only considers selector-view entries whose slow progress gate `[entry+0xa4]` is set, blocker `[entry+0x4c]` is clear, total-success count `[entry+0x98]` is nonzero, and in-flight progress latch `[entry+0x9c]` is clear; among those, it requires at least `0x1388` ms since the last progress tick `[entry+0x70]` and keeps the stalest candidate in the caller scratch slot. objdump + caller xrefs
368 0x005944f0 69 multiplayer_transport_select_stale_selector_view_progress_entry shell cdecl inferred objdump 3 Walks the keyed selector-view store at `[transport+0xab4]` through callback `0x594490` and returns the stalest eligible selector-view entry for the slow progress-snapshot lane, or null when none qualify. Current grounded caller is multiplayer_transport_service_selector_view_refresh_cycle. objdump + caller xrefs
369 0x00594540 214 multiplayer_transport_service_selector_view_refresh_cycle shell thiscall inferred objdump 3 Recurring selector-view maintenance pass beneath the multiplayer transport frame owner. When the selector-view layer is enabled and not blocked by the `g`/`a` route gates at `[this+0xb44]` and `[this+0x180c]`, it first rate-limits and runs the fast probe lane by collecting refreshable entries through multiplayer_transport_collect_refreshable_selector_view_entries and scheduling deferred probes through multiplayer_transport_schedule_selector_view_entry_refresh_probe. It then runs a slower sidecar lane every `0x7d0` ms by selecting one stale progress entry through multiplayer_transport_select_stale_selector_view_progress_entry and staging a progress snapshot through multiplayer_transport_stage_selector_view_progress_snapshot before falling into the shared timer service at `0x5a05d0`. objdump + caller xrefs
370 0x0059f3c0 498 multiplayer_transport_handle_gml_or_png_selector_control shell cdecl inferred objdump 3 Small control-token handler reached from the slot-`25` selector-view callback lane after multiplayer_transport_split_selector_payload_token_and_tail. When the token is `GML` and the tail is `Disconnected`, it requires the current selector-view entry to pass multiplayer_transport_selector_view_entry_has_gml_disconnect_gate, then forces one status-pump pass, emits callback slot `16` with the tail text, and re-enters route mode `5`. Its sibling `PNG` branch resolves a named selector-view entry from the tail text and, when that entry overlaps the active selector-slot ownership, refreshes selector-view runtime state through `0x5948f0` and republishes callback slot `25`. objdump + caller xrefs + strings
371 0x0059f650 193 multiplayer_transport_callback_dispatch_selector_name_payload_lane shell cdecl inferred objdump 3 Main selector-name branch in the second transport-side callback descriptor lane. It first classifies the incoming payload through multiplayer_transport_is_selector_control_line. `@@@NFO` control lines resolve one selector-view entry through multiplayer_transport_find_selector_view_entry_by_name and forward into multiplayer_transport_sync_selector_view_nfo_r_flag; non-control mode-`3/4` payloads split through multiplayer_transport_split_selector_payload_token_and_tail and publish callback slot `14`; and the remaining non-control payloads publish callback slot `13`. objdump + caller xrefs + strings
372 0x0059f720 289 multiplayer_transport_callback_dispatch_current_selector_payload_lane shell cdecl inferred objdump 3 Sibling callback root that first resolves the current selector through `0x5951a0` and then dispatches one payload against that active selector context. It reuses multiplayer_transport_is_selector_control_line, the `@@@GML` and `@@@NFO` control tokens, and the shared token-tail splitter at `0x59f320`: `@@@NFO` lines flow into multiplayer_transport_sync_selector_view_nfo_r_flag, `@@@GML` lines plus mode-`3/4` payloads feed callback slot `10`, and the remaining non-control payloads feed callback slot `9`. objdump + caller xrefs + strings
373 0x0059f850 87 multiplayer_transport_callback_reset_selector_and_enqueue_slot19 shell cdecl inferred objdump 2 Callback-root helper from the second transport-side descriptor lane. It resolves the current selector slot through `0x5951a0`, resets that selector text path through `0x5954b0`, forwards the supplied selector-name pair through multiplayer_transport_enqueue_callback_slot19, and when the resolved selector is `2` plus route mode is still active it re-enters multiplayer_transport_set_route_mode with mode `1`. objdump + caller xrefs
374 0x00594bd0 97 multiplayer_transport_set_selector_slot_flags shell cdecl inferred ghidra-headless 3 Updates one selector-slot flag dword at [entry+0x5c] after resolving the current selector entry through 0x00594a40. When selector index `2` flips bit `1` it forwards the new bit value through multiplayer_transport_enqueue_callback_slot15_record and then notifies the shared selector-change callback path through 0x00593250 with selector id old flags and new flags. ghidra + rizin + llvm-objdump
375 0x00594c40 103 multiplayer_transport_parse_selector_mode_letters shell cdecl inferred ghidra-headless 3 Parses one selector-mode letter string into a small bitmask by probing for the letters `s` `r` `g` `a` and `h`. Current grounded callers merge this mask into the selector-slot flags that live at [entry+0x5c]. ghidra + rizin + llvm-objdump + strings
376 0x00594cb0 65 multiplayer_transport_merge_selector_mode_mask shell cdecl inferred ghidra-headless 3 Resolves one selector entry through 0x00594a40 parses the caller mode-letter string through multiplayer_transport_parse_selector_mode_letters preserves the current presence bits 0x20 and 0x40 from [entry+0x5c] and commits the merged result through multiplayer_transport_set_selector_slot_flags. ghidra + rizin + llvm-objdump + strings
389 0x005959e0 81 multiplayer_transport_submit_route_status_request shell cdecl inferred ghidra-headless 3 Submits one route-status request for the current binding at [this+0x1ec8]. It gathers the binding fields at +0x2c and +0x30 together with the local counter at [this+0xb48] and default sample text at 0x005c87a8 then sends that request through 0x593980 using multiplayer_transport_handle_route_status_result as the completion callback. Failure sets [this+0x1ed8] so the route-mode setter can fall back immediately. ghidra + rizin + llvm-objdump
390 0x00596270 70 multiplayer_transport_clone_staged_callback_payload shell cdecl inferred ghidra-headless 3 Clones one staged route-callback payload block by allocating a same-sized object through 0x58d5b0 copying the first nine dwords and then registering a cleanup callback through 0x58fa00 with shim 0x596260. Current grounded caller is multiplayer_transport_try_stage_route_callback_payload. ghidra + rizin + llvm-objdump
391 0x00597720 96 multiplayer_transport_format_gsp_payload shell cdecl inferred ghidra-headless 3 Formats one transport text payload with the `#GSP!%s!%c%s%c` template at 0x005e2358. Depending on whether the global formatter state at 0x00dba4c4 is present it builds either a 0x58-byte or 0x4d-byte intermediate fragment through 0x597590 or 0x5976c0 and then emits the final string through 0x5a19c4. Current grounded callers are multiplayer_transport_submit_bound_route_request and multiplayer_transport_try_stage_route_callback_payload. ghidra + rizin + llvm-objdump + strings
392 0x005977b0 127 multiplayer_transport_parse_selector_view_probe_marker shell cdecl inferred objdump 3 Parses one selector-view probe marker in the local `X%sX|%d` family. It requires a length of at least `0x0c`, accepts the marker only when byte `0` or byte `9` is `X`, decodes the wrapped request-id fragment through `0x597630`, parses the decimal tail after the `|` through `0x5a1ea5`, and returns those two values through caller output pointers. Current grounded callers are the profile-key callback lanes at `0x596a01` and `0x59f912`, which forward the parsed request id and companion value into multiplayer_transport_arm_selector_view_probe_tracking. objdump + caller xrefs + format string
393 0x00597840 30 multiplayer_transport_format_selector_view_probe_marker shell cdecl inferred objdump 3 Formats one selector-view probe marker in the local `X%sX|%d` family. It encodes the caller request id through `0x597590`, then wraps the result with sentinel `X` bytes and a trailing `|%d` suffix into the destination buffer. Current grounded caller is multiplayer_transport_stage_selector_view_progress_snapshot, which uses `[entry+0x50]` as the marker id when building `PNG %s %d` progress lines. objdump + caller xrefs + format string
394 0x00593980 382 multiplayer_transport_submit_bound_route_request shell cdecl inferred ghidra-headless 3 Builds and submits one bound-route request using the current transport text buffers and a caller-supplied binding id or fallback route id. It formats the request payload through multiplayer_transport_format_gsp_payload allocates a type `1` transient request record through 0x5934e0 stores route and callback metadata on that record publishes selector `2` text through multiplayer_transport_set_selector_name and finally submits the request through 0x58e720 using multiplayer_transport_handle_bound_route_request. A nonempty caller text sample sets [this+0xb4c]. ghidra + rizin + llvm-objdump + strings
395 0x00593b00 161 multiplayer_transport_handle_selector_update_response shell cdecl inferred ghidra-headless 3 Follow-up callback used by multiplayer_transport_handle_selector_text_route_request. When the callback succeeds it initializes or repopulates selector slot [req+0x1c] through multiplayer_transport_init_selector_slot and multiplayer_transport_upsert_selector_name_entry. When it fails it resets that selector slot. Both paths finish by enqueueing a route record through multiplayer_transport_probe_or_enqueue_route_record and unlinking the request through 0x5933a0. ghidra + rizin + llvm-objdump
396 0x00593bb0 144 multiplayer_transport_handle_selector_text_route_request shell cdecl inferred ghidra-headless 3 Completion callback for multiplayer_transport_submit_selector_text_route_request. If the request is already stale at +0x38 it clears the transient state through 0x5962c0 and unlinks the request. On nonzero result it schedules multiplayer_transport_handle_selector_update_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot [req+0x1c] and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request. ghidra + rizin + llvm-objdump
411 0x005962e0 583 multiplayer_transport_register_field_subscription_bundle shell cdecl inferred ghidra-headless 3 Builds one field-subscription bundle from the field-id list optional suffix text and selector-name table. Rebuilds the callback table at [this+0xba4] seeds the local field cache at [this+0x1724] installs the subscription block through 0x590ed0 sets [this+0x1774] on success and enqueues an immediate mode-3 field snapshot through multiplayer_transport_enqueue_field_snapshot_record. ghidra + rizin + llvm-objdump
412 0x00596530 101 multiplayer_transport_try_seed_am_rating_route_table shell cdecl inferred ghidra-headless 2 Used by the larger route-mode setter around 0x595650. It first calls multiplayer_transport_reset_am_rating_route_state then rebuilds one mode `4` route entry in the callback table at [this+0x18bc] from the stored descriptor at [this+0x1ed0]. Success clears [this+0x1ed4] sets [this+0x1ec4] to one and failure reverts through multiplayer_transport_reset_am_rating_route_state before setting [this+0x1ed4]. ghidra + rizin + llvm-objdump + strings
413 0x005965a0 44 multiplayer_transport_try_connect_status_route_once shell cdecl inferred ghidra-headless 3 Single-shot wrapper for the auxiliary status-route object at [this+0xaf0]. When the in-flight latch at [this+0xb40] is already set it returns false immediately. Otherwise it sets that latch and forwards the caller route id into multiplayer_transport_try_connect_status_route then booleanizes the result. Current grounded caller is multiplayer_transport_handle_names_query_response. ghidra + rizin + llvm-objdump
414 0x00596970 404 multiplayer_transport_handle_profile_key_query_result shell cdecl inferred objdump 3 Per-key callback helper for the profile-key query bundle family. It ignores empty selector names, treats a null fallback text as `0x005c87a8`, special-cases the `username` key by parsing one `X...X|%d` marker through multiplayer_transport_parse_selector_view_probe_marker, arming selector-view probe tracking through multiplayer_transport_arm_selector_view_probe_tracking, and optionally publishing callback slot `22` with the selector name plus the parsed marker pair or a zeroed `(END)` sentinel payload. It also special-cases `b_flags` by forwarding the returned mode-letter string into multiplayer_transport_merge_selector_mode_mask, then hashes the selector name, key name, and resolved value text through `0x58f4a0` and upserts that triplet into the caller table through hashed_entry_table_upsert. objdump + strings + caller context
415 0x00596da0 497 multiplayer_transport_submit_profile_key_query_bundle shell cdecl inferred rizin 2 Wrapper above the transport key-command builders that stages a small named-key query bundle around the strings `username` and `b_flags`. It allocates temporary key-name arrays and callback-entry tables submits the first request through multiplayer_transport_submit_getkey_command_and_wait folds returned key results into transport-owned callback state through 0x0058f8f0 and 0x0058fa00 and then follows with the larger channel-key submission path through multiplayer_transport_submit_setchankey_pair_list_command_and_wait when the staged key set is nonempty. rizin + llvm-objdump + strings
416 0x00596fa0 19 multiplayer_transport_submit_profile_key_query_bundle_with_context shell cdecl inferred rizin 2 Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector or route context in `edx` and forwards the stack-supplied context pointer as the extra bundle argument. Current grounded use is through the local callback table rooted at 0x0059f8b0. rizin + llvm-objdump
417 0x00596fc0 14 multiplayer_transport_submit_profile_key_query_bundle_default shell cdecl inferred rizin 3 Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector slot in `edx` and forces a null extra-context argument. Current grounded caller is multiplayer_transport_init_selector_slot and the same wrapper is also installed through the local callback table rooted at 0x0059fb60. rizin + llvm-objdump
418 0x0059f8b0 260 multiplayer_transport_callback_upsert_current_selector_and_request_profile_keys shell cdecl inferred objdump 3 Callback-root helper adjacent to the second transport-side descriptor lane. It resolves the current selector through multiplayer_transport_find_selector_name, upserts that selector name into the selector-view store through multiplayer_transport_upsert_selector_name_entry, optionally reuses a cached `username` marker from `0x58eb10` to arm selector-view probe tracking through multiplayer_transport_parse_selector_view_probe_marker and multiplayer_transport_arm_selector_view_probe_tracking, then submits one profile-key query bundle through multiplayer_transport_submit_profile_key_query_bundle_with_context and publishes callback slot `17`. When selector `2` is active, the same helper can also force the route-mode transitions `2 -> 3 -> 4` through multiplayer_transport_set_route_mode after checking the status-route latch at `[this+0xb54]`, route activity, and the generation gate `[this+0xac0] >= [this+0xb48]`. objdump + caller xrefs + strings
419 0x00596fd0 441 multiplayer_transport_dispatch_status_route_event shell cdecl inferred rizin 3 Main local callback dispatcher for the auxiliary status-route object. It gates on [this+0x398] [this+0xb44] and flag bits in [this+0xb38] then maps route event ids through the local table at 0x005970c4 into selector text publication openstaging publication boolean status publication and callback forwarding paths. The dispatcher publishes through multiplayer_transport_send_selector_text and multiplayer_transport_publish_fixed_token_message and can also invoke the owner callback at [this+0x17dc] with payload [this+0x17f8]. rizin + llvm-objdump + strings
420 0x005972c0 97 multiplayer_transport_handle_validated_route_cookie_event shell cdecl inferred objdump 3 Validated subtype-`4` callback for the transport-owned GameSpy route family. The route constructor seeds this helper into `[route+0x9c]`; after multiplayer_gamespy_route_dispatch_inbound_packet validates the current route cookie it forwards the event id in `ecx`, the remaining payload pointer in `edx`, and the owner transport context from `[route+0x104]`. When multiplayer_transport_is_route_mode_active_nonterminal succeeds it marks `[this+0x1ed8]` and re-enters multiplayer_transport_set_route_mode with a mode-selection bit derived from `[this+0x1ed4]` and `[this+0x18b8]`; otherwise it falls back to the owner callback at `[this+0x17f0]` using context `[this+0x17f8]`. objdump
421 0x00597330 28 multiplayer_transport_forward_validated_extended_route_payload shell cdecl inferred objdump 3 Small forwarding callback used for the transport-owned status route's validated extended-payload slot. It treats `edx` as the owner transport object, checks the owner callback pointer at `[this+0x17f4]`, and when present forwards the validated payload wrapper in `ecx` together with owner context `[this+0x17f8]`. Current grounded caller is the status-route connect helper through multiplayer_gamespy_route_set_extended_payload_callback. objdump